[justin808]

Summary

New ruby-advisory-db entries flag the locked loofah (< 2.25.3), nokogiri (1.19.4) and rails-html-sanitizer (< 1.7.2), which turns bundler-audit red on any run (seen on TanStack main, not caused by the rc.3 bump). This is a conservative relock: bundle lock --update loofah nokogiri rails-html-sanitizer --conservative.

• loofah -> 2.25.3, nokogiri -> 1.19.7, rails-html-sanitizer -> 1.7.2
• every platform entry already in the lockfile is kept; nothing else moves
• Gemfile.lock is the only changed file

rails-html-sanitizer was added to the requested pair because the same advisory run flags it (>= 1.7.2); Hacker News did the same in its #127.

Verification

• bundle check passes; Nokogiri 1.19.7 / Loofah 2.25.3 / Rails::HTML::Sanitizer 1.7.2 load under bundle exec.
• bundler-audit check reports no remaining advisories for these three gems. See PR checks for the full CI run.

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters: 1

• Gemfile.lock is excluded by !**/*.lock

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: eb5ccf59-868b-449a-a29c-44626a8c997c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-04T01:48:45.101072Z	84235b4	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

🚀 Quick Review App Commands

Welcome! Here are the commands you can use in this PR:
They require the repository to have cpflow review apps configured, including the CPLN_TOKEN_STAGING secret.

+review-app-deploy

Deploy your PR branch for testing.

+review-app-delete

Remove the review app when done.

+review-app-help

Show detailed instructions, environment setup, and configuration options.

Comment +review-app-help for full setup details.

[claude]

Review: this only bumps Gemfile.lock (nokogiri 1.19.4 → 1.19.7, loofah 2.25.2 → 2.25.3, rails-html-sanitizer 1.7.1 → 1.7.2). The versions stay within the existing constraints, and Gemfile is unchanged. These are patch-level security/sanitizer updates, so there are no code-quality, performance or security concerns from the diff. I didn't run the test suite. Please make sure CI is green, since the sanitizer changes could affect any rendered HTML output. LGTM.

[github-actions]

No description provided.

[github-actions]

No description provided.

[github-actions]

✅ Review App Deleted

Review app for PR #878 is deleted

🎮 Control Plane Console
📋 View Workflow Logs