From ca9b963961abcffed8256029afd75f32ecfdea81 Mon Sep 17 00:00:00 2001
From: Mike Dalessio <mike@37signals.com>
Date: Mon, 26 Oct 2026 18:24:58 -0400
Subject: [PATCH] dep: update sqlite3 and crass (#418)

* dep: update sqlite3 to 2.10.2

sqlite3 2.9.6 truncated SQL strings and bound values longer than
`INT_MAX` bytes, and could crash or deadlock when a callback raised.

ref: https://github.com/sparklemotion/sqlite3-ruby/releases/tag/v2.10.2
ref: https://github.com/sparklemotion/sqlite3-ruby/security/advisories/GHSA-4fqr-96q8-xrfx

* dep: update crass to 1.0.8

crass 1.0.7 tokenized bad URLs incorrectly, which allowed a CSS
sanitizer bypass.

ref: https://github.com/rgrove/crass/security/advisories/GHSA-pq4g-8rxf-4g29
---
 Gemfile.lock | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/Gemfile.lock b/Gemfile.lock
index ece06d85..50095f40 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -167,7 +167,7 @@ GEM
     crack (1.0.0)
       bigdecimal
       rexml
-    crass (1.0.7)
+    crass (1.0.8)
     date (3.5.1)
     debug (1.11.0)
       irb (~> 1.10)
@@ -390,10 +390,10 @@ GEM
       rack-protection (= 4.2.1)
       rack-session (>= 2.0.0, < 3)
       tilt (~> 2.0)
-    sqlite3 (2.9.6-aarch64-linux-gnu)
-    sqlite3 (2.9.6-arm64-darwin)
-    sqlite3 (2.9.6-x86_64-darwin)
-    sqlite3 (2.9.6-x86_64-linux-gnu)
+    sqlite3 (2.10.2-aarch64-linux-gnu)
+    sqlite3 (2.10.2-arm64-darwin)
+    sqlite3 (2.10.2-x86_64-darwin)
+    sqlite3 (2.10.2-x86_64-linux-gnu)
     stimulus-rails (1.3.4)
       railties (>= 6.0.0)
     stringio (3.2.0)