Composer should lock libs to the latest version