fix(deps): bump nokogiri to 1.19.4 for Dependabot alerts

[proxymeshai]

Summary

Reviewed Dependabot/OSV findings against the current Gemfile.lock. The only remaining vulnerable package was transitive nokogiri 1.19.2 (via mechanize). All other locked gems were already on patched versions.

This PR bumps nokogiri 1.19.2 → 1.19.4, which clears the open advisories (including high-severity CSS selector ReDoS).

Fixed advisories

Severity	Advisory	Summary
High	GHSA-c4rq-3m3g-8wgx	CSS selector tokenizer ReDoS
Moderate	GHSA-5prr-v3j2-97mh	OOB read in NodeSet#[]
Moderate	GHSA-v2fc-qm4h-8hqv	XSLT transform memory leak
Low	GHSA-phwj-rprq-35pp / GHSA-wfpw-mmfh-qq69 / GHSA-p67v-3w7g-wjg7 / GHSA-wjv4-x9w8-wm3h / GHSA-5v8h-3h3q-446p / GHSA-9cv2-cfxc-v4v2 / GHSA-8678-w3jw-xfc2	Various UAF / null deref / JRuby schema issues

Verified with OSV querybatch against the updated lockfile: no remaining vulns.

Test plan

• CI / unit specs pass
• Confirm Dependabot alerts for nokogiri resolve after merge

Slack Thread

  

[cursor]

Approved: routine security version bump of nokogiri in Gemfile.lock (1.19.2 → 1.19.4); required integration check passed and the PR is mergeable. No reviewers assigned. Auto-merge could not be enabled with available tools.

  

_{Sent by Cursor Approval Agent: oss dependabot approver}