Composer updates

`dev-master` is still considered a bad practice, even though some of the issues with using this as a version constraint in composer were fixed ~1 month ago.