composer.json: locked dependencies