actionview 5.2.8.1 → 6.1.6.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4a732cbd8a2b766ebf37e375ffd2f97c71760de86cb46d9a70702896d07aeb73
-  data.tar.gz: d76fb4ed63f24c3e6b09b576fe3b945b7eb436059cb703e241da7d7d9343cf90
+  metadata.gz: 73ad472357d09152ca691368bebd4d9879dde000ca496201bc2d2f4781c20787
+  data.tar.gz: 51229bf951522f16967e4bce38848c20009713b22d753a53af7c1e61bd9e3396
 SHA512:
-  metadata.gz: 69feb0b2c271b42c17c0bc55d0cee3f857aa4a177fe9e27edaf9a5cc101b2a92b5eb0cb678d89c7ea1f40fa1a1c28a6288c2ee9e5dee16db0859777259fce137
-  data.tar.gz: a04fc509175c93512d6517742c283d617749b1498a422c05a6ab02da17ce0042e33011176c83b97e48638f7e2750921d04fd8855bbfb6fc29a1cb1bbbd63bf8b
+  metadata.gz: 3baeab0382dc8aee9f262b63b5bdb05753201f9677822c77d4282ebe8d04f42696fe697d0194b3754230c6340694cbb98d4c1f81647b7c715d3a15ffc336c682
+  data.tar.gz: 79a528161f47a066ca70cd9284e81cdf2a7a441623a0774d78ef1c182e40cd15b9b44c21c630a3df4bb7bf17538fc7ac055e6bb06bebf32d08bc904fe543045d

data/CHANGELOG.md

@@ -1,14 +1,9 @@
-## Rails 5.2.8.1 (July 12, 2022) ##
+## Rails 6.1.6.1 (July 12, 2022) ##
 
 *   No changes.
 
 
-## Rails 5.2.8 (May 09, 2022) ##
-
-*   No changes.
-
-
-## Rails 5.2.7.1 (April 26, 2022) ##
+## Rails 6.1.5.1 (April 26, 2022) ##
 
 *   Fix and add protections for XSS in `ActionView::Helpers` and `ERB::Util`.
 
@@ -19,229 +14,406 @@
 
     *Álvaro Martín Fraguas*
 
+## Rails 6.1.5 (March 09, 2022) ##
 
-## Rails 5.2.7 (March 10, 2022) ##
+*   `preload_link_tag` properly inserts `as` attributes for files with `image` MIME
+    types, such as JPG or SVG.
 
-*   No changes.
+    *Nate Berkopec*
+
+*   Add `autocomplete="off"` to all generated hidden fields.
+
+    Fixes #42610.
+
+    *Ryan Baumann*
 
+*   Fix `current_page?` when URL has trailing slash.
 
-## Rails 5.2.6.3 (March 08, 2022) ##
+    This fixes the `current_page?` helper when the given URL has a trailing slash,
+    and is an absolute URL or also has query params.
+
+    Fixes #33956.
+
+    *Jonathan Hefner*
+
+
+## Rails 6.1.4.7 (March 08, 2022) ##
 
 *   No changes.
 
 
-## Rails 5.2.6.2 (February 11, 2022) ##
+## Rails 6.1.4.6 (February 11, 2022) ##
 
 *   No changes.
 
 
-## Rails 5.2.6.1 (February 11, 2022) ##
+## Rails 6.1.4.5 (February 11, 2022) ##
 
 *   No changes.
 
 
-## Rails 5.2.6 (May 05, 2021) ##
+## Rails 6.1.4.4 (December 15, 2021) ##
 
 *   No changes.
 
 
-## Rails 5.2.5 (March 26, 2021) ##
+## Rails 6.1.4.3 (December 14, 2021) ##
 
 *   No changes.
 
 
-## Rails 5.2.4.6 (May 05, 2021) ##
+## Rails 6.1.4.2 (December 14, 2021) ##
 
 *   No changes.
 
 
-## Rails 5.2.4.5 (February 10, 2021) ##
+## Rails 6.1.4.1 (August 19, 2021) ##
 
 *   No changes.
 
 
-## Rails 5.2.4.4 (September 09, 2020) ##
+## Rails 6.1.4 (June 24, 2021) ##
 
-*   [CVE-2020-15169] Fix potential XSS vulnerability in the `translate`/`t` helper
+*   The `translate` helper now passes `default` values that aren't
+    translation keys through `I18n.translate` for interpolation.
 
     *Jonathan Hefner*
 
+*   Don't attach UJS form submission handlers to Turbo forms.
 
-## Rails 5.2.4.3 (May 18, 2020) ##
+    *David Heinemeier Hansson*
 
-*   [CVE-2020-8167] Check that request is same-origin prior to including CSRF token in XHRs
+*   Allow both `current_page?(url_hash)` and `current_page?(**url_hash)` on Ruby 2.7.
 
+    *Ryuta Kamizono*
 
-## Rails 5.2.4.2 (March 19, 2020) ##
 
-*   Fix possible XSS vector in `escape_javascript` helper
+## Rails 6.1.3.2 (May 05, 2021) ##
 
-    CVE-2020-5267
+*   No changes.
 
-    *Aaron Patterson*
 
+## Rails 6.1.3.1 (March 26, 2021) ##
 
-## Rails 5.2.4.1 (December 18, 2019) ##
+*   No changes.
+
+
+## Rails 6.1.3 (February 17, 2021) ##
 
 *   No changes.
 
 
-## Rails 5.2.4 (November 27, 2019) ##
+## Rails 6.1.2.1 (February 10, 2021) ##
 
-*   Allow programmatic click events to trigger Rails UJS click handlers.
-    Programmatic click events (eg. ones generated by `Rails.fire(link, "click")`) don't specify a button. These events were being incorrectly stopped by code meant to ignore scroll wheel and right clicks introduced in #34573.
+*   No changes.
 
-    *Sudara Williams*
 
+## Rails 6.1.2 (February 09, 2021) ##
 
-## Rails 5.2.3 (March 27, 2019) ##
+*   No changes.
 
-*   Prevent non-primary mouse keys from triggering Rails UJS click handlers.
-    Firefox fires click events even if the click was triggered by non-primary mouse keys such as right- or scroll-wheel-clicks.
-    For example, right-clicking a link such as the one described below (with an underlying ajax request registered on click) should not cause that request to occur.
 
-    ```
-    <%= link_to 'Remote', remote_path, class: 'remote', remote: true, data: { type: :json } %>
-    ```
+## Rails 6.1.1 (January 07, 2021) ##
+
+*   Fix lazy translation in partial with block.
 
-    Fixes #34541
+    *Marek Kasztelnik*
 
-    *Wolfgang Hobmaier*
+*   Avoid extra `SELECT COUNT` queries when rendering Active Record collections.
 
+    *aar0nr*
 
-## Rails 5.2.2.1 (March 11, 2019) ##
+*   Link preloading keep integrity hashes in the header.
 
-*   Only accept formats from registered mime types
+    *Étienne Barrié*
 
-    A lack of filtering on mime types could allow an attacker to read
-    arbitrary files on the target server or to perform a denial of service
-    attack.
+*   Add `config.action_view.preload_links_header` to allow disabling of
+    the `Link` header being added by default when using `stylesheet_link_tag`
+    and `javascript_include_tag`.
 
-    Fixes CVE-2019-5418
-    Fixes CVE-2019-5419
+    *Andrew White*
 
-    *John Hawthorn*, *Eileen M. Uchitelle*, *Aaron Patterson*
+*   The `translate` helper now resolves `default` values when a `nil` key is
+    specified, instead of always returning `nil`.
 
+    *Jonathan Hefner*
 
-## Rails 5.2.2 (December 04, 2018) ##
 
-*   No changes.
+## Rails 6.1.0 (December 09, 2020) ##
 
+*   SanitizeHelper.sanitized_allowed_attributes and SanitizeHelper.sanitized_allowed_tags
+    call safe_list_sanitizer's class method
 
-## Rails 5.2.1.1 (November 27, 2018) ##
+    Fixes #39586
 
-*   No changes.
+    *Taufiq Muhammadi*
 
+*   Change form_with to generate non-remote forms by default.
 
-## Rails 5.2.1 (August 07, 2018) ##
+    `form_with` would generate a remote form by default. This would confuse
+    users because they were forced to handle remote requests.
 
-*   Fix leak of `skip_default_ids` and `allow_method_names_outside_object` options
-    to HTML attributes.
+    All new 6.1 applications will generate non-remote forms by default.
+    When upgrading a 6.0 application you can enable remote forms by default by
+    setting `config.action_view.form_with_generates_remote_forms` to `true`.
 
-    *Yurii Cherniavskyi*
+    *Petrik de Heus*
 
-*   Fix issue with `button_to`'s `to_form_params`
+*   Yield translated strings to calls of `ActionView::FormBuilder#button`
+    when a block is given.
 
-    `button_to` was throwing exception when invoked with `params` hash that
-    contains symbol and string keys. The reason for the exception was that
-    `to_form_params` was comparing the given symbol and string keys.
+    *Sean Doyle*
 
-    The issue is fixed by turning all keys to strings inside
-    `to_form_params` before comparing them.
+*   Alias `ActionView::Helpers::Tags::Label::LabelBuilder#translation` to
+    `#to_s` so that `form.label` calls can yield that value to their blocks.
 
-    *Georgi Georgiev*
+    *Sean Doyle*
 
-*   Fix JavaScript views rendering does not work with Firefox when using
-    Content Security Policy.
+*   Rename the new `TagHelper#class_names` method to `TagHelper#token_list`,
+    and make the original available as an alias.
 
-    Fixes #32577.
+        token_list("foo", "foo bar")
+        # => "foo bar"
 
-    *Yuji Yaginuma*
+    *Sean Doyle*
 
-*   Add the `nonce: true` option for `javascript_include_tag` helper to
-    support automatic nonce generation for Content Security Policy.
-    Works the same way as `javascript_tag nonce: true` does.
+*   ARIA Array and Hash attributes are treated as space separated `DOMTokenList`
+    values. This is useful when declaring lists of label text identifiers in
+    `aria-labelledby` or `aria-describedby`.
 
-    *Yaroslav Markin*
+        tag.input type: 'checkbox', name: 'published', aria: {
+          invalid: @post.errors[:published].any?,
+          labelledby: ['published_context', 'published_label'],
+          describedby: { published_errors: @post.errors[:published].any? }
+        }
+        #=> <input
+              type="checkbox" name="published" aria-invalid="true"
+              aria-labelledby="published_context published_label"
+              aria-describedby="published_errors"
+            >
 
+    *Sean Doyle*
 
-## Rails 5.2.0 (April 09, 2018) ##
+*   Remove deprecated `escape_whitelist` from `ActionView::Template::Handlers::ERB`.
 
-*   Pass the `:skip_pipeline` option in `image_submit_tag` when calling `path_to_image`.
+    *Rafael Mendonça França*
 
-    Fixes #32248.
+*   Remove deprecated `find_all_anywhere` from `ActionView::Resolver`.
 
-    *Andrew White*
+    *Rafael Mendonça França*
+
+*   Remove deprecated `formats` from `ActionView::Template::HTML`.
+
+    *Rafael Mendonça França*
+
+*   Remove deprecated `formats` from `ActionView::Template::RawFile`.
+
+    *Rafael Mendonça França*
+
+*   Remove deprecated `formats` from `ActionView::Template::Text`.
+
+    *Rafael Mendonça França*
+
+*   Remove deprecated `find_file` from `ActionView::PathSet`.
+
+    *Rafael Mendonça França*
+
+*   Remove deprecated `rendered_format` from `ActionView::LookupContext`.
+
+    *Rafael Mendonça França*
+
+*   Remove deprecated `find_file` from `ActionView::ViewPaths`.
+
+    *Rafael Mendonça França*
+
+*   Require that `ActionView::Base` subclasses implement `#compiled_method_container`.
+
+    *Rafael Mendonça França*
+
+*   Remove deprecated support to pass an object that is not a `ActionView::LookupContext` as the first argument
+    in `ActionView::Base#initialize`.
+
+    *Rafael Mendonça França*
+
+*   Remove deprecated `format` argument `ActionView::Base#initialize`.
+
+    *Rafael Mendonça França*
+
+*   Remove deprecated `ActionView::Template#refresh`.
 
-*   Allow the use of callable objects as group methods for grouped selects.
+    *Rafael Mendonça França*
 
-    Until now, the `option_groups_from_collection_for_select` method was only able to
-    handle method names as `group_method` and `group_label_method` parameters,
-    it is now able to receive procs and other callable objects too.
+*   Remove deprecated `ActionView::Template#original_encoding`.
 
-    *Jérémie Bonal*
+    *Rafael Mendonça França*
 
-*   Add `preload_link_tag` helper.
+*   Remove deprecated `ActionView::Template#variants`.
 
-    This helper that allows to the browser to initiate early fetch of resources
-    (different to the specified in `javascript_include_tag` and `stylesheet_link_tag`).
-    Additionally, this sends Early Hints if supported by browser.
+    *Rafael Mendonça França*
 
-    *Guillermo Iguaran*
+*   Remove deprecated `ActionView::Template#formats`.
 
-*   Change `form_with` to generates ids by default.
+    *Rafael Mendonça França*
 
-    When `form_with` was introduced we disabled the automatic generation of ids
-    that was enabled in `form_for`. This usually is not an good idea since labels don't work
-    when the input doesn't have an id and it made harder to test with Capybara.
+*   Remove deprecated `ActionView::Template#virtual_path=`.
 
-    You can still disable the automatic generation of ids setting `config.action_view.form_with_generates_ids`
-    to `false.`
+    *Rafael Mendonça França*
 
-    *Nick Pezza*
+*   Remove deprecated `ActionView::Template#updated_at`.
 
-*   Fix issues with `field_error_proc` wrapping `optgroup` and select divider `option`.
+    *Rafael Mendonça França*
 
-    Fixes #31088
+*   Remove deprecated `updated_at` argument required on `ActionView::Template#initialize`.
 
-    *Matthias Neumayr*
+    *Rafael Mendonça França*
 
-*   Remove deprecated Erubis ERB handler.
+*   Make `locals` argument required on `ActionView::Template#initialize`.
 
     *Rafael Mendonça França*
 
-*   Remove default `alt` text generation.
+*   Remove deprecated `ActionView::Template.finalize_compiled_template_methods`.
+
+    *Rafael Mendonça França*
+
+*   Remove deprecated `config.action_view.finalize_compiled_template_methods`
+
+    *Rafael Mendonça França*
+
+*   Remove deprecated support to calling `ActionView::ViewPaths#with_fallback` with a block.
+
+    *Rafael Mendonça França*
+
+*   Remove deprecated support to passing absolute paths to `render template:`.
+
+    *Rafael Mendonça França*
+
+*   Remove deprecated support to passing relative paths to `render file:`.
+
+    *Rafael Mendonça França*
+
+*   Remove support to template handlers that don't accept two arguments.
+
+    *Rafael Mendonça França*
+
+*   Remove deprecated pattern argument in `ActionView::Template::PathResolver`.
+
+    *Rafael Mendonça França*
+
+*   Remove deprecated support to call private methods from object in some view helpers.
+
+    *Rafael Mendonça França*
+
+*   `ActionView::Helpers::TranslationHelper#translate` accepts a block, yielding
+    the translated text and the fully resolved translation key:
+
+        <%= translate(".relative_key") do |translation, resolved_key| %>
+          <span title="<%= resolved_key %>"><%= translation %></span>
+        <% end %>
+
+    *Sean Doyle*
+
+*   Ensure cache fragment digests include all relevant template dependencies when
+    fragments are contained in a block passed to the render helper. Remove the
+    virtual_path keyword arguments found in CacheHelper as they no longer possess
+    any function following 1581cab.
+
+    Fixes #38984.
+
+    *Aaron Lipman*
+
+*   Deprecate `config.action_view.raise_on_missing_translations` in favor of
+    `config.i18n.raise_on_missing_translations`.
+
+    New generalized configuration option now determines whether an error should be raised
+    for missing translations in controllers and views.
+
+    *fatkodima*
+
+*   Instrument layout rendering in `TemplateRenderer#render_with_layout` as `render_layout.action_view`,
+    and include (when necessary) the layout's virtual path in notification payloads for collection and partial renders.
+
+    *Zach Kemp*
+
+*   `ActionView::Base.annotate_rendered_view_with_filenames` annotates HTML output with template file names.
+
+    *Joel Hawksley*, *Aaron Patterson*
+
+*   `ActionView::Helpers::TranslationHelper#translate` returns nil when
+    passed `default: nil` without a translation matching `I18n#translate`.
+
+    *Stefan Wrobel*
+
+*   `OptimizedFileSystemResolver` prefers template details in order of locale,
+    formats, variants, handlers.
+
+    *Iago Pimenta*
+
+*   Added `class_names` helper to create a CSS class value with conditional classes.
+
+    *Joel Hawksley*, *Aaron Patterson*
+
+*   Add support for conditional values to TagBuilder.
+
+    *Joel Hawksley*
+
+*   `ActionView::Helpers::FormOptionsHelper#select` should mark option for `nil` as selected.
+
+    ```ruby
+    @post = Post.new
+    @post.category = nil
+
+    # Before
+    select("post", "category", none: nil, programming: 1, economics: 2)
+    # =>
+    # <select name="post[category]" id="post_category">
+    #   <option value="">none</option>
+    #  <option value="1">programming</option>
+    #  <option value="2">economics</option>
+    # </select>
+
+    # After
+    select("post", "category", none: nil, programming: 1, economics: 2)
+    # =>
+    # <select name="post[category]" id="post_category">
+    #   <option selected="selected" value="">none</option>
+    #  <option value="1">programming</option>
+    #  <option value="2">economics</option>
+    # </select>
+    ```
+
+    *bogdanvlviv*
 
-    Fixes #30096
+*   Log lines for partial renders and started template renders are now
+    emitted at the `DEBUG` level instead of `INFO`.
 
-    *Cameron Cundiff*
+    Completed template renders are still logged at the `INFO` level.
 
-*   Add `srcset` option to `image_tag` helper.
+    *DHH*
 
-    *Roberto Miranda*
+*   ActionView::Helpers::SanitizeHelper: support rails-html-sanitizer 1.1.0.
 
-*   Fix issues with scopes and engine on `current_page?` method.
+    *Juanito Fatas*
 
-    Fixes #29401.
+*   Added `phone_to` helper method to create a link from mobile numbers.
 
-    *Nikita Savrov*
+    *Pietro Moro*
 
-*   Generate field ids in `collection_check_boxes` and `collection_radio_buttons`.
+*   annotated_source_code returns an empty array so TemplateErrors without a
+    template in the backtrace are surfaced properly by DebugExceptions.
 
-    This makes sure that the labels are linked up with the fields.
+    *Guilherme Mansur*, *Kasper Timm Hansen*
 
-    Fixes #29014.
+*   Add autoload for SyntaxErrorInTemplate so syntax errors are correctly raised by DebugExceptions.
 
-    *Yuji Yaginuma*
+    *Guilherme Mansur*, *Gannon McGibbon*
 
-*   Add `:json` type to `auto_discovery_link_tag` to support [JSON Feeds](https://jsonfeed.org/version/1).
+*   `RenderingHelper` supports rendering objects that `respond_to?` `:render_in`.
 
-    *Mike Gunderloy*
+    *Joel Hawksley*, *Natasha Umer*, *Aaron Patterson*, *Shawn Allen*, *Emily Plummer*, *Diana Mounter*, *John Hawthorn*, *Nathan Herald*, *Zaid Zawaideh*, *Zach Ahn*
 
-*   Update `distance_of_time_in_words` helper to display better error messages
-    for bad input.
+*   Fix `select_tag` so that it doesn't change `options` when `include_blank` is present.
 
-    *Jay Hayes*
+    *Younes SERRAJ*
 
 
-Please check [5-1-stable](https://github.com/rails/rails/blob/5-1-stable/actionview/CHANGELOG.md) for previous changes.
+Please check [6-0-stable](https://github.com/rails/rails/blob/6-0-stable/actionview/CHANGELOG.md) for previous changes.

data/MIT-LICENSE

@@ -1,4 +1,4 @@
-Copyright (c) 2004-2018 David Heinemeier Hansson
+Copyright (c) 2004-2022 David Heinemeier Hansson
 
 Permission is hereby granted, free of charge, to any person obtaining
 a copy of this software and associated documentation files (the
@@ -18,4 +18,3 @@ NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
 LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
 OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
 WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-

data/README.rdoc

@@ -5,6 +5,8 @@ view helpers that assist when building HTML forms, Atom feeds and more.
 Template formats that Action View handles are ERB (embedded Ruby, typically
 used to inline short Ruby snippets inside HTML), and XML Builder.
 
+You can read more about Action View in the {Action View Overview}[https://edgeguides.rubyonrails.org/action_view_overview.html] guide.
+
 == Download and installation
 
 The latest version of Action View can be installed with RubyGems:
@@ -13,7 +15,7 @@ The latest version of Action View can be installed with RubyGems:
 
 Source code can be downloaded as part of the Rails project on GitHub:
 
-* https://github.com/rails/rails/tree/5-2-stable/actionview
+* https://github.com/rails/rails/tree/main/actionview
 
 
 == License
@@ -27,7 +29,7 @@ Action View is released under the MIT license:
 
 API documentation is at
 
-* http://api.rubyonrails.org
+* https://api.rubyonrails.org
 
 Bug reports for the Ruby on Rails project can be filed here:
 
@@ -35,4 +37,4 @@ Bug reports for the Ruby on Rails project can be filed here:
 
 Feature requests should be discussed on the rails-core mailing list here:
 
-* https://groups.google.com/forum/?fromgroups#!forum/rubyonrails-core
+* https://discuss.rubyonrails.org/c/rubyonrails-core