"roave/security-advisories" is not available in a stable enough version and therefore I can't install the API client without explicitly requiring "roave/security-advisories": "dev-master" as well. I think this responsibility should not be handled by a library but by the main project instead.