expose composer.lock with updated dependencies