[dependabot]

Bumps rails-html-sanitizer from 1.7.1 to 1.7.2.

Release notes

Sourced from rails-html-sanitizer's releases.

v1.7.2 / 2026-11-02

• Deciding whether an SVG href or xlink:href is a local reference no longer takes quadratic time.

  PermitScrubber matched the attribute value against a pattern that rescanned the value's whitespace run from every line start, so an all-whitespace value took seconds to scrub. Only Ruby 3.1 and earlier are affected, because Ruby 3.2 introduced linear-time regexp matching. Through PermitScrubber, applications are only affected if the allowed tags are overridden to include an SVG reference element such as use; the default configuration is not affected.

  This change addresses GHSA-cpgf-5mjf-73p7. PermitScrubber now applies the html5lib attribute value rules by calling Loofah::HTML5::Scrub.scrub_attribute_value rather than carrying its own copy. The minimum Loofah dependency is now ~> 2.25, >= 2.25.3.

  Mike Dalessio

• rails-html-sanitizer now requires Ruby >= 3.2, because Loofah 2.25.3 requires it.

  The 1.6.x and 1.5.x release branches no longer receive security updates. Every Rails release in security support accepts rails-html-sanitizer 1.7 and requires Ruby >= 3.2.

  Mike Dalessio

• SafeListSanitizer no longer shares a PermitScrubber across calls.

  Previously one sanitizer instance reused a single PermitScrubber, assigning its tags and attributes on every call. Action View memoizes one sanitizer per helper module, so two concurrent sanitize calls with different tags: or attributes: options could interleave and one call could be scrubbed with the other call's allowlist. Each call now builds its own PermitScrubber.

  This change addresses GHSA-h7wh-q2qr-458c.

  Mike Dalessio

Changelog

Sourced from rails-html-sanitizer's changelog.

v1.7.2 / 2026-11-02

• Deciding whether an SVG href or xlink:href is a local reference no longer takes quadratic time.

  PermitScrubber matched the attribute value against a pattern that rescanned the value's whitespace run from every line start, so an all-whitespace value took seconds to scrub. Only Ruby 3.1 and earlier are affected, because Ruby 3.2 introduced linear-time regexp matching. Through PermitScrubber, applications are only affected if the allowed tags are overridden to include an SVG reference element such as use; the default configuration is not affected.

  This change addresses GHSA-cpgf-5mjf-73p7. PermitScrubber now applies the html5lib attribute value rules by calling Loofah::HTML5::Scrub.scrub_attribute_value rather than carrying its own copy. The minimum Loofah dependency is now ~> 2.25, >= 2.25.3.

  Mike Dalessio

• rails-html-sanitizer now requires Ruby >= 3.2, because Loofah 2.25.3 requires it.

  The 1.6.x and 1.5.x release branches no longer receive security updates. Every Rails release in security support accepts rails-html-sanitizer 1.7 and requires Ruby >= 3.2.

  Mike Dalessio

• SafeListSanitizer no longer shares a PermitScrubber across calls.

  Previously one sanitizer instance reused a single PermitScrubber, assigning its tags and attributes on every call. Action View memoizes one sanitizer per helper module, so two concurrent sanitize calls with different tags: or attributes: options could interleave and one call could be scrubbed with the other call's allowlist. Each call now builds its own PermitScrubber.

  This change addresses GHSA-h7wh-q2qr-458c.

  Mike Dalessio

Commits

• bac36ce version bump to v1.7.2
• 235d7a4 Merge pull request #243 from rails/card-934-release-v1-7-2
• 63ff4dc doc: end support for the 1.6.x and 1.5.x branches
• 15f764c Build a PermitScrubber per SafeListSanitizer call
• c5252d7 build: require Ruby >= 3.2
• f776f96 Scrub SVG href attributes in linear time
• efa57d8 build(deps): bump crass from 1.0.7 to 1.0.8 (#240)
• 1530fb9 build(deps): bump ruby/setup-ruby (#239)
• 9206a0b build(deps): bump the github-actions group across 1 directory with 2 updates ...
• c486875 ci: run Ruby 2.7, 3.0 and 3.1 on ubuntu-24.04 (#237)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)