actionview 5.2.4.4 → 6.1.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 285d9a982fd985cc0c7b694548154f3e7b52dac3dfa42c9c7dbbd61d07f6ed81
-  data.tar.gz: e877ec1372d604047b00f5a665397a42952ca07f7ed470a7c64a7c8913630f1e
+  metadata.gz: a164a5f7ce09e84dfab86b45a2df631dc782f50fc22c0cbb92f967c95808de63
+  data.tar.gz: 9dd5e8614c436054ebb785df67171b16deb22bb8be3518d57ee8486613919d86
 SHA512:
-  metadata.gz: 6293206a2f96b9a349fe3f40f1f42fa81727e38e8333149b60df3bfd56afb39fced4f23c2643eb6fd477bf5b8095e1b31b70cd8f5abbe9d7c577fab225fadfa5
-  data.tar.gz: b5bffb0c64df5ba0640b1fbc0d4b75ca3e672f3172a4cd9c97280a35681be4419e82ac93b4093c6b2889c05fb26dd02e651e14c75e0aed98006ddadda2ca181d
+  metadata.gz: 3502d7dd7b2407ce4634afadcd61b2d654f248d91bf85d9f43bd6b1ad150fdd84a45b6f009a04d899be293d123be503a7e497b761c10a576bea6c9248140f599
+  data.tar.gz: 3b0695d10e6939424bf14a8cbcea85f6628de02d0a4de37266213883604be8a95daf65eb435cf32260dae4d8b8ad562af7c37a3b426a2589fd305056ec381361

data/CHANGELOG.md

@@ -1,176 +1,304 @@
-## Rails 5.2.4.4 (September 09, 2020) ##
+## Rails 6.1.1 (January 07, 2021) ##
 
-*   [CVE-2020-15169] Fix potential XSS vulnerability in the `translate`/`t` helper
+*   Fix lazy translation in partial with block.
+
+    *Marek Kasztelnik*
+
+*   Avoid extra `SELECT COUNT` queries when rendering Active Record collections.
+
+    *aar0nr*
+
+*   Link preloading keep integrity hashes in the header.
+
+    *Étienne Barrié*
+
+*   Add `config.action_view.preload_links_header` to allow disabling of
+    the `Link` header being added by default when using `stylesheet_link_tag`
+    and `javascript_include_tag`.
+
+    *Andrew White*
+
+*   The `translate` helper now resolves `default` values when a `nil` key is
+    specified, instead of always returning `nil`.
 
     *Jonathan Hefner*
 
 
-## Rails 5.2.4.3 (May 18, 2020) ##
+## Rails 6.1.0 (December 09, 2020) ##
 
-*   [CVE-2020-8167] Check that request is same-origin prior to including CSRF token in XHRs
+*   SanitizeHelper.sanitized_allowed_attributes and SanitizeHelper.sanitized_allowed_tags
+    call safe_list_sanitizer's class method
 
+    Fixes #39586
 
-## Rails 5.2.4.1 (December 18, 2019) ##
+    *Taufiq Muhammadi*
 
-*   No changes.
+*   Change form_with to generate non-remote forms by default.
 
+    `form_with` would generate a remote form by default. This would confuse
+    users because they were forced to handle remote requests.
 
-## Rails 5.2.4 (November 27, 2019) ##
+    All new 6.1 applications will generate non-remote forms by default.
+    When upgrading a 6.0 application you can enable remote forms by default by
+    setting `config.action_view.form_with_generates_remote_forms` to `true`.
 
-*   Allow programmatic click events to trigger Rails UJS click handlers.
-    Programmatic click events (eg. ones generated by `Rails.fire(link, "click")`) don't specify a button. These events were being incorrectly stopped by code meant to ignore scroll wheel and right clicks introduced in #34573.
+    *Petrik de Heus*
 
-    *Sudara Williams*
+*   Yield translated strings to calls of `ActionView::FormBuilder#button`
+    when a block is given.
 
+    *Sean Doyle*
 
-## Rails 5.2.3 (March 27, 2019) ##
+*   Alias `ActionView::Helpers::Tags::Label::LabelBuilder#translation` to
+    `#to_s` so that `form.label` calls can yield that value to their blocks.
 
-*   Prevent non-primary mouse keys from triggering Rails UJS click handlers.
-    Firefox fires click events even if the click was triggered by non-primary mouse keys such as right- or scroll-wheel-clicks.
-    For example, right-clicking a link such as the one described below (with an underlying ajax request registered on click) should not cause that request to occur.
+    *Sean Doyle*
 
-    ```
-    <%= link_to 'Remote', remote_path, class: 'remote', remote: true, data: { type: :json } %>
-    ```
+*   Rename the new `TagHelper#class_names` method to `TagHelper#token_list`,
+    and make the original available as an alias.
+
+        token_list("foo", "foo bar")
+        # => "foo bar"
+
+    *Sean Doyle*
+
+*   ARIA Array and Hash attributes are treated as space separated `DOMTokenList`
+    values. This is useful when declaring lists of label text identifiers in
+    `aria-labelledby` or `aria-describedby`.
+
+        tag.input type: 'checkbox', name: 'published', aria: {
+          invalid: @post.errors[:published].any?,
+          labelledby: ['published_context', 'published_label'],
+          describedby: { published_errors: @post.errors[:published].any? }
+        }
+        #=> <input
+              type="checkbox" name="published" aria-invalid="true"
+              aria-labelledby="published_context published_label"
+              aria-describedby="published_errors"
+            >
+
+    *Sean Doyle*
+
+*   Remove deprecated `escape_whitelist` from `ActionView::Template::Handlers::ERB`.
+
+    *Rafael Mendonça França*
 
-    Fixes #34541
+*   Remove deprecated `find_all_anywhere` from `ActionView::Resolver`.
 
-    *Wolfgang Hobmaier*
+    *Rafael Mendonça França*
 
+*   Remove deprecated `formats` from `ActionView::Template::HTML`.
 
-## Rails 5.2.2.1 (March 11, 2019) ##
+    *Rafael Mendonça França*
 
-*   Only accept formats from registered mime types
+*   Remove deprecated `formats` from `ActionView::Template::RawFile`.
 
-    A lack of filtering on mime types could allow an attacker to read
-    arbitrary files on the target server or to perform a denial of service
-    attack.
+    *Rafael Mendonça França*
 
-    Fixes CVE-2019-5418
-    Fixes CVE-2019-5419
+*   Remove deprecated `formats` from `ActionView::Template::Text`.
 
-    *John Hawthorn*, *Eileen M. Uchitelle*, *Aaron Patterson*
+    *Rafael Mendonça França*
 
+*   Remove deprecated `find_file` from `ActionView::PathSet`.
 
-## Rails 5.2.2 (December 04, 2018) ##
+    *Rafael Mendonça França*
 
-*   No changes.
+*   Remove deprecated `rendered_format` from `ActionView::LookupContext`.
 
+    *Rafael Mendonça França*
 
-## Rails 5.2.1.1 (November 27, 2018) ##
+*   Remove deprecated `find_file` from `ActionView::ViewPaths`.
 
-*   No changes.
+    *Rafael Mendonça França*
 
+*   Require that `ActionView::Base` subclasses implement `#compiled_method_container`.
 
-## Rails 5.2.1 (August 07, 2018) ##
+    *Rafael Mendonça França*
 
-*   Fix leak of `skip_default_ids` and `allow_method_names_outside_object` options
-    to HTML attributes.
+*   Remove deprecated support to pass an object that is not a `ActionView::LookupContext` as the first argument
+    in `ActionView::Base#initialize`.
 
-    *Yurii Cherniavskyi*
+    *Rafael Mendonça França*
 
-*   Fix issue with `button_to`'s `to_form_params`
+*   Remove deprecated `format` argument `ActionView::Base#initialize`.
 
-    `button_to` was throwing exception when invoked with `params` hash that
-    contains symbol and string keys. The reason for the exception was that
-    `to_form_params` was comparing the given symbol and string keys.
+    *Rafael Mendonça França*
 
-    The issue is fixed by turning all keys to strings inside
-    `to_form_params` before comparing them.
+*   Remove deprecated `ActionView::Template#refresh`.
 
-    *Georgi Georgiev*
+    *Rafael Mendonça França*
 
-*   Fix JavaScript views rendering does not work with Firefox when using
-    Content Security Policy.
+*   Remove deprecated `ActionView::Template#original_encoding`.
 
-    Fixes #32577.
+    *Rafael Mendonça França*
 
-    *Yuji Yaginuma*
+*   Remove deprecated `ActionView::Template#variants`.
 
-*   Add the `nonce: true` option for `javascript_include_tag` helper to
-    support automatic nonce generation for Content Security Policy.
-    Works the same way as `javascript_tag nonce: true` does.
+    *Rafael Mendonça França*
 
-    *Yaroslav Markin*
+*   Remove deprecated `ActionView::Template#formats`.
 
+    *Rafael Mendonça França*
 
-## Rails 5.2.0 (April 09, 2018) ##
+*   Remove deprecated `ActionView::Template#virtual_path=`.
 
-*   Pass the `:skip_pipeline` option in `image_submit_tag` when calling `path_to_image`.
+    *Rafael Mendonça França*
 
-    Fixes #32248.
+*   Remove deprecated `ActionView::Template#updated_at`.
 
-    *Andrew White*
+    *Rafael Mendonça França*
+
+*   Remove deprecated `updated_at` argument required on `ActionView::Template#initialize`.
+
+    *Rafael Mendonça França*
 
-*   Allow the use of callable objects as group methods for grouped selects.
+*   Make `locals` argument required on `ActionView::Template#initialize`.
 
-    Until now, the `option_groups_from_collection_for_select` method was only able to
-    handle method names as `group_method` and `group_label_method` parameters,
-    it is now able to receive procs and other callable objects too.
+    *Rafael Mendonça França*
 
-    *Jérémie Bonal*
+*   Remove deprecated `ActionView::Template.finalize_compiled_template_methods`.
 
-*   Add `preload_link_tag` helper.
+    *Rafael Mendonça França*
 
-    This helper that allows to the browser to initiate early fetch of resources
-    (different to the specified in `javascript_include_tag` and `stylesheet_link_tag`).
-    Additionally, this sends Early Hints if supported by browser.
+*   Remove deprecated `config.action_view.finalize_compiled_template_methods`
+
+    *Rafael Mendonça França*
 
-    *Guillermo Iguaran*
+*   Remove deprecated support to calling `ActionView::ViewPaths#with_fallback` with a block.
 
-*   Change `form_with` to generates ids by default.
+    *Rafael Mendonça França*
 
-    When `form_with` was introduced we disabled the automatic generation of ids
-    that was enabled in `form_for`. This usually is not an good idea since labels don't work
-    when the input doesn't have an id and it made harder to test with Capybara.
+*   Remove deprecated support to passing absolute paths to `render template:`.
 
-    You can still disable the automatic generation of ids setting `config.action_view.form_with_generates_ids`
-    to `false.`
+    *Rafael Mendonça França*
 
-    *Nick Pezza*
+*   Remove deprecated support to passing relative paths to `render file:`.
 
-*   Fix issues with `field_error_proc` wrapping `optgroup` and select divider `option`.
+    *Rafael Mendonça França*
 
-    Fixes #31088
+*   Remove support to template handlers that don't accept two arguments.
 
-    *Matthias Neumayr*
+    *Rafael Mendonça França*
 
-*   Remove deprecated Erubis ERB handler.
+*   Remove deprecated pattern argument in `ActionView::Template::PathResolver`.
 
     *Rafael Mendonça França*
 
-*   Remove default `alt` text generation.
+*   Remove deprecated support to call private methods from object in some view helpers.
+
+    *Rafael Mendonça França*
+
+*   `ActionView::Helpers::TranslationHelper#translate` accepts a block, yielding
+    the translated text and the fully resolved translation key:
+
+        <%= translate(".relative_key") do |translation, resolved_key| %>
+          <span title="<%= resolved_key %>"><%= translation %></span>
+        <% end %>
+
+    *Sean Doyle*
+
+*   Ensure cache fragment digests include all relevant template dependencies when
+    fragments are contained in a block passed to the render helper. Remove the
+    virtual_path keyword arguments found in CacheHelper as they no longer possess
+    any function following 1581cab.
+
+    Fixes #38984.
+
+    *Aaron Lipman*
+
+*   Deprecate `config.action_view.raise_on_missing_translations` in favor of
+    `config.i18n.raise_on_missing_translations`.
+
+    New generalized configuration option now determines whether an error should be raised
+    for missing translations in controllers and views.
+
+    *fatkodima*
+
+*   Instrument layout rendering in `TemplateRenderer#render_with_layout` as `render_layout.action_view`,
+    and include (when necessary) the layout's virtual path in notification payloads for collection and partial renders.
+
+    *Zach Kemp*
+
+*   `ActionView::Base.annotate_rendered_view_with_filenames` annotates HTML output with template file names.
+
+    *Joel Hawksley*, *Aaron Patterson*
+
+*   `ActionView::Helpers::TranslationHelper#translate` returns nil when
+    passed `default: nil` without a translation matching `I18n#translate`.
+
+    *Stefan Wrobel*
+
+*   `OptimizedFileSystemResolver` prefers template details in order of locale,
+    formats, variants, handlers.
+
+    *Iago Pimenta*
+
+*   Added `class_names` helper to create a CSS class value with conditional classes.
+
+    *Joel Hawksley*, *Aaron Patterson*
+
+*   Add support for conditional values to TagBuilder.
+
+    *Joel Hawksley*
+
+*   `ActionView::Helpers::FormOptionsHelper#select` should mark option for `nil` as selected.
+
+    ```ruby
+    @post = Post.new
+    @post.category = nil
+
+    # Before
+    select("post", "category", none: nil, programming: 1, economics: 2)
+    # =>
+    # <select name="post[category]" id="post_category">
+    #   <option value="">none</option>
+    #  <option value="1">programming</option>
+    #  <option value="2">economics</option>
+    # </select>
+
+    # After
+    select("post", "category", none: nil, programming: 1, economics: 2)
+    # =>
+    # <select name="post[category]" id="post_category">
+    #   <option selected="selected" value="">none</option>
+    #  <option value="1">programming</option>
+    #  <option value="2">economics</option>
+    # </select>
+    ```
+
+    *bogdanvlviv*
 
-    Fixes #30096
+*   Log lines for partial renders and started template renders are now
+    emitted at the `DEBUG` level instead of `INFO`.
 
-    *Cameron Cundiff*
+    Completed template renders are still logged at the `INFO` level.
 
-*   Add `srcset` option to `image_tag` helper.
+    *DHH*
 
-    *Roberto Miranda*
+*   ActionView::Helpers::SanitizeHelper: support rails-html-sanitizer 1.1.0.
 
-*   Fix issues with scopes and engine on `current_page?` method.
+    *Juanito Fatas*
 
-    Fixes #29401.
+*   Added `phone_to` helper method to create a link from mobile numbers.
 
-    *Nikita Savrov*
+    *Pietro Moro*
 
-*   Generate field ids in `collection_check_boxes` and `collection_radio_buttons`.
+*   annotated_source_code returns an empty array so TemplateErrors without a
+    template in the backtrace are surfaced properly by DebugExceptions.
 
-    This makes sure that the labels are linked up with the fields.
+    *Guilherme Mansur*, *Kasper Timm Hansen*
 
-    Fixes #29014.
+*   Add autoload for SyntaxErrorInTemplate so syntax errors are correctly raised by DebugExceptions.
 
-    *Yuji Yaginuma*
+    *Guilherme Mansur*, *Gannon McGibbon*
 
-*   Add `:json` type to `auto_discovery_link_tag` to support [JSON Feeds](https://jsonfeed.org/version/1).
+*   `RenderingHelper` supports rendering objects that `respond_to?` `:render_in`.
 
-    *Mike Gunderloy*
+    *Joel Hawksley*, *Natasha Umer*, *Aaron Patterson*, *Shawn Allen*, *Emily Plummer*, *Diana Mounter*, *John Hawthorn*, *Nathan Herald*, *Zaid Zawaideh*, *Zach Ahn*
 
-*   Update `distance_of_time_in_words` helper to display better error messages
-    for bad input.
+*   Fix `select_tag` so that it doesn't change `options` when `include_blank` is present.
 
-    *Jay Hayes*
+    *Younes SERRAJ*
 
 
-Please check [5-1-stable](https://github.com/rails/rails/blob/5-1-stable/actionview/CHANGELOG.md) for previous changes.
+Please check [6-0-stable](https://github.com/rails/rails/blob/6-0-stable/actionview/CHANGELOG.md) for previous changes.

data/MIT-LICENSE

@@ -1,4 +1,4 @@
-Copyright (c) 2004-2018 David Heinemeier Hansson
+Copyright (c) 2004-2020 David Heinemeier Hansson
 
 Permission is hereby granted, free of charge, to any person obtaining
 a copy of this software and associated documentation files (the

data/README.rdoc

@@ -5,6 +5,8 @@ view helpers that assist when building HTML forms, Atom feeds and more.
 Template formats that Action View handles are ERB (embedded Ruby, typically
 used to inline short Ruby snippets inside HTML), and XML Builder.
 
+You can read more about Action View in the {Action View Overview}[https://edgeguides.rubyonrails.org/action_view_overview.html] guide.
+
 == Download and installation
 
 The latest version of Action View can be installed with RubyGems:
@@ -13,7 +15,7 @@ The latest version of Action View can be installed with RubyGems:
 
 Source code can be downloaded as part of the Rails project on GitHub:
 
-* https://github.com/rails/rails/tree/5-2-stable/actionview
+* https://github.com/rails/rails/tree/master/actionview
 
 
 == License
@@ -27,7 +29,7 @@ Action View is released under the MIT license:
 
 API documentation is at
 
-* http://api.rubyonrails.org
+* https://api.rubyonrails.org
 
 Bug reports for the Ruby on Rails project can be filed here:
 
@@ -35,4 +37,4 @@ Bug reports for the Ruby on Rails project can be filed here:
 
 Feature requests should be discussed on the rails-core mailing list here:
 
-* https://groups.google.com/forum/?fromgroups#!forum/rubyonrails-core
+* https://discuss.rubyonrails.org/c/rubyonrails-core

data/lib/action_view.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 #--
-# Copyright (c) 2004-2018 David Heinemeier Hansson
+# Copyright (c) 2004-2020 David Heinemeier Hansson
 #
 # Permission is hereby granted, free of charge, to any person obtaining
 # a copy of this software and associated documentation files (the
@@ -35,7 +35,6 @@ module ActionView
   eager_autoload do
     autoload :Base
     autoload :Context
-    autoload :CompiledTemplates, "action_view/context"
     autoload :Digestor
     autoload :Helpers
     autoload :LookupContext
@@ -45,12 +44,15 @@ module ActionView
     autoload :Rendering
     autoload :RoutingUrlFor
     autoload :Template
+    autoload :UnboundTemplate
     autoload :ViewPaths
 
     autoload_under "renderer" do
       autoload :Renderer
       autoload :AbstractRenderer
       autoload :PartialRenderer
+      autoload :CollectionRenderer
+      autoload :ObjectRenderer
       autoload :TemplateRenderer
       autoload :StreamingTemplateRenderer
     end
@@ -58,6 +60,7 @@ module ActionView
     autoload_at "action_view/template/resolver" do
       autoload :Resolver
       autoload :PathResolver
+      autoload :FileSystemResolver
       autoload :OptimizedFileSystemResolver
       autoload :FallbackFileSystemResolver
     end
@@ -77,10 +80,12 @@ module ActionView
       autoload :ActionViewError
       autoload :EncodingError
       autoload :TemplateError
+      autoload :SyntaxErrorInTemplate
       autoload :WrongEncodingError
     end
   end
 
+  autoload :CacheExpiry
   autoload :TestCase
 
   def self.eager_load!