composer.lock for fixed dependencies