cleanup composer.json, expose the lock file, update deps