If you are responsible for an application, a last-mile application, not a library (a gem), please check in your Gemfile.lock. Updating your dependency gem versions is something you do deliberately, under the cover of your test suite.