Composer should `update`, not `install` dependencies