actionview 7.2.3 → 7.2.3.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 773338461dd6a54e8b6efa075c2be80d8f8c975ee46bd2167bc7e2fcd8e78f35
-  data.tar.gz: 22244120a030dfc49034d8d790fa86013b1de42b5ee7acbe75243580c9eec7c1
+  metadata.gz: 61f8e3426843a85e006134bb5d330f91e09457e3392025afab472d470d706929
+  data.tar.gz: c066f5cc2718465d6f24a8c81ee5361c3c9fcbef2288a8d04b77334e9c724ad9
 SHA512:
-  metadata.gz: 1c26e2052e3f599c7f28c19892948c6b3f8cdeef005a4dc54762b4e74309ac32ef794115b0e46d2364624b26debb85a6aaebc938813d08e69e9c670c3bf79ae6
-  data.tar.gz: 15bdc1f27280a327a1270ddf794b484d68f88af959c2d49361ef0e33c37e547b81166c8b92ef400f7e9a62c8192820bd58042733335ff4a9c3f1a77b660f775f
+  metadata.gz: 0a9f2a3f39681a4687a4b8a42b10e00be43c0ee413037c9f236b3bbc04961c8d9993ee955bb0b940a5f05c0024c8f17abb3106d4420f0dea593dd020f038df55
+  data.tar.gz: b259ce7c6e668708a25ca4e61551bbe65aee7c898cf6c2da3ba0d2c40f64e6ccc5adc2067f817e95ac1f913edbb34b9e75ec4de89e058899c7644ecf4fbf5fb5

data/CHANGELOG.md

@@ -1,3 +1,12 @@
+## Rails 7.2.3.1 (March 23, 2026) ##
+
+*   Skip blank attribute names in tag helpers to avoid generating invalid HTML.
+
+    [CVE-2026-33168]
+
+    *Mike Dalessio*
+
+
 ## Rails 7.2.3 (October 28, 2025) ##
 
 *   Fix `javascript_include_tag` `type` option to accept either strings and symbols.

data/lib/action_view/gem_version.rb

@@ -10,7 +10,7 @@ module ActionView
     MAJOR = 7
     MINOR = 2
     TINY  = 3
-    PRE   = nil
+    PRE   = "1"
 
     STRING = [MAJOR, MINOR, TINY, PRE].compact.join(".")
   end

data/lib/action_view/helpers/tag_helper.rb

@@ -263,16 +263,19 @@ module ActionView
           output = +""
           sep    = " "
           options.each_pair do |key, value|
+            next if key.blank?
+
             type = TAG_TYPES[key]
             if type == :data && value.is_a?(Hash)
               value.each_pair do |k, v|
-                next if v.nil?
+                next if k.blank? || v.nil?
+
                 output << sep
                 output << prefix_tag_option(key, k, v, escape)
               end
             elsif type == :aria && value.is_a?(Hash)
               value.each_pair do |k, v|
-                next if v.nil?
+                next if k.blank? || v.nil?
 
                 case v
                 when Array, Hash

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: actionview
 version: !ruby/object:Gem::Version
-  version: 7.2.3
+  version: 7.2.3.1
 platform: ruby
 authors:
 - David Heinemeier Hansson
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 7.2.3
+        version: 7.2.3.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 7.2.3
+        version: 7.2.3.1
 - !ruby/object:Gem::Dependency
   name: cgi
   requirement: !ruby/object:Gem::Requirement
@@ -99,28 +99,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 7.2.3
+        version: 7.2.3.1
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 7.2.3
+        version: 7.2.3.1
 - !ruby/object:Gem::Dependency
   name: activemodel
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 7.2.3
+        version: 7.2.3.1
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 7.2.3
+        version: 7.2.3.1
 description: Simple, battle-tested conventions and helpers for building web pages.
 email: david@loudthinking.com
 executables: []
@@ -259,10 +259,10 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/rails/rails/issues
-  changelog_uri: https://github.com/rails/rails/blob/v7.2.3/actionview/CHANGELOG.md
-  documentation_uri: https://api.rubyonrails.org/v7.2.3/
+  changelog_uri: https://github.com/rails/rails/blob/v7.2.3.1/actionview/CHANGELOG.md
+  documentation_uri: https://api.rubyonrails.org/v7.2.3.1/
   mailing_list_uri: https://discuss.rubyonrails.org/c/rubyonrails-talk
-  source_code_uri: https://github.com/rails/rails/tree/v7.2.3/actionview
+  source_code_uri: https://github.com/rails/rails/tree/v7.2.3.1/actionview
   rubygems_mfa_required: 'true'
 rdoc_options: []
 require_paths:
@@ -279,7 +279,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements:
 - none
-rubygems_version: 3.6.9
+rubygems_version: 4.0.6
 specification_version: 4
 summary: Rendering framework putting the V in MVC (part of Rails).
 test_files: []