Fix out-of-date composer.lock