remote composer.lock