add composer.json to avoid out-of-date dependencies