Stable version constraints for all dependencies

Also update dependency specs in composer.lock