update composer.json and lock