bundle update (rack security issue)