Update composer, lock version for production