doc: update CHANGELOG with v1.19.3 notes

Author: flavorjones

CHANGELOG.md

@@ -32,6 +32,14 @@ Nokogiri follows [Semantic Versioning](https://semver.org/), please see the [REA
 * [JRuby] `Document#create_element` and `Node.new` no longer set the namespace to the document's default namespace. The namespace must be set explicitly with `namespace=` or by parenting the node. (#3457, #3463) @flavorjones
 
 
+## v1.19.3 / 2026-04-27
+
+### Fixed / Security
+
+* Address exponential regex backtracking in CSS selector tokenizer. See [GHSA-c4rq-3m3g-8wgx](https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-c4rq-3m3g-8wgx) for more information.
+* [CRuby] Address memory leak in `XSLT::Stylesheet#transform`. See [GHSA-v2fc-qm4h-8hqv](https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-v2fc-qm4h-8hqv) for more information.
+
+
 ## v1.19.2 / 2026-03-19
 
 ### Dependencies