abqari 1.1.0 → 1.1.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a20fb790c6db4c0a3d9a357373667acbfb346811e2b5909c97a3b085b3e99580
-  data.tar.gz: 05321cf63a57429e11ac958512ec6628f99e2a2345ce9b4d708faee1feded544
+  metadata.gz: '035944943314205611728976da674b3459ebe5b38cc7bcf7ac037dac5726dc39'
+  data.tar.gz: ca10d8e3ba566d54f81b6d6ad20779a8252e9eb768e508d5d911a75807e5f2a2
 SHA512:
-  metadata.gz: b578071dfb5c70920b40503e1d60a7f0a340242687273cb3dd769be19e79faa2328763a9d88e2a520d3b414d1b9be7f1cd7d99bc7e812c1293374aea25a00dcb
-  data.tar.gz: 5085055521aa63a6be54eecb66213bfb05a64bb470886113bc951a5bd3fd441ff516013e6c770997dae14ace656d024946cb8cad2ca605f0f69ff53a59542805
+  metadata.gz: 987bc6ee6e1e9186193f6a35745559a3e5b1c383b634e681df38c94016b45ab766b2d8d0d6215e6bca88c741d95f4ffff70c2e9be904ea1e93b32ee0c9280397
+  data.tar.gz: 94f4ec0a8576c75d6b30b5f7a306dc44bb0cad5fe2312ab075b419efe3b9227f9a02a7676b289fa062ad4d46e7bf470a288f45ad0503d937fd009281de20e5d8

data/CHANGELOG.md

@@ -9,6 +9,80 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 _Nothing yet._
 
+## [1.1.1] — 2026-08-11
+
+Bug-fix release, all of it found while building a site against the
+published 1.1.0 gem.
+
+Upgrade if you minify (the default in production): a tag name written
+inside an HTML comment could silently delete everything between that
+comment and the next one, and layouts carry explanatory comments as a
+matter of course. Upgrade too if you use the contact button — it never
+worked at all.
+
+### Fixed
+
+- **A tag name written inside an HTML comment silently deleted page
+  content — production builds only.** `Minifier.minify` stashed
+  `<pre>` / `<textarea>` / `<script>` / `<style>` blocks *before* it
+  stripped comments, so ordinary explanatory prose in a layout or
+  partial — `<!-- see the <script> tag below -->` — opened a
+  "preserved" region at the comment's own text. That region ran to the
+  next genuine `</script>` further down the document, swallowing the
+  comment's `-->` on the way; the orphaned `<!--` then paired with some
+  later `-->`, and the comment pass deleted the placeholder along with
+  everything between the two. Pages shipped with an empty `<main>`
+  against a green build, and only in production, because dev doesn't
+  minify.
+
+  Comments and preserved blocks are now matched in one ordered
+  left-to-right pass, so whichever construct starts first consumes the
+  other and tag-like text inside a comment can't open a region. This is
+  the same single-pass discipline (and the same failure class) as the
+  CSS minifier's comment/string handling. Conditional comments
+  (`<!--[if …]>`) are stashed rather than stripped, so they now survive
+  verbatim instead of having their contents whitespace-collapsed.
+
+- **A document beginning or ending with a `<pre>` / `<script>` /
+  `<style>` block leaked the minifier's internal placeholder.** The
+  final trim used `String#strip`, which removes NUL bytes as well as
+  whitespace, truncating the stash sentinel so the placeholder never
+  matched on restore and shipped as literal `ABQARI_PRESERVED_0` text.
+  Real pages end in `</html>`, which is why this stayed hidden. Both
+  the HTML and CSS minifiers now trim whitespace only.
+
+- **The contact button did nothing when clicked.** `contact-button.js`
+  delegates on `.contact-button[data-user][data-domain]`, but the
+  partial only ever emitted the styling classes (`btn
+  btn-outline-secondary`, or whatever `css_class:` was set to) — the
+  wrapper's `.contact-button-wrapper` is a different class token, so
+  the selector matched nothing on every site that enabled the button.
+  No console error; the button just sat there. `.contact-button` is now
+  emitted as a styling-free JS hook alongside `css_class:`, so
+  overriding the variant can't break the handler.
+
+- **`contact.subject:` rendered a malformed `data-subject` attribute.**
+  `_contact_button.html.erb` built the whole attribute as a Ruby string
+  and emitted it through `<%= %>`, which auto-escapes under Erubi — so
+  the attribute's own quote characters came out as entities
+  (`data-subject=&quot;Project enquiry&quot;`) and the subject would
+  not have reached `contact-button.js` even once the click handler
+  fired. The attribute name and quotes are now literal template text;
+  only the value passes through the escape.
+
+### Changed
+
+- `Minifier::PRESERVE_REGEX` and `Minifier::COMMENT_REGEX` are gone,
+  replaced by the single `Minifier::HTML_TOKEN_REGEX`. Both were
+  internal to `minify` and nothing outside the engine has reason to
+  reference them; they're called out because 1.1.0 is on RubyGems and
+  removing a public constant is technically breaking. `PRESERVE_TAGS`
+  is unchanged.
+
+- `test/low_priority_hardening_test.rb` no longer relies on
+  `Object#stub`. Minitest 6 dropped `minitest/mock` from the default
+  install, so that test errored on every run of the suite.
+
 ## [1.1.0] — 2026-08-06
 
 First public release on RubyGems. 1.0.0 below was tagged in git but
@@ -884,6 +958,7 @@ run a real working author / publisher site.
   commonmarker ≥ 2.4 ships precompiled 4.0 binaries, which is what
   the `~> 2.4` floor bought.
 
-[Unreleased]: https://github.com/grantrayner/abqari/compare/v1.1.0...HEAD
+[Unreleased]: https://github.com/grantrayner/abqari/compare/v1.1.1...HEAD
+[1.1.1]: https://github.com/grantrayner/abqari/compare/v1.1.0...v1.1.1
 [1.1.0]: https://github.com/grantrayner/abqari/compare/v1.0.0...v1.1.0
 [1.0.0]: https://github.com/grantrayner/abqari/releases/tag/v1.0.0

data/README.md

@@ -11,7 +11,7 @@ optional overrides), while the engine — layouts, themes, helpers, asset
 pipeline — lives in the dependency. Forking the engine is also
 supported for users who want to own all the code.
 
-> **Status:** v1.1.0 — first public release, see
+> **Status:** v1.1.1 — see
 > [CHANGELOG.md](https://github.com/grantrayner/abqari/blob/main/CHANGELOG.md).
 > Distributed via RubyGems (`gem install abqari`) and as a Bundler
 > path/git source. The API follows [semver](https://semver.org/) from
@@ -174,7 +174,7 @@ Test that it worked:
 abqari version
 ```
 
-You should see a version number, e.g. `abqari 1.1.0`. If you get
+You should see a version number, e.g. `abqari 1.1.1`. If you get
 `command not found`, see [Troubleshooting](#troubleshooting) below.
 
 ### Step 3 — Create your first site
@@ -470,7 +470,7 @@ end
 Or — pin to a git ref while tracking pre-release work:
 
 ```ruby
-gem 'abqari', git: 'https://github.com/grantrayner/abqari.git', tag: 'v1.1.0'
+gem 'abqari', git: 'https://github.com/grantrayner/abqari.git', tag: 'v1.1.1'
 ```
 
 Install the libvips C library once (hard dep for the image pipeline):
@@ -2550,7 +2550,7 @@ taking a feature release. To track a fork or an unreleased branch
 instead, swap the line for a git source:
 
 ```ruby
-gem 'abqari', git: 'https://github.com/grantrayner/abqari.git', tag: 'v1.1.0'
+gem 'abqari', git: 'https://github.com/grantrayner/abqari.git', tag: 'v1.1.1'
 ```
 
 The cadence: read [CHANGELOG.md](https://github.com/grantrayner/abqari/blob/main/CHANGELOG.md) before each upgrade,

data/app/views/partials/_contact_button.html.erb

@@ -15,6 +15,10 @@
   Place anywhere by calling `<%%= render 'partials/contact_button' %%>`
   from any layout. Already wired into the default about layout.
 
+  `.contact-button` is the JS hook contact-button.js delegates on. It's
+  always emitted and carries no styling, so `css_class:` can be anything
+  without breaking the click handler — keep the two roles separate.
+
   Default styling: `.btn .btn-outline-secondary` from _common.css.
   Override with `css_class:` to swap the variant — e.g.
       <%%= render 'partials/contact_button', css_class: 'btn btn-success' %%>
@@ -31,10 +35,10 @@
   <% subject = cfg['subject'] %>
   <% button_class = defined?(css_class) ? css_class.to_s : 'btn btn-outline-secondary' %>
   <p class="contact-button-wrapper">
-    <button type="button" class="<%= button_class %>"
+    <button type="button" class="contact-button <%= button_class %>"
             data-user="<%= user %>"
             data-domain="<%= domain %>"
-            <%= subject ? %(data-subject="#{h(subject)}") : '' %>>
+            <% if subject %>data-subject="<%= subject %>"<% end %>>
       <%= label %>
     </button>
   </p>

data/lib/abqari/minifier.rb

@@ -6,20 +6,46 @@ module Abqari
   # <pre>, <textarea>, <script>, and <style> blocks where whitespace matters.
   module Minifier
     PRESERVE_TAGS = %w[pre textarea script style].freeze
-    PRESERVE_REGEX = /<(#{PRESERVE_TAGS.join('|')})\b[^>]*>.*?<\/\1>/im.freeze
     PLACEHOLDER = "\x00ABQARI_PRESERVED_%d\x00"
-    COMMENT_REGEX = /<!--(?!\[if).*?-->/m.freeze
+
+    # Comments and preserved blocks are recognised in ONE left-to-right
+    # pass, via ordered alternation, so whichever construct STARTS first
+    # consumes the other — the same single-pass discipline (and for the
+    # same reason) as CSS_TOKEN_REGEX below.
+    #
+    # Stashing preserved blocks first and stripping comments afterwards
+    # is what this replaced, and it was wrong: a tag-like string written
+    # inside a comment — `<!-- see the <script> tag -->` in a layout —
+    # opened a preserved region at the `<script>` text, which then ran
+    # to the next GENUINE `</script>` further down the document,
+    # swallowing the comment's own `-->` on the way. The orphaned `<!--`
+    # then paired with some later `-->`, and the comment pass deleted
+    # the placeholder and everything between. Pages came out with an
+    # empty `<main>`, in production builds only (dev doesn't minify).
+    #
+    # Comments matched here are dropped, except conditional comments
+    # (`<!--[if …]>`), which are stashed so they survive verbatim.
+    HTML_TOKEN_REGEX = %r{
+      (?<comment><!--.*?-->)
+      |
+      (?<preserved><(?<tag>#{PRESERVE_TAGS.join('|')})\b[^>]*>.*?</\k<tag>>)
+    }imx.freeze
+    CONDITIONAL_COMMENT_REGEX = /\A<!--\[if/i.freeze
 
     def self.minify(html)
       preserved = []
 
-      protected_html = html.gsub(PRESERVE_REGEX) do |match|
-        preserved << match
-        format(PLACEHOLDER, preserved.length - 1)
+      protected_html = html.gsub(HTML_TOKEN_REGEX) do
+        match = ::Regexp.last_match
+        if match[:comment] && !match[:comment].match?(CONDITIONAL_COMMENT_REGEX)
+          ''
+        else
+          preserved << match[0]
+          format(PLACEHOLDER, preserved.length - 1)
+        end
       end
 
       minified = protected_html
-                 .gsub(COMMENT_REGEX, '')
                  # Collapse inter-tag whitespace to a SINGLE space, not
                  # nothing. `<em>a</em> <strong>b</strong>` must stay
                  # "a b" — deleting the space renders "ab". The size win
@@ -29,12 +55,28 @@ module Abqari
                  # significant whitespace inside them is untouched.)
                  .gsub(/>\s+</, '> <')
                  .gsub(/\s{2,}/, ' ')
-                 .strip
+      minified = trim(minified)
 
-      minified.gsub(/\x00ABQARI_PRESERVED_(\d+)\x00/) do
-        preserved[::Regexp.last_match(1).to_i]
-      end
+      restore(minified, preserved)
+    end
+
+    # `String#strip` also removes NUL bytes, which would bite the
+    # PLACEHOLDER's trailing \x00 whenever a document starts or ends
+    # with a preserved block — the placeholder then fails to match on
+    # restore and ships to the browser as literal
+    # "\x00ABQARI_PRESERVED_0" text. `\s` in a Ruby regex is whitespace
+    # only, so trimming this way leaves the sentinels intact.
+    TRIM_REGEX = /\A\s+|\s+\z/.freeze
+    PLACEHOLDER_REGEX = /\x00ABQARI_PRESERVED_(\d+)\x00/.freeze
+
+    def self.trim(text)
+      text.gsub(TRIM_REGEX, '')
+    end
+
+    def self.restore(text, preserved)
+      text.gsub(PLACEHOLDER_REGEX) { preserved[::Regexp.last_match(1).to_i] }
     end
+    private_class_method :trim, :restore
 
     # Comments and quoted strings are recognised in ONE left-to-right
     # pass, via ordered alternation, so whichever construct STARTS first
@@ -81,11 +123,9 @@ module Abqari
                  .gsub(/\s+/, ' ')
                  .gsub(/\s*([{};,>])\s*/, '\1')
                  .gsub(';}', '}')
-                 .strip
+      minified = trim(minified)
 
-      minified.gsub(/\x00ABQARI_PRESERVED_(\d+)\x00/) do
-        preserved[::Regexp.last_match(1).to_i]
-      end
+      restore(minified, preserved)
     end
 
     JS_LINE_COMMENT_REGEX  = %r{^[ \t]*//.*$}.freeze

data/lib/abqari/version.rb

@@ -14,5 +14,5 @@
 #
 # Keep this file dependency-free.
 module Abqari
-  VERSION = '1.1.0'
+  VERSION = '1.1.1'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: abqari
 version: !ruby/object:Gem::Version
-  version: 1.1.0
+  version: 1.1.1
 platform: ruby
 authors:
 - Grant Rayner