upgrade rack and multi_json for CVEs