The bundler/setup require creates a Gemfile.lock file. AIUI:
This records the current actual versions of the Gems available at the time. Once created, it is used in preference to re-evaluating the versions. I think this may cause a problem. If we don't include it in version control, then deployed copies will create the file once then not update it. If we do include it, we probably need to make sure it is deleted/recreated on a regular basis.
