I'd prefer to have dependabot keep track of that.

Why?

Because it'll notify us when there are changes and then we can evaluate if we still abide by those changes. 

For PHPUnit a range is fine since it'll just fail if it gets too new, for our adherence to a protocol I think we need to be a little more strict.

But it's not a protocol, it's just an interface. I don't see why different rules should apply here compared to another library we're using. IMHO, using 2.0.3 or 2.0.4 instead of 2.0.2 should be perfectly fine.