Update README to suggest using only tagged release in composer.json