vendor config.php composer.lock