composer.json: relaxed dependencies ~2.2.x