Start to lock down the composer deps