refresh composer.lock