fix lockfile with bundle install, new dep auto-fetched in