bundle update to fix multiple vulns