vendor output composer.lock