[Aikido] Fix 9 security issues in nokogiri, tzinfo

[aikido-autofix]

Upgrade Nokogiri and TZInfo to fix critical use-after-free and buffer overflow vulnerabilities, plus path traversal in timezone handling.

✅ 9 CVEs resolved by this upgrade, including 1 critical 🚨 CVE

This PR will resolve the following CVEs:

Issue	Severity	Description
GHSA-353f-x4gh-cqq8	🚨 CRITICAL	[nokogiri] Multiple critical vulnerabilities in vendored libxml2 including use-after-free, NULL pointer dereference, buffer overflow, and memory corruption when processing malicious XML input. Impact ranges from denial of service to potential code execution.
GHSA-mrxw-mxhj-p664	HIGH	[nokogiri] Two use-after-free vulnerabilities in libxslt's XPath processing and namespace handling could allow local attackers to cause denial of service or information disclosure with high impact (CVSS 7.8).
GHSA-2qc6-mcvw-92cw	MEDIUM	[nokogiri] Packaged libxml2 dependency contains three vulnerabilities: CVE-2022-2309 (DoS via NULL pointer dereference, not affecting Nokogiri), CVE-2022-40304 (data corruption/DoS via entity reference cycle), and CVE-2022-40303 (integer overflow with XML_PARSE_HUGE).
GHSA-pxvg-2qj5-37jq	MEDIUM	[nokogiri] Packaged libxml2 dependency contains multiple null pointer dereference vulnerabilities that can cause denial of service or crashes when parsing untrusted XML inputs. Upgrade to address CVE-2023-29469, CVE-2023-28484, and xmlSchemaCheckCOSSTDerivedOK issues.
GHSA-xc9x-jj77-9p9j	MEDIUM	[nokogiri] A use-after-free vulnerability in libxml2's xmlTextReader module can be triggered when processing crafted XML with DTD validation and XInclude expansion enabled, potentially leading to remote code execution or denial of service.
GHSA-5w6v-399v-w3cc	LOW	[nokogiri] Contains two libxml2 vulnerabilities: CVE-2025-32414 has no impact on Nokogiri users, while CVE-2025-32415 is a low-severity heap-based buffer under-read in XML schema validation that requires a crafted schema or document to trigger.
GHSA-r95h-9x8f-r3f7	LOW	[nokogiri] A vulnerability in libxml2's xmllint tool was addressed, but there is no impact to users since Nokogiri does not expose or provide this tool.
GHSA-vvfq-8hwr-qm4m	LOW	[nokogiri] Stack-buffer overflow in DTD validation with long QName prefixes and use-after-free during XML Schema validation can lead to remote code execution or denial of service when processing untrusted XML documents or schemas.
CVE-2022-31163	HIGH	[tzinfo] TZInfo fails to properly validate time zone identifiers, allowing newline characters that enable relative path traversal and arbitrary file loading via require. This vulnerability permits remote code execution when processing untrusted time zone identifiers.

[gitstream-cm]

🚨 gitStream Monthly Automation Limit Reached 🚨

Your organization has exceeded the number of pull requests allowed for automation with gitStream.
Monthly PRs automated: 250/250

To continue automating your PR workflows and unlock additional features, please contact LinearB.

[pr-auditor]

✅ Security Analysis Results

Great news! No security issues found in this pull request.

Analysis Summary:

• 📁 Files reviewed: 2
• ✅ No security vulnerabilities detected

---

💡 Trigger a new security scan by commenting @pr-auditor rescan on this PR.

Security analysis powered by Claude Sonnet 4.6 via pr-auditor | Questions? Contact #dx-team or check out this page