From bc1caa98b2506a9a24e49542762f0efffa363160 Mon Sep 17 00:00:00 2001 From: Yuriy Kirillov Date: Wed, 2 Sep 2026 11:49:00 +0200 Subject: [PATCH] chore: bump loofah and rails-html-sanitizer for security fixes loofah 2.25.1 -> 2.25.2 and rails-html-sanitizer 1.7.0 -> 1.7.1 fix XSS sanitizer bypasses flagged by Dependabot alerts #9, #10, #11, #12. Also bumps bundler to 4.0.11. Co-Authored-By: Claude Sonnet 5 --- Gemfile.lock | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/Gemfile.lock b/Gemfile.lock index 68b44c3..395e4e2 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -44,7 +44,7 @@ GEM builder (3.3.0) concurrent-ruby (1.3.8) connection_pool (3.0.2) - crass (1.0.6) + crass (1.0.7) drb (2.2.3) erb_lint (0.9.0) activesupport @@ -68,7 +68,7 @@ GEM language_server-protocol (3.17.0.6) lint_roller (1.1.0) logger (1.7.0) - loofah (2.25.1) + loofah (2.25.2) crass (~> 1.0.2) nokogiri (>= 1.12.0) minitest (6.0.6) @@ -101,8 +101,8 @@ GEM activesupport (>= 5.0.0) minitest nokogiri (>= 1.6) - rails-html-sanitizer (1.7.0) - loofah (~> 2.25) + rails-html-sanitizer (1.7.1) + loofah (~> 2.25, >= 2.25.2) nokogiri (>= 1.15.7, != 1.16.7, != 1.16.6, != 1.16.5, != 1.16.4, != 1.16.3, != 1.16.2, != 1.16.1, != 1.16.0.rc1, != 1.16.0) rainbow (3.1.1) regexp_parser (2.12.0) @@ -158,4 +158,4 @@ DEPENDENCIES BUNDLED WITH - 4.0.10 + 4.0.11