bundle update for devise, even though postgres isn't vulnerable