composer.lock vendor/