Renovate project: Ruby 3.3, React 18, security hardening

.dockerignore

@@ -0,0 +1,34 @@
+# Git
+.git
+.gitignore
+
+# Documentation
+README.md
+LICENSE
+
+# Development files
+.ruby-version
+.rspec
+Gemfile.lock
+
+# Test files
+spec/
+
+# IDE and editor files
+.idea/
+.vscode/
+*.swp
+*.swo
+*~
+
+# OS files
+.DS_Store
+Thumbs.db
+
+# Docker files
+Dockerfile
+docker-compose*.yml
+.dockerignore
+
+# Conductor
+conductor.json

.github/workflows/docker.yml

@@ -0,0 +1,59 @@
+name: Build and Push Docker Image
+
+on:
+  push:
+    branches:
+      - master
+    tags:
+      - 'v*'
+  pull_request:
+    branches:
+      - master
+
+env:
+  REGISTRY: ghcr.io
+  IMAGE_NAME: ${{ github.repository }}
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to Container Registry
+        if: github.event_name != 'pull_request'
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract metadata for Docker
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          tags: |
+            type=ref,event=branch
+            type=ref,event=pr
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=sha
+
+      - name: Build and push Docker image
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          push: ${{ github.event_name != 'pull_request' }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max

.ruby-version

@@ -1 +1 @@
-2.7.2
+3.3.6

Dockerfile

@@ -1,10 +1,16 @@
-FROM ruby:2.7.0
-RUN mkdir /app
+FROM ruby:3.3.6-slim
+
+RUN apt-get update && apt-get install -y \
+    build-essential \
+    && rm -rf /var/lib/apt/lists/*
+
 WORKDIR /app
-ADD Gemfile .
-ADD Gemfile.lock .
-RUN gem install bundler:1.17.2
-RUN bundle install --without test
-ADD . .
+
+COPY Gemfile Gemfile.lock ./
+RUN bundle config set --local without 'test development' \
+    && bundle install
+
+COPY . .
+
 EXPOSE 80
-CMD ["rackup", "-o", "0.0.0.0", "-p", "80"]
+CMD ["bundle", "exec", "rackup", "-o", "0.0.0.0", "-p", "80"]

Gemfile

@@ -1,22 +1,27 @@
-# A sample Gemfile
+# DL.Center - File sharing application
 source "https://rubygems.org"
 
-gem 'sinatra'
-gem 'sinatra-contrib'
-gem 'sinatra-websocket'
-gem 'uuid'
-gem 'ruby-prof'
-gem 'rubyzip'
-gem 'zip_tricks'
+ruby '>= 3.3.0'
 
+# Sinatra 3.x is the last version compatible with Rack 2.x (required by thin/sinatra-websocket)
+gem 'sinatra', '~> 3.2'
+gem 'sinatra-contrib', '~> 3.2'
+gem 'sinatra-websocket', '~> 0.3.1'
+gem 'uuid', '~> 2.3'
+gem 'rubyzip', '~> 2.4'
+gem 'zip_tricks', '~> 5.6'
+gem 'thin', '~> 1.8'
+gem 'rackup', '~> 1.0'
 
-group :test do
-  gem 'rspec'
-  gem 'rack-test'
-  gem 'simplecov', :require => false
-  gem 'rubocop'
-  gem 'ffaker'
-  gem 'mocha'
+group :development do
+  gem 'ruby-prof', '~> 1.7'
 end
 
-# gem "rails"
+group :test do
+  gem 'rspec', '~> 3.13'
+  gem 'rack-test', '~> 2.2'
+  gem 'simplecov', '~> 0.22', require: false
+  gem 'rubocop', '~> 1.69'
+  gem 'ffaker', '~> 2.23'
+  gem 'mocha', '~> 2.7'
+end

Gemfile.lock

@@ -1,112 +1,136 @@
 GEM
   remote: https://rubygems.org/
   specs:
-    addressable (2.7.0)
-      public_suffix (>= 2.0.2, < 5.0)
-    ast (2.4.2)
-    daemons (1.4.0)
-    diff-lcs (1.4.4)
-    docile (1.4.0)
+    addressable (2.8.8)
+      public_suffix (>= 2.0.2, < 8.0)
+    ast (2.4.3)
+    base64 (0.3.0)
+    daemons (1.4.1)
+    diff-lcs (1.6.2)
+    docile (1.4.1)
     em-websocket (0.3.8)
       addressable (>= 2.1.1)
       eventmachine (>= 0.12.9)
     eventmachine (1.2.7)
-    ffaker (2.18.0)
+    ffaker (2.25.0)
+    json (2.17.1)
+    language_server-protocol (3.17.0.5)
+    lint_roller (1.1.0)
     macaddr (1.7.2)
       systemu (~> 2.6.5)
-    mocha (1.12.0)
-    multi_json (1.15.0)
-    mustermann (1.1.1)
+    mocha (2.8.2)
+      ruby2_keywords (>= 0.0.5)
+    multi_json (1.18.0)
+    mustermann (3.0.4)
       ruby2_keywords (~> 0.0.1)
-    parallel (1.20.1)
-    parser (3.0.1.1)
+    parallel (1.27.0)
+    parser (3.3.10.0)
       ast (~> 2.4.1)
-    public_suffix (4.0.6)
-    rack (2.2.3)
-    rack-protection (2.1.0)
-      rack
-    rack-test (1.1.0)
-      rack (>= 1.0, < 3)
-    rainbow (3.0.0)
-    regexp_parser (2.1.1)
-    rexml (3.2.5)
-    rspec (3.10.0)
-      rspec-core (~> 3.10.0)
-      rspec-expectations (~> 3.10.0)
-      rspec-mocks (~> 3.10.0)
-    rspec-core (3.10.1)
-      rspec-support (~> 3.10.0)
-    rspec-expectations (3.10.1)
+      racc
+    prism (1.6.0)
+    public_suffix (7.0.0)
+    racc (1.8.1)
+    rack (2.2.21)
+    rack-protection (3.2.0)
+      base64 (>= 0.1.0)
+      rack (~> 2.2, >= 2.2.4)
+    rack-test (2.2.0)
+      rack (>= 1.3)
+    rackup (1.0.1)
+      rack (< 3)
+      webrick
+    rainbow (3.1.1)
+    regexp_parser (2.11.3)
+    rspec (3.13.2)
+      rspec-core (~> 3.13.0)
+      rspec-expectations (~> 3.13.0)
+      rspec-mocks (~> 3.13.0)
+    rspec-core (3.13.6)
+      rspec-support (~> 3.13.0)
+    rspec-expectations (3.13.5)
       diff-lcs (>= 1.2.0, < 2.0)
-      rspec-support (~> 3.10.0)
-    rspec-mocks (3.10.2)
+      rspec-support (~> 3.13.0)
+    rspec-mocks (3.13.7)
       diff-lcs (>= 1.2.0, < 2.0)
-      rspec-support (~> 3.10.0)
-    rspec-support (3.10.2)
-    rubocop (1.14.0)
+      rspec-support (~> 3.13.0)
+    rspec-support (3.13.6)
+    rubocop (1.81.7)
+      json (~> 2.3)
+      language_server-protocol (~> 3.17.0.2)
+      lint_roller (~> 1.1.0)
       parallel (~> 1.10)
-      parser (>= 3.0.0.0)
+      parser (>= 3.3.0.2)
       rainbow (>= 2.2.2, < 4.0)
-      regexp_parser (>= 1.8, < 3.0)
-      rexml
-      rubocop-ast (>= 1.5.0, < 2.0)
+      regexp_parser (>= 2.9.3, < 3.0)
+      rubocop-ast (>= 1.47.1, < 2.0)
       ruby-progressbar (~> 1.7)
-      unicode-display_width (>= 1.4.0, < 3.0)
-    rubocop-ast (1.5.0)
-      parser (>= 3.0.1.1)
-    ruby-prof (1.4.3)
-    ruby-progressbar (1.11.0)
-    ruby2_keywords (0.0.4)
-    rubyzip (2.3.0)
-    simplecov (0.21.2)
+      unicode-display_width (>= 2.4.0, < 4.0)
+    rubocop-ast (1.48.0)
+      parser (>= 3.3.7.2)
+      prism (~> 1.4)
+    ruby-prof (1.7.2)
+      base64
+    ruby-progressbar (1.13.0)
+    ruby2_keywords (0.0.5)
+    rubyzip (2.4.1)
+    simplecov (0.22.0)
       docile (~> 1.1)
       simplecov-html (~> 0.11)
       simplecov_json_formatter (~> 0.1)
-    simplecov-html (0.12.3)
-    simplecov_json_formatter (0.1.3)
-    sinatra (2.1.0)
-      mustermann (~> 1.0)
-      rack (~> 2.2)
-      rack-protection (= 2.1.0)
+    simplecov-html (0.13.2)
+    simplecov_json_formatter (0.1.4)
+    sinatra (3.2.0)
+      mustermann (~> 3.0)
+      rack (~> 2.2, >= 2.2.4)
+      rack-protection (= 3.2.0)
       tilt (~> 2.0)
-    sinatra-contrib (2.1.0)
-      multi_json
-      mustermann (~> 1.0)
-      rack-protection (= 2.1.0)
-      sinatra (= 2.1.0)
+    sinatra-contrib (3.2.0)
+      multi_json (>= 0.0.2)
+      mustermann (~> 3.0)
+      rack-protection (= 3.2.0)
+      sinatra (= 3.2.0)
       tilt (~> 2.0)
     sinatra-websocket (0.3.1)
       em-websocket (~> 0.3.6)
       eventmachine
       thin (>= 1.3.1, < 2.0.0)
     systemu (2.6.5)
-    thin (1.8.0)
+    thin (1.8.2)
       daemons (~> 1.0, >= 1.0.9)
       eventmachine (~> 1.0, >= 1.0.4)
       rack (>= 1, < 3)
-    tilt (2.0.10)
-    unicode-display_width (2.0.0)
+    tilt (2.6.1)
+    unicode-display_width (3.2.0)
+      unicode-emoji (~> 4.1)
+    unicode-emoji (4.1.0)
     uuid (2.3.9)
       macaddr (~> 1.0)
-    zip_tricks (5.5.0)
+    webrick (1.9.2)
+    zip_tricks (5.6.0)
 
 PLATFORMS
+  arm64-darwin-23
   ruby
 
 DEPENDENCIES
-  ffaker
-  mocha
-  rack-test
-  rspec
-  rubocop
-  ruby-prof
-  rubyzip
-  simplecov
-  sinatra
-  sinatra-contrib
-  sinatra-websocket
-  uuid
-  zip_tricks
+  ffaker (~> 2.23)
+  mocha (~> 2.7)
+  rack-test (~> 2.2)
+  rackup (~> 1.0)
+  rspec (~> 3.13)
+  rubocop (~> 1.69)
+  ruby-prof (~> 1.7)
+  rubyzip (~> 2.4)
+  simplecov (~> 0.22)
+  sinatra (~> 3.2)
+  sinatra-contrib (~> 3.2)
+  sinatra-websocket (~> 0.3.1)
+  thin (~> 1.8)
+  uuid (~> 2.3)
+  zip_tricks (~> 5.6)
+
+RUBY VERSION
+   ruby 3.3.6p108
 
 BUNDLED WITH
-   2.1.4
+   2.5.22