bundle update

[touhouota]

• loofah
  • CHANGELOG
    • v2.3.1

      • Security

        • Address CVE-2019-15587: Unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished.
        • This CVE's public notice is at CVE-2019-15587 - Loofah XSS Vulnerability flavorjones/loofah#171
    • v2.3.0

      • Features

        • Expand set of allowed protocols to include tel: and line:. [Bump rubocop-ast from 0.0.3 to 0.2.0 #104, Bump rubocop from 0.90.0 to 0.91.1 #147]
        • Expand set of allowed CSS functions. [related to Bump committee from 4.1.0 to 4.2.0 #122]
        • Allow greater precision in shorthand CSS values. [Bump rubocop-ast from 0.4.0 to 0.5.0 #149] (Thanks, @danfstucky!)
        • Allow CSS property list-style [Bump regexp_parser from 1.8.1 to 1.8.2 #162] (Thanks, @jaredbeck!)
        • Allow CSS keywords thick and thin [Bump rubocop-ast from 0.8.0 to 1.0.1 #168] (Thanks, @georgeclaghorn!)
        • Allow HTML property contenteditable [Bump rspec-support from 3.9.3 to 3.9.4 #167] (Thanks, @andreynering!)

      • Bug fixes

        • CSS hex values are no longer limited to lowercase hex. Previously uppercase hex were scrubbed. [Bump rubocop from 0.93.1 to 1.0.0 #165] (Thanks, @asok!)
  • Compare URL
    • flavorjones/loofah@v2.2.3...v2.3.1
• nokogiri
  • CHANGELOG
    • [MRI] vendored libxml2 is updated from 2.9.9 to 2.9.10
    • [MRI] vendored libxslt is updated from 1.1.33 to 1.1.34
  • Compare URL
    • sparklemotion/nokogiri@v1.10.4...v1.10.5
• crass
  • CHANGELOG
    • Removed test files from the gem.
  • Compare URL
    • rgrove/crass@v1.0.4...v1.0.5
• rails-html-sanitizer
  • CHANGELOG
    • Address deprecations in Loofah 2.3.0.
  • Compare URL
    • rails/rails-html-sanitizer@v1.2.0...v1.3.0
• factory_bot_rails
  • CHANGELOG
    • Fixed: Ensure definitions do not load before I18n is initialized
  • Compare URL
    • thoughtbot/factory_bot_rails@v5.1.0...v5.1.1