build(deps): bump rails-html-sanitizer from 1.6.2 to 1.7.1

[dependabot]

Bumps rails-html-sanitizer from 1.6.2 to 1.7.1.

Release notes

Sourced from rails-html-sanitizer's releases.

v1.7.1 / 2026-07-15

• SVG reference elements now restrict both href and xlink:href to local references.

  Previously PermitScrubber restricted only xlink:href on elements in SVG_ALLOW_LOCAL_HREF, so a plain href attribute on those elements could reference an external document. Applications are only affected if the allowed tags are overridden to include an SVG reference element such as use; the default configuration is not affected.

  This change addresses GHSA-cj75-f6xr-r4g7 (CVE requested). The minimum Loofah dependency is now ~> 2.25, >= 2.25.2.

  Mike Dalessio @​flavorjones

v1.7.0 / 2026-02-24

• Add Rails::HTML::Sanitizer.allowed_uri? which delegates to Loofah::HTML5::Scrub.allowed_uri?, allowing the Rails framework to check URI safety without a direct dependency on Loofah.

  The minimum Loofah dependency is now ~> 2.25.

  Mike Dalessio @​flavorjones

Changelog

Sourced from rails-html-sanitizer's changelog.

v1.7.1 / 2026-07-15

• SVG reference elements now restrict both href and xlink:href to local references.

  Previously PermitScrubber restricted only xlink:href on elements in SVG_ALLOW_LOCAL_HREF, so a plain href attribute on those elements could reference an external document. Applications are only affected if the allowed tags are overridden to include an SVG reference element such as use; the default configuration is not affected.

  This change addresses GHSA-cj75-f6xr-r4g7 (CVE requested). The minimum Loofah dependency is now ~> 2.25, >= 2.25.2.

  Mike Dalessio

v1.7.0 / 2026-02-24

• Add Rails::HTML::Sanitizer.allowed_uri? which delegates to Loofah::HTML5::Scrub.allowed_uri?, allowing the Rails framework to check URI safety without a direct dependency on Loofah.

  The minimum Loofah dependency is now ~> 2.25.

  Mike Dalessio

Commits

• 4f37e3d version bump to v1.7.1
• b4673b9 Merge pull request #223 from rails/svg-href-local-ref
• 74dcb80 Properly restrict SVG href attributes
• 11ee440 Adjust data: URI mediatype tests for loofah 2.25.2 (#222)
• bc9622c Harden GitHub Actions workflows (#220)
• 3459ffd dep(dev): update nokogiri (#219)
• 8aa4bb2 build(deps-dev): bump concurrent-ruby from 1.3.6 to 1.3.7 (#218)
• 4ddc0c7 dep(dev): update development dependencies (#217)
• f87abb4 Merge pull request #215 from yuri-zubov/reduce-gem-size
• 527b317 Reduce gem size by excluding test files
• Additional commits viewable in compare view

[david-yz-liu]

@dependabot rebase

[coveralls]

Coverage Report for CI Build 30014916171

Coverage remained the same at 90.43%

Details

• Coverage remained the same as the base build.
• Patch coverage: No coverable lines changed in this PR.
• No coverage regressions found.

Uncovered Changes

No uncovered changes found.

Coverage Regressions

No coverage regressions found.

---

Coverage Stats

Relevant Lines:	51378
Covered Lines:	47477
Line Coverage:	92.41%
Relevant Branches:	2470
Covered Branches:	1218
Branch Coverage:	49.31%
Branches in Coverage %:	Yes
Coverage Strength:	127.87 hits per line

---

💛 - Coveralls