versioning composer lock