[Security] Bump rubyzip from 1.2.1 to 1.2.2

[greysteil]

Bumps rubyzip from 1.2.1 to 1.2.2. This update includes security fixes.

Vulnerabilities fixed

Sourced from The Ruby Advisory Database.

Directory Traversal in rubyzip
rubyzip version 1.2.1 and earlier contains a Directory Traversal vulnerability
in Zip::File component that can result in write arbitrary files to the filesystem.
If a site allows uploading of .zip files, an attacker can upload a malicious file
which contains symlinks or files with absolute pathnames "../" to write arbitrary
files to the filesystem.

Patched versions: >= 1.2.2
Unaffected versions: none

Commits

• d07b13a Merge pull request #376 from jdleesmiller/fix-cve-2018-1000544
• fd81bd5 Bump version to 1.2.2
• cf35774 Bump version to 1.3.0
• ffb374c Bump version to 2.0.0
• 8a1de58 Expand from root rather than current working directory
• 3dd165b Disable symlinks and check for path traversal
• ffebfa3 Consolidate path traversal tests
• 9c468f3 Add jwilk's path traversal tests
• 0586329 Trigger CI again
• cf71583 Move jruby to allow failures matrix till crc uint 32 issues are resolved
• Additional commits viewable in compare view

[greysteil]

@enricostano - did you have a chance to check out Dependabot? A left a comment here on its open source status - it's not perfect but I do what I can.

[greysteil]

(I'm don't think that TimeOverflow is affected by this vulnerability, as rubyzip is only used as a sub-dependency of a development dependency here, but still probably a good idea to patch.)