update dependencies
ignore changes to composer.lock and vendor