Modernize build toolchain: Ruby 2.5.8 → 3.3.10, clear Dependabot alerts - #4896
Merged
Cobra-Bitcoin merged 9 commits intoAug 8, 2026
Merged
Conversation
Regenerate Gemfile.lock on Ruby 3.3.12: html-proofer 2.1.0 -> ~> 5.0 (pulls fully patched nokogiri 1.19.4), rexml/concurrent-ruby/addressable/ RedCloth all resolve to secure versions, clearing the open Dependabot alerts. Replace therubyracer/libv8 (2014, does not build on modern toolchains) with mini_racer, which check-jshint needs as its ExecJS runtime; drop less, which nothing in the build invokes. Lock includes x86_64-linux and arm64-darwin platforms. Travis: bump rvm to 3.3.12 and drop the RubyGems/bundler pins from the 2.5.8 era, which would break on Ruby 3.3.
Psych 4 (Ruby 3.1+) rejects YAML aliases by default: switch 8 YAML.load_file calls to YAML.unsafe_load_file (build-time loading of the repo's own files). File.exists? was removed in Ruby 3.2: use File.exist? (5 occurrences). Kernel#open with a URL was removed in Ruby 3.0: use URI.open (2 calls); without this the contributors plugin fails silently behind a bare rescue and caches an empty list.
The 2.x require path and constructor are gone. Keep the same checking scope as before: internal links only, no https enforcement, no internal hash checking. Passes on the current site (5,234 internal links across 3,823 files).
devdavidejesus
marked this pull request as draft
July 23, 2026 18:59
Travis images ship ruby-3.3.10 prebuilt; no rvm binary rubies exist for 3.3.12 on either focal or jammy, so CI cannot install it. 3.3.10 resolves the identical dependency set (same gem versions, same cleared alerts). Full make build test re-verified green in a ruby:3.3.10 Linux container. Also reverts the jammy dist experiment; focal provably ships 3.3.10.
devdavidejesus
changed the title
Travis's default install command still passes --deployment and --path, flags removed in Bundler 4. Use the bundle config equivalents the error message itself recommends, keeping the same semantics (frozen lockfile, vendor/bundle path so the bundler cache keeps working).
mini_racer 0.21.x compiles with -std=c++20, which gcc 9 (focal default) does not accept; jammy ships gcc 11. Everything else already passed on focal: rvm found ruby 3.3.10 instantly and all 66 other gems installed from x86_64-linux prebuilt binaries.
Cobra-Bitcoin
marked this pull request as ready for review
August 7, 2026 15:33
Contributor
|
Thank you! This is great work and long overdue. Everything looks good. I think with a change like this the most important thing is knowing there isn't something silently breaking somewhere, and I don't think there is. I will merge this myself once the build server is prepared and the conflict has been resolved (good that we no longer need the events plugin). Will report back if it's a success. |
# Conflicts: # _plugins/events.rb
Collaborator
Author
|
Thanks, @Cobra-Bitcoin ! |
devdavidejesus
added
Build
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The 40 open Dependabot alerts all live in the Gemfile.lock, which has been frozen on the Ruby 2.5.8 (EOL) toolchain; the bulk of them (the nokogiri chain, pinned by html-proofer 2.1.0) can't reach secure versions without a newer Ruby. These are build/test dependencies on a static Jekyll site, nothing is served to visitors, so real-world risk is low, but the alerts are valid.
What
.ruby-version,.travis.yml. Travis also drops the 2.5.8-era RubyGems/bundler pins, which would break on Ruby 3.3. (3.3.10 is the patch Travis images ship prebuilt — no rvm binaries exist for 3.3.12; the pin can move to any 3.3.x the server gets.)check-jshint(verified:ExecJS.runtime.name→ "mini_racer (V8)" on Linux).lessremoved, nothing in the build invokes it (no plugin, no Makefile target; CSS comes from the SCSS pipeline,ie8.lessis copied as-is).YAML.unsafe_load_file);File.exists?removed in 3.2 (5×File.exist?);Kernel#openwith URLs removed in 3.0 (2×URI.open, the old call failed silently behind a bare rescue, caching an empty contributors list)._contrib/bco-htmlproofported to the html-proofer 5.x API, keeping the exact 2.x checking scope (internal links only, no https enforcement, no hash checking).sass: silence_deprecations: ["import"], Dart Sass deprecation warnings were trippingcheck-for-build-errors; migrating the SCSS to@useremains a future cleanup (sass-migrator automates it).x86_64-linuxandarm64-darwinplatforms;docs/setting-up-your-environment.mdupdated to 3.3.10.Proof
Full
make build testpasses end to end in a Linux container (ruby:3.3Docker image, same GNU toolchain as the build server): 3,823 pages built, every check green, link checker included (5,234 internal links, zero failures). The full build also passed on macOS arm64 during the sandbox PoC; the test suite on macOS only trips on pre-existing BSD-vs-GNU tool assumptions in the Makefile, unrelated to this change.Notes for review
http://on every page; two dead anchors in old posts (#sponsorship/#githubon about-us);_alertsdestination-conflict warnings in the build log; the Makefile assumes GNU tools.