From c9e6847481cfd56ea283b223e581fe245f8c63e0 Mon Sep 17 00:00:00 2001 From: Mike Dalessio Date: Mon, 2 Nov 2026 03:51:21 -0500 Subject: [PATCH] dep: update rails-html-sanitizer, loofah, and nokogiri loofah 2.25.2 let a live CSS `url()` through `style` attributes, and its HTML5 output could become new markup when a browser parsed it again. Update rails-html-sanitizer to 1.7.2, loofah to 2.25.3, and nokogiri to 1.19.5. ref: https://github.com/rails/rails-html-sanitizer/releases/tag/v1.7.2 ref: https://github.com/flavorjones/loofah/releases/tag/v2.25.3 ref: https://github.com/sparklemotion/nokogiri/releases/tag/v1.19.5 --- Gemfile.lock | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/Gemfile.lock b/Gemfile.lock index 50095f40..2a8ad1f1 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -218,9 +218,9 @@ GEM rails (>= 8.0.2) lint_roller (1.1.0) logger (1.7.0) - loofah (2.25.2) + loofah (2.25.3) crass (~> 1.0.2) - nokogiri (>= 1.12.0) + nokogiri (>= 1.19.5) mail (2.9.1) logger mini_mime (>= 0.1.1) @@ -251,13 +251,13 @@ GEM net-smtp (0.5.2) net-protocol nio4r (2.7.5) - nokogiri (1.19.4-aarch64-linux-gnu) + nokogiri (1.19.5-aarch64-linux-gnu) racc (~> 1.4) - nokogiri (1.19.4-arm64-darwin) + nokogiri (1.19.5-arm64-darwin) racc (~> 1.4) - nokogiri (1.19.4-x86_64-darwin) + nokogiri (1.19.5-x86_64-darwin) racc (~> 1.4) - nokogiri (1.19.4-x86_64-linux-gnu) + nokogiri (1.19.5-x86_64-linux-gnu) racc (~> 1.4) openssl (4.0.2) ostruct (0.6.3) @@ -296,8 +296,8 @@ GEM activesupport (>= 5.0.0) minitest nokogiri (>= 1.6) - rails-html-sanitizer (1.7.1) - loofah (~> 2.25, >= 2.25.2) + rails-html-sanitizer (1.7.2) + loofah (~> 2.25, >= 2.25.3) nokogiri (>= 1.15.7, != 1.16.7, != 1.16.6, != 1.16.5, != 1.16.4, != 1.16.3, != 1.16.2, != 1.16.1, != 1.16.0.rc1, != 1.16.0) rails_autolink (1.1.8) actionview (> 3.1)