jongyoul opened a new pull request, #60: URL: https://github.com/apache/zeppelin-site/pull/60
## Summary This PR **consolidates the 9 open Dependabot PRs into one change** and modernizes the build: - Upgrades the Docker build image to **Ruby 3.3.5** — required because `nokogiri 1.19.3` needs Ruby `>= 3.2` and `activesupport 7.2.3.1` (already pinned in the lockfile) needs `>= 3.1`, so the old `ruby:3.0.6` image can no longer build the site. - Pins **Bundler 4.0.13** in the Dockerfile to match `Gemfile.lock`'s `BUNDLED WITH`, for reproducible builds. - **Removes the vendored `Gemfile` / `Gemfile.lock` from every `docs/<version>/`.** These are build artifacts that were accidentally copied from the docs build sources (they are byte-identical to the root `Gemfile`) and are not used to serve the static site — but they are exactly what triggers the recurring Dependabot security PRs against `docs/`. Merging this PR closes all 9 Dependabot PRs automatically (see Closes below). ## Changes **Root site** (`Gemfile`, `Gemfile.lock`, `Dockerfile`) - Docker image `ruby:3.0.6` → `ruby:3.3.5` - Bundler pinned to `4.0.13` (matches `BUNDLED WITH`) - nokogiri `1.15.4` → `1.19.3` (#53) - faraday `2.14.1` → `2.14.2` (#57) - addressable `2.8.5` → `2.9.0` (#50) **docs/** — removed stray build-artifact Gemfiles - Deleted `Gemfile` + `Gemfile.lock` under every `docs/<version>/` (0.5.0-incubating … 0.12.0) - Supersedes the lockfile bumps in #54 (nokogiri), #51 (addressable), #33 (rexml) — the files those PRs target no longer exist - Published static HTML under `docs/` is left untouched **helium GitHub Action** (`package-lock.json`, `lockfileVersion: 2` preserved) - follow-redirects `1.15.6` → `1.16.0` (#52) - ajv `6.12.6` → `6.15.0` (#49) - underscore `1.13.7` → `1.13.8` (#47) ## Verification All builds run inside Docker: - `bundle install` (Bundler 4.0.13) + `jekyll build` succeed on Ruby 3.3.5 - `npm ci` succeeds for the helium action ## Closes Closes #57, #53, #50, #54, #51, #33, #52, #49, #47 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
