gems update, fix rails CVE