provide a composer.lock for Scrutinizer
remove explicit dev flags, use minimum-stability with prefer-stable instead