update rails due to the two CVEs