Exclude vendor/bundle
update libyaml to 0.1.6, CVE-2014-2525