bringing composer.lock up to date