composer.lock for heroku