[vendors] updated composer.lock