composer.lock: update