Bump dependencies in composer.lock