oops.. need composer.lock too