sync composer.json and composer.lock