update rails, json, rack (security fixes)