update pubspec.lock