diff --git a/Gemfile b/Gemfile
index 04ad8b67b1a..133d0b1e42a 100644
--- a/Gemfile
+++ b/Gemfile
@@ -36,7 +36,7 @@ gem 'redis-namespace'
 
 gem 'active_model_serializers', '~> 0.8.3'
 
-gem 'onebox', '1.8.39'
+gem 'onebox', '1.8.40'
 
 gem 'http_accept_language', '~>2.0.5', require: false
 
diff --git a/Gemfile.lock b/Gemfile.lock
index 1d856bcced8..bdbc00a36db 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -79,7 +79,7 @@ GEM
     cppjieba_rb (0.3.0)
     crack (0.4.3)
       safe_yaml (~> 1.0.0)
-    crass (1.0.2)
+    crass (1.0.3)
     debug_inspector (0.0.3)
     diff-lcs (1.3)
     discourse-qunit-rails (0.0.11)
@@ -184,13 +184,13 @@ GEM
     mock_redis (0.17.3)
     moneta (1.0.0)
     msgpack (1.1.0)
-    multi_json (1.12.1)
+    multi_json (1.13.1)
     multi_xml (0.6.0)
     multipart-post (2.0.0)
     mustache (1.0.5)
     nokogiri (1.8.2)
       mini_portile2 (~> 2.3.0)
-    nokogumbo (1.4.13)
+    nokogumbo (1.5.0)
       nokogiri
     oauth (0.5.1)
     oauth2 (1.3.1)
@@ -228,7 +228,7 @@ GEM
     omniauth-twitter (1.3.0)
       omniauth-oauth (~> 1.1)
       rack
-    onebox (1.8.39)
+    onebox (1.8.40)
       fast_blank (>= 1.0.0)
       htmlentities (~> 4.3)
       moneta (~> 1.0)
@@ -338,10 +338,10 @@ GEM
       nokogiri (>= 1.6.0)
     ruby_dep (1.5.0)
     safe_yaml (1.0.4)
-    sanitize (4.5.0)
+    sanitize (4.6.0)
       crass (~> 1.0.2)
       nokogiri (>= 1.4.4)
-      nokogumbo (~> 1.4.1)
+      nokogumbo (~> 1.4)
     sass (3.4.24)
     sassc (1.11.2)
       bundler
@@ -461,7 +461,7 @@ DEPENDENCIES
   omniauth-oauth2
   omniauth-openid
   omniauth-twitter
-  onebox (= 1.8.39)
+  onebox (= 1.8.40)
   openid-redis-store
   pg (~> 0.21.0)
   pry-nav