update for rails vulnerability