Nokogiri is the HTML and XML parser Ruby scrapers and document pipelines use. From 1 October through 6 October 2026, main took three commits and changed 5 files, 17 insertions and 17 deletions. The only parser edit makes a deprecation macro compile with MSVC, and the other two commits move a development gem constraint and pinned GitHub Actions.
The GNU macro fails under MSVC ¶
ext/nokogiri/nokogiri.h defines NOKO_WARN_DEPRECATION. Before the 6 October fix, both copies used the GNU named form message.... GCC treats that name as the rest of the arguments. MSVC rejects a period in a macro parameter list and reports error C2010: '.': unexpected in macro parameter list.
Both branches now use standard ... and __VA_ARGS__. The category branch calls rb_category_warning with RB_WARN_CATEGORY_DEPRECATED. The other calls rb_warning. Leaving either copy on the GNU syntax would still stop cl.exe.
#if HAVE_RB_CATEGORY_WARNING
# define NOKO_WARN_DEPRECATION(...) rb_category_warning(RB_WARN_CATEGORY_DEPRECATED, __VA_ARGS__)
#else
# define NOKO_WARN_DEPRECATION(...) rb_warning(__VA_ARGS__)
#endif
ext/nokogiri/extconf.rb probes have_func("rb_category_warning"). The comment says the function arrived in Ruby 3.0 and that TruffleRuby had trouble resolving the symbol. The README requires Ruby 3.2 or newer, and CRuby in that range satisfies the probe. Warning[:deprecated] = false then silences this category. The rb_warning fallback ignores that switch.
The commit adds no test and changes no C or Java behavior. The extension compiled with cl.exe afterward. The windows job in the CI workflow runs on windows-2022 and windows-11-arm, calls ruby/setup-ruby-pkgs at v1.33.5, and requests the MinGW packages libxml2 and libxslt. The shipped Windows gem is x64-mingw-ucrt. MinGW accepts the old syntax, so that job would still pass. Native gem installs do not compile the header. The break is an MSVC build from source, and rakelib/extensions.rake still treats mswin as Windows. CI does not run that compiler.
The warning text did not move ¶
Five C call sites still use the macro. The fix did not change their strings.
Node.new warns when the second argument is a Node and not a Document. The text says to pass a Document or to call Node#add_child. The comment dates the warning to v1.13.0 and says it becomes an error in v1.17.0.
CDATA.new, Text.new, and Schema.from_document check the document argument the same way. The deprecated path reads node->doc and continues. Those comments say v1.15.3, and the same v1.17.0 error.
The handler lookup needs the variable argument list. If a custom XPath or CSS handler responds to the bare name and the namespace is null, the call passes a format string and c_name twice. The text says to call the function as nokogiri: plus the name. A single parameter macro would not compile it. The comment says remove this in v1.19.0. The string still says v1.17.0.
lib/nokogiri/version/constant.rb sets VERSION to 1.20.0.dev. A Node that is not a Document still works, and so does a handler with no namespace. The warning prints, then the old path continues.
The rubyzip bump is a development constraint ¶
The 3 October commit changes one line in the Gemfile. In the :development group, rubyzip moves from ~> 3.6.0 to ~> 3.7.0. That operator still excludes 3.8 and above.
The gemspec does not depend on rubyzip, so installing nokogiri does not fetch it. The only use is the test serializes correctly with Zip::OutputStream objects in test/xml/test_document_encoding.rb. It requires zip, skips on LoadError, writes one UTF-8 document through Zip::OutputStream and write_to, then reads the entry back. The comment ties the example to issue 2773, an exception during the write. It also says the encoding check on io.read was removed because rubyzip 2.4.1 and 3.0.0.dev disagreed. The bump only affects a development bundle.
Action pins moved and the workflows did not ¶
The 1 October commit updates four actions. SHAs and version comments change. Steps, permissions, matrices, and commands do not.
ruby/setup-ruby moves from v1.322.0 to v1.325.0 across nine steps in the CI workflow, plus the image build workflow and the upstream workflow. The CI steps include gumbo, osx, jruby, and the MinGW native gem install jobs. The windows compile job and the TruffleRuby job still use ruby/setup-ruby-pkgs at v1.33.5.
vmactions/freebsd-vm moves from v1.5.6 to v1.5.7 on the bsd job. In the image workflow, docker/setup-buildx-action moves from v4.3.0 to v4.4.1 and docker/build-push-action moves from v7.3.0 to v7.4.0. docker/login-action stays at v4.6.0.
The cache-poisoning zizmor ignores stay. The CI comment describes the bundler cache as test tooling that is branch isolated, so a fork pull request cannot poison it. The image job comment says the workflow runs on a schedule or manual dispatch, with no pull request trigger. The commit message does not describe the changes inside those action tags.
What to watch ¶
No release tag came with these commits. Track main, or wait for a release, only if you compile the C extension with MSVC. The MinGW Windows job would still pass if the GNU parameter list came back.
The v1.17.0 wording is a stale deadline. Main is 1.20.0.dev, and the old constructor calls still succeed. The warning string says v1.17.0. The XPath comment says v1.19.0.
A copied Gemfile now wants development rubyzip at ~> 3.7.0. Copied workflows should take the new action SHAs. Parse output and the JRuby code are untouched.