diff --git a/.github/workflows/sca.yml b/.github/workflows/sca.yml
index a025cc48437..ee57f2bcc68 100644
--- a/.github/workflows/sca.yml
+++ b/.github/workflows/sca.yml
@@ -70,7 +70,7 @@ jobs:
           ./dev-tools/check_file_permissions.sh
           ./dev-tools/check_trailing_spaces.sh
           ./dev-tools/vendor/bin/phpstan analyse
-          ./dev-tools/vendor/bin/composer-require-checker check composer.json --config-file $(realpath .composer-require-checker.json)
+          ./dev-tools/vendor/bin/composer-require-checker check composer.json --config-file .composer-require-checker.json
           composer normalize --dry-run --working-dir=./dev-tools ../composer.json
           ./dev-tools/check_shell_scripts.sh
 
diff --git a/dev-tools/composer.json b/dev-tools/composer.json
index 6aa541ac6a9..69e59feba0b 100644
--- a/dev-tools/composer.json
+++ b/dev-tools/composer.json
@@ -3,14 +3,14 @@
         "php": "^7.1"
     },
     "require-dev": {
-        "ergebnis/composer-normalize": "^2.5.1",
+        "ergebnis/composer-normalize": "^2.11",
         "humbug/box": "^3.8",
         "jangregor/phpstan-prophecy": "^0.6",
         "maglnet/composer-require-checker": "2.0.0",
         "mi-schi/phpmd-extension": "^4.3",
-        "phpmd/phpmd": "^2.6",
+        "phpmd/phpmd": "^2.9",
         "phpstan/phpstan": "0.12.18",
-        "phpstan/phpstan-phpunit": "^0.12"
+        "phpstan/phpstan-phpunit": "^0.12.8"
     },
     "config": {
         "optimize-autoloader": true,