Lock composer dependencies and update cms version