upgrade because of rails vulnerability