[jeremy]

Crass 1.0.7 is affected by GHSA-pq4g-8rxf-4g29, a CSS sanitizer bypass fixed in 1.0.8. This updates only Crass and its lockfile checksum.

Crass is present transitively through Loofah and rails-html-sanitizer. I found no engine call to CSS sanitization and no engine configuration that permits style attributes. This lockfile governs the engine's development and dummy-app environment; applications that consume the gem resolve their own lockfiles.

Validation on this exact change:

• current ruby-advisory-db: no vulnerabilities
• RuboCop: 270 files, no offenses
• Brakeman: no warnings
• actionlint: clean
• zizmor: no findings
• 481 runs, 1,193 assertions, 0 failures, 0 errors across all test files that do not require privileged mtr sockets or an installed Playwright browser

The full 490-test run reached 5 environment-only failures/errors in the two excluded probe files: mtr could not open raw sockets and Playwright's browser executable is not installed. The remaining 481 tests passed when run separately.

[Copilot]

Copilot wasn't able to review any files in this pull request. Check if the Files changed in this pull request are included in default exclusions.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-24T23:00:14.300860Z	6282c36	Manual request
🔒 Security Review	✅ Completed 2026-10-24T23:01:26.620351Z	6282c36	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[jeremy]

@codex review

@codex security review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Nice work!

Reviewed commit: 6282c36d94

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

🛡️ Codex Security Review · Automatically triggered

Security review completed. No security issues were found in this pull request.

Reviewed commit: 6282c36d94

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.