Bump composer.lock