diff --git a/.ruby-version b/.ruby-version
index 24ba9a3..c4e41f9 100644
--- a/.ruby-version
+++ b/.ruby-version
@@ -1 +1 @@
-2.7.0
+4.0.3
diff --git a/CHANGELOG.md b/CHANGELOG.md
new file mode 100644
index 0000000..62431bb
--- /dev/null
+++ b/CHANGELOG.md
@@ -0,0 +1,9 @@
+# CHANGE LOG
+
+**Version (0.0.9)**
+- udpate to ruby 4.0.x
+  - needed to update vcr (5.1) gem to (6.4.0) to be ruby 4.0 compatible
+- update gems to fix high security issues (bundle-audit --update)
+  - **addressable (2.7.0)** - ISSUE: CVE-2021-32740 (High), CVE-2026-35611 (High); SOLUTION: update to '>= 2.9.0'
+  - **httparty (0.18.0)** - ISSUE(S): CVE-2024-22049 (Medium), CVE-2025-68696 (High); SOLUTION: update to '>= 0.24.0'
+  - **thor (1.0.1)** - ISSUE:  CVE-2025-54314; SOLUTION: update to '>= 1.4.0'
diff --git a/Gemfile.lock b/Gemfile.lock
index d00c4e7..37cdffd 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -1,27 +1,33 @@
 PATH
   remote: .
   specs:
-    formstack-api (0.0.8)
+    formstack-api (0.0.9)
       httparty (~> 0.15)
 
 GEM
   remote: https://rubygems.org/
   specs:
-    addressable (2.7.0)
-      public_suffix (>= 2.0.2, < 5.0)
-    coderay (1.1.2)
-    crack (0.4.3)
-      safe_yaml (~> 1.0.0)
-    diff-lcs (1.3)
-    ffi (1.12.2)
-    formatador (0.2.5)
-    guard (2.16.1)
+    addressable (2.9.0)
+      public_suffix (>= 2.0.2, < 8.0)
+    base64 (0.3.0)
+    bigdecimal (4.1.2)
+    coderay (1.1.3)
+    crack (1.0.1)
+      bigdecimal
+      rexml
+    csv (3.3.5)
+    diff-lcs (1.6.2)
+    ffi (1.17.4)
+    formatador (1.2.3)
+      reline
+    guard (2.20.1)
       formatador (>= 0.2.4)
       listen (>= 2.7, < 4.0)
+      logger (~> 1.6)
       lumberjack (>= 1.0.12, < 2.0)
       nenv (~> 0.1)
       notiffany (~> 0.0)
-      pry (>= 0.9.12)
+      pry (>= 0.13.0)
       shellany (~> 0.0)
       thor (>= 0.18.1)
     guard-compat (1.2.1)
@@ -29,50 +35,56 @@ GEM
       guard (~> 2.1)
       guard-compat (~> 1.1)
       rspec (>= 2.99.0, < 4.0)
-    hashdiff (1.0.1)
-    httparty (0.18.0)
-      mime-types (~> 3.0)
+    hashdiff (1.2.1)
+    httparty (0.24.2)
+      csv
+      mini_mime (>= 1.0.0)
       multi_xml (>= 0.5.2)
-    listen (3.2.1)
+    io-console (0.8.2)
+    listen (3.10.0)
+      logger
       rb-fsevent (~> 0.10, >= 0.10.3)
       rb-inotify (~> 0.9, >= 0.9.10)
-    lumberjack (1.2.4)
-    method_source (0.9.2)
-    mime-types (3.3.1)
-      mime-types-data (~> 3.2015)
-    mime-types-data (3.2019.1009)
-    multi_xml (0.6.0)
+    logger (1.7.0)
+    lumberjack (1.4.2)
+    method_source (1.1.0)
+    mini_mime (1.1.5)
+    multi_xml (0.9.1)
+      bigdecimal (>= 3.1, < 5)
     nenv (0.3.0)
     notiffany (0.1.3)
       nenv (~> 0.1)
       shellany (~> 0.0)
-    pry (0.12.2)
-      coderay (~> 1.1.0)
-      method_source (~> 0.9.0)
-    public_suffix (4.0.3)
-    rake (13.0.1)
-    rb-fsevent (0.10.3)
-    rb-inotify (0.10.1)
+    pry (0.16.0)
+      coderay (~> 1.1)
+      method_source (~> 1.0)
+      reline (>= 0.6.0)
+    public_suffix (7.0.5)
+    rake (13.4.2)
+    rb-fsevent (0.11.2)
+    rb-inotify (0.11.1)
       ffi (~> 1.0)
-    rspec (3.9.0)
-      rspec-core (~> 3.9.0)
-      rspec-expectations (~> 3.9.0)
-      rspec-mocks (~> 3.9.0)
-    rspec-core (3.9.1)
-      rspec-support (~> 3.9.1)
-    rspec-expectations (3.9.0)
+    reline (0.6.3)
+      io-console (~> 0.5)
+    rexml (3.4.4)
+    rspec (3.13.2)
+      rspec-core (~> 3.13.0)
+      rspec-expectations (~> 3.13.0)
+      rspec-mocks (~> 3.13.0)
+    rspec-core (3.13.6)
+      rspec-support (~> 3.13.0)
+    rspec-expectations (3.13.5)
       diff-lcs (>= 1.2.0, < 2.0)
-      rspec-support (~> 3.9.0)
-    rspec-mocks (3.9.1)
+      rspec-support (~> 3.13.0)
+    rspec-mocks (3.13.8)
       diff-lcs (>= 1.2.0, < 2.0)
-      rspec-support (~> 3.9.0)
-    rspec-support (3.9.2)
-    safe_yaml (1.0.5)
+      rspec-support (~> 3.13.0)
+    rspec-support (3.13.7)
     shellany (0.0.1)
-    thor (1.0.1)
-    vcr (5.1.0)
-    webmock (3.8.2)
-      addressable (>= 2.3.6)
+    thor (1.5.0)
+    vcr (6.4.0)
+    webmock (3.26.2)
+      addressable (>= 2.8.0)
       crack (>= 0.3.2)
       hashdiff (>= 0.4.0, < 2.0.0)
 
@@ -80,14 +92,15 @@ PLATFORMS
   ruby
 
 DEPENDENCIES
-  bundler (~> 2.0)
+  base64 (>= 0.3)
+  bundler (>= 2.0)
   formstack-api!
   guard (~> 2.16)
   guard-rspec (~> 4.7)
   rake (~> 13.0)
   rspec (~> 3.9)
-  vcr (~> 5.1)
-  webmock (~> 3.8)
+  vcr (>= 6.4)
+  webmock (>= 3.26.2)
 
 BUNDLED WITH
-   2.0.2
+  4.0.14
diff --git a/formstack-api.gemspec b/formstack-api.gemspec
index 6a6ff3f..469ad0b 100644
--- a/formstack-api.gemspec
+++ b/formstack-api.gemspec
@@ -20,17 +20,12 @@ Gem::Specification.new do |spec|
 
   spec.add_dependency 'httparty', '~> 0.15'
 
-  spec.add_development_dependency 'bundler', '~> 2.0'
-  # spec.add_development_dependency 'bundler', '~> 1.16'
+  spec.add_development_dependency 'bundler', '>= 2.0'
   spec.add_development_dependency 'rake', '~> 13.0'
-  # spec.add_development_dependency 'rake', '~> 12.3'
   spec.add_development_dependency 'rspec', '~> 3.9'
-  # spec.add_development_dependency 'rspec', '~> 3.7'
   spec.add_development_dependency 'guard', '~> 2.16'
-  # spec.add_development_dependency 'guard', '~> 2.14'
   spec.add_development_dependency 'guard-rspec', '~> 4.7'
-  spec.add_development_dependency 'vcr', '~> 5.1'
-  # spec.add_development_dependency 'vcr', '~> 4.0'
-  spec.add_development_dependency 'webmock', '~> 3.8'
-  # spec.add_development_dependency 'webmock', '~> 3.2'
+  spec.add_development_dependency 'base64', '>= 0.3'
+  spec.add_development_dependency 'vcr', '>= 6.4'
+  spec.add_development_dependency 'webmock', '>= 3.26.2'
 end
diff --git a/lib/formstack/api/version.rb b/lib/formstack/api/version.rb
index 9e67874..12982eb 100644
--- a/lib/formstack/api/version.rb
+++ b/lib/formstack/api/version.rb
@@ -1,5 +1,5 @@
 module Formstack
   module Api
-    VERSION = "0.0.8"
+    VERSION = "0.0.9"
   end
 end