Locking in Composer version numbers