actionview 4.2.11.1 → 7.0.2.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 71fb7b73001ccc9220ba0da089fc3336a3a18620ca13a18730fa91d4799fbf58
-  data.tar.gz: a87ef6a72900a81c7cff2d00f3fac65006c0f95935b7bf366c1f4bfa1210b6d1
+  metadata.gz: 05b202fb72d79b08cc80097deb5e09fda321f310a8a06c361599e95a76c16cfc
+  data.tar.gz: 64d8271b6a06f9de6f6692b96a1ba3016b53d10b068df1c41db4c81094e642d3
 SHA512:
-  metadata.gz: ea93cb6a5de3af579900cf1534b50842c6d197062ee7a01a9f499287dbbb8f6f3d9c32abfadba3c2d1868b8deddc70594c3e5767744031e47961d5da15cb5e54
-  data.tar.gz: e59b44cf756ed5bf55ef96709055a04413dfba03fa083c32ef709eb266267ac774bc7d83c08c696a16c98e5dd93a412a531372eee7546bcc8e856e1304dcf618
+  metadata.gz: 42594ba6f50e9611210173d7a4e42351c928acf1024ea33858d91679b20df6d8fb5b49aa7f21ee147827efcf005ffdb60025cc15293d4f462c1927c3c251155e
+  data.tar.gz: ac02f50538a88bc0fec35186567e376c95908cc791b500b24fbcdcbc9ae0a0c839a0f9245e9fae67ea6dde9304e53fe62ad30f0ad4bdf96aced044651df7f4f8

data/CHANGELOG.md

@@ -1,357 +1,371 @@
-## Rails 4.2.11.1 (March 11, 2019) ##
+## Rails 7.0.2.4 (April 26, 2022) ##
 
-*   No changes.
-
-
-## Rails 4.2.11 (November 27, 2018) ##
+*   Fix and add protections for XSS in `ActionView::Helpers` and `ERB::Util`.
 
-*   No changes.
+    Escape dangerous characters in names of tags and names of attributes in the
+    tag helpers, following the XML specification. Rename the option
+    `:escape_attributes` to `:escape`, to simplify by applying the option to the
+    whole tag.
 
+    *Álvaro Martín Fraguas*
 
-## Rails 4.2.10 (September 27, 2017) ##
+## Rails 7.0.2.3 (March 08, 2022) ##
 
 *   No changes.
 
 
-## Rails 4.2.9 (June 26, 2017) ##
+## Rails 7.0.2.2 (February 11, 2022) ##
 
 *   No changes.
 
 
-## Rails 4.2.8 (February 21, 2017) ##
+## Rails 7.0.2.1 (February 11, 2022) ##
 
 *   No changes.
 
 
-## Rails 4.2.7 (July 12, 2016) ##
-
-*   No changes.
-
-
-## Rails 4.2.6 (March 07, 2016) ##
-
-*   Fix stripping the digest from the automatically generated img tag alt
-    attribute when assets are handled by Sprockets >=3.0.
-
-    *Bart de Water*
-
-*   Create a new `ActiveSupport::SafeBuffer` instance when `content_for` is flushed.
+## Rails 7.0.2 (February 08, 2022) ##
 
-    Fixes #19890
+*   Ensure `preload_link_tag` preloads JavaScript modules correctly.
 
-    *Yoong Kang Lim*
+    *Máximo Mussini*
 
-*   Respect value of `:object` if `:object` is false when rendering.
+*   Fix `stylesheet_link_tag` and similar helpers are being used to work in objects with
+    a `response` method.
 
-    Fixes #22260.
+    *dark-panda*
 
-    *Yuichiro Kaneko*
 
-*   Generate `week_field` input values using a 1-based index and not a 0-based index
-    as per the W3 spec: http://www.w3.org/TR/html-markup/datatypes.html#form.data.week
+## Rails 7.0.1 (January 06, 2022) ##
 
-    *Christoph Geschwind*
+*   Fix `button_to` to work with a hash parameter as URL.
 
+    *MingyuanQin*
 
-## Rails 4.2.5.2 (February 26, 2016) ##
+*   Fix `link_to` with a model passed as an argument twice.
 
-*   Do not allow render with unpermitted parameter.
+    *Alex Ghiculescu*
 
-    Fixes CVE-2016-2098.
 
-    *Arthur Neves*
+## Rails 7.0.0 (December 15, 2021) ##
 
+*   Support `include_hidden:` option in calls to
+    `ActionView::Helper::FormBuilder#file_field` with `multiple: true` to
+    support submitting an empty collection of files.
 
-## Rails 4.2.5.1 (January 25, 2015) ##
+    ```ruby
+    form.file_field :attachments, multiple: true
+    # => <input type="hidden" autocomplete="off" name="post[attachments][]" value="">
+         <input type="file" multiple="multiple" id="post_attachments" name="post[attachments][]">
 
-*   Adds boolean argument outside_app_allowed to `ActionView::Resolver#find_templates`
-    method.
+    form.file_field :attachments, multiple: true, include_hidden: false
+    # => <input type="file" multiple="multiple" id="post_attachments" name="post[attachments][]">
+    ```
 
-    *Aaron Patterson*
+    *Sean Doyle*
 
+*   Fix `number_with_precision(raise: true)` always raising even on valid numbers.
 
-## Rails 4.2.5 (November 12, 2015) ##
+    *Pedro Moreira*
 
-*   Fix `mail_to` when called with `nil` as argument.
 
-    *Rafael Mendonça França*
+## Rails 7.0.0.rc3 (December 14, 2021) ##
 
-*   `url_for` does not modify its arguments when generating polymorphic URLs.
-
-    *Bernerd Schaefer*
-
-
-## Rails 4.2.4 (August 24, 2015) ##
-
-* No Changes *
-
-
-## Rails 4.2.3 (June 25, 2015) ##
-
-*   `translate` should handle `raise` flag correctly in case of both main and default
-    translation is missing.
+*   No changes.
 
-    Fixes #19967
 
-    *Bernard Potocki*
+## Rails 7.0.0.rc2 (December 14, 2021) ##
 
-*   `translate` allows `default: [[]]` again for a default value of `[]`.
+*   No changes.
 
-    Fixes #19640.
+## Rails 7.0.0.rc1 (December 06, 2021) ##
 
-    *Adam Prescott*
+*   Support `fields model: [@nested, @model]` the same way as `form_with model:
+    [@nested, @model]`.
 
-*   `translate` should accept nils as members of the `:default`
-    parameter without raising a translation missing error.  Fixes a
-    regression introduced 362557e.
+    *Sean Doyle*
 
-    Fixes #19419
+*   Infer HTTP verb `[method]` from a model or Array with model as the first
+    argument to `button_to` when combined with a block:
 
-    *Justin Coyne*
+    ```ruby
+    button_to(Workshop.find(1)){ "Update" }
+    #=> <form method="post" action="/workshops/1" class="button_to">
+    #=>   <input type="hidden" name="_method" value="patch" autocomplete="off" />
+    #=>   <button type="submit">Update</button>
+    #=> </form>
 
-*   `number_to_percentage` does not crash with `Float::NAN` or `Float::INFINITY`
-    as input when `precision: 0` is used.
+    button_to([ Workshop.find(1), Session.find(1) ]) { "Update" }
+    #=> <form method="post" action="/workshops/1/sessions/1" class="button_to">
+    #=>   <input type="hidden" name="_method" value="patch" autocomplete="off" />
+    #=>   <button type="submit">Update</button>
+    #=> </form>
+    ```
 
-    Fixes #19227.
+    *Sean Doyle*
 
-    *Yves Senn*
+*   Support passing a Symbol as the first argument to `FormBuilder#button`:
 
+    ```ruby
+    form.button(:draft, value: true)
+    # => <button name="post[draft]" value="true" type="submit">Create post</button>
 
-## Rails 4.2.2 (June 16, 2015) ##
+    form.button(:draft, value: true) do
+      content_tag(:strong, "Save as draft")
+    end
+    # =>  <button name="post[draft]" value="true" type="submit">
+    #       <strong>Save as draft</strong>
+    #     </button>
+    ```
 
-* No Changes *
+    *Sean Doyle*
 
+*   Introduce the `field_name` view helper, along with the
+    `FormBuilder#field_name` counterpart:
 
-## Rails 4.2.1 (March 19, 2015) ##
+    ```ruby
+    form_for @post do |f|
+      f.field_tag :tag, name: f.field_name(:tag, multiple: true)
+      # => <input type="text" name="post[tag][]">
+    end
+    ```
 
-*   Default translations that have a lower precedence than an html safe default,
-    but are not themselves safe, should not be marked as html_safe.
+    *Sean Doyle*
 
-    *Justin Coyne*
+*   Execute the `ActionView::Base.field_error_proc` within the context of the
+    `ActionView::Base` instance:
 
-*   Added an explicit error message, in `ActionView::PartialRenderer`
-    for partial `rendering`, when the value of option `as` has invalid characters.
+    ```ruby
+    config.action_view.field_error_proc = proc { |html| content_tag(:div, html, class: "field_with_errors") }
+    ```
 
-    *Angelo Capilleri*
+    *Sean Doyle*
 
+*   Add support for `button_to ..., authenticity_token: false`
 
-## Rails 4.2.0 (December 20, 2014) ##
+    ```ruby
+    button_to "Create", Post.new, authenticity_token: false
+    # => <form class="button_to" method="post" action="/posts"><button type="submit">Create</button></form>
 
-*   Local variable in a partial is now available even if a falsy value is
-    passed to `:object` when rendering a partial.
+    button_to "Create", Post.new, authenticity_token: true
+    # => <form class="button_to" method="post" action="/posts"><button type="submit">Create</button><input type="hidden" name="form_token" value="abc123..." autocomplete="off" /></form>
 
-    Fixes #17373.
+    button_to "Create", Post.new, authenticity_token: "secret"
+    # => <form class="button_to" method="post" action="/posts"><button type="submit">Create</button><input type="hidden" name="form_token" value="secret" autocomplete="off" /></form>
+    ```
 
-    *Agis Anastasopoulos*
+    *Sean Doyle*
 
-*   Add support for `:enforce_utf8` option in `form_for`.
+*   Support rendering `<form>` elements _without_ `[action]` attributes by:
 
-    This is the same option that was added in 06388b0 to `form_tag` and allows
-    users to skip the insertion of the UTF8 enforcer tag in a form.
+    * `form_with url: false` or `form_with ..., html: { action: false }`
+    * `form_for ..., url: false` or `form_for ..., html: { action: false }`
+    * `form_tag false` or `form_tag ..., action: false`
+    * `button_to "...", false` or `button_to(false) { ... }`
 
-    * claudiob *
+    *Sean Doyle*
 
-*   Fix a bug that <%= foo(){ %> and <%= foo()do %> in view templates were not regarded
-    as Ruby block calls.
+*   Add `:day_format` option to `date_select`
 
-    * Akira Matsuda *
+        date_select("article", "written_on", day_format: ->(day) { day.ordinalize })
+        # generates day options like <option value="1">1st</option>\n<option value="2">2nd</option>...
 
-*   Update `select_tag` to work correctly with `:include_blank` option passing a string.
+    *Shunichi Ikegami*
 
-    Fixes #16483.
+*   Allow `link_to` helper to infer link name from `Model#to_s` when it
+    is used with a single argument:
 
-    *Frank Groeneveld*
+        link_to @profile
+        #=> <a href="/profiles/1">Eileen</a>
 
-*   Changed the meaning of `render "foo/bar"`.
+    This assumes the model class implements a `to_s` method like this:
 
-    Previously, calling `render "foo/bar"` in a controller action is equivalent
-    to `render file: "foo/bar"`. In Rails 4.2, this has been changed to mean
-    `render template: "foo/bar"` instead. If you need to render a file, please
-    change your code to use the explicit form (`render file: "foo/bar"`) instead.
+        class Profile < ApplicationRecord
+          # ...
+          def to_s
+            name
+          end
+        end
 
-    *Jeremy Jackson*
+    Previously you had to supply a second argument even if the `Profile`
+    model implemented a `#to_s` method that called the `name` method.
 
-*   Add support for ARIA attributes in tags.
+        link_to @profile, @profile.name
+        #=> <a href="/profiles/1">Eileen</a>
 
-    Example:
+    *Olivier Lacan*
 
-        <%= f.text_field :name, aria: { required: "true", hidden: "false" } %>
+*   Support svg unpaired tags for `tag` helper.
 
-    now generates:
+        tag.svg { tag.use('href' => "#cool-icon") }
+        # => <svg><use href="#cool-icon"></svg>
 
-         <input aria-hidden="false" aria-required="true" id="user_name" name="user[name]" type="text">
+    *Oleksii Vasyliev*
 
-    *Paola Garcia Casadiego*
 
-*   Provide a `builder` object when using the `label` form helper in block form.
+## Rails 7.0.0.alpha2 (September 15, 2021) ##
 
-    The new `builder` object responds to `translation`, allowing I18n fallback support
-    when you want to customize how a particular label is presented.
+*   No changes.
 
-    *Alex Robbin*
 
-*   Add I18n support for input/textarea placeholder text.
+## Rails 7.0.0.alpha1 (September 15, 2021) ##
 
-    Placeholder I18n follows the same convention as `label` I18n.
+*   Improves the performance of ActionView::Helpers::NumberHelper formatters by avoiding the use of
+    exceptions as flow control.
 
-    *Alex Robbin*
+    *Mike Dalessio*
 
-*   Fix that render layout: 'messages/layout' should also be added to the dependency tracker tree.
+*   `preload_link_tag` properly inserts `as` attributes for files with `image` MIME types, such as JPG or SVG.
 
-    *DHH*
+    *Nate Berkopec*
 
-*   Add `PartialIteration` object used when rendering collections.
+*   Add `weekday_options_for_select` and `weekday_select` helper methods. Also adds `weekday_select` to `FormBuilder`.
 
-    The iteration object is available as the local variable
-    `#{template_name}_iteration` when rendering partials with collections.
+    *Drew Bragg*, *Dana Kashubeck*, *Kasper Timm Hansen*
 
-    It gives access to the `size` of the collection being iterated over,
-    the current `index` and two convenience methods `first?` and `last?`.
+*   Add `caching?` helper that returns whether the current code path is being cached and `uncacheable!` to denote helper methods that can't participate in fragment caching.
 
-    *Joel Junström*, *Lucas Uyezu*
+    *Ben Toews*, *John Hawthorn*, *Kasper Timm Hansen*, *Joel Hawksley*
 
-*   Return an absolute instead of relative path from an asset url in the case
-    of the `asset_host` proc returning nil.
+*   Add `include_seconds` option for `time_field`.
 
-    *Jolyon Pawlyn*
+        <%= form.time_field :foo, include_seconds: false %>
+        # => <input value="16:22" type="time" />
 
-*   Fix `html_escape_once` to properly handle hex escape sequences (e.g. &#x1a2b;).
+    Default includes seconds:
 
-    *John F. Douthat*
+        <%= form.time_field :foo %>
+        # => <input value="16:22:01.440" type="time" />
 
-*   Added String support for min and max properties for date field helpers.
+    This allows you to take advantage of [different rendering options](https://developer.mozilla.org/en-US/docs/Web/HTML/Element/input/time#time_value_format) in some browsers.
 
-    *Todd Bealmear*
+    *Alex Ghiculescu*
 
-*   The `highlight` helper now accepts a block to be used instead of the `highlighter`
-    option.
+*   Improve error messages when template file does not exist at absolute filepath.
 
-    *Lucas Mazza*
+    *Ted Whang*
 
-*   The `except` and `highlight` helpers now accept regular expressions.
+*   Add `:country_code` option to `sms_to` for consistency with `phone_to`.
 
-    *Jan Szumiec*
+    *Jonathan Hefner*
 
-*   Flatten the array parameter in `safe_join`, so it behaves consistently with
-    `Array#join`.
+*   OpenSSL constants are now used for Digest computations.
 
-    *Paul Grayson*
+    *Dirkjan Bussink*
 
-*   Honor `html_safe` on array elements in tag values, as we do for plain string
-    values.
+*   The `translate` helper now passes `default` values that aren't
+    translation keys through `I18n.translate` for interpolation.
 
-    *Paul Grayson*
+    *Jonathan Hefner*
 
-*   Add `ActionView::Template::Handler.unregister_template_handler`.
+*   Adds option `extname` to `stylesheet_link_tag` to skip default
+    `.css` extension appended to the stylesheet path.
 
-    It performs the opposite of `ActionView::Template::Handler.register_template_handler`.
+    Before:
 
-    *Zuhao Wan*
+    ```ruby
+    stylesheet_link_tag "style.less"
+    # <link href="/stylesheets/style.less.scss" rel="stylesheet">
+    ```
 
-*   Bring `cache_digest` rake tasks up-to-date with the latest API changes.
+    After:
 
-    *Jiri Pospisil*
+    ```ruby
+    stylesheet_link_tag "style.less", extname: false, skip_pipeline: true, rel: "stylesheet/less"
+    # <link href="/stylesheets/style.less" rel="stylesheet/less">
+    ```
 
-*   Allow custom `:host` option to be passed to `asset_url` helper that
-    overwrites `config.action_controller.asset_host` for particular asset.
+    *Abhay Nikam*
 
-    *Hubert Łępicki*
+*   Deprecate `render` locals to be assigned to instance variables.
 
-*   Deprecate `AbstractController::Base.parent_prefixes`.
-    Override `AbstractController::Base.local_prefixes` when you want to change
-    where to find views.
+    *Petrik de Heus*
 
-    *Nick Sutterer*
+*   Remove legacy default `media=screen` from `stylesheet_link_tag`.
 
-*   Take label values into account when doing I18n lookups for model attributes.
+    *André Luis Leal Cardoso Junior*
 
-    The following:
+*   Change `ActionView::Helpers::FormBuilder#button` to transform `formmethod`
+    attributes into `_method="$VERB"` Form Data to enable varied same-form actions:
 
-        # form.html.erb
-        <%= form_for @post do |f| %>
-          <%= f.label :type, value: "long" %>
+        <%= form_with model: post, method: :put do %>
+          <%= form.button "Update" %>
+          <%= form.button "Delete", formmethod: :delete %>
         <% end %>
+        <%# => <form action="posts/1">
+            =>   <input type="hidden" name="_method" value="put">
+            =>   <button type="submit">Update</button>
+            =>   <button type="submit" formmethod="post" name="_method" value="delete">Delete</button>
+            => </form>
+        %>
 
-        # en.yml
-        en:
-          activerecord:
-            attributes:
-              post/long: "Long-form Post"
-
-    Used to simply return "long", but now it will return "Long-form
-    Post".
-
-    *Joshua Cody*
-
-*   Change `asset_path` to use File.join to create proper paths:
-
-    Before:
-
-        https://some.host.com//assets/some.js
-
-    After:
-
-        https://some.host.com/assets/some.js
+    *Sean Doyle*
 
-    *Peter Schröder*
+*   Change `ActionView::Helpers::UrlHelper#button_to` to *always* render a
+    `<button>` element, regardless of whether or not the content is passed as
+    the first argument or as a block.
 
-*   Change `favicon_link_tag` default mimetype from `image/vnd.microsoft.icon` to
-    `image/x-icon`.
+        <%= button_to "Delete", post_path(@post), method: :delete %>
+        # => <form action="/posts/1"><input type="hidden" name="_method" value="delete"><button type="submit">Delete</button></form>
 
-    Before:
-
-        # => favicon_link_tag 'myicon.ico'
-        <link href="/assets/myicon.ico" rel="shortcut icon" type="image/vnd.microsoft.icon" />
-
-    After:
-
-        # => favicon_link_tag 'myicon.ico'
-        <link href="/assets/myicon.ico" rel="shortcut icon" type="image/x-icon" />
-
-    *Geoffroy Lorieux*
+        <%= button_to post_path(@post), method: :delete do %>
+          Delete
+        <% end %>
+        # => <form action="/posts/1"><input type="hidden" name="_method" value="delete"><button type="submit">Delete</button></form>
 
-*   Remove wrapping div with inline styles for hidden form fields.
+    *Sean Doyle*, *Dusan Orlovic*
 
-    We are dropping HTML 4.01 and XHTML strict compliance since input tags directly
-    inside a form are valid HTML5, and the absence of inline styles help in validating
-    for Content Security Policy.
+*   Add `config.action_view.preload_links_header` to allow disabling of
+    the `Link` header being added by default when using `stylesheet_link_tag`
+    and `javascript_include_tag`.
 
-    *Joost Baaij*
+    *Andrew White*
 
-*   `collection_check_boxes` respects `:index` option for the hidden field name.
+*   The `translate` helper now resolves `default` values when a `nil` key is
+    specified, instead of always returning `nil`.
 
-    Fixes #14147.
+    *Jonathan Hefner*
 
-    *Vasiliy Ermolovich*
+*   Add `config.action_view.image_loading` to configure the default value of
+    the `image_tag` `:loading` option.
 
-*   `date_select` helper with option `with_css_classes: true` does not overwrite other classes.
+    By setting `config.action_view.image_loading = "lazy"`, an application can opt in to
+    lazy loading images sitewide, without changing view code.
 
-    *Izumi Wong-Horiuchi*
+    *Jonathan Hefner*
 
-*   `number_to_percentage` does not crash with `Float::NAN` or `Float::INFINITY`
-    as input.
+*   `ActionView::Helpers::FormBuilder#id` returns the value
+    of the `<form>` element's `id` attribute. With a `method` argument, returns
+    the `id` attribute for a form field with that name.
 
-    Fixes #14405.
+        <%= form_for @post do |f| %>
+          <%# ... %>
 
-    *Yves Senn*
+          <% content_for :sticky_footer do %>
+            <%= form.button(form: f.id) %>
+          <% end %>
+        <% end %>
 
-*   Add `include_hidden` option to `collection_check_boxes` helper.
+    *Sean Doyle*
 
-    *Vasiliy Ermolovich*
+*   `ActionView::Helpers::FormBuilder#field_id` returns the value generated by
+    the FormBuilder for the given attribute name.
 
-*   Fixed a problem where the default options for the `button_tag` helper are not
-    applied correctly.
+        <%= form_for @post do |f| %>
+          <%= f.label :title %>
+          <%= f.text_field :title, aria: { describedby: f.field_id(:title, :error) } %>
+          <%= tag.span("is blank", id: f.field_id(:title, :error) %>
+        <% end %>
 
-    Fixes #14254.
+    *Sean Doyle*
 
-    *Sergey Prikhodko*
+*   Add `tag.attributes` to transform a Hash into HTML Attributes, ready to be
+    interpolated into ERB.
 
-*   Take variants into account when calculating template digests in ActionView::Digestor.
+        <input <%= tag.attributes(type: :text, aria: { label: "Search" }) %> >
+        # => <input type="text" aria-label="Search">
 
-    The arguments to ActionView::Digestor#digest are now being passed as a hash
-    to support variants and allow more flexibility in the future. The support for
-    regular (required) arguments is deprecated and will be removed in Rails 5.0 or later.
+    *Sean Doyle*
 
-    *Piotr Chmolowski, Łukasz Strzałkowski*
 
-Please check [4-1-stable](https://github.com/rails/rails/blob/4-1-stable/actionview/CHANGELOG.md) for previous changes.
+Please check [6-1-stable](https://github.com/rails/rails/blob/6-1-stable/actionview/CHANGELOG.md) for previous changes.

data/MIT-LICENSE

@@ -1,4 +1,4 @@
-Copyright (c) 2004-2014 David Heinemeier Hansson
+Copyright (c) 2004-2022 David Heinemeier Hansson
 
 Permission is hereby granted, free of charge, to any person obtaining
 a copy of this software and associated documentation files (the