composer.lock vendor