# v0.3.6

**Released:** 2026-06-27

Changes since v0.3.5 (`d67781d`..`55e3db8`).

## Security

- **crass 1.0.6 -> 1.0.7** (transitive): four CVEs in the CSS parser used by sanitize / loofah — `SystemStackError` from deeply-nested blocks/functions, ReDoS-style CPU/memory blow-up on large numeric exponents, superlinear CPU consumption on non-ASCII characters, and another `SystemStackError` from a large number of adjacent CSS comments.
- **faraday 2.14.2 -> 2.14.3** (transitive): uncontrolled recursion in `NestedParamsEncoder` allows stack-exhaustion DoS via deeply-nested query parameters.

## Infrastructure

- Bumped `actions/cache` v4 -> v6 in `ci.yml`.

## Test Coverage

- 450 Ruby tests, 1,393 JavaScript tests (1,843 total) — unchanged from v0.3.5.