This took me two hours on stackoverflow.com, so I'm going to document it to future me:
require section, for all packages starting with
symfony/, but not for
symfony/monolog-bundle, change the required version to the value of the
$VERSION environment variable.
Write out the updated
composer.json file in a way that works _without