added security-bundle as require-dev, it still fails until security bundle is merged