Cherry-picking Rails version update for security