oops, we should also ignore composer.lock