composer's lockfile should not be included in libraries