please don't use the commit locking. This is a huge hack in composer. This does not make it a bound constraint. The requirement itself is still on ``dev-master``. And it is worse because the code being installed will not match the metadata being used

Given they don't provide any stable release, dev-master is the best we can do here. But you should contact the maintainers to ask them to provide stable versions of their lib