Upgrade crack

As per security advisory for potential XML issues. I think it's only
used for testing as a dependency of webmock, but good to keep current.