As we actually aren't publishing any new releases for https://github.com/matomo-org/referrer-spam-list, the list is only updated through the scheduled task within Matomo. If Internet connection is disabled that won't work and the list won't be updated.
As the scheduled task fetches the latest version from
master branch, I've updated the composer requirement to do the same.
This should ensure that every automatic composer update will also update to the latest list.