bu, includes security fix for rails