Skip to content

Bundle audit update - crass - #82

Merged
bunnymatic merged 1 commit into
mainfrom
chore/bundle-audit
Jun 28, 2026
Merged

Bundle audit update - crass#82
bunnymatic merged 1 commit into
mainfrom
chore/bundle-audit

Conversation

@bunnymatic

Copy link
Copy Markdown
Member

problem

 bundle audit
Name: crass
Version: 1.0.6
GHSA: GHSA-6jxj-px6v-747w
Criticality: Unknown
URL: https://github.com/rgrove/crass/security/advisories/GHSA-6jxj-px6v-747w
Title: Deeply nested CSS blocks and functions can trigger a SystemStackError or excessive memory usage
Solution: update to '>= 1.0.7'

Name: crass
Version: 1.0.6
GHSA: GHSA-6wmf-3r64-vcwv
Criticality: Unknown
URL: https://github.com/rgrove/crass/security/advisories/GHSA-6wmf-3r64-vcwv
Title: Large numeric exponents cause CPU and memory denial of service
Solution: update to '>= 1.0.7'

Name: crass
Version: 1.0.6
GHSA: GHSA-8vfg-2r28-hvhj
Criticality: Unknown
URL: https://github.com/rgrove/crass/security/advisories/GHSA-8vfg-2r28-hvhj
Title: Non-ASCII characters cause superlinear CPU consumption
Solution: update to '>= 1.0.7'

Name: crass
Version: 1.0.6
GHSA: GHSA-wwpr-jff3-395c
Criticality: Unknown
URL: https://github.com/rgrove/crass/security/advisories/GHSA-wwpr-jff3-395c
Title: A large number of adjacent CSS comments can trigger a SystemStackError
Solution: update to '>= 1.0.7'

solution

bundle update crass

problem
-----

```
 bundle audit
Name: crass
Version: 1.0.6
GHSA: GHSA-6jxj-px6v-747w
Criticality: Unknown
URL: GHSA-6jxj-px6v-747w
Title: Deeply nested CSS blocks and functions can trigger a SystemStackError or excessive memory usage
Solution: update to '>= 1.0.7'

Name: crass
Version: 1.0.6
GHSA: GHSA-6wmf-3r64-vcwv
Criticality: Unknown
URL: GHSA-6wmf-3r64-vcwv
Title: Large numeric exponents cause CPU and memory denial of service
Solution: update to '>= 1.0.7'

Name: crass
Version: 1.0.6
GHSA: GHSA-8vfg-2r28-hvhj
Criticality: Unknown
URL: GHSA-8vfg-2r28-hvhj
Title: Non-ASCII characters cause superlinear CPU consumption
Solution: update to '>= 1.0.7'

Name: crass
Version: 1.0.6
GHSA: GHSA-wwpr-jff3-395c
Criticality: Unknown
URL: GHSA-wwpr-jff3-395c
Title: A large number of adjacent CSS comments can trigger a SystemStackError
Solution: update to '>= 1.0.7'
```

solution
-----

```
bundle update crass
```
@bunnymatic
bunnymatic merged commit 2caa202 into main Jun 28, 2026
2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant