[ci skip] Please don't send more PRs trying to bump Loofah.

rails · Nov 5, 2018 · d4d823c · d4d823c
1 parent fc5fd28
commit d4d823c
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/rails-html-sanitizer.gemspec b/rails-html-sanitizer.gemspec
@@ -17,6 +17,8 @@ Gem::Specification.new do |spec|
   spec.test_files    = Dir["test/**/*"]
   spec.require_paths = ["lib"]
 
+  # NOTE: There's no need to update this dependency for Loofah CVEs
+  # in minor releases when users can simply run `bundle update loofah`.
   spec.add_dependency "loofah", "~> 2.2", ">= 2.2.2"
 
   spec.add_development_dependency "bundler", "~> 1.3"