Composer lock review for known vulnerabilities