chore(deps): bump loofah from 2.25.1 to 2.25.2 (#6008)

Bumps [loofah](https://github.com/flavorjones/loofah) from 2.25.1 to
2.25.2.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/flavorjones/loofah/releases">loofah's
releases</a>.</em></p>
<blockquote>
<h2>2.25.2 / 2026-07-15</h2>
<h3>Security</h3>
<ul>
<li>Ensure <code>Loofah::HTML5::Scrub.allowed_uri?</code> recognizes
numeric character references without semicolons (e.g.
<code>javascript&amp;#58alert(1)</code>), which browsers decode and
execute, and rejects schemes split by them. See <a
href="https://github.com/flavorjones/loofah/security/advisories/GHSA-5qhf-9phg-95m2">GHSA-5qhf-9phg-95m2</a>.
<a
href="https://github.com/flavorjones"><code>@​flavorjones</code></a></li>
<li>Ensure <code>Loofah::HTML5::Scrub.allowed_uri?</code> recognizes the
named character references <code>&amp;Tab;</code> and
<code>&amp;NewLine;</code>, which <code>CGI.unescapeHTML</code> does not
decode and browsers strip from URIs, and rejects schemes split by them
(e.g. <code>java&amp;Tab;script:alert(1)</code>). See <a
href="https://github.com/flavorjones/loofah/security/advisories/GHSA-8whx-365g-h9vv">GHSA-8whx-365g-h9vv</a>.
<a
href="https://github.com/flavorjones"><code>@​flavorjones</code></a></li>
<li>Ensure that both <code>href</code> and <code>xlink:href</code>
attributes on SVG elements like <code>use</code> are restricted to local
(same-document) references. Previously only <code>xlink:href</code> was
restricted, allowing the SVG 2 <code>href</code> attribute to reference
external documents. See <a
href="https://github.com/flavorjones/loofah/security/advisories/GHSA-9wjq-cp2p-hrgf">GHSA-9wjq-cp2p-hrgf</a>.
<a
href="https://github.com/flavorjones"><code>@​flavorjones</code></a></li>
</ul>
<h3>Improved</h3>
<ul>
<li>Harden <code>data:</code> URI mediatype parsing in
<code>Loofah::HTML5::Scrub.allowed_uri?</code>. The mediatype is now
parsed following the <a
href="https://fetch.spec.whatwg.org/#data-urls">WHATWG data: URL
spec</a> and <a href="https://www.rfc-editor.org/rfc/rfc2397">RFC
2397</a> instead of simply being split on a colon. A <code>data:</code>
URI with an omitted or malformed mediatype is now treated as
<code>text/plain</code> and allowed, and one without the required comma
is now rejected. <a
href="https://redirect.github.com/flavorjones/loofah/issues/305">#305</a>
<a
href="https://github.com/flavorjones"><code>@​flavorjones</code></a></li>
<li>Remove <code>feed</code> from the default set of allowed protocols.
The <a href="https://en.wikipedia.org/wiki/Feed_URI_scheme">feed URI
scheme</a> was never accepted as a standard protocol, and no major
browser supports it. Removing it reduces the attack surface particularly
for non-browser contexts. <a
href="https://redirect.github.com/flavorjones/loofah/issues/304">#304</a>
<a
href="https://github.com/flavorjones"><code>@​flavorjones</code></a></li>
<li>Remove a vestigial <code>&amp;#x70</code> alternative from
<code>Loofah::HTML5::SafeList::PROTOCOL_SEPARATOR</code>. This appears
to be an ancient typo dating back to pre-extraction Rails circa 2007. <a
href="https://redirect.github.com/flavorjones/loofah/issues/305">#305</a>
<a
href="https://github.com/flavorjones"><code>@​flavorjones</code></a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/flavorjones/loofah/blob/main/CHANGELOG.md">loofah's
changelog</a>.</em></p>
<blockquote>
<h2>2.25.2 / 2026-07-15</h2>
<h3>Security</h3>
<ul>
<li>Ensure <code>Loofah::HTML5::Scrub.allowed_uri?</code> recognizes
numeric character references without semicolons (e.g.
<code>javascript&amp;#58alert(1)</code>), which browsers decode and
execute, and rejects schemes split by them. See <a
href="https://github.com/flavorjones/loofah/security/advisories/GHSA-5qhf-9phg-95m2">GHSA-5qhf-9phg-95m2</a>.
<a
href="https://github.com/flavorjones"><code>@​flavorjones</code></a></li>
<li>Ensure <code>Loofah::HTML5::Scrub.allowed_uri?</code> recognizes the
named character references <code>&amp;Tab;</code> and
<code>&amp;NewLine;</code>, which <code>CGI.unescapeHTML</code> does not
decode and browsers strip from URIs, and rejects schemes split by them
(e.g. <code>java&amp;Tab;script:alert(1)</code>). See <a
href="https://github.com/flavorjones/loofah/security/advisories/GHSA-8whx-365g-h9vv">GHSA-8whx-365g-h9vv</a>.
<a
href="https://github.com/flavorjones"><code>@​flavorjones</code></a></li>
<li>Ensure that both <code>href</code> and <code>xlink:href</code>
attributes on SVG elements like <code>use</code> are restricted to local
(same-document) references. Previously only <code>xlink:href</code> was
restricted, allowing the SVG 2 <code>href</code> attribute to reference
external documents. See <a
href="https://github.com/flavorjones/loofah/security/advisories/GHSA-9wjq-cp2p-hrgf">GHSA-9wjq-cp2p-hrgf</a>.
<a
href="https://github.com/flavorjones"><code>@​flavorjones</code></a></li>
</ul>
<h3>Improved</h3>
<ul>
<li>Harden <code>data:</code> URI mediatype parsing in
<code>Loofah::HTML5::Scrub.allowed_uri?</code>. The mediatype is now
parsed following the <a
href="https://fetch.spec.whatwg.org/#data-urls">WHATWG data: URL
spec</a> and <a href="https://www.rfc-editor.org/rfc/rfc2397">RFC
2397</a> instead of simply being split on a colon. A <code>data:</code>
URI with an omitted or malformed mediatype is now treated as
<code>text/plain</code> and allowed, and one without the required comma
is now rejected. <a
href="https://redirect.github.com/flavorjones/loofah/issues/305">#305</a>
<a
href="https://github.com/flavorjones"><code>@​flavorjones</code></a></li>
<li>Remove <code>feed</code> from the default set of allowed protocols.
The <a href="https://en.wikipedia.org/wiki/Feed_URI_scheme">feed URI
scheme</a> was never accepted as a standard protocol, and no major
browser supports it. Removing it reduces the attack surface particularly
for non-browser contexts. <a
href="https://redirect.github.com/flavorjones/loofah/issues/304">#304</a>
<a
href="https://github.com/flavorjones"><code>@​flavorjones</code></a></li>
<li>Remove a vestigial <code>&amp;#x70</code> alternative from
<code>Loofah::HTML5::SafeList::PROTOCOL_SEPARATOR</code>. This appears
to be an ancient typo dating back to pre-extraction Rails circa 2007. <a
href="https://redirect.github.com/flavorjones/loofah/issues/305">#305</a>
<a
href="https://github.com/flavorjones"><code>@​flavorjones</code></a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/flavorjones/loofah/commit/2706d7e858426ba856d9711b0e761b2fee7986c4"><code>2706d7e</code></a>
version bump to v2.25.2</li>
<li><a
href="https://github.com/flavorjones/loofah/commit/1afde0cb8db147debed5d7200a7de947b09c1d9b"><code>1afde0c</code></a>
Merge pull request <a
href="https://redirect.github.com/flavorjones/loofah/issues/308">#308</a>
from flavorjones/security-2252</li>
<li><a
href="https://github.com/flavorjones/loofah/commit/f1be9d893b5a8dd79240441a912d8897e74c38c0"><code>f1be9d8</code></a>
Update <code>allowed_uri?</code> to decode semicolon-less numeric
character references</li>
<li><a
href="https://github.com/flavorjones/loofah/commit/5e91af861e3cdab47b91dd0b81f3afdfd13a5e19"><code>5e91af8</code></a>
Update <code>allowed_uri?</code> to handle named whitespace character
references</li>
<li><a
href="https://github.com/flavorjones/loofah/commit/20867b9be689521887364b74822c41ef830523c9"><code>20867b9</code></a>
Properly restrict SVG href attributes</li>
<li><a
href="https://github.com/flavorjones/loofah/commit/5f3bff46b610c1221c4bdb4e5b5b90e1178576cc"><code>5f3bff4</code></a>
test: opt into JSON comment parsing for sanitizer testdata (<a
href="https://redirect.github.com/flavorjones/loofah/issues/307">#307</a>)</li>
<li><a
href="https://github.com/flavorjones/loofah/commit/b07713d155ec7f5ae101464f09483a45efd481c2"><code>b07713d</code></a>
test: do not run in verbose mode</li>
<li><a
href="https://github.com/flavorjones/loofah/commit/babe7a86e808e4f4df638140bf6719d18d97ffae"><code>babe7a8</code></a>
doc: update CHANGELOG</li>
<li><a
href="https://github.com/flavorjones/loofah/commit/a8d8d96d916f08ac46f478cbe9e8ae056c98f2b3"><code>a8d8d96</code></a>
Merge pull request <a
href="https://redirect.github.com/flavorjones/loofah/issues/305">#305</a>
from flavorjones/drop-protocol-typo</li>
<li><a
href="https://github.com/flavorjones/loofah/commit/b52f4b022db0a35f08d7f916fdf6034d312c7c8d"><code>b52f4b0</code></a>
version bump to 2.25.2.beta1</li>
<li>Additional commits viewable in <a
href="https://github.com/flavorjones/loofah/compare/v2.25.1...v2.25.2">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=loofah&package-manager=bundler&previous-version=2.25.1&new-version=2.25.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/getlago/lago-api/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Author: dependabot[bot]

Gemfile.lock

@@ -174,7 +174,7 @@ GEM
     crack (1.0.1)
       bigdecimal
       rexml
-    crass (1.0.6)
+    crass (1.0.7)
     csv (3.3.5)
     database_cleaner-active_record (2.2.2)
       activerecord (>= 5.a)
@@ -463,7 +463,7 @@ GEM
       railties (>= 4)
       request_store (~> 1.0)
     logstash-event (1.2.02)
-    loofah (2.25.1)
+    loofah (2.25.2)
       crass (~> 1.0.2)
       nokogiri (>= 1.12.0)
     lumberjack (1.4.2)