sync composer.lock with composer.json