fix composer lock vendors url