In the documentary of the package roave/security-advisories (https://github.com/Roave/SecurityAdvisories/blob/latest/README.md#installation) is the recommendation, that "dev-latest" should be used instead of "dev-master".
Everyone using those recommendation AND your package is getting conflicts and has to require "dev-master" instead. Can you please adjust this?
runopencode/sax[3.2.0, ..., 3.2.2] require roave/security-advisories dev-master -> found roave/security-advisories[dev-master] but it conflicts with your root composer.json require (dev-latest).