bump dependencies

composer.lock update is missing