@jamcut, I think rexml is the preferred option to use from modules, specially when using to parse untrusted input, since nokogiri makes use of libxml which has suffered XXE injection issues in the past.