abqari 1.1.0 → 1.1.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a20fb790c6db4c0a3d9a357373667acbfb346811e2b5909c97a3b085b3e99580
-  data.tar.gz: 05321cf63a57429e11ac958512ec6628f99e2a2345ce9b4d708faee1feded544
+  metadata.gz: fd411b1e1b18a824d5cee74ee6e557c7135fc973f6fc9edb4f4c806edff7cadf
+  data.tar.gz: bb34137c4de0ffb733d1b911f6e523df2cde7b933d196e07d0e4ca4a4fb91460
 SHA512:
-  metadata.gz: b578071dfb5c70920b40503e1d60a7f0a340242687273cb3dd769be19e79faa2328763a9d88e2a520d3b414d1b9be7f1cd7d99bc7e812c1293374aea25a00dcb
-  data.tar.gz: 5085055521aa63a6be54eecb66213bfb05a64bb470886113bc951a5bd3fd441ff516013e6c770997dae14ace656d024946cb8cad2ca605f0f69ff53a59542805
+  metadata.gz: b1c8ea8aa8cad1f13f9dc3eddd81fbbedf891d024b6998f8a1f7aacf7c45c66ce783bea05174d983973c46eac5318372addd0d8b590e29871723f29f1d71a40c
+  data.tar.gz: 2820827176cec3ecaaf08ad2ceb70c15b506435368154e24d2afc7ea544f2fe959613da696e2bb05eb81eff3011d4c37e07081565e1c4fa2ae2e901073b4e5c8

data/CHANGELOG.md

@@ -9,6 +9,109 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 _Nothing yet._
 
+## [1.1.2] — 2026-10-09
+
+### Fixed
+
+- **Changing `fonts:` and re-running `bin/fetch-fonts` didn't reach
+  returning visitors; they kept the old fonts for up to a year.** The
+  head linked the font stylesheet at a fixed `/assets/fonts/fonts.css`,
+  and the generated `_headers` serves all of `/assets/*` with
+  `Cache-Control: public, max-age=31536000, immutable`, so a browser
+  that had cached the old file never asked for it again. The new
+  families fell back to system fonts. It hid because a first visit, a
+  hard reload, and the dev server (which doesn't apply `_headers`) all
+  show the new fonts; only returning visitors on a host that honours
+  `_headers` were stuck. `syntax.css` had the same bug before the CSS
+  bundle.
+
+  `vendor/fonts/fonts.css` now goes through the asset pipeline and is
+  linked as `/assets/fonts/fonts.<hash>.css`, minified in production,
+  so a re-fetch changes the URL. Dev-server rebuilds now re-render
+  every page after a re-fetch, because every head carries the hash.
+  The head no longer emits the link when `fonts:` is set but
+  `bin/fetch-fonts` hasn't run; it used to link a stylesheet that
+  404'd.
+
+  If your site overrides `_head.html.erb`, change its font link to
+  `<%= asset_path('fonts/fonts.css') %>`. The unhashed copy still ships
+  at `/assets/fonts/fonts.css`, so an overridden head keeps working,
+  but it keeps the stale-cache problem.
+
+## [1.1.1] — 2026-08-11
+
+Bug-fix release, all of it found while building a site against the
+published 1.1.0 gem.
+
+Upgrade if you minify (the default in production): a tag name written
+inside an HTML comment could silently delete everything between that
+comment and the next one, and layouts carry explanatory comments as a
+matter of course. Upgrade too if you use the contact button — it never
+worked at all.
+
+### Fixed
+
+- **A tag name written inside an HTML comment silently deleted page
+  content — production builds only.** `Minifier.minify` stashed
+  `<pre>` / `<textarea>` / `<script>` / `<style>` blocks *before* it
+  stripped comments, so ordinary explanatory prose in a layout or
+  partial — `<!-- see the <script> tag below -->` — opened a
+  "preserved" region at the comment's own text. That region ran to the
+  next genuine `</script>` further down the document, swallowing the
+  comment's `-->` on the way; the orphaned `<!--` then paired with some
+  later `-->`, and the comment pass deleted the placeholder along with
+  everything between the two. Pages shipped with an empty `<main>`
+  against a green build, and only in production, because dev doesn't
+  minify.
+
+  Comments and preserved blocks are now matched in one ordered
+  left-to-right pass, so whichever construct starts first consumes the
+  other and tag-like text inside a comment can't open a region. This is
+  the same single-pass discipline (and the same failure class) as the
+  CSS minifier's comment/string handling. Conditional comments
+  (`<!--[if …]>`) are stashed rather than stripped, so they now survive
+  verbatim instead of having their contents whitespace-collapsed.
+
+- **A document beginning or ending with a `<pre>` / `<script>` /
+  `<style>` block leaked the minifier's internal placeholder.** The
+  final trim used `String#strip`, which removes NUL bytes as well as
+  whitespace, truncating the stash sentinel so the placeholder never
+  matched on restore and shipped as literal `ABQARI_PRESERVED_0` text.
+  Real pages end in `</html>`, which is why this stayed hidden. Both
+  the HTML and CSS minifiers now trim whitespace only.
+
+- **The contact button did nothing when clicked.** `contact-button.js`
+  delegates on `.contact-button[data-user][data-domain]`, but the
+  partial only ever emitted the styling classes (`btn
+  btn-outline-secondary`, or whatever `css_class:` was set to) — the
+  wrapper's `.contact-button-wrapper` is a different class token, so
+  the selector matched nothing on every site that enabled the button.
+  No console error; the button just sat there. `.contact-button` is now
+  emitted as a styling-free JS hook alongside `css_class:`, so
+  overriding the variant can't break the handler.
+
+- **`contact.subject:` rendered a malformed `data-subject` attribute.**
+  `_contact_button.html.erb` built the whole attribute as a Ruby string
+  and emitted it through `<%= %>`, which auto-escapes under Erubi — so
+  the attribute's own quote characters came out as entities
+  (`data-subject=&quot;Project enquiry&quot;`) and the subject would
+  not have reached `contact-button.js` even once the click handler
+  fired. The attribute name and quotes are now literal template text;
+  only the value passes through the escape.
+
+### Changed
+
+- `Minifier::PRESERVE_REGEX` and `Minifier::COMMENT_REGEX` are gone,
+  replaced by the single `Minifier::HTML_TOKEN_REGEX`. Both were
+  internal to `minify` and nothing outside the engine has reason to
+  reference them; they're called out because 1.1.0 is on RubyGems and
+  removing a public constant is technically breaking. `PRESERVE_TAGS`
+  is unchanged.
+
+- `test/low_priority_hardening_test.rb` no longer relies on
+  `Object#stub`. Minitest 6 dropped `minitest/mock` from the default
+  install, so that test errored on every run of the suite.
+
 ## [1.1.0] — 2026-08-06
 
 First public release on RubyGems. 1.0.0 below was tagged in git but
@@ -884,6 +987,8 @@ run a real working author / publisher site.
   commonmarker ≥ 2.4 ships precompiled 4.0 binaries, which is what
   the `~> 2.4` floor bought.
 
-[Unreleased]: https://github.com/grantrayner/abqari/compare/v1.1.0...HEAD
+[Unreleased]: https://github.com/grantrayner/abqari/compare/v1.1.2...HEAD
+[1.1.2]: https://github.com/grantrayner/abqari/compare/v1.1.1...v1.1.2
+[1.1.1]: https://github.com/grantrayner/abqari/compare/v1.1.0...v1.1.1
 [1.1.0]: https://github.com/grantrayner/abqari/compare/v1.0.0...v1.1.0
 [1.0.0]: https://github.com/grantrayner/abqari/releases/tag/v1.0.0

data/README.md

@@ -11,7 +11,7 @@ optional overrides), while the engine — layouts, themes, helpers, asset
 pipeline — lives in the dependency. Forking the engine is also
 supported for users who want to own all the code.
 
-> **Status:** v1.1.0 — first public release, see
+> **Status:** v1.1.2 — see
 > [CHANGELOG.md](https://github.com/grantrayner/abqari/blob/main/CHANGELOG.md).
 > Distributed via RubyGems (`gem install abqari`) and as a Bundler
 > path/git source. The API follows [semver](https://semver.org/) from
@@ -174,7 +174,7 @@ Test that it worked:
 abqari version
 ```
 
-You should see a version number, e.g. `abqari 1.1.0`. If you get
+You should see a version number, e.g. `abqari 1.1.2`. If you get
 `command not found`, see [Troubleshooting](#troubleshooting) below.
 
 ### Step 3 — Create your first site
@@ -470,7 +470,7 @@ end
 Or — pin to a git ref while tracking pre-release work:
 
 ```ruby
-gem 'abqari', git: 'https://github.com/grantrayner/abqari.git', tag: 'v1.1.0'
+gem 'abqari', git: 'https://github.com/grantrayner/abqari.git', tag: 'v1.1.2'
 ```
 
 Install the libvips C library once (hard dep for the image pipeline):
@@ -1629,7 +1629,9 @@ Then run once:
 bin/fetch-fonts
 ```
 
-Abqari downloads the woff2 files to `vendor/fonts/`, generates a `fonts.css` with rewritten URLs, and serves everything from `/assets/fonts/` at build time. The head partial conditionally includes the link tag whenever `fonts:` is configured.
+Abqari downloads the woff2 files to `vendor/fonts/`, generates a `fonts.css` with rewritten URLs, and serves everything from `/assets/fonts/` at build time. The stylesheet is fingerprinted like any other asset (`/assets/fonts/fonts.<hash>.css`), so changing `fonts:` and re-running `bin/fetch-fonts` busts the immutable cache. The head partial links it whenever `fonts:` is configured and the fetch has run.
+
+If you override the head partial, link the stylesheet with `<%= asset_path('fonts/fonts.css') %>`. An unhashed copy still ships at `/assets/fonts/fonts.css`, but `_headers` caches it for a year, so returning visitors won't see font changes.
 
 ## Icons
 
@@ -2550,7 +2552,7 @@ taking a feature release. To track a fork or an unreleased branch
 instead, swap the line for a git source:
 
 ```ruby
-gem 'abqari', git: 'https://github.com/grantrayner/abqari.git', tag: 'v1.1.0'
+gem 'abqari', git: 'https://github.com/grantrayner/abqari.git', tag: 'v1.1.2'
 ```
 
 The cadence: read [CHANGELOG.md](https://github.com/grantrayner/abqari/blob/main/CHANGELOG.md) before each upgrade,

data/app/views/partials/_contact_button.html.erb

@@ -15,6 +15,10 @@
   Place anywhere by calling `<%%= render 'partials/contact_button' %%>`
   from any layout. Already wired into the default about layout.
 
+  `.contact-button` is the JS hook contact-button.js delegates on. It's
+  always emitted and carries no styling, so `css_class:` can be anything
+  without breaking the click handler — keep the two roles separate.
+
   Default styling: `.btn .btn-outline-secondary` from _common.css.
   Override with `css_class:` to swap the variant — e.g.
       <%%= render 'partials/contact_button', css_class: 'btn btn-success' %%>
@@ -31,10 +35,10 @@
   <% subject = cfg['subject'] %>
   <% button_class = defined?(css_class) ? css_class.to_s : 'btn btn-outline-secondary' %>
   <p class="contact-button-wrapper">
-    <button type="button" class="<%= button_class %>"
+    <button type="button" class="contact-button <%= button_class %>"
             data-user="<%= user %>"
             data-domain="<%= domain %>"
-            <%= subject ? %(data-subject="#{h(subject)}") : '' %>>
+            <% if subject %>data-subject="<%= subject %>"<% end %>>
       <%= label %>
     </button>
   </p>

data/app/views/partials/_head.html.erb

@@ -367,8 +367,12 @@
   <% Array(site.config['fonts_preload']).each do |path| %>
   <link rel="preload" href="<%= sanitized_url(path) %>" as="font" type="font/woff2" crossorigin>
   <% end %>
-  <% if Array(site.config['fonts']).any? %>
-  <link rel="stylesheet" href="/assets/fonts/fonts.css">
+  <%# Fingerprinted, never the fixed `/assets/fonts/fonts.css` — that
+      URL is cached `immutable`, so a re-fetch never reached returning
+      visitors. No link until `bin/fetch-fonts` has run. %>
+  <% fonts_css = Array(site.config['fonts']).any? && optional_asset_path('fonts/fonts.css') %>
+  <% if fonts_css %>
+  <link rel="stylesheet" href="<%= fonts_css %>">
   <% end %>
   <%# Render-blocking CSS ships as ONE fingerprinted bundle (syntax +
       _common + theme app.css + site.css, same cascade order as the

data/lib/abqari/asset_pipeline.rb

@@ -8,6 +8,7 @@ module Abqari
     OUTPUT_SUBDIR = 'assets'
     HASH_LENGTH = 10
     BUNDLE_LOGICAL = 'css/bundle.css'
+    FONTS_LOGICAL = 'fonts/fonts.css'
     # A theme name is a directory name under themes/ and nothing more.
     # The strict pattern is load-bearing: the name is joined into
     # filesystem paths in several places (here, ArtifactWriter,
@@ -55,6 +56,7 @@ module Abqari
       [engine_app_assets, site_app_assets].uniq.each do |dir|
         process_dir(dir) if dir && Dir.exist?(dir)
       end
+      process_font_stylesheet
       build_css_bundle
     end
 
@@ -172,6 +174,22 @@ module Abqari
       @paths[logical] = "/#{OUTPUT_SUBDIR}/#{fingerprinted}"
     end
 
+    # The `bin/fetch-fonts` stylesheet gets a content hash like any
+    # other asset. At its old fixed URL it sat under the `/assets/*
+    # immutable` cache rule, so a site that changed `fonts:` and
+    # re-fetched kept serving returning visitors the old `@font-face`
+    # rules for a year. Its woff2 `url()`s are root-absolute, so the
+    # renamed file still resolves them. ArtifactWriter#copy_fonts keeps
+    # shipping the unhashed copy for sites that override the head.
+    def process_font_stylesheet
+      source = File.join(@site.site_root, 'vendor', 'fonts', 'fonts.css')
+      return unless File.file?(source)
+      return if @site.external_symlink?(source)
+
+      write_asset(FONTS_LOGICAL, processed_content(source, FONTS_LOGICAL))
+      @sources[FONTS_LOGICAL] = source
+    end
+
     def processed_content(entry, logical)
       raw = File.binread(entry)
       kind = MINIFY_KINDS[File.extname(logical)]

data/lib/abqari/minifier.rb

@@ -6,20 +6,46 @@ module Abqari
   # <pre>, <textarea>, <script>, and <style> blocks where whitespace matters.
   module Minifier
     PRESERVE_TAGS = %w[pre textarea script style].freeze
-    PRESERVE_REGEX = /<(#{PRESERVE_TAGS.join('|')})\b[^>]*>.*?<\/\1>/im.freeze
     PLACEHOLDER = "\x00ABQARI_PRESERVED_%d\x00"
-    COMMENT_REGEX = /<!--(?!\[if).*?-->/m.freeze
+
+    # Comments and preserved blocks are recognised in ONE left-to-right
+    # pass, via ordered alternation, so whichever construct STARTS first
+    # consumes the other — the same single-pass discipline (and for the
+    # same reason) as CSS_TOKEN_REGEX below.
+    #
+    # Stashing preserved blocks first and stripping comments afterwards
+    # is what this replaced, and it was wrong: a tag-like string written
+    # inside a comment — `<!-- see the <script> tag -->` in a layout —
+    # opened a preserved region at the `<script>` text, which then ran
+    # to the next GENUINE `</script>` further down the document,
+    # swallowing the comment's own `-->` on the way. The orphaned `<!--`
+    # then paired with some later `-->`, and the comment pass deleted
+    # the placeholder and everything between. Pages came out with an
+    # empty `<main>`, in production builds only (dev doesn't minify).
+    #
+    # Comments matched here are dropped, except conditional comments
+    # (`<!--[if …]>`), which are stashed so they survive verbatim.
+    HTML_TOKEN_REGEX = %r{
+      (?<comment><!--.*?-->)
+      |
+      (?<preserved><(?<tag>#{PRESERVE_TAGS.join('|')})\b[^>]*>.*?</\k<tag>>)
+    }imx.freeze
+    CONDITIONAL_COMMENT_REGEX = /\A<!--\[if/i.freeze
 
     def self.minify(html)
       preserved = []
 
-      protected_html = html.gsub(PRESERVE_REGEX) do |match|
-        preserved << match
-        format(PLACEHOLDER, preserved.length - 1)
+      protected_html = html.gsub(HTML_TOKEN_REGEX) do
+        match = ::Regexp.last_match
+        if match[:comment] && !match[:comment].match?(CONDITIONAL_COMMENT_REGEX)
+          ''
+        else
+          preserved << match[0]
+          format(PLACEHOLDER, preserved.length - 1)
+        end
       end
 
       minified = protected_html
-                 .gsub(COMMENT_REGEX, '')
                  # Collapse inter-tag whitespace to a SINGLE space, not
                  # nothing. `<em>a</em> <strong>b</strong>` must stay
                  # "a b" — deleting the space renders "ab". The size win
@@ -29,12 +55,28 @@ module Abqari
                  # significant whitespace inside them is untouched.)
                  .gsub(/>\s+</, '> <')
                  .gsub(/\s{2,}/, ' ')
-                 .strip
+      minified = trim(minified)
 
-      minified.gsub(/\x00ABQARI_PRESERVED_(\d+)\x00/) do
-        preserved[::Regexp.last_match(1).to_i]
-      end
+      restore(minified, preserved)
+    end
+
+    # `String#strip` also removes NUL bytes, which would bite the
+    # PLACEHOLDER's trailing \x00 whenever a document starts or ends
+    # with a preserved block — the placeholder then fails to match on
+    # restore and ships to the browser as literal
+    # "\x00ABQARI_PRESERVED_0" text. `\s` in a Ruby regex is whitespace
+    # only, so trimming this way leaves the sentinels intact.
+    TRIM_REGEX = /\A\s+|\s+\z/.freeze
+    PLACEHOLDER_REGEX = /\x00ABQARI_PRESERVED_(\d+)\x00/.freeze
+
+    def self.trim(text)
+      text.gsub(TRIM_REGEX, '')
+    end
+
+    def self.restore(text, preserved)
+      text.gsub(PLACEHOLDER_REGEX) { preserved[::Regexp.last_match(1).to_i] }
     end
+    private_class_method :trim, :restore
 
     # Comments and quoted strings are recognised in ONE left-to-right
     # pass, via ordered alternation, so whichever construct STARTS first
@@ -81,11 +123,9 @@ module Abqari
                  .gsub(/\s+/, ' ')
                  .gsub(/\s*([{};,>])\s*/, '\1')
                  .gsub(';}', '}')
-                 .strip
+      minified = trim(minified)
 
-      minified.gsub(/\x00ABQARI_PRESERVED_(\d+)\x00/) do
-        preserved[::Regexp.last_match(1).to_i]
-      end
+      restore(minified, preserved)
     end
 
     JS_LINE_COMMENT_REGEX  = %r{^[ \t]*//.*$}.freeze

data/lib/abqari/renderer.rb

@@ -48,13 +48,17 @@ module Abqari
     # `compute_shared_deps_mtime` time so we only walk the active
     # theme's directory, not every theme that happens to ship with
     # the gem.
+    #
+    # `vendor/fonts/fonts.css` is here because every page's head links
+    # it by content hash; a re-fetch must re-render them all.
     GLOBAL_DEP_GLOBS = [
       'app/views/partials/**/*',
       'app/icons/**/*',
       'app/assets/**/*',
       'lib/**/*',
       'config/**/*',
-      'data/**/*'
+      'data/**/*',
+      'vendor/fonts/fonts.css'
     ].freeze
 
     # The renderer only needs the frontmatter block (no body), but

data/lib/abqari/version.rb

@@ -14,5 +14,5 @@
 #
 # Keep this file dependency-free.
 module Abqari
-  VERSION = '1.1.0'
+  VERSION = '1.1.2'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: abqari
 version: !ruby/object:Gem::Version
-  version: 1.1.0
+  version: 1.1.2
 platform: ruby
 authors:
 - Grant Rayner