Critical and high-level dependabot-recommended security updates (December 2025)

[nicoledow]

Items Addressed

These updates should address all "critical" and "high" severity dependabot alerts.

Author Checklist

• Add unit test(s)
• Update documentation (if necessary)
• Update version in version.rb following versioning guidelines

[nicoledow]

Nokogiri needed to be upgraded to 1.18.4+ to resolve a couple of critical dependabot security warnings (listed below). Since nokogiri is not a direct dependency of decanter but a sub-dependency, I had to update a few other gems:

1. Warning 1
2. Warning 2

Changes made:

• Updated rails-html-sanitizer from >= 1.0.4 to >= 1.6.2
  • rails-html-sanitizer 1.6.0 (bundled with Rails 7.1.3.2) constrains nokogiri to ~> 1.14, which blocks upgrading to 1.18.4+
  • Version 1.6.2+ allows nokogiri >= 1.18.4
• Constrained Rails to ~> 7.1.3 (allows 7.1.6, latest 7.1.x)
  • Keeps Rails 7.1.x compatibility while enabling nokogiri upgrade

[nicoledow]

In the process, activestorage was upgraded to 7.1.6, which will resolve the active storage critical security alert which recommends upgrading to 7.1.5.2+.

[kweingart08]

🎉

[nicoledow]

This update will address the following high-level security warnings for rack:

1. https://github.com/LaunchPadLab/decanter/security/dependabot/92
2. https://github.com/LaunchPadLab/decanter/security/dependabot/95
3. https://github.com/LaunchPadLab/decanter/security/dependabot/104

[kweingart08]

lgtm from a dependency standpoint — thanks for the thorough notes.
Just to sanity check: were you able to bundle + boot this version locally with the updated Rails/Rack/Nokogiri combo?

[kweingart08]

🎉

[nicoledow]

@kweingart08 Thanks! Yes, I tested bundling on a Rails 7 and a Rails 8 project.