add COMPOSER_PREFER_LOWEST_STABLE

Run `COMPOSER_PREFER_LOWEST_STABLE=1 composer update` and get all the deps installed to their lowest (pretended) supported version

Fixes #3440
Fixes #1902