specify composer dependency version