Update composer.lock policy