actionview 8.0.3 → 8.0.4.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d906f994cc2a7151f2763ccfd5505479b2ba0dd408797b28716d495b4ec89089
-  data.tar.gz: 10cb316f59e90d20729c7f61ec92c0e3b6b28e359ea13b2692736e5ffbe7e7a4
+  metadata.gz: db69362edf94a58af2281f36919c695039e5e2e7be5707b36ee6a6553deaddcf
+  data.tar.gz: 4343c2bcf50ed9237feb87fb8c295e16ae37b5bda5b66573d0f47d3efb2fb40c
 SHA512:
-  metadata.gz: a845f01c731db0f215c2a7d29888924fa1e50d3c68a17e1ed37e6dd746aa47a3250c7018d6d66639fc9ef7039f0b6d64234110edd310870bdae2074932044356
-  data.tar.gz: be07fd924f900d3d8c537652678d941fed5ea46ff657197e2182fdbaf4554923a1f1c41e27873735911a85b7a4d5819c330b35ceacefa90ca542c04e9b6053a8
+  metadata.gz: a5a42c58fe67751baf3004a2cb5e1fbcc843c23dc01c668eb5e9de02c2a68fe776e808a9076f9b8af5842bb33770fe1110814dab70d6906751762bdf550595f2
+  data.tar.gz: 806f5955af447cf19e200ad782f7ae65c9ba3d1d2587f4af04a8a58fc13b6d85ff7dcf28dc8db1976b37cf5108201696bcb594818ee188cb22f5f52c70554134

data/CHANGELOG.md

@@ -1,3 +1,19 @@
+## Rails 8.0.4.1 (March 23, 2026) ##
+
+*   Skip blank attribute names in tag helpers to avoid generating invalid HTML.
+
+    [CVE-2026-33168]
+
+    *Mike Dalessio*
+
+
+## Rails 8.0.4 (October 28, 2025) ##
+
+*   Restore `add_default_name_and_id` method.
+
+    *Hartley McGuire*
+
+
 ## Rails 8.0.3 (September 22, 2025) ##
 
 *   Fix label with `for` option not getting prefixed by form `namespace` value

data/lib/action_view/gem_version.rb

@@ -9,8 +9,8 @@ module ActionView
   module VERSION
     MAJOR = 8
     MINOR = 0
-    TINY  = 3
-    PRE   = nil
+    TINY  = 4
+    PRE   = "1"
 
     STRING = [MAJOR, MINOR, TINY, PRE].compact.join(".")
   end

data/lib/action_view/helpers/asset_tag_helper.rb

@@ -115,7 +115,7 @@ module ActionView
         path_options = options.extract!("protocol", "extname", "host", "skip_pipeline").symbolize_keys
         preload_links = []
         use_preload_links_header = options["preload_links_header"].nil? ? preload_links_header : options.delete("preload_links_header")
-        nopush = options["nopush"].nil? ? true : options.delete("nopush")
+        nopush = options["nopush"].nil? || options.delete("nopush")
         crossorigin = options.delete("crossorigin")
         crossorigin = "anonymous" if crossorigin == true
         integrity = options["integrity"]
@@ -206,7 +206,7 @@ module ActionView
         preload_links = []
         crossorigin = options.delete("crossorigin")
         crossorigin = "anonymous" if crossorigin == true
-        nopush = options["nopush"].nil? ? true : options.delete("nopush")
+        nopush = options["nopush"].nil? || options.delete("nopush")
         integrity = options["integrity"]
 
         sources_tags = sources.uniq.map { |source|

data/lib/action_view/helpers/tag_helper.rb

@@ -250,16 +250,19 @@ module ActionView
           output = +""
           sep    = " "
           options.each_pair do |key, value|
+            next if key.blank?
+
             type = TAG_TYPES[key]
             if type == :data && value.is_a?(Hash)
               value.each_pair do |k, v|
-                next if v.nil?
+                next if k.blank? || v.nil?
+
                 output << sep
                 output << prefix_tag_option(key, k, v, escape)
               end
             elsif type == :aria && value.is_a?(Hash)
               value.each_pair do |k, v|
-                next if v.nil?
+                next if k.blank? || v.nil?
 
                 case v
                 when Array, Hash

data/lib/action_view/helpers/tags/base.rb

@@ -92,6 +92,7 @@ module ActionView
               end
             end
           end
+          alias_method :add_default_name_and_id_for_value, :add_default_name_and_field_for_value
 
           def add_default_name_and_field(options, field = "id")
             index = name_and_id_index(options)
@@ -104,6 +105,7 @@ module ActionView
               end
             end
           end
+          alias_method :add_default_name_and_id, :add_default_name_and_field
 
           def tag_name(multiple = false, index = nil)
             @template_object.field_name(@object_name, sanitized_method_name, multiple: multiple, index: index)

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: actionview
 version: !ruby/object:Gem::Version
-  version: 8.0.3
+  version: 8.0.4.1
 platform: ruby
 authors:
 - David Heinemeier Hansson
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 8.0.3
+        version: 8.0.4.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 8.0.3
+        version: 8.0.4.1
 - !ruby/object:Gem::Dependency
   name: builder
   requirement: !ruby/object:Gem::Requirement
@@ -85,28 +85,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 8.0.3
+        version: 8.0.4.1
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 8.0.3
+        version: 8.0.4.1
 - !ruby/object:Gem::Dependency
   name: activemodel
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 8.0.3
+        version: 8.0.4.1
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 8.0.3
+        version: 8.0.4.1
 description: Simple, battle-tested conventions and helpers for building web pages.
 email: david@loudthinking.com
 executables: []
@@ -246,10 +246,10 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/rails/rails/issues
-  changelog_uri: https://github.com/rails/rails/blob/v8.0.3/actionview/CHANGELOG.md
-  documentation_uri: https://api.rubyonrails.org/v8.0.3/
+  changelog_uri: https://github.com/rails/rails/blob/v8.0.4.1/actionview/CHANGELOG.md
+  documentation_uri: https://api.rubyonrails.org/v8.0.4.1/
   mailing_list_uri: https://discuss.rubyonrails.org/c/rubyonrails-talk
-  source_code_uri: https://github.com/rails/rails/tree/v8.0.3/actionview
+  source_code_uri: https://github.com/rails/rails/tree/v8.0.4.1/actionview
   rubygems_mfa_required: 'true'
 rdoc_options: []
 require_paths:
@@ -266,7 +266,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements:
 - none
-rubygems_version: 3.6.9
+rubygems_version: 4.0.6
 specification_version: 4
 summary: Rendering framework putting the V in MVC (part of Rails).
 test_files: []