Comment # 5 on bug 996014 from Andreas Stieger

CVE-2016-7103 is fixed in jquery-ui 1.12.0.
https://nodesecurity.io/advisories/127

jquery-ui-rails 6.0.1 bundles 1.12.1 (since 6.0.0)
https://github.com/jquery-ui-rails/jquery-ui-rails/blob/master/History.md

Leap has 6.0.1