composer.json requires stable packages