bundle update does not update the vulnerability data, so add 1 more hack