add allowing require to update dep chain, fixes composer/composer#2668