bump composer deps