bundle update (fixes rails vulnerability)