vendor bin composer.lock