Lock composer versions
Add bug demonstration