The composer require does automatically run update and thus pulling in all things we've removed in previous step. Passing --update-no-dev avoids this. Fixes #13146 Signed-off-by: Michal Čihař <michal@cihar.com>