Affected: RubyGems: nokogiri

### Summary

Nokogiri v1.11.4 updates the vendored libxml2 from v2.9.10 to v2.9.12 which addresses:

- [CVE-2019-20388](https://security.archlinux.org/CVE-2019-20388) (Medium severity) - [CVE-2020-24977](https://security.archlinux.org/CVE-2020-24977) (Medium severity) - [CVE-2021-3517](https://security.archlinux.org/CVE-2021-3517) (Medium severity) - [CVE-2021-3518](https://security.archlinux.org/CVE-2021-3518) (Medium severity) - [CVE-2021-3537](https://security.archlinux.org/CVE-2021-3537) (Low severity) - [CVE-2021-3541](https://security.archlinux.org/CVE-2021-3541) (Low severity)

Note that two additional CVEs were addressed upstream but are not relevant to this release. [CVE-2021-3516](https://security.archlinux.org/CVE-2021-3516) via `xmllint` is not present in Nokogiri, and [CVE-2020-7595](https://security.archlinux.org/CVE-2020-7595) has been patched in Nokogiri since v1.10.8 (see #1992).

Please note that this advisory only applies to the CRuby implementation of Nokogiri `< 1.11.4`, and only if the packaged version of libxml2 is being used. If you've overridden defaults at installation time to use system libraries instead of packaged libraries, you should instead pay attention to your distro's `libxml2` release announcements.

### Mitigation

Upgrade to Nokogiri `>= 1.11.4`.

### Impact

I've done a brief analysis of the published CVEs that are addressed in this upstream release. The libxml2 maintainers have not released a canonical set of CVEs, and so this list i…