composer lock file is mandatory for now