Used locked repo only if it is present

src/Composer/Installer.php

@@ -387,7 +387,7 @@ class Installer
         $this->io->writeError('<info>Updating dependencies</info>');
 
         // if we're updating mirrors we want to keep exactly the same versions installed which are in the lock file, but we want current remote metadata
-        if ($this->updateMirrors) {
+        if ($this->updateMirrors && $lockedRepository) {
             foreach ($lockedRepository->getPackages() as $lockedPackage) {
                 $request->requireName($lockedPackage->getName(), new Constraint('==', $lockedPackage->getVersion()));
             }