allowed composer.lock