BerkeleyLibrary · awilfox · Aug 18, 2026 · Aug 17, 2026
diff --git a/.gitignore b/.gitignore
@@ -13,16 +13,6 @@
 # Build/test artifacts
 /artifacts/
 
-# Yarn v3 -- see https://yarnpkg.com/getting-started/qa#which-files-should-be-gitignored
-
-.pnp.*
-.yarn/*
-!.yarn/patches
-!.yarn/plugins
-!.yarn/releases
-!.yarn/sdks
-!.yarn/versions
-
 ############################################################
 # Generated ignores
 
@@ -399,3 +389,6 @@ Temporary Items
 .apdisk
 .irb_history
 .local
+
+/app/assets/builds/*
+!/app/assets/builds/.keep
diff --git a/.ruby-version b/.ruby-version
@@ -1 +1 @@
-3.4.9
+~> 3.4
diff --git a/CHANGES.md b/CHANGES.md
@@ -1,3 +1,8 @@
+# 1.2.2 (unreleased)
+* AP-808: Migrate from Sprockets to Propshaft
+  We don't need a JS runtime at all, so this involved a lot of cleanup.
+* Update JSON gem for security patch
+
 # 1.2.1 (2026-07-29)
 * AP-803: Update to Rails 8.1.3.1 for security patches
 

diff --git a/Dockerfile b/Dockerfile
@@ -4,7 +4,7 @@
 # The base stage scaffolds elements which are common to building and running
 # the application, such as installing ca-certificates, creating the app user,
 # and installing runtime system dependencies.
-FROM ruby:3.4.9-slim AS base
+FROM ruby:3.4-slim AS base
 
 # ------------------------------------------------------------
 # Declarative metadata
@@ -39,27 +39,6 @@ RUN apt-get install -y --no-install-recommends \
     gpg \
     libyaml-dev
 
-# Install Node.js and Yarn from their own repositories
-
-# Add Node.js package repository (version 16 LTS release) & install Node.js
-# -- note that the Node.js setup script takes care of updating the package list
-RUN curl -fsSL https://deb.nodesource.com/setup_16.x | bash - \
-    && apt-get install -y --no-install-recommends nodejs
-
-# Add Yarn package repository, update package list, & install Yarn
-RUN curl -sL https://dl.yarnpkg.com/debian/pubkey.gpg | gpg --dearmor | tee /usr/share/keyrings/yarnkey.gpg >/dev/null \
-    && echo "deb [signed-by=/usr/share/keyrings/yarnkey.gpg] https://dl.yarnpkg.com/debian stable main" | tee /etc/apt/sources.list.d/yarn.list \
-    && apt-get update -qq \
-    && apt-get install -y --no-install-recommends yarn
-
-# Remove packages we only needed as part of the Node.js / Yarn repository
-# setup and installation -- note that the Node.js setup scripts installs
-# a full version of Python, but at runtime we only need a minimal version
-RUN apt-mark manual python3-minimal \
-    && apt-get autoremove --purge -y \
-      curl \
-      python3
-
 # ------------------------------------------------------------
 # Run configuration
 
@@ -112,13 +91,6 @@ COPY --chown=$APP_USER:$APP_USER Gemfile* .ruby-version ./
 RUN bundle config set --local path /usr/local/bundle
 RUN bundle install
 
-# ------------------------------------------------------------
-# Install JS packages
-
-# Install JS packages
-COPY --chown=$APP_USER:$APP_USER package.json yarn.lock ./
-RUN yarn install
-
 # ------------------------------------------------------------
 # Copy codebase
 
@@ -129,6 +101,7 @@ COPY --chown=$APP_USER:$APP_USER . .
 
 # ------------------------------------------------------------
 # Development configuration
+RUN bundle exec rails dartsass:build
 
 # Show the home page
 ENV LIT_SHOW_HOMEPAGE=1
@@ -160,16 +133,11 @@ COPY --from=development --chown=$APP_USER /usr/local/bundle /usr/local/bundle
 RUN bundle config set frozen 'true'
 RUN bundle install --local
 
-# Ensure JS modules are installed and yarn.lock is synced
-RUN yarn install --immutable
-
 # ------------------------------------------------------------
 # Precompile production assets
 
 # Pre-compile assets so we don't have to do it after deployment.
-# NOTE: dummy SECRET_KEY_BASE to prevent spurious initializer issues
-#       -- see https://github.com/rails/rails/issues/32947
-RUN SECRET_KEY_BASE=1 rails assets:precompile --trace
+RUN SECRET_KEY_BASE_DUMMY=1 rails assets:precompile --trace
 
 # ------------------------------------------------------------
 # Preserve build arguments

diff --git a/Gemfile b/Gemfile
@@ -10,20 +10,19 @@ gem 'berkeley_library-docker', '~> 0.2.0'
 gem 'berkeley_library-logging', '~> 0.2'
 gem 'berkeley_library-util', '~> 0.3'
 gem 'browser', '~> 4.2'
+gem 'dartsass-rails'
 gem 'jbuilder', '~> 2.13'
 gem 'mutex_m'
 gem 'non-stupid-digest-assets', '~> 1.0' # Allow static pages (e.g. 404.html) to link to compiled assets
 gem 'okcomputer', '~> 1.19'
 gem 'omniauth-cas', '~> 3.0'
 gem 'omniauth-rails_csrf_protection', '~> 1.0'
+gem 'propshaft'
 gem 'puma', '>= 6.0', '< 8'
 gem 'puma-plugin-delayed_stop', '~> 0.1.2'
 gem 'rack', '~> 3.2.6'
 gem 'rails', '~> 8.1.3', '>= 8.1.3.1'
 gem 'rest-client', '~> 2.1'
-gem 'sassc-rails', '~> 2.1'
-gem 'sprockets', '~> 4.0'
-gem 'sprockets-rails', '~> 3.4', require: 'sprockets/railtie'
 gem 'typesafe_enum', '~> 0.2'
 
 group :development, :test do

diff --git a/Gemfile.lock b/Gemfile.lock
@@ -131,6 +131,9 @@ GEM
       bigdecimal
       rexml
     crass (1.0.7)
+    dartsass-rails (0.5.1)
+      railties (>= 6.0.0)
+      sass-embedded (~> 1.63)
     date (3.5.1)
     diff-lcs (1.6.2)
     docile (1.4.1)
@@ -152,6 +155,27 @@ GEM
     ffi (1.17.4-x86_64-linux-musl)
     globalid (1.4.0)
       activesupport (>= 6.1)
+    google-protobuf (4.35.1)
+      bigdecimal
+      rake (~> 13.3)
+    google-protobuf (4.35.1-aarch64-linux-gnu)
+      bigdecimal
+      rake (~> 13.3)
+    google-protobuf (4.35.1-aarch64-linux-musl)
+      bigdecimal
+      rake (~> 13.3)
+    google-protobuf (4.35.1-arm64-darwin)
+      bigdecimal
+      rake (~> 13.3)
+    google-protobuf (4.35.1-x86_64-darwin)
+      bigdecimal
+      rake (~> 13.3)
+    google-protobuf (4.35.1-x86_64-linux-gnu)
+      bigdecimal
+      rake (~> 13.3)
+    google-protobuf (4.35.1-x86_64-linux-musl)
+      bigdecimal
+      rake (~> 13.3)
     hashdiff (1.2.1)
     hashie (5.1.0)
       logger
@@ -169,7 +193,7 @@ GEM
     jbuilder (2.15.1)
       actionview (>= 7.0.0)
       activesupport (>= 7.0.0)
-    json (2.21.1)
+    json (2.21.2)
     language_server-protocol (3.17.0.5)
     lint_roller (1.1.0)
     listen (3.10.0)
@@ -264,6 +288,10 @@ GEM
       prettyprint
     prettyprint (0.2.0)
     prism (1.9.0)
+    propshaft (1.3.2)
+      actionpack (>= 7.0.0)
+      activesupport (>= 7.0.0)
+      rack
     public_suffix (7.0.5)
     puma (7.2.1)
       nio4r (~> 2.0)
@@ -396,14 +424,22 @@ GEM
       base64
       ostruct
     ruby-progressbar (1.13.0)
-    sassc (2.4.0)
-      ffi (~> 1.9)
-    sassc-rails (2.1.2)
-      railties (>= 4.0.0)
-      sassc (>= 2.0)
-      sprockets (> 3.0)
-      sprockets-rails
-      tilt
+    sass-embedded (1.102.0-aarch64-linux-gnu)
+      google-protobuf (~> 4.31)
+    sass-embedded (1.102.0-aarch64-linux-musl)
+      google-protobuf (~> 4.31)
+    sass-embedded (1.102.0-arm-linux-gnueabihf)
+      google-protobuf (~> 4.31)
+    sass-embedded (1.102.0-arm-linux-musleabihf)
+      google-protobuf (~> 4.31)
+    sass-embedded (1.102.0-arm64-darwin)
+      google-protobuf (~> 4.31)
+    sass-embedded (1.102.0-x86_64-darwin)
+      google-protobuf (~> 4.31)
+    sass-embedded (1.102.0-x86_64-linux-gnu)
+      google-protobuf (~> 4.31)
+    sass-embedded (1.102.0-x86_64-linux-musl)
+      google-protobuf (~> 4.31)
     securerandom (0.4.1)
     simplecov (0.22.0)
       docile (~> 1.1)
@@ -417,12 +453,7 @@ GEM
       concurrent-ruby (~> 1.0)
       logger
       rack (>= 2.2.4, < 4)
-    sprockets-rails (3.5.2)
-      actionpack (>= 6.1)
-      activesupport (>= 6.1)
-      sprockets (>= 3.0.0)
     thor (1.5.0)
-    tilt (2.7.0)
     timeout (0.6.1)
     tsort (0.2.0)
     typesafe_enum (0.3.1)
@@ -470,6 +501,7 @@ DEPENDENCIES
   byebug
   capybara
   colorize
+  dartsass-rails
   dotenv-rails
   jbuilder (~> 2.13)
   listen (>= 3.0)
@@ -478,6 +510,7 @@ DEPENDENCIES
   okcomputer (~> 1.19)
   omniauth-cas (~> 3.0)
   omniauth-rails_csrf_protection (~> 1.0)
+  propshaft
   puma (>= 6.0, < 8)
   puma-plugin-delayed_stop (~> 0.1.2)
   rack (~> 3.2.6)
@@ -491,11 +524,8 @@ DEPENDENCIES
   rubocop-rspec (~> 3.10.2)
   rubocop-rspec_rails
   ruby-prof (~> 2.0)
-  sassc-rails (~> 2.1)
   simplecov (~> 0.21)
   simplecov-rcov (~> 0.2)
-  sprockets (~> 4.0)
-  sprockets-rails (~> 3.4)
   typesafe_enum (~> 0.2)
   web-console (>= 4.1.0)
   webmock
@@ -537,6 +567,7 @@ CHECKSUMS
   connection_pool (3.0.2) sha256=33fff5ba71a12d2aa26cb72b1db8bba2a1a01823559fb01d29eb74c286e62e0a
   crack (1.0.1) sha256=ff4a10390cd31d66440b7524eb1841874db86201d5b70032028553130b6d4c7e
   crass (1.0.7) sha256=94868719948664c89ddcaf0a37c65048413dfcb1c869470a5f7a7ceb5390b295
+  dartsass-rails (0.5.1) sha256=f19510fb1b29c76c1739a06954d615f1d20ad653b6fc668dd7c68542bb303a1a
   date (3.5.1) sha256=750d06384d7b9c15d562c76291407d89e368dda4d4fff957eb94962d325a0dc0
   diff-lcs (1.6.2) sha256=9ae0d2cba7d4df3075fe8cd8602a8604993efc0dfa934cff568969efb1909962
   docile (1.4.1) sha256=96159be799bfa73cdb721b840e9802126e4e03dfc26863db73647204c727f21e
@@ -555,6 +586,13 @@ CHECKSUMS
   ffi (1.17.4-x86_64-linux-gnu) sha256=9d3db14c2eae074b382fa9c083fe95aec6e0a1451da249eab096c34002bc752d
   ffi (1.17.4-x86_64-linux-musl) sha256=3fdf9888483de005f8ef8d1cf2d3b20d86626af206cbf780f6a6a12439a9c49e
   globalid (1.4.0) sha256=037f12fbf1d9d7a014d501c2d5c77356fd4ddd96d7a7991d6700bba96706f427
+  google-protobuf (4.35.1) sha256=a3a6471331d918f58dfa4d014a8f6286f0af2cf4840216bde52fcf2ea3fe3726
+  google-protobuf (4.35.1-aarch64-linux-gnu) sha256=50ca44d0eeff3f8475e630a1accdd974256f3510694d574e2c9d6119ea8bc9e1
+  google-protobuf (4.35.1-aarch64-linux-musl) sha256=d5c65cef6bd6498a9e5ed5f88cf6cf7e341c10b0a005e32137d5d1a2b6e8c18a
+  google-protobuf (4.35.1-arm64-darwin) sha256=d9c957df04fa89c749fa9a72a7b383eb4296efc9b2303dc6fd6fbe39c698ad6b
+  google-protobuf (4.35.1-x86_64-darwin) sha256=66b62b4df00931018a692806df66393efa960d6d2b7da69735187249f950d3ee
+  google-protobuf (4.35.1-x86_64-linux-gnu) sha256=c786439087512a3fbd199e9897d265b855f951d4027e218ea55e858d45969edd
+  google-protobuf (4.35.1-x86_64-linux-musl) sha256=91890eb0002934a339fdb7d77a147c46b7474b6799db27872b747b905837f744
   hashdiff (1.2.1) sha256=9c079dbc513dfc8833ab59c0c2d8f230fa28499cc5efb4b8dd276cf931457cd1
   hashie (5.1.0) sha256=c266471896f323c446ea8207f8ffac985d2718df0a0ba98651a3057096ca3870
   http-accept (1.7.0) sha256=c626860682bfbb3b46462f8c39cd470fd7b0584f61b3cc9df5b2e9eb9972a126
@@ -563,7 +601,7 @@ CHECKSUMS
   io-console (0.8.2) sha256=d6e3ae7a7cc7574f4b8893b4fca2162e57a825b223a177b7afa236c5ef9814cc
   irb (1.18.0) sha256=de9454a0703a54704b9811a5ef31a60c86949fbf4013fcf244fabc7c775248e3
   jbuilder (2.15.1) sha256=2430bec28fb0cebacb5875b1009cf9d8bc3c303ccb810c4c8b062a4b51457637
-  json (2.21.1) sha256=13a43df75d95641443f5702dff350f237164a9d811ff0f2c2800d4d980220583
+  json (2.21.2) sha256=1f1d3b7cf2b3ba1a69beca0bb6db13d5438b80bff3cd54cdaaa620b9b07c1c6a
   language_server-protocol (3.17.0.5) sha256=fd1e39a51a28bf3eec959379985a72e296e9f9acfce46f6a79d31ca8760803cc
   lint_roller (1.1.0) sha256=2c0c845b632a7d172cb849cc90c1bce937a28c5c8ccccb50dfd46a485003cc87
   listen (3.10.0) sha256=c6e182db62143aeccc2e1960033bebe7445309c7272061979bb098d03760c9d2
@@ -607,6 +645,7 @@ CHECKSUMS
   pp (0.6.4) sha256=dfcb0fce700c41456265922884f9fe195d7fbb0674a3578e6c0f69588e82b570
   prettyprint (0.2.0) sha256=2bc9e15581a94742064a3cc8b0fb9d45aae3d03a1baa6ef80922627a0766f193
   prism (1.9.0) sha256=7b530c6a9f92c24300014919c9dcbc055bf4cdf51ec30aed099b06cd6674ef85
+  propshaft (1.3.2) sha256=1d56a3e56a92c21bfc29caf07406b5386b00d4c47ddf357cf989a5a234b1389e
   public_suffix (7.0.5) sha256=1a8bb08f1bbea19228d3bed6e5ed908d1cb4f7c2726d18bd9cadf60bc676f623
   puma (7.2.1) sha256=d7bf0e9cabd532e0d401e142cd94e3ac531e993610e2d80e6fbf9c26961414b0
   puma-plugin-delayed_stop (0.1.2) sha256=cb30cd2ba10a59e330f38e9ece2a298fecce79b46a9f90c57da9f7d3e5731171
@@ -646,17 +685,21 @@ CHECKSUMS
   ruby-marc-spec (0.1.3) sha256=4207c760d87c667dfaad6bfb44b0e473da4efe22bb3c18046571bd6703afc0da
   ruby-prof (2.0.5) sha256=dbc3b5112089538ac33303145db0cbd77cbdcdbc05b09e44a967ff72a36d6c0e
   ruby-progressbar (1.13.0) sha256=80fc9c47a9b640d6834e0dc7b3c94c9df37f08cb072b7761e4a71e22cff29b33
-  sassc (2.4.0) sha256=4c60a2b0a3b36685c83b80d5789401c2f678c1652e3288315a1551d811d9f83e
-  sassc-rails (2.1.2) sha256=5f4fdf3881fc9bdc8e856ffbd9850d70a2878866feae8114aa45996179952db5
+  sass-embedded (1.102.0-aarch64-linux-gnu) sha256=087f377fa4135a8f67f5f422781b59815e99b8fd3aec335935c50a47c2a205fd
+  sass-embedded (1.102.0-aarch64-linux-musl) sha256=12bb4091972499241c35304ca11ca2c314764badf1b9933a8d437ba62432b538
+  sass-embedded (1.102.0-arm-linux-gnueabihf) sha256=566b1188e4f923366f494a5d95e4e5e03864ae55bae5ea52beb2c30b1b9e2915
+  sass-embedded (1.102.0-arm-linux-musleabihf) sha256=1ca396610bf4f4aa8f849b67a9f2720f67d9f3b42651072eafee786aece314cf
+  sass-embedded (1.102.0-arm64-darwin) sha256=8e18b2dd94b232c2dd73984c579f77bbc1a066028f4675c8989ac34fa40d14dc
+  sass-embedded (1.102.0-x86_64-darwin) sha256=3e78c6ac5be0ba4236d075bd044a49d0f515d54799f7d6f253c71d325ffedac0
+  sass-embedded (1.102.0-x86_64-linux-gnu) sha256=9815b7604123a9a44a65d44d5e58e7af1c7005174b745cda83bad4c9e3760ab3
+  sass-embedded (1.102.0-x86_64-linux-musl) sha256=9e3c15eb5d83784adf3b946d4fc5d8a32aed25566a2fee939f25dd1e1d217ddf
   securerandom (0.4.1) sha256=cc5193d414a4341b6e225f0cb4446aceca8e50d5e1888743fac16987638ea0b1
   simplecov (0.22.0) sha256=fe2622c7834ff23b98066bb0a854284b2729a569ac659f82621fc22ef36213a5
   simplecov-html (0.13.2) sha256=bd0b8e54e7c2d7685927e8d6286466359b6f16b18cb0df47b508e8d73c777246
   simplecov-rcov (0.3.7) sha256=372f50bf6df6b6350b7d0c840f2f8bdabe021861a43c26877b747c9ac96139fc
   simplecov_json_formatter (0.1.4) sha256=529418fbe8de1713ac2b2d612aa3daa56d316975d307244399fa4838c601b428
   sprockets (4.2.2) sha256=761e5a49f1c288704763f73139763564c845a8f856d52fba013458f8af1b59b1
-  sprockets-rails (3.5.2) sha256=a9e88e6ce9f8c912d349aa5401509165ec42326baf9e942a85de4b76dbc4119e
   thor (1.5.0) sha256=e3a9e55fe857e44859ce104a84675ab6e8cd59c650a49106a05f55f136425e73
-  tilt (2.7.0) sha256=0d5b9ba69f6a36490c64b0eee9f6e9aad517e20dcc848800a06eb116f08c6ab3
   timeout (0.6.1) sha256=78f57368a7e7bbadec56971f78a3f5ecbcfb59b7fcbb0a3ed6ddc08a5094accb
   tsort (0.2.0) sha256=9650a793f6859a43b6641671278f79cfead60ac714148aabe4e3f0060480089f
   typesafe_enum (0.3.1) sha256=15b58de378999858c74aaa1d4e119d77d0ace95cac25cabf21256dd103886597

diff --git a/app/assets/builds/.keep b/app/assets/builds/.keep
diff --git a/app/assets/config/manifest.js b/app/assets/config/manifest.js
diff --git a/app/assets/javascripts/application.js b/app/assets/javascripts/application.js
diff --git a/app/assets/stylesheets/includes/main.scss b/app/assets/stylesheets/includes/main.scss
@@ -319,13 +319,13 @@ strong {
 /// additional MediaElement.js styles
 
 .mejs__overlay-button {
-  background-image: url("/assets/icons/mejs-controls.svg");
+  background-image: url("/icons/mejs-controls.svg");
 }
 .mejs__overlay-loading-bg-img {
-  background-image: url("/assets/icons/mejs-controls.svg");
+  background-image: url("/icons/mejs-controls.svg");
 }
 .mejs__button > button {
-  background-image: url("/assets/icons/mejs-controls.svg");
+  background-image: url("/icons/mejs-controls.svg");
 }
 
 // ////////////////////////////////////////////////////////////

diff --git a/app/views/layouts/application.html.erb b/app/views/layouts/application.html.erb
@@ -23,7 +23,6 @@
   <link rel="stylesheet" href="https://use.typekit.net/rxa5jay.css"/>
 
   <%= stylesheet_link_tag 'application', media: 'all' %>
-  <%= javascript_include_tag 'application' %>
 
   <%= yield :head_additional %>
 </head>

diff --git a/app/views/player/_player_head_additional.erb b/app/views/player/_player_head_additional.erb
@@ -37,7 +37,7 @@
             // workaround for mediaelement/mediaelement#2963
             // (when the HLS stream contains WebVTT captions)
             hls: { enableWebVTT: false },
-            iconSprite: "/assets/icons/mejs-controls.svg",
+            iconSprite: '<%= image_path 'icons/mejs-controls.svg' %>',
             stretching: 'responsive',
             success: function (mediaElement, originalNode, instance) {
                 if (typeof dashjs !== "undefined") {