diff --git a/Gemfile.lock b/Gemfile.lock
index 279537629..70bfe2e41 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -136,7 +136,7 @@ GEM
     crack (1.0.1)
       bigdecimal
       rexml
-    crass (1.0.6)
+    crass (1.0.7)
     dalli (4.3.3)
       logger
     date (3.5.1)
@@ -205,7 +205,7 @@ GEM
     language_server-protocol (3.17.0.6)
     lint_roller (1.1.0)
     logger (1.7.0)
-    loofah (2.25.1)
+    loofah (2.25.2)
       crass (~> 1.0.2)
       nokogiri (>= 1.12.0)
     mail (2.9.0)
@@ -293,8 +293,8 @@ GEM
       activesupport (>= 5.0.0)
       minitest
       nokogiri (>= 1.6)
-    rails-html-sanitizer (1.7.0)
-      loofah (~> 2.25)
+    rails-html-sanitizer (1.7.1)
+      loofah (~> 2.25, >= 2.25.2)
       nokogiri (>= 1.15.7, != 1.16.7, != 1.16.6, != 1.16.5, != 1.16.4, != 1.16.3, != 1.16.2, != 1.16.1, != 1.16.0.rc1, != 1.16.0)
     railties (8.1.3)
       actionpack (= 8.1.3)
@@ -508,7 +508,7 @@ CHECKSUMS
   config (5.6.1) sha256=a9f0f0f9ffa6d12d43147a3fa1ab8486fe484c3098a350c6a2e0f32430e0d1cc
   connection_pool (3.0.2) sha256=33fff5ba71a12d2aa26cb72b1db8bba2a1a01823559fb01d29eb74c286e62e0a
   crack (1.0.1) sha256=ff4a10390cd31d66440b7524eb1841874db86201d5b70032028553130b6d4c7e
-  crass (1.0.6) sha256=dc516022a56e7b3b156099abc81b6d2b08ea1ed12676ac7a5657617f012bd45d
+  crass (1.0.7) sha256=94868719948664c89ddcaf0a37c65048413dfcb1c869470a5f7a7ceb5390b295
   dalli (4.3.3) sha256=ae58aa3442b0d9e129898f56bc6e3a0f8b6149523e723b3eb124a05ae9a2da0c
   date (3.5.1) sha256=750d06384d7b9c15d562c76291407d89e368dda4d4fff957eb94962d325a0dc0
   debug (1.11.1) sha256=2e0b0ac6119f2207a6f8ac7d4a73ca8eb4e440f64da0a3136c30343146e952b6
@@ -541,7 +541,7 @@ CHECKSUMS
   language_server-protocol (3.17.0.6) sha256=5ef2c0c138f8267e1bc631d3328347d354f96724b0af22f2c79516120443b7f0
   lint_roller (1.1.0) sha256=2c0c845b632a7d172cb849cc90c1bce937a28c5c8ccccb50dfd46a485003cc87
   logger (1.7.0) sha256=196edec7cc44b66cfb40f9755ce11b392f21f7967696af15d274dde7edff0203
-  loofah (2.25.1) sha256=d436c73dbd0c1147b16c4a41db097942d217303e1f7728704b37e4df9f6d2e04
+  loofah (2.25.2) sha256=2007f746959ac65552456e04b433e83deb22759ab38c838b4445c70e43425918
   mail (2.9.0) sha256=6fa6673ecd71c60c2d996260f9ee3dd387d4673b8169b502134659ece6d34941
   marcel (1.1.0) sha256=fdcfcfa33cc52e93c4308d40e4090a5d4ea279e160a7f6af988260fa970e0bee
   mini_mime (1.1.5) sha256=8681b7e2e4215f2a159f9400b5816d85e9d8c6c6b491e96a12797e798f8bccef
@@ -578,7 +578,7 @@ CHECKSUMS
   rackup (2.3.1) sha256=6c79c26753778e90983761d677a48937ee3192b3ffef6bc963c0950f94688868
   rails (8.1.3) sha256=6d017ba5348c98fc909753a8169b21d44de14d2a0b92d140d1a966834c3c9cd3
   rails-dom-testing (2.3.0) sha256=8acc7953a7b911ca44588bf08737bc16719f431a1cc3091a292bca7317925c1d
-  rails-html-sanitizer (1.7.0) sha256=28b145cceaf9cc214a9874feaa183c3acba036c9592b19886e0e45efc62b1e89
+  rails-html-sanitizer (1.7.1) sha256=e797a7c9b01e567307e317c576b49ab4168017e63eea4dba9ce3cb587e2f22c2
   railties (8.1.3) sha256=913eb0e0cb520aac687ffd74916bd726d48fa21f47833c6292576ef6a286de22
   rainbow (3.1.1) sha256=039491aa3a89f42efa1d6dec2fc4e62ede96eb6acd95e52f1ad581182b79bc6a
   rake (13.4.2) sha256=cb825b2bd5f1f8e91ca37bddb4b9aaf345551b4731da62949be002fa89283701
diff --git a/sorbet/rbi/gems/crass@1.0.6.rbi b/sorbet/rbi/gems/crass@1.0.7.rbi
similarity index 64%
rename from sorbet/rbi/gems/crass@1.0.6.rbi
rename to sorbet/rbi/gems/crass@1.0.7.rbi
index ef7740f90..e5d241217 100644
--- a/sorbet/rbi/gems/crass@1.0.6.rbi
+++ b/sorbet/rbi/gems/crass@1.0.7.rbi
@@ -12,55 +12,66 @@ module Crass
   class << self
     # Parses _input_ as a CSS stylesheet and returns a parse tree.
     #
-    # See {Tokenizer#initialize} for _options_.
+    # Options:
+    #
+    #   * **:maximum_depth** - Maximum nesting depth for simple blocks and
+    #     functions. Constructs nested more deeply than this are discarded to
+    #     prevent stack exhaustion. Defaults to {Parser::DEFAULT_MAXIMUM_DEPTH}.
+    #
+    #   * **:preserve_comments** - If `true`, comments will be preserved as
+    #     `:comment` tokens.
+    #
+    #   * **:preserve_hacks** - If `true`, certain non-standard browser hacks
+    #     such as the IE "*" hack will be preserved even though they violate
+    #     CSS 3 syntax rules.
     #
-    # pkg:gem/crass#lib/crass.rb:10
+    # pkg:gem/crass#lib/crass.rb:22
     def parse(input, options = T.unsafe(nil)); end
 
     # Parses _input_ as a string of CSS properties (such as the contents of an
     # HTML element's `style` attribute) and returns a parse tree.
     #
-    # See {Tokenizer#initialize} for _options_.
+    # See {Crass.parse} for _options_.
     #
-    # pkg:gem/crass#lib/crass.rb:18
+    # pkg:gem/crass#lib/crass.rb:30
     def parse_properties(input, options = T.unsafe(nil)); end
   end
 end
 
 # Parses a CSS string or list of tokens.
 #
-# 5. http://dev.w3.org/csswg/css-syntax/#parsing
+# 5. https://www.w3.org/TR/2013/WD-css-syntax-3-20130919/#parsing
 #
 # pkg:gem/crass#lib/crass/parser.rb:10
 class Crass::Parser
   # Initializes a parser based on the given _input_, which may be a CSS string
   # or an array of tokens.
   #
-  # See {Tokenizer#initialize} for _options_.
+  # See {Crass.parse} for _options_.
   #
-  # pkg:gem/crass#lib/crass/parser.rb:126
+  # pkg:gem/crass#lib/crass/parser.rb:140
   def initialize(input, options = T.unsafe(nil)); end
 
   # Consumes an at-rule and returns it.
   #
-  # 5.4.2. http://dev.w3.org/csswg/css-syntax-3/#consume-at-rule
+  # 5.4.2. https://www.w3.org/TR/2013/WD-css-syntax-3-20130919/#consume-at-rule
   #
-  # pkg:gem/crass#lib/crass/parser.rb:137
+  # pkg:gem/crass#lib/crass/parser.rb:153
   def consume_at_rule(input = T.unsafe(nil)); end
 
   # Consumes a component value and returns it, or `nil` if there are no more
   # tokens.
   #
-  # 5.4.6. http://dev.w3.org/csswg/css-syntax-3/#consume-a-component-value
+  # 5.4.6. https://www.w3.org/TR/2013/WD-css-syntax-3-20130919/#consume-a-component-value
   #
-  # pkg:gem/crass#lib/crass/parser.rb:184
+  # pkg:gem/crass#lib/crass/parser.rb:200
   def consume_component_value(input = T.unsafe(nil)); end
 
   # Consumes a declaration and returns it, or `nil` on parse error.
   #
-  # 5.4.5. http://dev.w3.org/csswg/css-syntax-3/#consume-a-declaration
+  # 5.4.5. https://www.w3.org/TR/2013/WD-css-syntax-3-20130919/#consume-a-declaration
   #
-  # pkg:gem/crass#lib/crass/parser.rb:209
+  # pkg:gem/crass#lib/crass/parser.rb:225
   def consume_declaration(input = T.unsafe(nil)); end
 
   # Consumes a list of declarations and returns them.
@@ -73,44 +84,44 @@ class Crass::Parser
   #   * **:strict** - Set to `true` to exclude non-standard `:comment`,
   #     `:semicolon`, and `:whitespace` nodes.
   #
-  # 5.4.4. http://dev.w3.org/csswg/css-syntax/#consume-a-list-of-declarations
+  # 5.4.4. https://www.w3.org/TR/2013/WD-css-syntax-3-20130919/#consume-a-list-of-declarations
   #
-  # pkg:gem/crass#lib/crass/parser.rb:276
+  # pkg:gem/crass#lib/crass/parser.rb:292
   def consume_declarations(input = T.unsafe(nil), options = T.unsafe(nil)); end
 
   # Consumes a function and returns it.
   #
-  # 5.4.8. http://dev.w3.org/csswg/css-syntax-3/#consume-a-function
+  # 5.4.8. https://www.w3.org/TR/2013/WD-css-syntax-3-20130919/#consume-a-function
   #
-  # pkg:gem/crass#lib/crass/parser.rb:326
+  # pkg:gem/crass#lib/crass/parser.rb:342
   def consume_function(input = T.unsafe(nil)); end
 
   # Consumes a qualified rule and returns it, or `nil` if a parse error
   # occurs.
   #
-  # 5.4.3. http://dev.w3.org/csswg/css-syntax-3/#consume-a-qualified-rule
+  # 5.4.3. https://www.w3.org/TR/2013/WD-css-syntax-3-20130919/#consume-a-qualified-rule
   #
-  # pkg:gem/crass#lib/crass/parser.rb:357
+  # pkg:gem/crass#lib/crass/parser.rb:383
   def consume_qualified_rule(input = T.unsafe(nil)); end
 
   # Consumes a list of rules and returns them.
   #
-  # 5.4.1. http://dev.w3.org/csswg/css-syntax/#consume-a-list-of-rules
+  # 5.4.1. https://www.w3.org/TR/2013/WD-css-syntax-3-20130919/#consume-a-list-of-rules
   #
-  # pkg:gem/crass#lib/crass/parser.rb:398
+  # pkg:gem/crass#lib/crass/parser.rb:424
   def consume_rules(flags = T.unsafe(nil)); end
 
   # Consumes and returns a simple block associated with the current input
   # token.
   #
-  # 5.4.7. http://dev.w3.org/csswg/css-syntax/#consume-a-simple-block
+  # 5.4.7. https://www.w3.org/TR/2013/WD-css-syntax-3-20130919/#consume-a-simple-block
   #
-  # pkg:gem/crass#lib/crass/parser.rb:434
+  # pkg:gem/crass#lib/crass/parser.rb:460
   def consume_simple_block(input = T.unsafe(nil)); end
 
   # Creates and returns a new parse node with the given _properties_.
   #
-  # pkg:gem/crass#lib/crass/parser.rb:458
+  # pkg:gem/crass#lib/crass/parser.rb:526
   def create_node(type, properties = T.unsafe(nil)); end
 
   # Parses the given _input_ tokens into a selector node and returns it.
@@ -118,98 +129,110 @@ class Crass::Parser
   # Doesn't bother splitting the selector list into individual selectors or
   # validating them. Feel free to do that yourself! It'll be fun!
   #
-  # pkg:gem/crass#lib/crass/parser.rb:466
+  # pkg:gem/crass#lib/crass/parser.rb:534
   def create_selector(input); end
 
   # Creates a `:style_rule` node from the given qualified _rule_, and returns
   # it.
   #
-  # pkg:gem/crass#lib/crass/parser.rb:474
+  # pkg:gem/crass#lib/crass/parser.rb:542
   def create_style_rule(rule); end
 
+  # Discards an over-nested simple block or function without recursing, then
+  # returns an `:error` node. Assumes `input.current` is the opening token (a
+  # `{`, `[`, `(`, or function token).
+  #
+  # This is reached only when the configured maximum nesting depth is
+  # exceeded. It iteratively consumes tokens up to the matching closing token
+  # (tracking nested blocks and functions with an explicit stack) so that a
+  # deeply nested construct can't exhaust the Ruby stack.
+  #
+  # pkg:gem/crass#lib/crass/parser.rb:501
+  def discard_block(input); end
+
   # Parses a single component value and returns it.
   #
-  # 5.3.7. http://dev.w3.org/csswg/css-syntax-3/#parse-a-component-value
+  # 5.3.7. https://www.w3.org/TR/2013/WD-css-syntax-3-20130919/#parse-a-component-value
   #
-  # pkg:gem/crass#lib/crass/parser.rb:483
+  # pkg:gem/crass#lib/crass/parser.rb:551
   def parse_component_value(input = T.unsafe(nil)); end
 
   # Parses a list of component values and returns an array of parsed tokens.
   #
-  # 5.3.8. http://dev.w3.org/csswg/css-syntax/#parse-a-list-of-component-values
+  # 5.3.8. https://www.w3.org/TR/2013/WD-css-syntax-3-20130919/#parse-a-list-of-component-values
   #
-  # pkg:gem/crass#lib/crass/parser.rb:510
+  # pkg:gem/crass#lib/crass/parser.rb:578
   def parse_component_values(input = T.unsafe(nil)); end
 
   # Parses a single declaration and returns it.
   #
-  # 5.3.5. http://dev.w3.org/csswg/css-syntax/#parse-a-declaration
+  # 5.3.5. https://www.w3.org/TR/2013/WD-css-syntax-3-20130919/#parse-a-declaration
   #
-  # pkg:gem/crass#lib/crass/parser.rb:524
+  # pkg:gem/crass#lib/crass/parser.rb:592
   def parse_declaration(input = T.unsafe(nil)); end
 
   # Parses a list of declarations and returns them.
   #
   # See {#consume_declarations} for _options_.
   #
-  # 5.3.6. http://dev.w3.org/csswg/css-syntax/#parse-a-list-of-declarations
+  # 5.3.6. https://www.w3.org/TR/2013/WD-css-syntax-3-20130919/#parse-a-list-of-declarations
   #
-  # pkg:gem/crass#lib/crass/parser.rb:552
+  # pkg:gem/crass#lib/crass/parser.rb:620
   def parse_declarations(input = T.unsafe(nil), options = T.unsafe(nil)); end
 
   # Parses a list of declarations and returns an array of `:property` nodes
   # (and any non-declaration nodes that were in the input). This is useful for
   # parsing the contents of an HTML element's `style` attribute.
   #
-  # pkg:gem/crass#lib/crass/parser.rb:560
+  # pkg:gem/crass#lib/crass/parser.rb:628
   def parse_properties(input = T.unsafe(nil)); end
 
   # Parses a single rule and returns it.
   #
-  # 5.3.4. http://dev.w3.org/csswg/css-syntax-3/#parse-a-rule
+  # 5.3.4. https://www.w3.org/TR/2013/WD-css-syntax-3-20130919/#parse-a-rule
   #
-  # pkg:gem/crass#lib/crass/parser.rb:586
+  # pkg:gem/crass#lib/crass/parser.rb:654
   def parse_rule(input = T.unsafe(nil)); end
 
   # Returns the unescaped value of a selector name or property declaration.
   #
-  # pkg:gem/crass#lib/crass/parser.rb:615
+  # pkg:gem/crass#lib/crass/parser.rb:683
   def parse_value(nodes); end
 
   # {TokenScanner} wrapping the tokens generated from this parser's input.
   #
-  # pkg:gem/crass#lib/crass/parser.rb:120
+  # pkg:gem/crass#lib/crass/parser.rb:134
   def tokens; end
 
   class << self
     # Parses CSS properties (such as the contents of an HTML element's `style`
     # attribute) and returns a parse tree.
     #
-    # See {Tokenizer#initialize} for _options_.
+    # See {Crass.parse} for _options_.
     #
-    # 5.3.6. http://dev.w3.org/csswg/css-syntax/#parse-a-list-of-declarations
+    # 5.3.6. https://www.w3.org/TR/2013/WD-css-syntax-3-20130919/#parse-a-list-of-declarations
     #
-    # pkg:gem/crass#lib/crass/parser.rb:25
+    # pkg:gem/crass#lib/crass/parser.rb:39
     def parse_properties(input, options = T.unsafe(nil)); end
 
     # Parses CSS rules (such as the content of a `@media` block) and returns a
     # parse tree. The only difference from {parse_stylesheet} is that CDO/CDC
     # nodes (`<!--` and `-->`) aren't ignored.
     #
-    # See {Tokenizer#initialize} for _options_.
+    # See {Crass.parse} for _options_.
     #
-    # 5.3.3. http://dev.w3.org/csswg/css-syntax/#parse-a-list-of-rules
+    # 5.3.3. https://www.w3.org/TR/2013/WD-css-syntax-3-20130919/#parse-a-list-of-rules
     #
-    # pkg:gem/crass#lib/crass/parser.rb:36
+    # pkg:gem/crass#lib/crass/parser.rb:50
     def parse_rules(input, options = T.unsafe(nil)); end
 
     # Parses a CSS stylesheet and returns a parse tree.
     #
-    # See {Tokenizer#initialize} for _options_.
+    # See {Crass.parse} for _options_.
     #
-    # 5.3.2. http://dev.w3.org/csswg/css-syntax/#parse-a-stylesheet
+    # 5.3.2. https://www.w3.org/TR/2013/WD-css-syntax-3-20130919/#parse-a-stylesheet
     #
-    # pkg:gem/crass#lib/crass/parser.rb:54
+    # pkg:gem/crass#lib/crass/parser.rb:68
     def parse_stylesheet(input, options = T.unsafe(nil)); end
 
     # Converts a node or array of nodes into a CSS string based on their
@@ -219,7 +242,7 @@ class Crass::Parser
     #
     #   * **:exclude_comments** - When `true`, comments will be excluded.
     #
-    # pkg:gem/crass#lib/crass/parser.rb:74
+    # pkg:gem/crass#lib/crass/parser.rb:88
     def stringify(nodes, options = T.unsafe(nil)); end
   end
 end
@@ -227,6 +250,22 @@ end
 # pkg:gem/crass#lib/crass/parser.rb:11
 Crass::Parser::BLOCK_END_TOKENS = T.let(T.unsafe(nil), Hash)
 
+# Default maximum nesting depth for simple blocks and functions. This is far
+# higher than any legitimate CSS needs, but far below the depth at which
+# Ruby would raise `SystemStackError` while recursively parsing nested
+# constructs.
+#
+# Keeping this low also bounds memory usage: each nested simple block and
+# function retains a `:tokens` array spanning its descendants for
+# serialization, so the total serialization metadata grows with nesting
+# depth. A modest limit prevents deeply nested (but otherwise valid) input
+# from amplifying memory disproportionately.
+#
+# It can be overridden with the `:maximum_depth` option.
+#
+# pkg:gem/crass#lib/crass/parser.rb:29
+Crass::Parser::DEFAULT_MAXIMUM_DEPTH = T.let(T.unsafe(nil), Integer)
+
 # Similar to a StringScanner, but with extra functionality needed to tokenize
 # CSS while preserving the original text.
 #
@@ -234,20 +273,20 @@ Crass::Parser::BLOCK_END_TOKENS = T.let(T.unsafe(nil), Hash)
 class Crass::Scanner
   # Creates a Scanner instance for the given _input_ string or IO instance.
   #
-  # pkg:gem/crass#lib/crass/scanner.rb:25
+  # pkg:gem/crass#lib/crass/scanner.rb:29
   def initialize(input); end
 
   # Consumes the next character and returns it, advancing the pointer, or
   # an empty string if the end of the string has been reached.
   #
-  # pkg:gem/crass#lib/crass/scanner.rb:34
+  # pkg:gem/crass#lib/crass/scanner.rb:38
   def consume; end
 
   # Consumes the rest of the string and returns it, advancing the pointer to
   # the end of the string. Returns an empty string is the end of the string
   # has already been reached.
   #
-  # pkg:gem/crass#lib/crass/scanner.rb:46
+  # pkg:gem/crass#lib/crass/scanner.rb:50
   def consume_rest; end
 
   # Current character, or `nil` if the scanner hasn't yet consumed a
@@ -259,19 +298,19 @@ class Crass::Scanner
   # Returns `true` if the end of the string has been reached, `false`
   # otherwise.
   #
-  # pkg:gem/crass#lib/crass/scanner.rb:57
+  # pkg:gem/crass#lib/crass/scanner.rb:66
   def eos?; end
 
   # Sets the marker to the position of the next character that will be
   # consumed.
   #
-  # pkg:gem/crass#lib/crass/scanner.rb:63
+  # pkg:gem/crass#lib/crass/scanner.rb:72
   def mark; end
 
   # Returns the substring between {#marker} and {#pos}, without altering the
   # pointer.
   #
-  # pkg:gem/crass#lib/crass/scanner.rb:69
+  # pkg:gem/crass#lib/crass/scanner.rb:79
   def marked; end
 
   # Current marker position. Use {#marked} to get the substring between
@@ -290,50 +329,58 @@ class Crass::Scanner
   # doesn't consume them. The number of characters returned may be less than
   # _length_ if the end of the string is reached.
   #
-  # pkg:gem/crass#lib/crass/scanner.rb:80
+  # pkg:gem/crass#lib/crass/scanner.rb:91
   def peek(length = T.unsafe(nil)); end
 
   # Position of the next character that will be consumed. This is a character
   # position, not a byte position, so it accounts for multi-byte characters.
   #
-  # pkg:gem/crass#lib/crass/scanner.rb:19
+  # Byte offsets (used internally for fast substring extraction) are tracked
+  # separately by the underlying StringScanner, whose `pos` always reflects
+  # the byte offset corresponding to this character position.
+  #
+  # pkg:gem/crass#lib/crass/scanner.rb:23
   def pos; end
 
   # Position of the next character that will be consumed. This is a character
   # position, not a byte position, so it accounts for multi-byte characters.
   #
-  # pkg:gem/crass#lib/crass/scanner.rb:19
+  # Byte offsets (used internally for fast substring extraction) are tracked
+  # separately by the underlying StringScanner, whose `pos` always reflects
+  # the byte offset corresponding to this character position.
+  #
+  # pkg:gem/crass#lib/crass/scanner.rb:23
   def pos=(_arg0); end
 
   # Moves the pointer back one character without changing the value of
   # {#current}. The next call to {#consume} will re-consume the current
   # character.
   #
-  # pkg:gem/crass#lib/crass/scanner.rb:87
+  # pkg:gem/crass#lib/crass/scanner.rb:103
   def reconsume; end
 
   # Resets the pointer to the beginning of the string.
   #
-  # pkg:gem/crass#lib/crass/scanner.rb:93
+  # pkg:gem/crass#lib/crass/scanner.rb:109
   def reset; end
 
   # Tries to match _pattern_ at the current position. If it matches, the
   # matched substring will be returned and the pointer will be advanced.
   # Otherwise, `nil` will be returned.
   #
-  # pkg:gem/crass#lib/crass/scanner.rb:103
+  # pkg:gem/crass#lib/crass/scanner.rb:122
   def scan(pattern); end
 
   # Scans the string until the _pattern_ is matched. Returns the substring up
   # to and including the end of the match, and advances the pointer. If there
   # is no match, `nil` is returned and the pointer is not advanced.
   #
-  # pkg:gem/crass#lib/crass/scanner.rb:115
+  # pkg:gem/crass#lib/crass/scanner.rb:134
   def scan_until(pattern); end
 
   # String being scanned.
   #
-  # pkg:gem/crass#lib/crass/scanner.rb:22
+  # pkg:gem/crass#lib/crass/scanner.rb:26
   def string; end
 end
 
@@ -386,7 +433,7 @@ end
 
 # Tokenizes a CSS string.
 #
-# 4. http://dev.w3.org/csswg/css-syntax/#tokenization
+# 4. https://www.w3.org/TR/2013/WD-css-syntax-3-20130919/#tokenization
 #
 # pkg:gem/crass#lib/crass/tokenizer.rb:9
 class Crass::Tokenizer
@@ -406,23 +453,23 @@ class Crass::Tokenizer
 
   # Consumes a token and returns the token that was consumed.
   #
-  # 4.3.1. http://dev.w3.org/csswg/css-syntax/#consume-a-token
+  # 4.3.1. https://www.w3.org/TR/2013/WD-css-syntax-3-20130919/#consume-a-token
   #
   # pkg:gem/crass#lib/crass/tokenizer.rb:70
   def consume; end
 
   # Consumes the remnants of a bad URL and returns the consumed text.
   #
-  # 4.3.15. http://dev.w3.org/csswg/css-syntax/#consume-the-remnants-of-a-bad-url
+  # 4.3.15. https://www.w3.org/TR/2013/WD-css-syntax-3-20130919/#consume-the-remnants-of-a-bad-url
   #
-  # pkg:gem/crass#lib/crass/tokenizer.rb:275
+  # pkg:gem/crass#lib/crass/tokenizer.rb:276
   def consume_bad_url; end
 
   # Consumes comments and returns them, or `nil` if no comments were consumed.
   #
-  # 4.3.2. http://dev.w3.org/csswg/css-syntax/#consume-comments
+  # 4.3.2. https://www.w3.org/TR/2013/WD-css-syntax-3-20130919/#consume-comments
   #
-  # pkg:gem/crass#lib/crass/tokenizer.rb:301
+  # pkg:gem/crass#lib/crass/tokenizer.rb:302
   def consume_comments; end
 
   # Consumes an escaped code point and returns its unescaped value.
@@ -431,114 +478,114 @@ class Crass::Tokenizer
   # next character in the input has already been verified not to be a newline
   # or EOF.
   #
-  # 4.3.8. http://dev.w3.org/csswg/css-syntax/#consume-an-escaped-code-point
+  # 4.3.8. https://www.w3.org/TR/2013/WD-css-syntax-3-20130919/#consume-an-escaped-code-point
   #
-  # pkg:gem/crass#lib/crass/tokenizer.rb:326
+  # pkg:gem/crass#lib/crass/tokenizer.rb:327
   def consume_escaped; end
 
   # Consumes an ident-like token and returns it.
   #
-  # 4.3.4. http://dev.w3.org/csswg/css-syntax/#consume-an-ident-like-token
+  # 4.3.4. https://www.w3.org/TR/2013/WD-css-syntax-3-20130919/#consume-an-ident-like-token
   #
-  # pkg:gem/crass#lib/crass/tokenizer.rb:350
+  # pkg:gem/crass#lib/crass/tokenizer.rb:351
   def consume_ident; end
 
   # Consumes a name and returns it.
   #
-  # 4.3.12. http://dev.w3.org/csswg/css-syntax/#consume-a-name
+  # 4.3.12. https://www.w3.org/TR/2013/WD-css-syntax-3-20130919/#consume-a-name
   #
-  # pkg:gem/crass#lib/crass/tokenizer.rb:375
+  # pkg:gem/crass#lib/crass/tokenizer.rb:376
   def consume_name; end
 
   # Consumes a number and returns a 3-element array containing the number's
   # original representation, its numeric value, and its type (either
   # `:integer` or `:number`).
   #
-  # 4.3.13. http://dev.w3.org/csswg/css-syntax/#consume-a-number
+  # 4.3.13. https://www.w3.org/TR/2013/WD-css-syntax-3-20130919/#consume-a-number
   #
-  # pkg:gem/crass#lib/crass/tokenizer.rb:407
+  # pkg:gem/crass#lib/crass/tokenizer.rb:408
   def consume_number; end
 
   # Consumes a numeric token and returns it.
   #
-  # 4.3.3. http://dev.w3.org/csswg/css-syntax/#consume-a-numeric-token
+  # 4.3.3. https://www.w3.org/TR/2013/WD-css-syntax-3-20130919/#consume-a-numeric-token
   #
-  # pkg:gem/crass#lib/crass/tokenizer.rb:430
+  # pkg:gem/crass#lib/crass/tokenizer.rb:431
   def consume_numeric; end
 
   # Consumes a string token that ends at the given character, and returns the
   # token.
   #
-  # 4.3.5. http://dev.w3.org/csswg/css-syntax/#consume-a-string-token
+  # 4.3.5. https://www.w3.org/TR/2013/WD-css-syntax-3-20130919/#consume-a-string-token
   #
-  # pkg:gem/crass#lib/crass/tokenizer.rb:469
+  # pkg:gem/crass#lib/crass/tokenizer.rb:470
   def consume_string(ending = T.unsafe(nil)); end
 
   # Consumes a Unicode range token and returns it. Assumes the initial "u+" or
   # "U+" has already been consumed.
   #
-  # 4.3.7. http://dev.w3.org/csswg/css-syntax/#consume-a-unicode-range-token
+  # 4.3.7. https://www.w3.org/TR/2013/WD-css-syntax-3-20130919/#consume-a-unicode-range-token
   #
-  # pkg:gem/crass#lib/crass/tokenizer.rb:510
+  # pkg:gem/crass#lib/crass/tokenizer.rb:511
   def consume_unicode_range; end
 
   # Consumes a URL token and returns it. Assumes the original "url(" has
   # already been consumed.
   #
-  # 4.3.6. http://dev.w3.org/csswg/css-syntax/#consume-a-url-token
+  # 4.3.6. https://www.w3.org/TR/2013/WD-css-syntax-3-20130919/#consume-a-url-token
   #
-  # pkg:gem/crass#lib/crass/tokenizer.rb:542
+  # pkg:gem/crass#lib/crass/tokenizer.rb:543
   def consume_url; end
 
   # Converts a valid CSS number string into a number and returns the number.
   #
-  # 4.3.14. http://dev.w3.org/csswg/css-syntax/#convert-a-string-to-a-number
+  # 4.3.14. https://www.w3.org/TR/2013/WD-css-syntax-3-20130919/#convert-a-string-to-a-number
   #
-  # pkg:gem/crass#lib/crass/tokenizer.rb:590
+  # pkg:gem/crass#lib/crass/tokenizer.rb:591
   def convert_string_to_number(str); end
 
   # Creates and returns a new token with the given _properties_.
   #
-  # pkg:gem/crass#lib/crass/tokenizer.rb:616
+  # pkg:gem/crass#lib/crass/tokenizer.rb:643
   def create_token(type, properties = T.unsafe(nil)); end
 
   # Preprocesses _input_ to prepare it for the tokenizer.
   #
-  # 3.3. http://dev.w3.org/csswg/css-syntax/#input-preprocessing
+  # 3.3. https://www.w3.org/TR/2013/WD-css-syntax-3-20130919/#input-preprocessing
   #
-  # pkg:gem/crass#lib/crass/tokenizer.rb:627
+  # pkg:gem/crass#lib/crass/tokenizer.rb:654
   def preprocess(input); end
 
   # Returns `true` if the given three-character _text_ would start an
   # identifier. If _text_ is `nil`, the current and next two characters in the
   # input stream will be checked, but will not be consumed.
   #
-  # 4.3.10. http://dev.w3.org/csswg/css-syntax/#would-start-an-identifier
+  # 4.3.10. https://www.w3.org/TR/2013/WD-css-syntax-3-20130919/#would-start-an-identifier
   #
-  # pkg:gem/crass#lib/crass/tokenizer.rb:642
+  # pkg:gem/crass#lib/crass/tokenizer.rb:669
   def start_identifier?(text = T.unsafe(nil)); end
 
   # Returns `true` if the given three-character _text_ would start a number.
   # If _text_ is `nil`, the current and next two characters in the input
   # stream will be checked, but will not be consumed.
   #
-  # 4.3.11. http://dev.w3.org/csswg/css-syntax/#starts-with-a-number
+  # 4.3.11. https://www.w3.org/TR/2013/WD-css-syntax-3-20130919/#starts-with-a-number
   #
-  # pkg:gem/crass#lib/crass/tokenizer.rb:666
+  # pkg:gem/crass#lib/crass/tokenizer.rb:693
   def start_number?(text = T.unsafe(nil)); end
 
   # Tokenizes the input stream and returns an array of tokens.
   #
-  # pkg:gem/crass#lib/crass/tokenizer.rb:685
+  # pkg:gem/crass#lib/crass/tokenizer.rb:712
   def tokenize; end
 
   # Returns `true` if the given two-character _text_ is the beginning of a
   # valid escape sequence. If _text_ is `nil`, the current and next character
   # in the input stream will be checked, but will not be consumed.
   #
-  # 4.3.9. http://dev.w3.org/csswg/css-syntax/#starts-with-a-valid-escape
+  # 4.3.9. https://www.w3.org/TR/2013/WD-css-syntax-3-20130919/#starts-with-a-valid-escape
   #
-  # pkg:gem/crass#lib/crass/tokenizer.rb:702
+  # pkg:gem/crass#lib/crass/tokenizer.rb:729
   def valid_escape?(text = T.unsafe(nil)); end
 
   class << self
diff --git a/sorbet/rbi/gems/loofah@2.25.1.rbi b/sorbet/rbi/gems/loofah@2.25.2.rbi
similarity index 90%
rename from sorbet/rbi/gems/loofah@2.25.1.rbi
rename to sorbet/rbi/gems/loofah@2.25.2.rbi
index 3fe61e215..ff4850213 100644
--- a/sorbet/rbi/gems/loofah@2.25.1.rbi
+++ b/sorbet/rbi/gems/loofah@2.25.2.rbi
@@ -275,65 +275,65 @@ Loofah::HTML5::SafeList::ACCEPTABLE_ATTRIBUTES = T.let(T.unsafe(nil), Set)
 
 # https://www.w3.org/TR/css-color-3/#html4
 #
-# pkg:gem/loofah#lib/loofah/html5/safelist.rb:738
+# pkg:gem/loofah#lib/loofah/html5/safelist.rb:743
 Loofah::HTML5::SafeList::ACCEPTABLE_CSS_COLORS = T.let(T.unsafe(nil), Set)
 
 # https://www.w3.org/TR/css-color-3/#svg-color
 #
-# pkg:gem/loofah#lib/loofah/html5/safelist.rb:758
+# pkg:gem/loofah#lib/loofah/html5/safelist.rb:763
 Loofah::HTML5::SafeList::ACCEPTABLE_CSS_EXTENDED_COLORS = T.let(T.unsafe(nil), Set)
 
 # see https://www.quackit.com/css/functions/
 # omit `url` and `image` from that list
 #
-# pkg:gem/loofah#lib/loofah/html5/safelist.rb:910
+# pkg:gem/loofah#lib/loofah/html5/safelist.rb:915
 Loofah::HTML5::SafeList::ACCEPTABLE_CSS_FUNCTIONS = T.let(T.unsafe(nil), Set)
 
-# pkg:gem/loofah#lib/loofah/html5/safelist.rb:699
+# pkg:gem/loofah#lib/loofah/html5/safelist.rb:704
 Loofah::HTML5::SafeList::ACCEPTABLE_CSS_KEYWORDS = T.let(T.unsafe(nil), Set)
 
-# pkg:gem/loofah#lib/loofah/html5/safelist.rb:626
+# pkg:gem/loofah#lib/loofah/html5/safelist.rb:631
 Loofah::HTML5::SafeList::ACCEPTABLE_CSS_PROPERTIES = T.let(T.unsafe(nil), Set)
 
 # pkg:gem/loofah#lib/loofah/html5/safelist.rb:50
 Loofah::HTML5::SafeList::ACCEPTABLE_ELEMENTS = T.let(T.unsafe(nil), Set)
 
-# pkg:gem/loofah#lib/loofah/html5/safelist.rb:983
+# pkg:gem/loofah#lib/loofah/html5/safelist.rb:988
 Loofah::HTML5::SafeList::ACCEPTABLE_PROTOCOLS = T.let(T.unsafe(nil), Set)
 
-# pkg:gem/loofah#lib/loofah/html5/safelist.rb:970
+# pkg:gem/loofah#lib/loofah/html5/safelist.rb:975
 Loofah::HTML5::SafeList::ACCEPTABLE_SVG_PROPERTIES = T.let(T.unsafe(nil), Set)
 
-# pkg:gem/loofah#lib/loofah/html5/safelist.rb:1014
+# pkg:gem/loofah#lib/loofah/html5/safelist.rb:1018
 Loofah::HTML5::SafeList::ACCEPTABLE_URI_DATA_MEDIATYPES = T.let(T.unsafe(nil), Set)
 
-# pkg:gem/loofah#lib/loofah/html5/safelist.rb:1024
+# pkg:gem/loofah#lib/loofah/html5/safelist.rb:1028
 Loofah::HTML5::SafeList::ALLOWED_ATTRIBUTES = T.let(T.unsafe(nil), Set)
 
-# pkg:gem/loofah#lib/loofah/html5/safelist.rb:1027
+# pkg:gem/loofah#lib/loofah/html5/safelist.rb:1031
 Loofah::HTML5::SafeList::ALLOWED_CSS_FUNCTIONS = T.let(T.unsafe(nil), Set)
 
-# pkg:gem/loofah#lib/loofah/html5/safelist.rb:1026
+# pkg:gem/loofah#lib/loofah/html5/safelist.rb:1030
 Loofah::HTML5::SafeList::ALLOWED_CSS_KEYWORDS = T.let(T.unsafe(nil), Set)
 
-# pkg:gem/loofah#lib/loofah/html5/safelist.rb:1025
+# pkg:gem/loofah#lib/loofah/html5/safelist.rb:1029
 Loofah::HTML5::SafeList::ALLOWED_CSS_PROPERTIES = T.let(T.unsafe(nil), Set)
 
 # subclasses may define their own versions of these constants
 #
-# pkg:gem/loofah#lib/loofah/html5/safelist.rb:1023
+# pkg:gem/loofah#lib/loofah/html5/safelist.rb:1027
 Loofah::HTML5::SafeList::ALLOWED_ELEMENTS = T.let(T.unsafe(nil), Set)
 
-# pkg:gem/loofah#lib/loofah/html5/safelist.rb:1048
+# pkg:gem/loofah#lib/loofah/html5/safelist.rb:1052
 Loofah::HTML5::SafeList::ALLOWED_ELEMENTS_WITH_LIBXML2 = T.let(T.unsafe(nil), Set)
 
-# pkg:gem/loofah#lib/loofah/html5/safelist.rb:1029
+# pkg:gem/loofah#lib/loofah/html5/safelist.rb:1033
 Loofah::HTML5::SafeList::ALLOWED_PROTOCOLS = T.let(T.unsafe(nil), Set)
 
-# pkg:gem/loofah#lib/loofah/html5/safelist.rb:1028
+# pkg:gem/loofah#lib/loofah/html5/safelist.rb:1032
 Loofah::HTML5::SafeList::ALLOWED_SVG_PROPERTIES = T.let(T.unsafe(nil), Set)
 
-# pkg:gem/loofah#lib/loofah/html5/safelist.rb:1030
+# pkg:gem/loofah#lib/loofah/html5/safelist.rb:1034
 Loofah::HTML5::SafeList::ALLOWED_URI_DATA_MEDIATYPES = T.let(T.unsafe(nil), Set)
 
 # pkg:gem/loofah#lib/loofah/html5/safelist.rb:526
@@ -348,13 +348,13 @@ Loofah::HTML5::SafeList::MATHML_ATTRIBUTES = T.let(T.unsafe(nil), Set)
 # pkg:gem/loofah#lib/loofah/html5/safelist.rb:147
 Loofah::HTML5::SafeList::MATHML_ELEMENTS = T.let(T.unsafe(nil), Set)
 
-# pkg:gem/loofah#lib/loofah/html5/safelist.rb:981
+# pkg:gem/loofah#lib/loofah/html5/safelist.rb:986
 Loofah::HTML5::SafeList::PROTOCOL_SEPARATOR = T.let(T.unsafe(nil), Regexp)
 
-# pkg:gem/loofah#lib/loofah/html5/safelist.rb:963
+# pkg:gem/loofah#lib/loofah/html5/safelist.rb:968
 Loofah::HTML5::SafeList::SHORTHAND_CSS_PROPERTIES = T.let(T.unsafe(nil), Set)
 
-# pkg:gem/loofah#lib/loofah/html5/safelist.rb:608
+# pkg:gem/loofah#lib/loofah/html5/safelist.rb:613
 Loofah::HTML5::SafeList::SVG_ALLOW_LOCAL_HREF = T.let(T.unsafe(nil), Set)
 
 # pkg:gem/loofah#lib/loofah/html5/safelist.rb:367
@@ -366,62 +366,77 @@ Loofah::HTML5::SafeList::SVG_ATTR_VAL_ALLOWS_REF = T.let(T.unsafe(nil), Set)
 # pkg:gem/loofah#lib/loofah/html5/safelist.rb:183
 Loofah::HTML5::SafeList::SVG_ELEMENTS = T.let(T.unsafe(nil), Set)
 
+# pkg:gem/loofah#lib/loofah/html5/safelist.rb:608
+Loofah::HTML5::SafeList::SVG_HREF_ATTRIBUTES = T.let(T.unsafe(nil), Set)
+
 # additional tags we should consider safe since we have libxml2 fixing up our documents.
 #
-# pkg:gem/loofah#lib/loofah/html5/safelist.rb:1043
+# pkg:gem/loofah#lib/loofah/html5/safelist.rb:1047
 Loofah::HTML5::SafeList::TAGS_SAFE_WITH_LIBXML2 = T.let(T.unsafe(nil), Set)
 
 # TODO: remove VOID_ELEMENTS in a future major release
 # and put it in the tests (it is used only for testing, not for functional behavior)
 #
-# pkg:gem/loofah#lib/loofah/html5/safelist.rb:1034
+# pkg:gem/loofah#lib/loofah/html5/safelist.rb:1038
 Loofah::HTML5::SafeList::VOID_ELEMENTS = T.let(T.unsafe(nil), Set)
 
 # pkg:gem/loofah#lib/loofah/html5/scrub.rb:9
 module Loofah::HTML5::Scrub
   class << self
-    # pkg:gem/loofah#lib/loofah/html5/scrub.rb:20
+    # pkg:gem/loofah#lib/loofah/html5/scrub.rb:56
     def allowed_element?(element_name); end
 
-    # Returns true if the given URI string is safe, false otherwise.
-    # This method can be used to validate URI attribute values without
-    # requiring a Nokogiri DOM node.
+    # Returns true if the given URI string is safe, false otherwise. This method can be used to
+    # validate URI attribute values without requiring a Nokogiri DOM node.
     #
-    # pkg:gem/loofah#lib/loofah/html5/scrub.rb:147
+    # pkg:gem/loofah#lib/loofah/html5/scrub.rb:182
     def allowed_uri?(uri_string); end
 
-    # pkg:gem/loofah#lib/loofah/html5/scrub.rb:207
+    # pkg:gem/loofah#lib/loofah/html5/scrub.rb:266
     def cdata_escape(node); end
 
-    # pkg:gem/loofah#lib/loofah/html5/scrub.rb:202
+    # pkg:gem/loofah#lib/loofah/html5/scrub.rb:261
     def cdata_needs_escaping?(node); end
 
-    # pkg:gem/loofah#lib/loofah/html5/scrub.rb:222
+    # pkg:gem/loofah#lib/loofah/html5/scrub.rb:206
+    def decode_numeric_character_references(string); end
+
+    # pkg:gem/loofah#lib/loofah/html5/scrub.rb:281
     def escape_tags(string); end
 
     #  libxml2 >= 2.9.2 fails to escape comments within some attributes.
     #
     #  see comments about CVE-2018-8048 within the tests for more information
     #
-    # pkg:gem/loofah#lib/loofah/html5/scrub.rb:181
+    # pkg:gem/loofah#lib/loofah/html5/scrub.rb:240
     def force_correct_attribute_escaping!(node); end
 
-    # pkg:gem/loofah#lib/loofah/html5/scrub.rb:125
+    # pkg:gem/loofah#lib/loofah/html5/scrub.rb:161
     def scrub_attribute_that_allows_local_ref(attr_node); end
 
     #  alternative implementation of the html5lib attribute scrubbing algorithm
     #
-    # pkg:gem/loofah#lib/loofah/html5/scrub.rb:25
+    # pkg:gem/loofah#lib/loofah/html5/scrub.rb:61
     def scrub_attributes(node); end
 
-    # pkg:gem/loofah#lib/loofah/html5/scrub.rb:74
+    # pkg:gem/loofah#lib/loofah/html5/scrub.rb:110
     def scrub_css(style); end
 
-    # pkg:gem/loofah#lib/loofah/html5/scrub.rb:69
+    # pkg:gem/loofah#lib/loofah/html5/scrub.rb:105
     def scrub_css_attribute(node); end
 
-    # pkg:gem/loofah#lib/loofah/html5/scrub.rb:167
+    # pkg:gem/loofah#lib/loofah/html5/scrub.rb:226
     def scrub_uri_attribute(attr_node); end
+
+    private
+
+    # Returns the mediatype of a data: URI per RFC 2397, or nil when the
+    # required comma is absent. allowed_uri? entity-decodes, downcases, and
+    # strips control characters before calling this. An omitted or malformed
+    # mediatype resolves to "text/plain", matching the WHATWG data: URL processor.
+    #
+    # pkg:gem/loofah#lib/loofah/html5/scrub.rb:307
+    def data_uri_mediatype(uri_string); end
   end
 end
 
@@ -446,10 +461,46 @@ Loofah::HTML5::Scrub::CSS_WHITESPACE = T.let(T.unsafe(nil), String)
 # pkg:gem/loofah#lib/loofah/html5/scrub.rb:16
 Loofah::HTML5::Scrub::DATA_ATTRIBUTE_NAME = T.let(T.unsafe(nil), Regexp)
 
-# pkg:gem/loofah#lib/loofah/html5/scrub.rb:17
+# Matches a valid MIME type "essence" (type "/" subtype, no parameters), used to
+# decide whether a data: URI mediatype is well-formed; a non-match is not a valid
+# MIME type, which the data: URL processor treats as text/plain. Specs:
+#
+#   https://mimesniff.spec.whatwg.org/#valid-mime-type
+#   https://mimesniff.spec.whatwg.org/#mime-type-essence
+#   https://mimesniff.spec.whatwg.org/#http-token-code-point
+#
+# The character class below is the HTTP token set (tchar) from RFC 9110 section
+# 5.6.2, https://www.rfc-editor.org/rfc/rfc9110#name-tokens :
+#
+#   tchar = "!" / "#" / "$" / "%" / "&" / "'" / "*" / "+" / "-" / "." / "^"
+#         / "_" / "`" / "|" / "~" / DIGIT / ALPHA
+#
+# ALPHA is written a-z, not a-zA-Z, because allowed_uri? downcases the input first.
+#
+# pkg:gem/loofah#lib/loofah/html5/scrub.rb:43
+Loofah::HTML5::Scrub::DATA_URI_MEDIATYPE = T.let(T.unsafe(nil), Regexp)
+
+# Decimal (`&#58`) or hexadecimal (`&#x3a`) form, with or without the trailing semicolon that
+# CGI.unescapeHTML requires but browsers do not.
+#
+# pkg:gem/loofah#lib/loofah/html5/scrub.rb:20
+Loofah::HTML5::Scrub::NUMERIC_CHARACTER_REFERENCE = T.let(T.unsafe(nil), Regexp)
+
+# A scheme (RFC 3986) followed by a protocol separator. The separator must recognize the same
+# encoded-colon forms as PROTOCOL_SEPARATOR, otherwise a scheme split by an encoded colon (for
+# example "javascript&#58alert(1)") would not be recognized as having a scheme and would skip
+# protocol validation.
+#
+# pkg:gem/loofah#lib/loofah/html5/scrub.rb:26
 Loofah::HTML5::Scrub::URI_PROTOCOL_REGEX = T.let(T.unsafe(nil), Regexp)
 
-# pkg:gem/loofah#lib/loofah/html5/safelist.rb:1051
+# HTML5 named character references for whitespace that browsers strip from
+# URIs. CGI.unescapeHTML does not decode these, so they are handled explicitly.
+#
+# pkg:gem/loofah#lib/loofah/html5/scrub.rb:53
+Loofah::HTML5::Scrub::WHITESPACE_CHARACTER_REFERENCES = T.let(T.unsafe(nil), Regexp)
+
+# pkg:gem/loofah#lib/loofah/html5/safelist.rb:1055
 Loofah::HTML5::WhiteList = Loofah::HTML5::SafeList
 
 # pkg:gem/loofah#lib/loofah/concerns.rb:133
diff --git a/sorbet/rbi/gems/rails-html-sanitizer@1.7.0.rbi b/sorbet/rbi/gems/rails-html-sanitizer@1.7.1.rbi
similarity index 100%
rename from sorbet/rbi/gems/rails-html-sanitizer@1.7.0.rbi
rename to sorbet/rbi/gems/rails-html-sanitizer@1.7.1.rbi