update composer.lock