Not all packages in a project's composer.json will have a notification URL (like those coming from a git repo)