Update composer.json

`*` for dependencies is a bad practice, and we're missing a branch alias.