escaping shell arg
added composer.lock so that composer update is never done in production