update composer .lock