bump composer.lock