➔ Nokogiri CI Pins Keep Dependabot and Zizmor Aligned
| 5 minute read
Nokogiri is a Ruby HTML and XML parser with native extension build paths, so its CI is part of the product surface. This recent activity was not about a parser API; it was about updating pinned GitHub Actions while keeping Dependabot comment parsing compatible, with actions/cache, actionlint, and zizmor at the center.
➔ Nokogiri v1.19.4 - CRuby and JRuby Security Fixes
| 4 minute read
Nokogiri v1.19.4 was published on June 18, 2026, with security fixes for Ruby XML users on CRuby and JRuby. The most important item is the medium severity bounds fix in XML::NodeSet#[], because the same path is also exposed through #slice. This release is not marked as a prerelease.