composer.lock out from repo