composer.lock update