vendor composer.lock cache