I disagree. If the project has a composer.lock file then dev-master is fine. The point of the lock file is to record the exact versions that are installed so they can be re-installed exactly as is. If your project is tested and works with dev-master with a hash in the lock then that is the same thing as a tagged release.

More info: