commit rails upgrade for critical security issue