include dev dependencies in composer.lock