updated dependencies

`composer.lock`, you know the drill.