Stabilising composer dependencies

This PR stabilises composer dependencies so we aren't using bleeding edge libraries.

TODO:
- [ ] ~~Wait for a recent tag to be created on `HearsayRequireJsBundle` (see [here](https://github.com/hearsayit/HearsayRequireJSBundle/issues/70))~~ (used a commit hash instead)

Fixes #145