bundle audit: Update gems

[seanpdoyle]

The following diff was generated by executing the following:

bundle update \
  crass
  json
  loofah
  rails-html-sanitizer
  websocket-driver

This commit updates the following gems based on CI failure output:

• crass
• json
• loofah
• rails-html-sanitizer
• websocket-driver

ruby-advisory-db:
  advisories:	1209 advisories
  last updated:	2026-07-15 19:08:00 -0400
  commit:	32a64d01964828d2f71ba17fb623a73142e03a3d
Name: crass
Version: 1.0.6
GHSA: GHSA-6jxj-px6v-747w
Criticality: Unknown
URL: https://github.com/rgrove/crass/security/advisories/GHSA-6jxj-px6v-747w
Title: Deeply nested CSS blocks and functions can trigger a SystemStackError or excessive memory usage
Solution: update to '>= 1.0.7'

Name: crass
Version: 1.0.6
GHSA: GHSA-6wmf-3r64-vcwv
Criticality: Unknown
URL: https://github.com/rgrove/crass/security/advisories/GHSA-6wmf-3r64-vcwv
Title: Large numeric exponents cause CPU and memory denial of service
Solution: update to '>= 1.0.7'

Name: crass
Version: 1.0.6
GHSA: GHSA-8vfg-2r28-hvhj
Criticality: Unknown
URL: https://github.com/rgrove/crass/security/advisories/GHSA-8vfg-2r28-hvhj
Title: Non-ASCII characters cause superlinear CPU consumption
Solution: update to '>= 1.0.7'

Name: crass
Version: 1.0.6
GHSA: GHSA-wwpr-jff3-395c
Criticality: Unknown
URL: https://github.com/rgrove/crass/security/advisories/GHSA-wwpr-jff3-395c
Title: A large number of adjacent CSS comments can trigger a SystemStackError
Solution: update to '>= 1.0.7'

Name: json
Version: 2.19.3
CVE: CVE-2026-54696
GHSA: GHSA-x2f5-4prf-w687
Criticality: Low
URL: https://nvd.nist.gov/vuln/detail/CVE-2026-54696
Title: JSON generator heap buffer overflow when streaming to an IO
Solution: update to '>= 2.19.9'

Name: websocket-driver
Version: 0.7.7
CVE: CVE-2026-54463
GHSA: GHSA-ghhp-3qvg-889p
Criticality: Unknown
URL: https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-54463
Title: Memory exhaustion via abuse of protocol length headers
Solution: update to '>= 0.8.1'

Name: websocket-driver
Version: 0.7.7
CVE: CVE-2026-54464
GHSA: GHSA-33ph-fccm-39pj
Criticality: Unknown
URL: https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-54464
Title: Resource limit bypass via message compression
Solution: update to '>= 0.8.1'

Name: websocket-driver
Version: 0.7.7
CVE: CVE-2026-54465
GHSA: GHSA-8j3g-f24p-4mpw
Criticality: Unknown
URL: https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-54465
Title: Memory exhaustion in HTTP header parser
Solution: update to '>= 0.8.1'

Name: websocket-driver
Version: 0.7.7
GHSA: GHSA-2x63-gw47-w4mm
Criticality: Unknown
URL: https://github.com/faye/websocket-driver-ruby/security/advisories/GHSA-2x63-gw47-w4mm
Title: Denial of service via malformed Host header
Solution: update to '>= 0.8.2'

[seanpdoyle]

I plan on merging this PR on green, since CI is currently failing for several open PRs related to bundle audit failures.

@pablobm since you mentioned an interest in removing bundle audit entirely (in this comment), I'm curious: would you oppose merging this PR to temporarily restore a passing suite?

[pablobm]

@seanpdoyle - Go for it.