update composer.json and .lock