Upgrade JSON gem to get fix for CVE-2013-0269. Update to latest Rails 2-3 series - has fixes for CVE-2013-0277, CVE-2013-0276, although alaveteli does not use attr_protected or serialize.