From 18e7c526f41997259a6435668c3912acb9e0fedc Mon Sep 17 00:00:00 2001
From: Jon Rogers <jon@carbonfive.com>
Date: Sun, 28 Jun 2026 15:49:32 -0700
Subject: [PATCH] Bundle audit update - crass

problem
-----

```
 bundle audit
Name: crass
Version: 1.0.6
GHSA: GHSA-6jxj-px6v-747w
Criticality: Unknown
URL: https://github.com/rgrove/crass/security/advisories/GHSA-6jxj-px6v-747w
Title: Deeply nested CSS blocks and functions can trigger a SystemStackError or excessive memory usage
Solution: update to '>= 1.0.7'

Name: crass
Version: 1.0.6
GHSA: GHSA-6wmf-3r64-vcwv
Criticality: Unknown
URL: https://github.com/rgrove/crass/security/advisories/GHSA-6wmf-3r64-vcwv
Title: Large numeric exponents cause CPU and memory denial of service
Solution: update to '>= 1.0.7'

Name: crass
Version: 1.0.6
GHSA: GHSA-8vfg-2r28-hvhj
Criticality: Unknown
URL: https://github.com/rgrove/crass/security/advisories/GHSA-8vfg-2r28-hvhj
Title: Non-ASCII characters cause superlinear CPU consumption
Solution: update to '>= 1.0.7'

Name: crass
Version: 1.0.6
GHSA: GHSA-wwpr-jff3-395c
Criticality: Unknown
URL: https://github.com/rgrove/crass/security/advisories/GHSA-wwpr-jff3-395c
Title: A large number of adjacent CSS comments can trigger a SystemStackError
Solution: update to '>= 1.0.7'
```

solution
-----

```
bundle update crass
```
---
 Gemfile.lock | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Gemfile.lock b/Gemfile.lock
index cd29482..79690f7 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -176,7 +176,7 @@ GEM
     coderay (1.1.3)
     concurrent-ruby (1.3.7)
     connection_pool (3.0.2)
-    crass (1.0.6)
+    crass (1.0.7)
     dalli (5.0.2)
       logger
     date (3.5.1)