updates composer.lock