nbproject vendor composer.lock