Add composer.lock: dependency versions