To allow critical security updates, this dependency ought to be specified as:

```ruby
gem 'rails', '~> 4.0.0'
```