fix composer.json dependencies and add composer.lock to .gitignore