build(deps): bump loofah from 2.22.0 to 2.25.2 in /appengine/rails-cloudsql-mysql

[dependabot]

Bumps loofah from 2.22.0 to 2.25.2.

Release notes

Sourced from loofah's releases.

2.25.2 / 2026-07-15

Security

• Ensure Loofah::HTML5::Scrub.allowed_uri? recognizes numeric character references without semicolons (e.g. javascript&#58alert(1)), which browsers decode and execute, and rejects schemes split by them. See GHSA-5qhf-9phg-95m2. @​flavorjones
• Ensure Loofah::HTML5::Scrub.allowed_uri? recognizes the named character references 	 and 
, which CGI.unescapeHTML does not decode and browsers strip from URIs, and rejects schemes split by them (e.g. java	script:alert(1)). See GHSA-8whx-365g-h9vv. @​flavorjones
• Ensure that both href and xlink:href attributes on SVG elements like use are restricted to local (same-document) references. Previously only xlink:href was restricted, allowing the SVG 2 href attribute to reference external documents. See GHSA-9wjq-cp2p-hrgf. @​flavorjones

Improved

• Harden data: URI mediatype parsing in Loofah::HTML5::Scrub.allowed_uri?. The mediatype is now parsed following the WHATWG data: URL spec and RFC 2397 instead of simply being split on a colon. A data: URI with an omitted or malformed mediatype is now treated as text/plain and allowed, and one without the required comma is now rejected. #305 @​flavorjones
• Remove feed from the default set of allowed protocols. The feed URI scheme was never accepted as a standard protocol, and no major browser supports it. Removing it reduces the attack surface particularly for non-browser contexts. #304 @​flavorjones
• Remove a vestigial &#x70 alternative from Loofah::HTML5::SafeList::PROTOCOL_SEPARATOR. This appears to be an ancient typo dating back to pre-extraction Rails circa 2007. #305 @​flavorjones

2.25.1 / 2026-03-17

• Ensure Loofah::HTML5::Scrub.allowed_uri? recognizes unescaped whitespace entities and rejects schemas containing them. See GHSA-46fp-8f5p-pf2m. #302 @​flavorjones

2.25.0 / 2025-12-15

• Extract Loofah::HTML5::Scrub.allowed_uri? which operates on a string. Previously this logic was coupled to the parsed tree in .scrub_uri_attribute. #300 @​flavorjones
• Tightened up how entities and control characters are handled when detecting allowed URIs. #301 @​flavorjones

Full Changelog: flavorjones/loofah@v2.24.1...v2.25.0

2.24.1 / 2025-05-12

Ruby support

• Import only what's needed from cgi for support for Ruby 3.5 #296 @​Earlopain

2.24.0 / 2024-12-24

Added

• Built-in scrubber :double_breakpoint which sees <br><br> and wraps the surrounding content in <p> tags. #279, #284 @​josecolella @​torihuang

Improved

• Built-in scrubber :targetblank now skips a tags whose href attribute is an anchor link. Previously, all a tags were modified to have target='_blank'. #291 @​fnando

New Contributors

• @​andrew made their first contribution in flavorjones/loofah#289
• @​fnando made their first contribution in flavorjones/loofah#291
• @​josecolella and @​torihuang made their first contribution in flavorjones/loofah#284

Full Changelog: flavorjones/loofah@v2.23.1...v2.24.0

... (truncated)

Changelog

Sourced from loofah's changelog.

2.25.2 / 2026-07-15

Security

• Ensure Loofah::HTML5::Scrub.allowed_uri? recognizes numeric character references without semicolons (e.g. javascript&#58alert(1)), which browsers decode and execute, and rejects schemes split by them. See GHSA-5qhf-9phg-95m2. @​flavorjones
• Ensure Loofah::HTML5::Scrub.allowed_uri? recognizes the named character references 	 and 
, which CGI.unescapeHTML does not decode and browsers strip from URIs, and rejects schemes split by them (e.g. java	script:alert(1)). See GHSA-8whx-365g-h9vv. @​flavorjones
• Ensure that both href and xlink:href attributes on SVG elements like use are restricted to local (same-document) references. Previously only xlink:href was restricted, allowing the SVG 2 href attribute to reference external documents. See GHSA-9wjq-cp2p-hrgf. @​flavorjones

Improved

• Harden data: URI mediatype parsing in Loofah::HTML5::Scrub.allowed_uri?. The mediatype is now parsed following the WHATWG data: URL spec and RFC 2397 instead of simply being split on a colon. A data: URI with an omitted or malformed mediatype is now treated as text/plain and allowed, and one without the required comma is now rejected. #305 @​flavorjones
• Remove feed from the default set of allowed protocols. The feed URI scheme was never accepted as a standard protocol, and no major browser supports it. Removing it reduces the attack surface particularly for non-browser contexts. #304 @​flavorjones
• Remove a vestigial &#x70 alternative from Loofah::HTML5::SafeList::PROTOCOL_SEPARATOR. This appears to be an ancient typo dating back to pre-extraction Rails circa 2007. #305 @​flavorjones

2.25.1 / 2026-03-17

• Ensure Loofah::HTML5::Scrub.allowed_uri? recognizes unescaped whitespace entities and rejects schemas containing them. See GHSA-46fp-8f5p-pf2m. #302 @​flavorjones

2.25.0 / 2025-12-15

• Extract Loofah::HTML5::Scrub.allowed_uri? which operates on a string. Previously this logic was coupled to the parsed tree in .scrub_uri_attribute. #300 @​flavorjones
• Tightened up how entities and control characters are handled when detecting allowed URIs. #301 @​flavorjones

2.24.1 / 2025-05-12

Ruby support

• Import only what's needed from cgi for support for Ruby 3.5 #296 @​Earlopain

2.24.0 / 2024-12-24

Added

• Built-in scrubber :double_breakpoint which sees <br><br> and wraps the surrounding content in <p> tags. #279, #284 @​josecolella @​torihuang

Improved

• Built-in scrubber :targetblank now skips a tags whose href attribute is an anchor link. Previously, all a tags were modified to have target='_blank'. #291 @​fnando

2.23.1 / 2024-10-25

Added

• Allow CSS properties min-height and max-height. #288 @​lazyatom

... (truncated)

Commits

• 2706d7e version bump to v2.25.2
• 1afde0c Merge pull request #308 from flavorjones/security-2252
• f1be9d8 Update allowed_uri? to decode semicolon-less numeric character references
• 5e91af8 Update allowed_uri? to handle named whitespace character references
• 20867b9 Properly restrict SVG href attributes
• 5f3bff4 test: opt into JSON comment parsing for sanitizer testdata (#307)
• b07713d test: do not run in verbose mode
• babe7a8 doc: update CHANGELOG
• a8d8d96 Merge pull request #305 from flavorjones/drop-protocol-typo
• b52f4b0 version bump to 2.25.2.beta1
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.