bump composer.lock fix frameworkextrabundle dep