The answer is: Tags. Your may also use Alias, if you don't want to use tags. But it's worth to mention, that you should only mark your packages as stable, when they are stable and not to make others believe they are.

Update: One more link: Stability

Elaborating on KingCrunch's answer, since this was not immediately obvious to me.

From https://getcomposer.org/doc/02-libraries.md#specifying-the-version

When you publish your package on Packagist, it is able to infer the version from the VCS (git, svn, hg) information. This means you don't have to explicitly declare it.

This is very easy with Github:https://help.github.com/articles/working-with-tags/

Furthermore:

If you are creating packages by hand and really have to specify it explicitly, you can just add a version field:

{    "version": "1.0.0" }

To answer the question :

• for VCS, it's dev-master
• for packagist, it's *@stable

For more about "stabilizing" or "freezing" composer versions

Freeze Make Stable

It's sometimes useful, especially during an audit, to grab latest versions of your requirements, that's why I made a composer package that make stable all your dependencies : Composer Stable Versions (https://github.com/MaximeCulea/Composer-Stable-Versions).

Using this command, your dependencies into composer.json will be automatically be changed from:

"wpackagist-plugin/wordpress-seo":"6.2"

into:

"wpackagist-plugin/wordpress-seo":"*@stable"

Freeze Composer Versions

If afterwards you plan doing the reverse thing to grab latest versions of your composer.lock which you tested your site against, especially useful while making a site live, have a look to an other of my composer command : Composer Freeze Versions (https://github.com/MaximeCulea/Composer-Freeze-Versions).

Using this command, your dependencies into composer.json will be automatically be locked:

"wpackagist-plugin/wordpress-seo":"@stable"

into:

"wpackagist-plugin/wordpress-seo":"6.2"

Hope it helps.