Remove vulnerable unused Distill assets

[rojasgabriel]

What changed

• remove the unused Distill layout and bundled JavaScript that produced eight CodeQL findings
• remove jekyll-3rd-party-libraries, whose css_parser constraint blocks the patched major version
• preserve its active version-substitution behavior with a small local Jekyll hook
• update concurrent-ruby to 1.3.8 and Nokogiri to 1.19.4

Why

No live page uses the retired Distill layout. Removing that dormant vendor surface resolves the CodeQL XSS, ReDoS, prototype-pollution, and sanitization findings rather than patching third-party code that the site does not serve. Removing the incompatible plugin also eliminates vulnerable css_parser while preserving configured CDN URLs and integrity hashes.

Validation

• Docker image rebuilt from the updated lockfile
• production bundle exec jekyll build
• generated site contains no unresolved {{version}} placeholders
• npx prettier . --check

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	gem/​concurrent-ruby@​1.3.6 ⏵ 1.3.8	+1	+18
	gem/​nokogiri@​1.19.2-aarch64-linux-gnu ⏵ 1.19.4-aarch64-linux-gnu	N/A	N/A	N/A	N/A	N/A

View full report

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.