updates to composer.lock