update composer lock