composer.lock vendor php/version.php