best to ensure version numbers of gems, since Gemfile.lock is not in repository