rails upgrade to address security vulnerability