There are two common json gems, one if which is NOT updated when you update rails. json_pure does not seem to be updated to 1.7.7 automatically by 'bundle update rails' so if your Gemfile.lock shows your app uses json_pure (via some other gem's dependency in my case), you also need to run 'bundle update json_pure'