fix jms/serializer dep to current stable
bump composer.lock