composer lock update