[dependabot]

Bumps nokogiri from 1.19.4 to 1.19.6.

Release notes

Sourced from nokogiri's releases.

v1.19.6 / 2026-11-02

Fixed

• [JRuby] Parsing or reparenting an HTML4 element that has an xmlns attribute and a child element no longer raises NullPointerException. This was a regression in v1.19.5. (#3753) @​flavorjones

746fca23be3cd3f121cabab65cb44c52049e4cf9f0d36e7e8c3c0eb6cc298c57  nokogiri-1.19.6-aarch64-linux-gnu.gem
4a5620da1c52150e0343bd2bba7dbd9b3899b5eb41687dc1942c9092d81e52a3  nokogiri-1.19.6-aarch64-linux-musl.gem
574e50ddd99ed71aaa868027d84eb3b9f051e55fe07ddc844e4fdd654be953fc  nokogiri-1.19.6-arm-linux-gnu.gem
c20ea8d8c92cbaa475f0952f755dea88cf6e3ace8b49d634a0a5385a1feaea10  nokogiri-1.19.6-arm-linux-musl.gem
0a89005ba8cf40c7bd580f4c0873f5f11e5866a99e364764fb59ac6516f560d0  nokogiri-1.19.6-arm64-darwin.gem
4068744c2afb9c2596666a5b02fe633be1c58abb3bf2c9d06c962ede95c55fba  nokogiri-1.19.6-java.gem
b5768c5dab09abe39e6e1329f692db191688398964f7d2c18caaa19aa00f5421  nokogiri-1.19.6-x64-mingw-ucrt.gem
8f15f820fa1373d8685ae48cdd8020d923b4104db74d149d1235ddae956469a6  nokogiri-1.19.6-x86_64-darwin.gem
ad1e228c3bc873e4f4fc4f845d7e37b4d3648af537acd7b5e8463cce5693065b  nokogiri-1.19.6-x86_64-linux-gnu.gem
c92b29e897f4ddc19bea67188695aab667f695e74592a5c8741642ecb25d34d9  nokogiri-1.19.6-x86_64-linux-musl.gem
a61e7192fc2691c23bc0241907c4dbcb70ada6ab904796ce2426a57171022c8f  nokogiri-1.19.6.gem

---

Full Changelog: sparklemotion/nokogiri@v1.19.5...v1.19.6

v1.19.5 / 2026-11-01

Security

• [CRuby] (Low) Fixed a possible use-after-free when an attribute value is replaced via Node#[]= or Node#lang= while Ruby objects still reference the attribute's children. See GHSA-3w22-6jfg-527w for more information.
• [CRuby] (Low) The HTML5 serializer now escapes text inside noscript unless the document was parsed with parse_noscript_content_as_text: true, preventing a mutation XSS in applications that allow noscript in sanitized HTML. A fragment now parses noscript content the same way as its document, and raises ArgumentError if given a conflicting parse_noscript_content_as_text: value. Comments and raw-text elements inside noscript are still serialized unchanged, as the HTML standard requires, so applications that sanitize HTML and allow noscript should parse with parse_noscript_content_as_text: true or remove noscript elements. See GHSA-4p39-36wj-23h4 for more information.
• [JRuby] (Low) NONET now blocks external DTDs and entities whose systemId uses a short-form IPv4 host such as 127.1, or is an absolute path in a document parsed from a network URL. Previously Nokogiri fetched them over the network during a parse with DTDLOAD or NOENT, potentially enabling SSRF. See GHSA-v995-44v6-5fqm for more information.

Improved

• [CRuby] The HTML5 parser now has linear performance when parsing many attributes. Previously performance was quadratic due to two hotspots, one in detecting duplicate attributes and one in constructing the libxml2 data structures. (#3393) @​flavorjones
• [CRuby] Improved XPath argument marshalling performance by using ALLOCV_N instead of rb_gc_register_address. (#3648) @​jhawthorn

Fixed

• Node#namespace= now declares the namespace on the node when no declaration of its prefix is in scope there. Previously, on CRuby, a node given a namespace and then moved under an element that binds the same prefix, or the default namespace, to a different URI was serialized in that other namespace. On JRuby, the namespace was missing from Node#namespace_definitions. (#3459, #3462) @​flavorjones
• XML::Reader is no longer affected by changes made to its source String after the reader is created. Previously, such a change could make the reader parse the changed String on JRuby, or changed or freed memory on CRuby with libxml2 < 2.11. (#3694) @​flavorjones
• Node#namespace = false now raises TypeError. Previously it crashed the process on CRuby and raised ClassCastException on JRuby. (#3719) @​flavorjones
• XML::XPathContext.new and XML::XPathContext#node= raise TypeError when the argument is not a Node. Previously, on CRuby, most such arguments crashed the process. (#3720) @​flavorjones

... (truncated)

Changelog

Sourced from nokogiri's changelog.

v1.19.6 / 2026-11-02

Fixed

• [JRuby] Parsing or reparenting an HTML4 element that has an xmlns attribute and a child element no longer raises NullPointerException. This was a regression in v1.19.5. (#3753) @​flavorjones

v1.19.5 / 2026-11-01

Security

• [CRuby] (Low) Fixed a possible use-after-free when an attribute value is replaced via Node#[]= or Node#lang= while Ruby objects still reference the attribute's children. See GHSA-3w22-6jfg-527w for more information.
• [CRuby] (Low) The HTML5 serializer now escapes text inside noscript unless the document was parsed with parse_noscript_content_as_text: true, preventing a mutation XSS in applications that allow noscript in sanitized HTML. A fragment now parses noscript content the same way as its document, and raises ArgumentError if given a conflicting parse_noscript_content_as_text: value. Comments and raw-text elements inside noscript are still serialized unchanged, as the HTML standard requires, so applications that sanitize HTML and allow noscript should parse with parse_noscript_content_as_text: true or remove noscript elements. See GHSA-4p39-36wj-23h4 for more information.
• [JRuby] (Low) NONET now blocks external DTDs and entities whose systemId uses a short-form IPv4 host such as 127.1, or is an absolute path in a document parsed from a network URL. Previously Nokogiri fetched them over the network during a parse with DTDLOAD or NOENT, potentially enabling SSRF. See GHSA-v995-44v6-5fqm for more information.

Improved

• [CRuby] The HTML5 parser now has linear performance when parsing many attributes. Previously performance was quadratic due to two hotspots, one in detecting duplicate attributes and one in constructing the libxml2 data structures. (#3393) @​flavorjones
• [CRuby] Improved XPath argument marshalling performance by using ALLOCV_N instead of rb_gc_register_address. (#3648) @​jhawthorn

Fixed

• Node#namespace= now declares the namespace on the node when no declaration of its prefix is in scope there. Previously, on CRuby, a node given a namespace and then moved under an element that binds the same prefix, or the default namespace, to a different URI was serialized in that other namespace. On JRuby, the namespace was missing from Node#namespace_definitions. (#3459, #3462) @​flavorjones
• XML::Reader is no longer affected by changes made to its source String after the reader is created. Previously, such a change could make the reader parse the changed String on JRuby, or changed or freed memory on CRuby with libxml2 < 2.11. (#3694) @​flavorjones
• Node#namespace = false now raises TypeError. Previously it crashed the process on CRuby and raised ClassCastException on JRuby. (#3719) @​flavorjones
• XML::XPathContext.new and XML::XPathContext#node= raise TypeError when the argument is not a Node. Previously, on CRuby, most such arguments crashed the process. (#3720) @​flavorjones
• CSS an+b selectors with a zero or negative step now follow the Selectors spec: :nth-child(0n+3) matches only the third element (previously nothing), 0n-1 matches nothing instead of raising ZeroDivisionError, and -n+0 / -2n match nothing instead of every (or every other) element. @​afurm
• CSS #id, .class and attribute selectors whose value contains a quote character, such as #it\'s or [a=\'b\'], now match that value. Previously they raised Nokogiri::XML::XPath::SyntaxError or generated an XPath query with a different meaning. An #id selector containing an escaped newline no longer drops the text after it. (#3724, #3727) @​flavorjones
• CSS :contains() arguments, custom pseudo-class string arguments, and element names containing a CSS escape, such as p:contains('it\'s') or a\-b, now match. Previously they raised Nokogiri::XML::XPath::SyntaxError. An element name that is not an XML name after unescaping, such as a\!b, raises Nokogiri::CSS::SyntaxError, except as an unprefixed name in an HTML5 document, where it matches by local name. In ids, classes, attribute values, element names and string arguments, an escape for U+0000, a surrogate, or a code point above U+10FFFF now decodes to U+FFFD, and a vertical tab after a hexadecimal escape is no longer dropped, as CSS Syntax Level 3 requires. (#3728, #3729) @​flavorjones
• CSS attribute names containing a CSS escape, such as [a\-b], now match. Previously they raised Nokogiri::XML::XPath::SyntaxError. An unprefixed attribute name that cannot be written as an XPath name test after unescaping, such as [\@click] or [\:class], matches an attribute with that exact name in no namespace. The HTML parsers create such attributes. A prefixed one, such as [x|a\!b], raises Nokogiri::CSS::SyntaxError. (#3732, #3735) @​flavorjones
• [CRuby] The HTML5 serializer escapes < and > in attribute values as < and >, following whatwg/html#6362. Previously they were written literally. (#3529, #3741) @​flavorjones
• [CRuby] Reparenting removes a node's declaration of a prefix that the new parent binds to the same URI. (#3462) @​flavorjones
• [CRuby] Builder now correctly builds namespaced nodes that define their own namespace when that ns prefix collides with one defined by the parent (or another ancestor). (#3458, #3461) @​flavorjones
• [CRuby] Reader.outer_xml and .inner_xml properly capture syntax errors. (#3558) @​flavorjones
• [CRuby] XML::SAX::PushParser and HTML4::SAX::PushParser keep parsing correctly after GC compaction relocates their SAX parser. (#3665) @​zanker
• [CRuby] XML::Reader keeps reading correctly when GC compaction runs. Previously, compaction could move the IO or String the reader was created from, and the reader then crashed or parsed the wrong bytes. (#3666, #3668) @​zanker
• [CRuby] XSLT::Stylesheet#transform calls custom XSLT extension functions correctly when GC compaction runs. Previously, after compaction moved a stylesheet that uses an extension module, a later transform raised an exception or crashed. (#3667) @​jeremy
• [CRuby] XSLT::Stylesheet#transform passes the correct params when GC compaction runs while it converts a param with #to_str. Previously, compaction could move the bytes of earlier short params, and the transform raised RuntimeError or silently left a param empty. (#3670) @​flavorjones
• [CRuby] XML::SAX::ParserContext.io and HTML4::SAX::ParserContext.io keep parsing correctly after GC compaction relocates the IO. (#3669) @​zanker
• [CRuby] Document#canonicalize passes the correct inclusive namespace prefixes when it converts a prefix with #to_str, and when GC compaction runs during canonicalization. Previously, libxml2 could read freed or moved memory, and the output lost namespaces or Ruby crashed. Raising on a prefix with a null byte also no longer leaks memory. (#3714, #3750) @​Priyank-gouda678 @​flavorjones
• [CRuby] XSLT::Stylesheet#transform calls custom XSLT extension functions correctly when GC compaction runs during the transform. Previously, compaction could move an extension handler instance, and a later call to one of its functions raised an exception or crashed. (#3748) @​flavorjones
• [CRuby] XSLT::Stylesheet#transform calls custom XSLT extension functions correctly after an extension function runs another transform with the same stylesheet, or while another thread does. Previously, the inner or concurrent transform released extension handler instances that the other transform still used, and GC could free them. (#3748) @​flavorjones
• [CRuby] XML::Reader.from_memory accepts an object that responds to to_str. Previously, it could raise Nokogiri::XML::SyntaxError. (#3694) @​flavorjones
• [CRuby] XPathContext#evaluate no longer leaks memory when a custom XPath function handler raises an exception. (#3715, #1610) @​flavorjones
• [CRuby] When a custom XPath function handler raises an exception, XPathContext#evaluate now resets libxml2's error handlers and unregisters the custom function lookup. Previously, libxml2 could keep references to garbage-collected Ruby objects. (#3715) @​flavorjones
• [CRuby MacOS] Fixed an issue handling SIGINT during HTML5 parsing. (#3528, #3535) @​stevecheckoway
• [CRuby] gumbo: gumbo_parse_with_options no longer crashes when stop_on_first_error is set and the parse ends on an unknown end tag in a fragment context. This is a C API path; it is not reachable from Ruby, because Nokogiri never sets stop_on_first_error. (#3672) @​jeremy
• [JRuby] Fixed multiple issues with Node#namespace_definitions so that it now behaves identically to CRuby. (#2543, #3460) @​flavorjones

... (truncated)

Commits

• b0702e6 version bump to v1.19.6
• 9d2cf65 Merge pull request #3754 from sparklemotion/card-936-jruby-relink-namespace-n...
• cbb5855 fix(jruby): avoid NPE on HTML4 elements with an xmlns attribute
• 724ef47 version bump to v1.19.5
• 60e801b Merge pull request #3752 from sparklemotion/card-931-v1-19-5-backport
• ce1a138 ci: bump ruby/setup-ruby to v1.335.0
• 3254e40 test: skip compaction tests before Ruby 3.3 to fix OOM in Ruby 3.2 CI jobs (#...
• 729d578 style(rubocop): Lint/Void in entity reference test
• e62615f doc: add the v1.19.5 Security CHANGELOG entries
• 97f41b6 fix: JRuby NONET bypass in external entity resolution
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)