bump ruby patchlevel for rexml vuln