actionview 4.2.11.1 → 6.1.5.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 71fb7b73001ccc9220ba0da089fc3336a3a18620ca13a18730fa91d4799fbf58
-  data.tar.gz: a87ef6a72900a81c7cff2d00f3fac65006c0f95935b7bf366c1f4bfa1210b6d1
+  metadata.gz: 347465d701c1688d4e91d033d1f29b16f6f284005f9aaeefc71a36ef0ff439a8
+  data.tar.gz: de5710a75c9b8aa8bcf02e34bb62efc0818f9069c71600a8b50cedf31c0ed94f
 SHA512:
-  metadata.gz: ea93cb6a5de3af579900cf1534b50842c6d197062ee7a01a9f499287dbbb8f6f3d9c32abfadba3c2d1868b8deddc70594c3e5767744031e47961d5da15cb5e54
-  data.tar.gz: e59b44cf756ed5bf55ef96709055a04413dfba03fa083c32ef709eb266267ac774bc7d83c08c696a16c98e5dd93a412a531372eee7546bcc8e856e1304dcf618
+  metadata.gz: cbe1e77c8db14198627aafa50b6e8438446828ddf6ecfed37732fb2cc72db2ff03a344a8bee860677a98eb2d6d85875b626b7119e92ac20884631547e7957309
+  data.tar.gz: 890f5eb3fa70152816e5397b39745836ad36efe145eeff80df744dfc09878abbaa3707472eeb53025049dc3ab4e02e0766668ea56cd658f001f9a3f4a3b8514b

data/CHANGELOG.md

@@ -1,357 +1,414 @@
-## Rails 4.2.11.1 (March 11, 2019) ##
+## Rails 6.1.5.1 (April 26, 2022) ##
+
+*   Fix and add protections for XSS in `ActionView::Helpers` and `ERB::Util`.
+
+    Escape dangerous characters in names of tags and names of attributes in the
+    tag helpers, following the XML specification. Rename the option
+    `:escape_attributes` to `:escape`, to simplify by applying the option to the
+    whole tag.
+
+    *Álvaro Martín Fraguas*
+
+## Rails 6.1.5 (March 09, 2022) ##
+
+*   `preload_link_tag` properly inserts `as` attributes for files with `image` MIME
+    types, such as JPG or SVG.
+
+    *Nate Berkopec*
+
+*   Add `autocomplete="off"` to all generated hidden fields.
+
+    Fixes #42610.
+
+    *Ryan Baumann*
+
+*   Fix `current_page?` when URL has trailing slash.
+
+    This fixes the `current_page?` helper when the given URL has a trailing slash,
+    and is an absolute URL or also has query params.
+
+    Fixes #33956.
+
+    *Jonathan Hefner*
+
+
+## Rails 6.1.4.7 (March 08, 2022) ##
 
 *   No changes.
 
 
-## Rails 4.2.11 (November 27, 2018) ##
+## Rails 6.1.4.6 (February 11, 2022) ##
 
 *   No changes.
 
 
-## Rails 4.2.10 (September 27, 2017) ##
+## Rails 6.1.4.5 (February 11, 2022) ##
 
 *   No changes.
 
 
-## Rails 4.2.9 (June 26, 2017) ##
+## Rails 6.1.4.4 (December 15, 2021) ##
 
 *   No changes.
 
 
-## Rails 4.2.8 (February 21, 2017) ##
+## Rails 6.1.4.3 (December 14, 2021) ##
 
 *   No changes.
 
 
-## Rails 4.2.7 (July 12, 2016) ##
+## Rails 6.1.4.2 (December 14, 2021) ##
 
 *   No changes.
 
 
-## Rails 4.2.6 (March 07, 2016) ##
+## Rails 6.1.4.1 (August 19, 2021) ##
 
-*   Fix stripping the digest from the automatically generated img tag alt
-    attribute when assets are handled by Sprockets >=3.0.
+*   No changes.
 
-    *Bart de Water*
 
-*   Create a new `ActiveSupport::SafeBuffer` instance when `content_for` is flushed.
+## Rails 6.1.4 (June 24, 2021) ##
 
-    Fixes #19890
+*   The `translate` helper now passes `default` values that aren't
+    translation keys through `I18n.translate` for interpolation.
 
-    *Yoong Kang Lim*
+    *Jonathan Hefner*
 
-*   Respect value of `:object` if `:object` is false when rendering.
+*   Don't attach UJS form submission handlers to Turbo forms.
 
-    Fixes #22260.
+    *David Heinemeier Hansson*
 
-    *Yuichiro Kaneko*
+*   Allow both `current_page?(url_hash)` and `current_page?(**url_hash)` on Ruby 2.7.
 
-*   Generate `week_field` input values using a 1-based index and not a 0-based index
-    as per the W3 spec: http://www.w3.org/TR/html-markup/datatypes.html#form.data.week
+    *Ryuta Kamizono*
 
-    *Christoph Geschwind*
 
+## Rails 6.1.3.2 (May 05, 2021) ##
 
-## Rails 4.2.5.2 (February 26, 2016) ##
+*   No changes.
 
-*   Do not allow render with unpermitted parameter.
 
-    Fixes CVE-2016-2098.
+## Rails 6.1.3.1 (March 26, 2021) ##
 
-    *Arthur Neves*
+*   No changes.
 
 
-## Rails 4.2.5.1 (January 25, 2015) ##
+## Rails 6.1.3 (February 17, 2021) ##
 
-*   Adds boolean argument outside_app_allowed to `ActionView::Resolver#find_templates`
-    method.
+*   No changes.
 
-    *Aaron Patterson*
 
+## Rails 6.1.2.1 (February 10, 2021) ##
 
-## Rails 4.2.5 (November 12, 2015) ##
+*   No changes.
 
-*   Fix `mail_to` when called with `nil` as argument.
 
-    *Rafael Mendonça França*
+## Rails 6.1.2 (February 09, 2021) ##
 
-*   `url_for` does not modify its arguments when generating polymorphic URLs.
+*   No changes.
 
-    *Bernerd Schaefer*
 
+## Rails 6.1.1 (January 07, 2021) ##
 
-## Rails 4.2.4 (August 24, 2015) ##
+*   Fix lazy translation in partial with block.
 
-* No Changes *
+    *Marek Kasztelnik*
 
+*   Avoid extra `SELECT COUNT` queries when rendering Active Record collections.
 
-## Rails 4.2.3 (June 25, 2015) ##
+    *aar0nr*
 
-*   `translate` should handle `raise` flag correctly in case of both main and default
-    translation is missing.
+*   Link preloading keep integrity hashes in the header.
 
-    Fixes #19967
+    *Étienne Barrié*
 
-    *Bernard Potocki*
+*   Add `config.action_view.preload_links_header` to allow disabling of
+    the `Link` header being added by default when using `stylesheet_link_tag`
+    and `javascript_include_tag`.
 
-*   `translate` allows `default: [[]]` again for a default value of `[]`.
+    *Andrew White*
 
-    Fixes #19640.
+*   The `translate` helper now resolves `default` values when a `nil` key is
+    specified, instead of always returning `nil`.
 
-    *Adam Prescott*
+    *Jonathan Hefner*
 
-*   `translate` should accept nils as members of the `:default`
-    parameter without raising a translation missing error.  Fixes a
-    regression introduced 362557e.
 
-    Fixes #19419
+## Rails 6.1.0 (December 09, 2020) ##
 
-    *Justin Coyne*
+*   SanitizeHelper.sanitized_allowed_attributes and SanitizeHelper.sanitized_allowed_tags
+    call safe_list_sanitizer's class method
 
-*   `number_to_percentage` does not crash with `Float::NAN` or `Float::INFINITY`
-    as input when `precision: 0` is used.
+    Fixes #39586
 
-    Fixes #19227.
+    *Taufiq Muhammadi*
 
-    *Yves Senn*
+*   Change form_with to generate non-remote forms by default.
 
+    `form_with` would generate a remote form by default. This would confuse
+    users because they were forced to handle remote requests.
 
-## Rails 4.2.2 (June 16, 2015) ##
+    All new 6.1 applications will generate non-remote forms by default.
+    When upgrading a 6.0 application you can enable remote forms by default by
+    setting `config.action_view.form_with_generates_remote_forms` to `true`.
 
-* No Changes *
+    *Petrik de Heus*
 
+*   Yield translated strings to calls of `ActionView::FormBuilder#button`
+    when a block is given.
 
-## Rails 4.2.1 (March 19, 2015) ##
+    *Sean Doyle*
 
-*   Default translations that have a lower precedence than an html safe default,
-    but are not themselves safe, should not be marked as html_safe.
+*   Alias `ActionView::Helpers::Tags::Label::LabelBuilder#translation` to
+    `#to_s` so that `form.label` calls can yield that value to their blocks.
 
-    *Justin Coyne*
+    *Sean Doyle*
 
-*   Added an explicit error message, in `ActionView::PartialRenderer`
-    for partial `rendering`, when the value of option `as` has invalid characters.
+*   Rename the new `TagHelper#class_names` method to `TagHelper#token_list`,
+    and make the original available as an alias.
 
-    *Angelo Capilleri*
+        token_list("foo", "foo bar")
+        # => "foo bar"
 
+    *Sean Doyle*
 
-## Rails 4.2.0 (December 20, 2014) ##
+*   ARIA Array and Hash attributes are treated as space separated `DOMTokenList`
+    values. This is useful when declaring lists of label text identifiers in
+    `aria-labelledby` or `aria-describedby`.
 
-*   Local variable in a partial is now available even if a falsy value is
-    passed to `:object` when rendering a partial.
+        tag.input type: 'checkbox', name: 'published', aria: {
+          invalid: @post.errors[:published].any?,
+          labelledby: ['published_context', 'published_label'],
+          describedby: { published_errors: @post.errors[:published].any? }
+        }
+        #=> <input
+              type="checkbox" name="published" aria-invalid="true"
+              aria-labelledby="published_context published_label"
+              aria-describedby="published_errors"
+            >
 
-    Fixes #17373.
+    *Sean Doyle*
 
-    *Agis Anastasopoulos*
+*   Remove deprecated `escape_whitelist` from `ActionView::Template::Handlers::ERB`.
 
-*   Add support for `:enforce_utf8` option in `form_for`.
+    *Rafael Mendonça França*
 
-    This is the same option that was added in 06388b0 to `form_tag` and allows
-    users to skip the insertion of the UTF8 enforcer tag in a form.
+*   Remove deprecated `find_all_anywhere` from `ActionView::Resolver`.
 
-    * claudiob *
+    *Rafael Mendonça França*
 
-*   Fix a bug that <%= foo(){ %> and <%= foo()do %> in view templates were not regarded
-    as Ruby block calls.
+*   Remove deprecated `formats` from `ActionView::Template::HTML`.
 
-    * Akira Matsuda *
+    *Rafael Mendonça França*
 
-*   Update `select_tag` to work correctly with `:include_blank` option passing a string.
+*   Remove deprecated `formats` from `ActionView::Template::RawFile`.
 
-    Fixes #16483.
+    *Rafael Mendonça França*
 
-    *Frank Groeneveld*
+*   Remove deprecated `formats` from `ActionView::Template::Text`.
 
-*   Changed the meaning of `render "foo/bar"`.
+    *Rafael Mendonça França*
 
-    Previously, calling `render "foo/bar"` in a controller action is equivalent
-    to `render file: "foo/bar"`. In Rails 4.2, this has been changed to mean
-    `render template: "foo/bar"` instead. If you need to render a file, please
-    change your code to use the explicit form (`render file: "foo/bar"`) instead.
+*   Remove deprecated `find_file` from `ActionView::PathSet`.
 
-    *Jeremy Jackson*
+    *Rafael Mendonça França*
 
-*   Add support for ARIA attributes in tags.
+*   Remove deprecated `rendered_format` from `ActionView::LookupContext`.
 
-    Example:
+    *Rafael Mendonça França*
 
-        <%= f.text_field :name, aria: { required: "true", hidden: "false" } %>
+*   Remove deprecated `find_file` from `ActionView::ViewPaths`.
 
-    now generates:
+    *Rafael Mendonça França*
 
-         <input aria-hidden="false" aria-required="true" id="user_name" name="user[name]" type="text">
+*   Require that `ActionView::Base` subclasses implement `#compiled_method_container`.
 
-    *Paola Garcia Casadiego*
+    *Rafael Mendonça França*
 
-*   Provide a `builder` object when using the `label` form helper in block form.
+*   Remove deprecated support to pass an object that is not a `ActionView::LookupContext` as the first argument
+    in `ActionView::Base#initialize`.
 
-    The new `builder` object responds to `translation`, allowing I18n fallback support
-    when you want to customize how a particular label is presented.
+    *Rafael Mendonça França*
 
-    *Alex Robbin*
+*   Remove deprecated `format` argument `ActionView::Base#initialize`.
 
-*   Add I18n support for input/textarea placeholder text.
+    *Rafael Mendonça França*
 
-    Placeholder I18n follows the same convention as `label` I18n.
+*   Remove deprecated `ActionView::Template#refresh`.
 
-    *Alex Robbin*
+    *Rafael Mendonça França*
 
-*   Fix that render layout: 'messages/layout' should also be added to the dependency tracker tree.
+*   Remove deprecated `ActionView::Template#original_encoding`.
 
-    *DHH*
+    *Rafael Mendonça França*
 
-*   Add `PartialIteration` object used when rendering collections.
+*   Remove deprecated `ActionView::Template#variants`.
 
-    The iteration object is available as the local variable
-    `#{template_name}_iteration` when rendering partials with collections.
+    *Rafael Mendonça França*
 
-    It gives access to the `size` of the collection being iterated over,
-    the current `index` and two convenience methods `first?` and `last?`.
+*   Remove deprecated `ActionView::Template#formats`.
 
-    *Joel Junström*, *Lucas Uyezu*
+    *Rafael Mendonça França*
 
-*   Return an absolute instead of relative path from an asset url in the case
-    of the `asset_host` proc returning nil.
+*   Remove deprecated `ActionView::Template#virtual_path=`.
 
-    *Jolyon Pawlyn*
+    *Rafael Mendonça França*
 
-*   Fix `html_escape_once` to properly handle hex escape sequences (e.g. &#x1a2b;).
+*   Remove deprecated `ActionView::Template#updated_at`.
 
-    *John F. Douthat*
+    *Rafael Mendonça França*
 
-*   Added String support for min and max properties for date field helpers.
+*   Remove deprecated `updated_at` argument required on `ActionView::Template#initialize`.
 
-    *Todd Bealmear*
+    *Rafael Mendonça França*
 
-*   The `highlight` helper now accepts a block to be used instead of the `highlighter`
-    option.
+*   Make `locals` argument required on `ActionView::Template#initialize`.
 
-    *Lucas Mazza*
+    *Rafael Mendonça França*
 
-*   The `except` and `highlight` helpers now accept regular expressions.
+*   Remove deprecated `ActionView::Template.finalize_compiled_template_methods`.
 
-    *Jan Szumiec*
+    *Rafael Mendonça França*
 
-*   Flatten the array parameter in `safe_join`, so it behaves consistently with
-    `Array#join`.
+*   Remove deprecated `config.action_view.finalize_compiled_template_methods`
 
-    *Paul Grayson*
+    *Rafael Mendonça França*
 
-*   Honor `html_safe` on array elements in tag values, as we do for plain string
-    values.
+*   Remove deprecated support to calling `ActionView::ViewPaths#with_fallback` with a block.
 
-    *Paul Grayson*
+    *Rafael Mendonça França*
 
-*   Add `ActionView::Template::Handler.unregister_template_handler`.
+*   Remove deprecated support to passing absolute paths to `render template:`.
 
-    It performs the opposite of `ActionView::Template::Handler.register_template_handler`.
+    *Rafael Mendonça França*
 
-    *Zuhao Wan*
+*   Remove deprecated support to passing relative paths to `render file:`.
 
-*   Bring `cache_digest` rake tasks up-to-date with the latest API changes.
+    *Rafael Mendonça França*
 
-    *Jiri Pospisil*
+*   Remove support to template handlers that don't accept two arguments.
 
-*   Allow custom `:host` option to be passed to `asset_url` helper that
-    overwrites `config.action_controller.asset_host` for particular asset.
+    *Rafael Mendonça França*
 
-    *Hubert Łępicki*
+*   Remove deprecated pattern argument in `ActionView::Template::PathResolver`.
 
-*   Deprecate `AbstractController::Base.parent_prefixes`.
-    Override `AbstractController::Base.local_prefixes` when you want to change
-    where to find views.
+    *Rafael Mendonça França*
 
-    *Nick Sutterer*
+*   Remove deprecated support to call private methods from object in some view helpers.
 
-*   Take label values into account when doing I18n lookups for model attributes.
+    *Rafael Mendonça França*
 
-    The following:
+*   `ActionView::Helpers::TranslationHelper#translate` accepts a block, yielding
+    the translated text and the fully resolved translation key:
 
-        # form.html.erb
-        <%= form_for @post do |f| %>
-          <%= f.label :type, value: "long" %>
+        <%= translate(".relative_key") do |translation, resolved_key| %>
+          <span title="<%= resolved_key %>"><%= translation %></span>
         <% end %>
 
-        # en.yml
-        en:
-          activerecord:
-            attributes:
-              post/long: "Long-form Post"
+    *Sean Doyle*
 
-    Used to simply return "long", but now it will return "Long-form
-    Post".
+*   Ensure cache fragment digests include all relevant template dependencies when
+    fragments are contained in a block passed to the render helper. Remove the
+    virtual_path keyword arguments found in CacheHelper as they no longer possess
+    any function following 1581cab.
 
-    *Joshua Cody*
+    Fixes #38984.
 
-*   Change `asset_path` to use File.join to create proper paths:
+    *Aaron Lipman*
 
-    Before:
+*   Deprecate `config.action_view.raise_on_missing_translations` in favor of
+    `config.i18n.raise_on_missing_translations`.
 
-        https://some.host.com//assets/some.js
+    New generalized configuration option now determines whether an error should be raised
+    for missing translations in controllers and views.
 
-    After:
+    *fatkodima*
 
-        https://some.host.com/assets/some.js
+*   Instrument layout rendering in `TemplateRenderer#render_with_layout` as `render_layout.action_view`,
+    and include (when necessary) the layout's virtual path in notification payloads for collection and partial renders.
 
-    *Peter Schröder*
+    *Zach Kemp*
 
-*   Change `favicon_link_tag` default mimetype from `image/vnd.microsoft.icon` to
-    `image/x-icon`.
+*   `ActionView::Base.annotate_rendered_view_with_filenames` annotates HTML output with template file names.
 
-    Before:
+    *Joel Hawksley*, *Aaron Patterson*
 
-        # => favicon_link_tag 'myicon.ico'
-        <link href="/assets/myicon.ico" rel="shortcut icon" type="image/vnd.microsoft.icon" />
+*   `ActionView::Helpers::TranslationHelper#translate` returns nil when
+    passed `default: nil` without a translation matching `I18n#translate`.
 
-    After:
+    *Stefan Wrobel*
 
-        # => favicon_link_tag 'myicon.ico'
-        <link href="/assets/myicon.ico" rel="shortcut icon" type="image/x-icon" />
+*   `OptimizedFileSystemResolver` prefers template details in order of locale,
+    formats, variants, handlers.
 
-    *Geoffroy Lorieux*
+    *Iago Pimenta*
 
-*   Remove wrapping div with inline styles for hidden form fields.
+*   Added `class_names` helper to create a CSS class value with conditional classes.
 
-    We are dropping HTML 4.01 and XHTML strict compliance since input tags directly
-    inside a form are valid HTML5, and the absence of inline styles help in validating
-    for Content Security Policy.
+    *Joel Hawksley*, *Aaron Patterson*
 
-    *Joost Baaij*
+*   Add support for conditional values to TagBuilder.
 
-*   `collection_check_boxes` respects `:index` option for the hidden field name.
+    *Joel Hawksley*
 
-    Fixes #14147.
+*   `ActionView::Helpers::FormOptionsHelper#select` should mark option for `nil` as selected.
 
-    *Vasiliy Ermolovich*
+    ```ruby
+    @post = Post.new
+    @post.category = nil
+
+    # Before
+    select("post", "category", none: nil, programming: 1, economics: 2)
+    # =>
+    # <select name="post[category]" id="post_category">
+    #   <option value="">none</option>
+    #  <option value="1">programming</option>
+    #  <option value="2">economics</option>
+    # </select>
+
+    # After
+    select("post", "category", none: nil, programming: 1, economics: 2)
+    # =>
+    # <select name="post[category]" id="post_category">
+    #   <option selected="selected" value="">none</option>
+    #  <option value="1">programming</option>
+    #  <option value="2">economics</option>
+    # </select>
+    ```
+
+    *bogdanvlviv*
+
+*   Log lines for partial renders and started template renders are now
+    emitted at the `DEBUG` level instead of `INFO`.
+
+    Completed template renders are still logged at the `INFO` level.
+
+    *DHH*
 
-*   `date_select` helper with option `with_css_classes: true` does not overwrite other classes.
+*   ActionView::Helpers::SanitizeHelper: support rails-html-sanitizer 1.1.0.
 
-    *Izumi Wong-Horiuchi*
+    *Juanito Fatas*
 
-*   `number_to_percentage` does not crash with `Float::NAN` or `Float::INFINITY`
-    as input.
+*   Added `phone_to` helper method to create a link from mobile numbers.
 
-    Fixes #14405.
+    *Pietro Moro*
 
-    *Yves Senn*
+*   annotated_source_code returns an empty array so TemplateErrors without a
+    template in the backtrace are surfaced properly by DebugExceptions.
 
-*   Add `include_hidden` option to `collection_check_boxes` helper.
+    *Guilherme Mansur*, *Kasper Timm Hansen*
 
-    *Vasiliy Ermolovich*
+*   Add autoload for SyntaxErrorInTemplate so syntax errors are correctly raised by DebugExceptions.
 
-*   Fixed a problem where the default options for the `button_tag` helper are not
-    applied correctly.
+    *Guilherme Mansur*, *Gannon McGibbon*
 
-    Fixes #14254.
+*   `RenderingHelper` supports rendering objects that `respond_to?` `:render_in`.
 
-    *Sergey Prikhodko*
+    *Joel Hawksley*, *Natasha Umer*, *Aaron Patterson*, *Shawn Allen*, *Emily Plummer*, *Diana Mounter*, *John Hawthorn*, *Nathan Herald*, *Zaid Zawaideh*, *Zach Ahn*
 
-*   Take variants into account when calculating template digests in ActionView::Digestor.
+*   Fix `select_tag` so that it doesn't change `options` when `include_blank` is present.
 
-    The arguments to ActionView::Digestor#digest are now being passed as a hash
-    to support variants and allow more flexibility in the future. The support for
-    regular (required) arguments is deprecated and will be removed in Rails 5.0 or later.
+    *Younes SERRAJ*
 
-    *Piotr Chmolowski, Łukasz Strzałkowski*
 
-Please check [4-1-stable](https://github.com/rails/rails/blob/4-1-stable/actionview/CHANGELOG.md) for previous changes.
+Please check [6-0-stable](https://github.com/rails/rails/blob/6-0-stable/actionview/CHANGELOG.md) for previous changes.

data/MIT-LICENSE

@@ -1,4 +1,4 @@
-Copyright (c) 2004-2014 David Heinemeier Hansson
+Copyright (c) 2004-2022 David Heinemeier Hansson
 
 Permission is hereby granted, free of charge, to any person obtaining
 a copy of this software and associated documentation files (the
@@ -18,4 +18,3 @@ NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
 LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
 OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
 WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-