🚨 [security] Update rails-html-sanitizer: 1.0.3 → 1.0.4 (patch)

🚨 Your version of rails-html-sanitizer has known security vulnerabilities 🚨

Advisory: CVE-2018-3741 Disclosed: March 22, 2018 URL: https://github.com/rails/rails-html-sanitizer/commit/f3ba1a839a35f2ba7f941c15e239a1cb379d56ae

Possible XSS vulnerability in rails-html-sanitizer

🚨 We recommend to merge and deploy this update as soon as possible! 🚨

We've updated a dependency and here is what you need to know:

name	version specification	old version	new version
rails-html-sanitizer	indirect dependency	1.0.3	1.0.4

Additionally, the update changed a few other dependencies as well:

action	name	old version	new version
updated	loofah	2.1.1	2.2.2
updated	nokogiri	1.8.1	1.8.2

You should probably take a good look at the info here and the test results before merging this pull request, of course.

What changed?

↗️ rails-html-sanitizer (indirect, 1.0.3 → 1.0.4) · Repo · Changelog

Release Notes

From the Github release:

Fix CVE-2018-3741.

Commits

See the full diff on Github. The new version differs by 16 commits:

↗️ loofah (indirect, 2.1.1 → 2.2.2) · Repo · Changelog

Release Notes

From the Github release:

2.2.2 / 2018-03-22

Make public Loofah::HTML5::Scrub.force_correct_attribute_escaping!,
which was previously a private method. This is so that downstream gems
(like rails-html-sanitizer) can use this logic directly for their own
attribute scrubbers should they need to address CVE-2018-8048.

Commits

See the full diff on Github. The new version differs by 47 commits:

✳️ nokogiri (1.8.1 → 1.8.2) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by 29 commits:

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

Depfu Status

thetallgrassnet / pokesite