[rb] update dependency to address the XML round-trip vulnerability
@@ -45,7 +45,7 @@ Gem::Specification.new do |s|
s.require_paths = ['lib']
s.add_runtime_dependency 'childprocess', ['>= 0.5', '< 5.0']
- s.add_runtime_dependency 'rexml', ['~> 3.2']
+ s.add_runtime_dependency 'rexml', ['~> 3.2', '>= 3.2.5']
s.add_runtime_dependency 'rubyzip', ['>= 1.2.2']
# childprocess requires ffi on windows but doesn't declare it in its dependencies
