specify psr/cache SHA as PSR-6 has gone back into draft :(