[4.0] Update composer.json

I've updated composer.json in 4.0 with some more sensible version constraints.