I'm using dev-master with a Git commit hash in https://github.com/opdavies/oliverdavies.uk/blob/master/composer.json#L15, which seems to work for me. I get the latest commit of Sculpin, and the stability and reliability of knowing that it isn't going to change without me being aware of it.