update to latest spree in response to security announcement