install composer packages with --prefer-source to avoid timeouts