upgrade composer.lock