Fix XSS in color field explanations

dev.md

@@ -21,6 +21,22 @@ The SandDance repo is a monorepo made up of several packages, managed by npm wor
 1. `npm install`
 1. [Install Jekyll](https://jekyllrb.com/) to run the website locally.
 
+The root install hook also installs the Power BI visual's dependencies locally with
+`--workspaces=false`. Power BI's packaging tools require `powerbi-visuals-api` in
+the visual's own `node_modules` directory; a hoisted workspace installation is not
+sufficient. If install scripts were skipped, run
+`cd packages/powerbi` followed by `npm install --prefix=. --workspaces=false`
+before building.
+
+Installing or updating a named dependency at the repository root can prune these
+local dependencies without running the root install hook. The Power BI
+`build:08`, `start`, and `pbiviz` scripts check for the local API first and restore
+the visual's dependencies if it is missing. This recovery requires registry access.
+
+Use the npm version bundled with your Node.js installation. With Node.js 24,
+npm 8.15 can fail during this standalone install with
+`Cannot set properties of null (setting 'dev')`; npm 11 completes it successfully.
+
 ## Build
 1. `npm run build`
 

docker-jekyll-local/Dockerfile

@@ -2,8 +2,10 @@ FROM jekyll/jekyll:4.2.2
 
 WORKDIR /srv/jekyll
 
+ENV BUNDLE_FROZEN=true
+
 # Copy the docs directory
-COPY docs/ ./
+COPY --chown=jekyll:jekyll docs/ ./
 
 # Install dependencies
 RUN bundle install

docker-jekyll-local/README.md

@@ -2,26 +2,50 @@
 
 This repository includes Docker setup for running Jekyll locally to preview the GitHub Pages site.
 
+On Windows, start Docker Desktop with Linux containers enabled. These commands
+use Docker Compose v2 or later (`docker compose`).
+
 ## Quick Start
 
 ### Start Jekyll
 ```bash
 cd docker-jekyll-local
-docker-compose up
+docker compose up --build
 ```
 
 ### View your site
 Open http://localhost:4000/SandDance/ in your browser
 
 ### Stop Jekyll
-Type ctrl-C in the terminal running `docker-compose up`
+Type ctrl-C in the terminal running `docker compose up`
 
 ## Other useful commands
 
 ### Rebuild after changes
 ```bash
 cd docker-jekyll-local
-docker-compose build
+docker compose build
+```
+
+Site files are bind-mounted from `docs`, so ordinary content edits do not require
+an image rebuild. Rebuild after changing the Dockerfile, Gemfile, or lockfile.
+
+### Troubleshooting
+
+If the image build reports that Bundler cannot write `/srv/jekyll/Gemfile.lock`,
+ensure the Dockerfile copies the docs with `--chown=jekyll:jekyll`. The image runs
+Bundler as the `jekyll` user, so root-owned copied files are not writable.
+Changing Windows file permissions is not necessary.
+
+The base image uses Ruby 3.1. Keep the lockfile compatible with that runtime.
+The image uses frozen Bundler installs so an incompatible lockfile fails during
+the build instead of silently resolving different versions that disappear when
+the host docs directory is mounted. To regenerate the lockfile using an existing
+image, run this from `docker-jekyll-local`, then rebuild:
+
+```bash
+docker compose run --rm -e BUNDLE_FROZEN=false jekyll bundle install
+docker compose up --build
 ```
 
 ## Files

docs/Gemfile.lock

@@ -25,7 +25,7 @@ GEM
     colorator (1.1.0)
     commonmarker (0.23.11)
     concurrent-ruby (1.3.7)
-    connection_pool (3.0.2)
+    connection_pool (2.5.5)
     csv (3.3.5)
     dnsruby (1.73.1)
       base64 (>= 0.2)
@@ -234,7 +234,7 @@ GEM
     minitest (5.27.0)
     net-http (0.9.1)
       uri (>= 0.11.1)
-    nokogiri (1.19.4-x86_64-linux-musl)
+    nokogiri (1.18.10-x86_64-linux-musl)
       racc (~> 1.4)
     octokit (4.25.1)
       faraday (>= 1, < 3)