chore(renovate): support transitive deps

[janishorsts]

Enables Renovate to update transitive dependencies in lockfiles (fixing Ruby on Rails security alerts).

Changes

• Enabled lockFileMaintenance globally in renovate.json5.
• Added .ruby-version (4.0.5) to examples/ruby-on-rails/ so Renovate can run lockfile commands.
• Upgraded examples/ruby-on-rails/Gemfile.lock to bump vulnerable dependencies and align Bundler to 4.0.15.

[github-actions]

➖ Are we earthbuild yet?

No change in "earthly" occurrences

📈 Overall Progress

Branch	Total Count
main	5408
This PR	5408
Difference	+0

---

Keep up the great work migrating from Earthly to Earthbuild! 🚀

💡 Tips for finding more occurrences

Run locally to see detailed breakdown:

./.github/scripts/count-earthly.sh

Note that the goal is not to reach 0.
There is anticipated to be at least some occurences of earthly in the source code due to backwards compatibility with config files and language constructs.

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: gem erb is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: examples/ruby-on-rails/Gemfile.lock → gem/debug@1.11.1 → gem/importmap-rails@2.2.3 → gem/rails@8.1.3 → gem/dartsass-rails@0.5.1 → gem/erb@6.0.4 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore gem/erb@6.0.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[gemini-code-assist]

Code Review

This pull request enables lockfile maintenance in the Renovate configuration and updates Ruby version and Gemfile dependencies for the Ruby on Rails example. The reviewer noted that enabling lockfile maintenance without a custom schedule defaults to a weekly run, which conflicts with the repository's monthly update strategy. It is recommended to configure the lockfile maintenance schedule to run monthly to align with the rest of the repository.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.