wildcard flags on minor and patch versions on deps in composer