updates composer.json and composer.lock