Here is a good example where dev-master can come back to haunt you:
https://seld.be/notes/the-road-to-monolog-2-0

I agree with the comments above, there is no substitute for being careful and locking things down in composer.lock.