Add missing setDistReference on alias package, fixes #3017
Skip updates to same reference-locked version, fixes #2487, fixes #1333
added tests for not updating packages referenced by specific commit hash
Fix regression in handling github-oauth settings in auth.json