There's also a list in Gemfile.lock, located in the root directory of your app.
For this reason I leave Gemfile.lock out of my .gitignore. This has saved me more than once when I forgot to specify the gem version in GemFile, and a gem got updated with breaking changes.