expose composer.lock, update dependencies