[dependabot]

Bumps crass from 1.0.6 to 1.0.8.

Release notes

Sourced from crass's releases.

v1.0.8

Security

• Moderate: Fixed a tokenizer bug in which a ) following an escaped backslash (\\) inside a bad URL didn't terminate the bad URL token, causing Crass to consume more input than a spec-compliant browser would. CSS sanitizers built on Crass could be tricked into passing through declarations, rules, or at-rules that a browser would then apply. (GHSA-pq4g-8rxf-4g29)

Full Changelog: rgrove/crass@v1.0.7...v1.0.8

v1.0.7

Security

• High: Fixed a denial of service vulnerability in which a large numeric exponent could consume disproportionate CPU and memory before the value was clamped. Exponents are now bounded before 10**exponent is computed. (GHSA-6wmf-3r64-vcwv)

• Moderate: Fixed a scenario in which deeply nested simple blocks or functions could exhaust the Ruby stack and raise SystemStackError, or could result in excessive memory usage. Parser nesting is now limited to a configurable maximum depth via a new option (:maximum_depth, with a conservative default of 25). Constructs nested more deeply are discarded as an :error node with the value "maximum-depth-exceeded". (GHSA-6jxj-px6v-747w)

• Moderate: Fixed a scenario in which a long run of adjacent comments could exhaust the Ruby stack and raise SystemStackError. Discarded comments are now skipped iteratively rather than recursively. (GHSA-wwpr-jff3-395c)

• Moderate: Fixed a denial of service vulnerability in which inputs containing many non-ASCII characters could cause excessive CPU usage due to inefficient handling of multi-byte characters during tokenization. (GHSA-8vfg-2r28-hvhj)

Changelog

Sourced from crass's changelog.

1.0.8 (2026-10-21)

Security

• Moderate: Fixed a tokenizer bug in which a ) following an escaped backslash (\\) inside a bad URL didn't terminate the bad URL token, causing Crass to consume more input than a spec-compliant browser would. CSS sanitizers built on Crass could be tricked into passing through declarations, rules, or at-rules that a browser would then apply. (GHSA-pq4g-8rxf-4g29)

1.0.7 (2026-06-25)

Security

• High: Fixed a denial of service vulnerability in which a large numeric exponent could consume disproportionate CPU and memory before the value was clamped. Exponents are now bounded before 10**exponent is computed. (GHSA-6wmf-3r64-vcwv)

• Moderate: Fixed a scenario in which deeply nested simple blocks or functions could exhaust the Ruby stack and raise SystemStackError, or could result in excessive memory usage. Parser nesting is now limited to a configurable maximum depth via a new option (:maximum_depth, with a conservative default of 25). Constructs nested more deeply are discarded as an :error node with the value "maximum-depth-exceeded". (GHSA-6jxj-px6v-747w)

• Moderate: Fixed a scenario in which a long run of adjacent comments could exhaust the Ruby stack and raise SystemStackError. Discarded comments are now skipped iteratively rather than recursively. (GHSA-wwpr-jff3-395c)

• Moderate: Fixed a denial of service vulnerability in which inputs containing many non-ASCII characters could cause excessive CPU usage due to inefficient handling of multi-byte characters during tokenization. (GHSA-8vfg-2r28-hvhj)

Commits

• fe77509 Release 1.0.8
• 689fc45 Fix bad URL token not terminating at ) after an escaped backslash
• 0eff227 Add SECURITY.md
• cfd5daa Release 1.0.7
• da29664 Fix inefficient handling of non-ASCII characters during tokenization
• 25d78cc Prevent a long run of adjacent comments from exhausting the stack
• cf68287 Limit recursion depth to prevent stack overflow and memory exhaustion
• ea6726b Prevent resource exhaustion denial of service via excessively large exponents
• 2b87347 Bump version to 1.0.7
• 0d3be20 Update CI workflow dependencies
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: a5f80614-0a06-4b00-9a70-d8c450457281

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn