updates lock to match composer.json