Update composer.json

locks down dependencies to tags, to hopefully fix composer install errors