actionview 8.1.3.1 → 8.1.4.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8aa4ee01b0e607eb916b6fa44ce85dca111d21a89b35d8dcafe7238473dddcc5
-  data.tar.gz: 3c036732a3611891ba8ac32fb6bf68ccaf7c19c6aaf15f9bc90819744e2aa162
+  metadata.gz: 4ad9b7f3e9b8677cd772d696b4056bda5f44b3cb2074877698060d83eeb8f501
+  data.tar.gz: 6d484d054ced5d8990d0ae4b8134879eb192fea59540f8c6f1dd112ed946ec06
 SHA512:
-  metadata.gz: 157d017bf8051b485efcad2d94c0968e2086db22fdf87ba50764ef45c69265c053fdb441d8f9566c0b089069aa9cb38bc71cb6a54bfdd8ed2d5bf46136957fe2
-  data.tar.gz: 7a2f125325d636972ded20d7e04d86a25738363db40f1c38c894aa76d8351b209ba8bbeec3ef25c35c93b37121bbd89b194bcc271ee80829d2563ccf5d3b15e0
+  metadata.gz: 47f094fac7bbc29736cf46dcaa570b42d25cdee803cdd522ae81e37a8351f029991b82099a3d4b64c253ae396412e1f112feb509f2e941f4bf806bcab4a95272
+  data.tar.gz: 07ee062127ab3554407ea34d293611e347789e5cd65012340302b7a690e18b01ce6630d85483be9eb5e575869df10a3808891ebd98d14ceb674499acdf904594

data/CHANGELOG.md

@@ -1,3 +1,105 @@
+## Rails 8.1.4.1 (November 03, 2026) ##
+
+*   Skip attribute names in tag helpers that are blank once converted to a
+    string.
+
+    A Symbol such as `:" "` is not blank, because `Symbol#blank?` is
+    `Symbol#empty?`, so it reached the escaping step and produced an attribute
+    with no name. The asset helpers symbolize their keys, so an ordinary String
+    key reached the same place.
+
+    [GHSA-68p9-83h6-5wpj]
+
+    *Mike Dalessio*
+
+*   Fix `strip_tags` to encode `"` and `'` in its output.
+
+    `strip_tags` returns an `html_safe` string, but was not encoding quotation
+    marks. The method now encodes all five HTML-significant characters (`&`,
+    `<`, `>`, `"`, `'`), consistent with the existing `html_safe` convention.
+
+    Output used outside HTML, such as in a text template or JSON, now contains
+    `&quot;` and `&#39;` where it contained `"` and `'`. `CGI.unescapeHTML`
+    decodes them.
+
+    [GHSA-rq8q-p985-fjq7]
+
+    *Mike Dalessio*
+
+*   Escape the matched phrase before substituting it into `highlight`'s
+    `:highlighter`.
+
+    A match was copied into each `\1` of the highlighter as it appeared in
+    the sanitized text, which keeps `"` and `'` as they are, so a match
+    containing a quote ended a quoted attribute value such as the
+    documented `'<a href="search?q=\1">\1</a>'` and added attributes of
+    its own. Each substituted group now goes through
+    `ERB::Util.html_escape_once`, so quotes in a match render as `&quot;`
+    and `&#39;`. Only the numbered placeholders `\0` to `\9` are expanded,
+    and a match never replaces the `>` that closes a tag.
+
+    [GHSA-v6rj-xm57-3p59]
+
+    *Jeremy Daer*
+
+*   Require rails-html-sanitizer 1.7.2 or later.
+
+    With the HTML5 sanitizer, Nokogiri before 1.19.5 left `<` and `>`
+    unescaped in attribute values. `highlight` and `simple_format`, which
+    edit the sanitized HTML as a string, could then turn markup inside an
+    attribute value into live elements. rails-html-sanitizer 1.7.2 requires
+    Loofah 2.25.3, which requires Nokogiri 1.19.5.
+
+    [GHSA-2p2f-4rq4-gjwc]
+
+    *Mike Dalessio*
+
+## Rails 8.1.4 (September 24, 2026) ##
+
+*   Fix non-ASCII strict locals defaults rendering as mojibake.
+
+    When a template declared a non-ASCII default in its `locals:` magic comment
+    and its body was ASCII-only, the handler returned ASCII-8BIT code and the
+    compiled method definition was retagged with it, corrupting the default.
+
+    *Carlos Daniel Pohlod*
+
+*   Fix the `:ruby` render tracker not being registered for ERB templates when
+    `eager_load` is enabled.
+
+    *Gabriel Quaresma*
+
+*   Fix `Encoding::CompatibilityError` when digesting templates with non-ASCII
+    content via `DependencyTracker::RubyTracker`.
+
+    File-backed templates are loaded as ASCII-8BIT. `RubyTracker` now passes
+    `template.encode!` to the handler (matching `Template#compiled_source`) so
+    handlers such as Haml/Temple can concatenate static UTF-8 strings without
+    raising. Fixes #58203.
+
+    *Edil Talantbek uulu*
+
+*   Fix `week_field` to not emit invalid  week strings at ISO year boundaries.
+
+    *Kenta Ishizaki*
+
+*   Fix `ActionView::TestCase#render` to reset `rendered`.
+    The behavior was changed when memoization was added in #51093. Now it once again conforms to the documentation.
+
+    *Jeroen Versteeg*
+
+*   Fix `FormBuilder#to_partial_path` returning `nil` for subclasses whose
+    name does not end in `Builder`.
+
+    *Kenta Ishizaki*
+
+*   Fix `collection_radio_buttons` and `collection_check_boxes` generating
+    a label `for` attribute that does not match the input `id` when a
+    collection value is `nil`.
+
+    *Kenta Ishizaki*
+
+
 ## Rails 8.1.3.1 (July 29, 2026) ##
 
 *   No changes.

data/lib/action_view/dependency_tracker/ruby_tracker.rb

@@ -28,7 +28,7 @@ module ActionView
         def render_dependencies
           return [] unless template.source.include?("render")
 
-          compiled_source = template.handler.call(template, template.source)
+          compiled_source = template.handler.call(template, template.encode!)
 
           @parser_class.new(@name, compiled_source).render_calls.filter_map do |render_call|
             render_call.gsub(%r|/_|, "/")

data/lib/action_view/gem_version.rb

@@ -9,7 +9,7 @@ module ActionView
   module VERSION
     MAJOR = 8
     MINOR = 1
-    TINY  = 3
+    TINY  = 4
     PRE   = "1"
 
     STRING = [MAJOR, MINOR, TINY, PRE].compact.join(".")

data/lib/action_view/helpers/form_helper.rb

@@ -1706,7 +1706,7 @@ module ActionView
       end
 
       def self._to_partial_path
-        @_to_partial_path ||= name.demodulize.underscore.sub!(/_builder$/, "")
+        @_to_partial_path ||= name.demodulize.underscore.sub(/_builder$/, "")
       end
 
       def to_partial_path

data/lib/action_view/helpers/form_options_helper.rb

@@ -383,6 +383,11 @@ module ActionView
       #
       #   select_tag 'person', options_from_collection_for_select(@people, 'id', 'name')
       #
+      # The +value_method+ and +text_method+ can be a method name to call on each member of the +collection+,
+      # or a Proc that will be called for each member of the +collection+:
+      #
+      #   options_from_collection_for_select(@people, Proc.new { |person| person.id }, Proc.new { |person| person.name })
+      #
       # If +selected+ is specified as a value or array of values, the element(s) returning a match on +value_method+
       # will be selected option tag(s).
       #
@@ -415,14 +420,14 @@ module ActionView
       #
       # Parameters:
       # * +collection+ - An array of objects representing the <tt><optgroup></tt> tags.
-      # * +group_method+ - The name of a method which, when called on a member of +collection+, returns an
+      # * +group_method+ - The name of a method which, when called on a member of +collection+, or a Proc, which when called with a member of +collection+, returns an
       #   array of child objects representing the <tt><option></tt> tags.
-      # * +group_label_method+ - The name of a method which, when called on a member of +collection+, returns a
+      # * +group_label_method+ - The name of a method which, when called on a member of +collection+, or a Proc, which when called with a member of +collection+, returns a
       #   string to be used as the +label+ attribute for its <tt><optgroup></tt> tag.
       # * +option_key_method+ - The name of a method which, when called on a child object of a member of
-      #   +collection+, returns a value to be used as the +value+ attribute for its <tt><option></tt> tag.
+      #   +collection+, or a Proc, which when called with a child object of a member of +collection+, returns a value to be used as the +value+ attribute for its <tt><option></tt> tag.
       # * +option_value_method+ - The name of a method which, when called on a child object of a member of
-      #   +collection+, returns a value to be used as the contents of its <tt><option></tt> tag.
+      #   +collection+, or a Proc, which when called with a child object of a member of +collection+, returns a value to be used as the contents of its <tt><option></tt> tag.
       # * +selected_key+ - A value equal to the +value+ attribute for one of the <tt><option></tt> tags,
       #   which will have the +selected+ attribute set. Corresponds to the return value of one of the calls
       #   to +option_key_method+. If +nil+, no selection is made. Can also be a hash if disabled values are

data/lib/action_view/helpers/sanitize_helper.rb

@@ -1,5 +1,6 @@
 # frozen_string_literal: true
 
+require "active_support/core_ext/string/output_safety"
 require "rails-html-sanitizer"
 
 module ActionView
@@ -33,6 +34,9 @@ module ActionView
       # Please note that sanitizing user-provided text does not guarantee that the
       # resulting markup is valid or even well-formed.
       #
+      # The output is markup, which is safe only as element content. Do not use it in an attribute
+      # value; use +strip_tags+ or a tag helper such as <tt>tag.a(title: ...)</tt> instead.
+      #
       # ==== Options
       #
       # [+:tags+]
@@ -137,7 +141,8 @@ module ActionView
       #   strip_tags("> A quote from Smith & Wesson")
       #   # => &gt; A quote from Smith &amp; Wesson
       def strip_tags(html)
-        self.class.full_sanitizer.sanitize(html)&.html_safe
+        stripped = self.class.full_sanitizer.sanitize(html)
+        ERB::Util.html_escape_once(stripped) if stripped
       end
 
       # Strips all link tags from +html+ leaving just the link text.

data/lib/action_view/helpers/tag_helper.rb

@@ -239,18 +239,27 @@ module ActionView
           options.each_pair do |key, value|
             next if key.blank?
 
+            name = Symbol === key ? key.name : key.to_s
+            next if name.blank?
+
             type = TAG_TYPES[key]
             if type == :data && value.is_a?(Hash)
               value.each_pair do |k, v|
                 next if k.blank? || v.nil?
 
+                nested_name = Symbol === k ? k.name : k.to_s
+                next if nested_name.blank?
+
                 output << sep
-                output << prefix_tag_option(key, k, v, escape)
+                output << prefix_tag_option(name, nested_name, v, escape)
               end
             elsif type == :aria && value.is_a?(Hash)
               value.each_pair do |k, v|
                 next if k.blank? || v.nil?
 
+                nested_name = Symbol === k ? k.name : k.to_s
+                next if nested_name.blank?
+
                 case v
                 when Array, Hash
                   tokens = TagHelper.build_tag_values(v)
@@ -262,16 +271,16 @@ module ActionView
                 end
 
                 output << sep
-                output << prefix_tag_option(key, k, v, escape)
+                output << prefix_tag_option(name, nested_name, v, escape)
               end
             elsif type == :boolean
               if value
                 output << sep
-                output << boolean_tag_option(key)
+                output << boolean_tag_option(name)
               end
             elsif !value.nil?
               output << sep
-              output << tag_option(key, value, escape)
+              output << tag_option(name, value, escape)
             end
           end
           output unless output.empty?

data/lib/action_view/helpers/tags/collection_helpers.rb

@@ -68,8 +68,18 @@ module ActionView
             html_options
           end
 
+          # Sanitize the attribute name used for the label's `for` attribute
+          # in collection helpers. When the value is nil or results in an
+          # empty sanitized string, skip the trailing underscore to match the
+          # id generated by add_default_name_and_id_for_value.
           def sanitize_attribute_name(value)
-            "#{sanitized_method_name}_#{sanitized_value(value)}"
+            sanitized = sanitized_value(value)
+
+            if sanitized.empty?
+              sanitized_method_name.dup
+            else
+              "#{sanitized_method_name}_#{sanitized}"
+            end
           end
 
           def render_collection

data/lib/action_view/helpers/tags/week_field.rb

@@ -6,7 +6,7 @@ module ActionView
       class WeekField < DatetimeField # :nodoc:
         private
           def format_datetime(value)
-            value&.strftime("%Y-W%V")
+            value&.strftime("%G-W%V")
           end
       end
     end

data/lib/action_view/helpers/text_helper.rb

@@ -143,8 +143,15 @@ module ActionView
       #
       # [+:highlighter+]
       #   The highlighter string. Uses <tt>\1</tt> as the placeholder for a
-      #   phrase, similar to +String#sub+. Defaults to <tt>"<mark>\1</mark>"</tt>.
-      #   This option is ignored if a block is specified.
+      #   phrase. Defaults to <tt>"<mark>\1</mark>"</tt>. The numbered placeholders
+      #   <tt>\0</tt> to <tt>\9</tt> are expanded; other +String#sub+ replacement escapes
+      #   are not. The phrase is HTML escaped, quotes included. This option
+      #   is ignored if a block is specified.
+      #
+      #   WARNING: Put a placeholder only in element content or inside a
+      #   quoted attribute value. HTML escaping does not make the phrase safe
+      #   in an unquoted attribute value, in a URL, JavaScript or CSS
+      #   context, or in an attribute whose value is HTML, such as +srcdoc+.
       #
       # [+:sanitize+]
       #   Whether to sanitize +text+ before highlighting. Defaults to true.
@@ -163,8 +170,8 @@ module ActionView
       #   highlight('You searched for: rails', ['for', 'rails'], highlighter: '<em>\1</em>')
       #   # => "You searched <em>for</em>: <em>rails</em>"
       #
-      #   highlight('You searched for: rails', 'rails', highlighter: '<a href="search?q=\1">\1</a>')
-      #   # => "You searched for: <a href=\"search?q=rails\">rails</a>"
+      #   highlight('You searched for: rails', 'rails', highlighter: '<mark title="\1">\1</mark>')
+      #   # => "You searched for: <mark title=\"rails\">rails</mark>"
       #
       #   highlight('You searched for: rails', 'rails') { |match| link_to(search_path(q: match)) }
       #   # => "You searched for: <a href=\"search?q=rails\">rails</a>"
@@ -179,14 +186,23 @@ module ActionView
         else
           patterns = Array(phrases).map { |phrase| Regexp === phrase ? phrase : Regexp.escape(phrase) }
           pattern = /(#{patterns.join("|")})/i
+          # The text after a tag begins with the ">" that closes it. Leave it
+          # in the segment so phrases can see it as context, but keep it out
+          # of the match so the highlighter can't take the place of the ">".
+          pattern_after_tag = /(?!\A)#{pattern}/
           highlighter = options.fetch(:highlighter, '<mark>\1</mark>') unless block
 
-          text.scan(/<[^>]*|[^<]+/).each do |segment|
+          text.scan(/<[^>]*|[^<]+/).each_with_index do |segment, index|
             if !segment.start_with?("<")
+              segment_pattern = index > 0 ? pattern_after_tag : pattern
+
               if block
-                segment.gsub!(pattern, &block)
+                segment.gsub!(segment_pattern, &block)
               else
-                segment.gsub!(pattern, highlighter)
+                segment.gsub!(segment_pattern) do
+                  match = Regexp.last_match
+                  highlighter.gsub(/\\(\d)/) { ERB::Util.html_escape_once(match[$1.to_i]) }
+                end
               end
             end
           end.join

data/lib/action_view/railtie.rb

@@ -78,10 +78,6 @@ module ActionView
     end
 
     config.after_initialize do |app|
-      config.after_initialize do
-        ActionView.render_tracker = config.action_view.render_tracker
-      end
-
       ActiveSupport.on_load(:action_view) do
         app.config.action_view.each do |k, v|
           next if k == :render_tracker
@@ -106,6 +102,10 @@ module ActionView
       end
     end
 
+    initializer "action_view.set_render_tracker" do |app|
+      ActionView.render_tracker = app.config.action_view.render_tracker
+    end
+
     initializer "action_view.setup_action_pack" do |app|
       ActiveSupport.on_load(:action_controller) do
         ActionView::RoutingUrlFor.include(ActionDispatch::Routing::UrlFor)

data/lib/action_view/template.rb

@@ -470,8 +470,9 @@ module ActionView
           end
         end_src
 
-        # Make sure the source is in the encoding of the returned code
-        source.force_encoding(code.encoding)
+        # Make sure the source is in the encoding of the returned code.
+        # ASCII-only code has no encoding worth propagating.
+        source.force_encoding(code.encoding) unless code.ascii_only?
 
         # In case we get back a String from a handler that is not in
         # BINARY or the default_internal, encode it to the default_internal

data/lib/action_view/test_case.rb

@@ -272,7 +272,7 @@ module ActionView
         @request = @controller.request
         @view_flow = ActionView::OutputFlow.new
         @output_buffer = ActionView::OutputBuffer.new
-        @rendered = self.class.content_class.new(+"")
+        _reset_rendered
 
         test_case_instance = self
         controller_class.define_method(:_test_case) { test_case_instance }
@@ -284,8 +284,18 @@ module ActionView
 
       def render(options = {}, local_assigns = {}, &block)
         view.assign(view_assigns)
-        @rendered << output = view.render(options, local_assigns, &block)
-        output
+
+        if @_rendering
+          view.render(options, local_assigns, &block)
+        else
+          _reset_rendered
+          @_rendering = true
+          output = view.render(options, local_assigns, &block)
+          @rendered << output
+          output
+        end
+      ensure
+        @_rendering = false unless @_rendering.nil?
       end
 
       def rendered_views
@@ -383,6 +393,7 @@ module ActionView
         :@method_name,
         :@output_buffer,
         :@_partials,
+        :@_rendering,
         :@passed,
         :@rendered,
         :@request,
@@ -412,6 +423,10 @@ module ActionView
         end]
       end
 
+      def _reset_rendered
+        @rendered = self.class.content_class.new(+"")
+      end
+
       def method_missing(selector, ...)
         begin
           routes = @controller.respond_to?(:_routes) && @controller._routes

data/lib/action_view.rb

@@ -37,6 +37,7 @@ module ActionView
   eager_autoload do
     autoload :Base
     autoload :Context
+    autoload :DependencyTracker
     autoload :Digestor
     autoload :Helpers
     autoload :LookupContext
@@ -91,7 +92,19 @@ module ActionView
   autoload :CacheExpiry
   autoload :TestCase
 
-  singleton_class.attr_accessor :render_tracker
+  singleton_class.attr_reader :render_tracker
+
+  def self.render_tracker=(value)
+    @render_tracker = value
+    case value
+    when :ruby
+      DependencyTracker.register_tracker :erb, DependencyTracker::RubyTracker
+    else
+      DependencyTracker.register_tracker :erb, DependencyTracker::ERBTracker
+    end
+    value
+  end
+
   self.render_tracker = :regex
 
   def self.eager_load!

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: actionview
 version: !ruby/object:Gem::Version
-  version: 8.1.3.1
+  version: 8.1.4.1
 platform: ruby
 authors:
 - David Heinemeier Hansson
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 8.1.3.1
+        version: 8.1.4.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 8.1.3.1
+        version: 8.1.4.1
 - !ruby/object:Gem::Dependency
   name: builder
   requirement: !ruby/object:Gem::Requirement
@@ -58,6 +58,9 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '1.6'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 1.7.2
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -65,6 +68,9 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '1.6'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 1.7.2
 - !ruby/object:Gem::Dependency
   name: rails-dom-testing
   requirement: !ruby/object:Gem::Requirement
@@ -85,28 +91,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 8.1.3.1
+        version: 8.1.4.1
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 8.1.3.1
+        version: 8.1.4.1
 - !ruby/object:Gem::Dependency
   name: activemodel
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 8.1.3.1
+        version: 8.1.4.1
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 8.1.3.1
+        version: 8.1.4.1
 description: Simple, battle-tested conventions and helpers for building web pages.
 email: david@loudthinking.com
 executables: []
@@ -247,10 +253,10 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/rails/rails/issues
-  changelog_uri: https://github.com/rails/rails/blob/v8.1.3.1/actionview/CHANGELOG.md
-  documentation_uri: https://api.rubyonrails.org/v8.1.3.1/
+  changelog_uri: https://github.com/rails/rails/blob/v8.1.4.1/actionview/CHANGELOG.md
+  documentation_uri: https://api.rubyonrails.org/v8.1.4.1/
   mailing_list_uri: https://discuss.rubyonrails.org/c/rubyonrails-talk
-  source_code_uri: https://github.com/rails/rails/tree/v8.1.3.1/actionview
+  source_code_uri: https://github.com/rails/rails/tree/v8.1.4.1/actionview
   rubygems_mfa_required: 'true'
 rdoc_options: []
 require_paths:
@@ -267,7 +273,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements:
 - none
-rubygems_version: 4.0.16
+rubygems_version: 4.0.20
 specification_version: 4
 summary: Rendering framework putting the V in MVC (part of Rails).
 test_files: []