[TASK] composer.json should stick to explicit dependencies