Nokogiri sits under so much Ruby code that its patch releases are worth reading even when the version number looks routine. 1.19.5 is a patch release carrying three security advisories and a long list of crash and memory fixes, so it’s worth pulling in on your next dependency pass.
Three Security Advisories, All Rated Low
None of these are rated critical, but one of them reaches a lot of applications.
The one to look at first is a mutation XSS in the HTML5 serializer (GHSA-4p39-36wj-23h4). The serializer now escapes text inside noscript unless the document was parsed with parse_noscript_content_as_text: true. If your app sanitizes user-supplied HTML and allows noscript through, that gap could let markup survive sanitization and execute after it’s re-serialized. If you sanitize HTML and permit noscript, parse with parse_noscript_content_as_text: true or strip noscript elements entirely.
The other two are narrower. On CRuby, there’s a possible use-after-free when an attribute value is replaced via Node#[]= or Node#lang= while Ruby objects still reference the attribute’s children (GHSA-3w22-6jfg-527w). On JRuby, NONET now blocks external DTDs and entities whose systemId uses a short-form IPv4 host like 127.1, or an absolute path in a document parsed from a network URL, closing a potential SSRF during parses with DTDLOAD or NOENT (GHSA-v995-44v6-5fqm).
The HTML5 Parser Is Now Linear on Wide Input
Separate from the advisories, the HTML5 parser used to go quadratic when a tag carried many attributes, with hotspots in duplicate-attribute detection and in building the libxml2 structures. 1.19.5 makes that path linear. If any of your endpoints parse HTML you don’t fully control, that’s a quiet resilience win against a document crafted to be expensive to parse.
A Long Run of Compaction and Memory Fixes
The bulk of this release is correctness work around GC compaction on CRuby. SAX push parsers, XML::Reader, XSLT::Stylesheet#transform with extension functions, and Document#canonicalize could all crash, raise, or read moved memory when compaction ran at the wrong moment. Several XPath and XSLT paths that leaked memory or left stale libxml2 error handlers behind on an exception are fixed too. If you run GC compaction in production, which a lot of Rails apps now do, these are the kind of rare, hard-to-reproduce crashes this release makes go away.
Why This One Hits Wide
Nokogiri is a transitive dependency almost everywhere in Ruby: Rails HTML sanitization, feed parsing, scraping, XML APIs, and SOAP clients all route through it. bundle update nokogiri gets most apps to 1.19.5. The sanitizer advisory is the one to act on deliberately; the rest you get for free by upgrading.
How Scout Sees What Changes After You Upgrade
Scout Monitoring traces the requests and background jobs where this parsing actually happens, alongside your database queries and external calls. After swapping in a foundational library like Nokogiri, that trace view is where you’d notice a shift in the time or memory a parse-heavy endpoint spends, and where the compaction crashes would have shown up as errors before this release removed them.
For application monitoring with errors, logs, and traces, Scout Monitoring provides the fastest insights without the bloat.