jekyll-compress-flow 0.2.1 → 0.2.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6e5a152c5ea63749b35bd7f707fadc383a54312e61bde7b9bd89b68f8d9d072e
-  data.tar.gz: d3261bba8a601a796cbc016e6b7399983d8098eb4839ff8407e5ce8782c5bbfd
+  metadata.gz: 7698a216c6b11cc78eb4dbf1fc8642b3b76e41dcb93a3f0f6e72ed939207a9ab
+  data.tar.gz: 50876d915cc373992f28fff651357c468bd9306e9651e7a280ec7e81a531825d
 SHA512:
-  metadata.gz: f8acbb85dd3422bb2ce6247ff85de0458b05b883069e45c6154e3d1f38b2dfa4519de216899754697cdeed086beeb0079516d1e226961175f803140ba4bcd5bd
-  data.tar.gz: a28861fff7a8b4bacf3ae6359934b6fbe24682679d24b1828e5d7aac4b9ad631925831ca7c64268b1b10d892d01de49689cefdabcc2d67820175b3257799aa2c
+  metadata.gz: 7f862ea2ee85d52f9b58e8abb5b79808cca7ec951c69fb1ab80fd3a81085292e3084e9ac7ddef365ebad1fdc75971905600adeab6f2a341d2425c3d5aacd9e1d
+  data.tar.gz: 7a750ebe879c078a28224ae84d3ec738f273b567c562f3a78face1625ce5b005b78d23b37119731a85c13f34a1f36536472d28f884b4af2a52ba13cfa89ad5a1

data/CHANGELOG.md

@@ -4,6 +4,31 @@ All notable changes to this project will be documented in this file.
 
 ## [Unreleased]
 
+## 0.2.2 — 2026-11-10
+
+### Added
+
+- `rake docs:demo` — captures the checked-in illustrative overview as
+  animated AVIF + WebP + static PNG (headless Chrome + ffmpeg + img2webp;
+  build-host tools), embedded in README via `<picture>`. Examples are
+  schematic, not generated from a live Jekyll build.
+
+### Changed
+
+- CI: Semgrep moved from an inline `pip3 install` pin to the pinned
+  `semgrep/semgrep` container image (tag + sha256 digest). Image bumped
+  to 1.182.1 (certificate trust fix for the eMudhra CA compromise).
+  CI Node bumped from 24 to 26 (Active LTS "Lithium" since 2026-10-28).
+- CI: `sonarqube-scan-action` bumped to v8.4.0; `markdownlint-cli2`
+  bumped to 0.24.0; `ruby/setup-ruby` v1.335.0 → v1.338.0; in-range
+  gem updates (rubocop 1.92.2, parser 3.3.13.0, addressable 2.9.2,
+  csv 3.3.7, sass-embedded 1.108.1, rspec-* 3.13.x patches);
+  `BUNDLED WITH` 4.0.23 → 4.0.24.
+- CI: Ruby 4.0 added to the test matrix (latest stable major;
+  `required_ruby_version >= 3.3.0` already permits it).
+- Gemspec `description` rewritten as an RDoc `==`-headed blurb so
+  rubygems.org renders it as markup instead of a single plain paragraph.
+
 ## 0.2.1 — 2026-10-06
 
 ### Added

data/README.md

@@ -25,6 +25,19 @@ simply happens at build time instead of request time.
 
 [Compare different formats](https://speedvitals.com/blog/zstd-vs-brotli-vs-gzip/)
 
+<!-- markdownlint-disable MD033 -->
+<picture>
+  <source
+    srcset="docs/assets/jekyll-compress-flow-demo.avif"
+    type="image/avif">
+  <source
+    srcset="docs/assets/jekyll-compress-flow-demo.webp"
+    type="image/webp">
+  <img src="docs/assets/jekyll-compress-flow-demo.png"
+       alt="jekyll-compress-flow demo">
+</picture>
+<!-- markdownlint-enable MD033 -->
+
 ## Prerequisites
 
 The plugin shells out to the platform compressor CLIs — install them on
@@ -32,7 +45,7 @@ the **build host** (not the web server; visitors need nothing):
 
 | Tool | Generates | Minimum | Tested baseline |
 | ---- | --------- | ------- | --------------- |
-| `brotli` | `.br` | 1.1.0 | 1.2.0 (macOS) |
+| `brotli` | `.br` | 1.1.0 | 1.2.1 (macOS) |
 | `zstd` | `.zst` | 1.5.5 | 1.5.7 (macOS) |
 | `gzip` | `.gz` | any | preinstalled on macOS/Linux; ships with Git for Windows |
 

data/interface.yml

@@ -2,7 +2,7 @@
 # Public tag/config surface for tooling (editor extensions, doc linters).
 ---
 gem: jekyll-compress-flow
-version: 0.2.1
+version: 0.2.2
 tags: {}
 filters: []
 config:

data/lib/jekyll/compress_flow/version.rb

@@ -2,6 +2,6 @@
 
 module Jekyll
   module CompressFlow
-    VERSION = "0.2.1"
+    VERSION = "0.2.2"
   end
 end

data/lib/jekyll/compress_flow.rb

@@ -99,6 +99,9 @@ module Jekyll
     end
 
     def compress(file, format, cfg)
+      # Array-form system(): no shell — tool/args are literals from the frozen
+      # FORMATS table; file is a data argument globbed under the build dest.
+      # nosemgrep: ruby.lang.security.dangerous-exec.dangerous-exec
       ok = system(format["tool"], *format["args"], file, out: File::NULL, err: File::NULL)
       fail_or_warn(cfg, "#{format['tool']} failed on #{file}") unless ok
     end
@@ -107,6 +110,8 @@ module Jekyll
     # banner could not be parsed (or no pattern is defined — e.g. Apple gzip
     # vs GNU gzip use incomparable version strings), nil when not installed.
     def tool_version(tool, pattern)
+      # Array-form capture2e: no shell — tool is a literal from frozen FORMATS.
+      # nosemgrep: ruby.lang.security.dangerous-exec.dangerous-exec
       out, status = Open3.capture2e(tool, "--version")
       return nil unless status.success?
       return :unversioned unless pattern && (match = out.match(pattern))

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: jekyll-compress-flow
 version: !ruby/object:Gem::Version
-  version: 0.2.1
+  version: 0.2.2
 platform: ruby
 authors:
 - Svend Gundestrup
@@ -29,10 +29,13 @@ dependencies:
     - - "<"
       - !ruby/object:Gem::Version
         version: '5.0'
-description: A Jekyll plugin that writes Brotli, Zstandard and gzip siblings next
-  to text assets at the end of a build, so a precompressed-capable static server (e.g.
-  Caddy's file_server precompressed) can serve them without per-request compression
-  CPU.
+description: |
+  == Precompressed siblings for Jekyll output
+
+  Writes .br, .zst and .gz siblings next to text assets at the end of a
+  build, so a precompressed-capable static server (for example Caddy's
+  file_server precompressed) can serve them without per-request
+  compression CPU.
 email:
 - svend@gundestrup.dk
 executables: []