updating Rails to avoid known exploit