update composer.json and lock files