ignoring composer.lock