Handle packages with replacements

Some packages have replacements, so don’t appear in composer.lock. Have
skipped checking these for now.

Added issue #1 to handle replacement packages in the future.