composer.lock updates