Do you have an explicit reason to start with a composer update and not a composer install?

A composer install will use the composer.lock file to install the same versions as used before. A composer update will try to get the latest versions available matching the requirements. With a dev-master version it means the latest commit from the master branch.

My advice is to start with the install if possible try to remove the dev-master version as soon as possible before any other upgrade. (If I'm correct you can see the commit hash after installing to find out what the installed version is form the dev-master branch)