what's wrong with the update? If you add a new dependency, you have to run the upgrade rather than the install command, in order to update your lock file (otherwise it'll not be installed at all). And a year ago, composer decided to always install dev dependencies.