bundle update because of CVE-2014-7818