lock activesupport dependency version to 3.x for legacy 1.8.7