[dependabot]

🤖 River’s Rails development bundle updates Nokogiri from 1.19.5 to 1.19.7 and rack-test from 2.2.0 to 2.3.0.

Package	From	To
Nokogiri	1.19.5	1.19.7
rack-test	2.2.0	2.3.0

The original Action Pack update and its coupled Rails and sanitizer security fixes are already included in master through #1596. This PR retains those fixes and adds the two remaining dependency updates. The diff is limited to locked gem versions and checksums.

[bgentry]

🤖 @dependabot rebase

The Rails 8.1.4.1 family and sanitizer updates are already present on master via #1596. Please refresh this untouched bot branch so the remaining dependency delta and CI can be reviewed on the current base.

[bgentry]

🤖 Codex review: Approved after dependency security and compatibility review.

Upgrade

• Nokogiri: 1.19.5 → 1.19.7 (all eight locked platforms).
• rack-test: 2.2.0 → 2.3.0.
• Reviewed head: dea87c7d418ecfd95a1c520756b71c599c144753.
• Current master: 008bd4ee364e64d5236802a04e0020725d4961d3.

Security review

• A delegated read-only supply-chain review inspected the full original lockfile delta, including the coupled Rails family, Loofah, sanitizer, Minitest, Nokogiri, and rack-test updates. All 40 old/new published gem variants match both their lockfile SHA-256 entries and canonical RubyGems registry metadata. No newly introduced gems, source switches, same-version checksum rewrites, install hooks, or executables were found.
• Inspected published source diffs and cross-checked canonical upstream tags and advisories. Nokogiri's own Ruby/C/header sources match both upstream tags; its changes are the JRuby namespace correction, Ruby-version macro guards, and version metadata. Its six Linux native artifact sets are byte-identical across the upgrade. rack-test's full diff and upstream sources show ordinary redirect and multipart fixes. No published affected advisories were returned for either retained target version.
• The Rails 8.1.4.1 and sanitizer security updates from the original PR are already included in master through #1596; this PR retains them. The remaining base-to-result delta is only Nokogiri and rack-test, with the exact reviewed versions and checksums. No security upgrade is deferred.

Compatibility verification

• BUNDLE_FROZEN=false make -C ruby install — passed. Frozen installation initially rejected this Mac's Darwin 27 platform in three unchanged bundles. The only local lockfile adjustments add arm64-darwin-27; no gem version or checksum changes result, and these local-only adjustments are excluded from the PR.
• RIVER_REQUIRE_DATABASES=1 make -C ruby test — passed: 3,262 examples across core, Active Record, Sequel, and Rails, using Postgres 18.6 and SQLite with Ruby 3.3.12. Two existing Ruby-version-specific Ractor skips are expected.
• make -C ruby lint type-check verify build — passed. A second make -C ruby lint is idempotent; no Ruby source changes result.
• The original Ruby 3.2 CI failure is a VM segmentation fault in the core Ractor/logger test, outside the changed Rails bundle. The retry and final Ruby checks now pass. All required Go checks and the Rails 7.2/8.0/8.1 matrix also pass on this head.
• git merge-tree --write-tree origin/master <reviewed-head> produces tree b97561224c2227a1d0bb3fedcf808d7db3d6c56e, identical to the reviewed head's tree. Thus the latest base introduces no additional code or dependency inputs beyond the tested tree. Go source/modules and the other ports are unchanged; their applicable required CI results pass. The requested bot rebase has not produced a new head; the merge-tree equality establishes that this does not invalidate the local verification.

Residual risk

• Nokogiri's Darwin native bundles were statically compared (including strings and dynamic library dependencies), not independently rebuilt. Registry metadata verifies artifact identity, not complete build provenance. No blocking supply-chain or compatibility issue was identified.