alchemy_cms 8.2.7 → 8.2.9

data/app/components/alchemy/ingredients/base_view.rb

@@ -16,7 +16,7 @@ module Alchemy
       end
 
       def call
-        value.html_safe
+        h(value)
       end
 
       def render?

data/app/components/alchemy/ingredients/picture_view.rb

@@ -68,7 +68,7 @@ module Alchemy
       def caption
         return unless show_caption?
 
-        @_caption ||= content_tag(:figcaption, ingredient.caption.html_safe)
+        @_caption ||= content_tag(:figcaption, sanitize(ingredient.caption))
       end
 
       def src

data/app/components/alchemy/ingredients/text_view.rb

@@ -18,7 +18,7 @@ module Alchemy
 
       def call
         if disable_link?
-          dom_id.present? ? anchor : value
+          dom_id.present? ? anchor : h(value)
         else
           link_to(value, url_for(link), {
             id: dom_id.presence,
@@ -26,7 +26,7 @@ module Alchemy
             target: link_target_value(link_target),
             rel: link_rel_value(link_target)
           }.merge(html_options))
-        end.html_safe
+        end
       end
 
       private

data/app/javascript/alchemy_admin/components/attachment_select.js

@@ -1,6 +1,6 @@
 import { RemoteSelect } from "alchemy_admin/components/remote_select"
 
-class AttachmentSelect extends RemoteSelect {
+export class AttachmentSelect extends RemoteSelect {
   _renderResult(item) {
     return this._renderListEntry(item)
   }

data/app/javascript/alchemy_admin/components/element_select.js

@@ -20,7 +20,7 @@ const formatItem = (icon, text, hint) => {
   `
 }
 
-class ElementSelect extends HTMLElement {
+export class ElementSelect extends HTMLElement {
   constructor() {
     super()
   }

data/app/javascript/alchemy_admin/components/page_select.js

@@ -1,6 +1,6 @@
 import { RemoteSelect } from "alchemy_admin/components/remote_select"
 
-class PageSelect extends RemoteSelect {
+export class PageSelect extends RemoteSelect {
   get pageId() {
     return this.selection ? JSON.parse(this.selection)["id"] : undefined
   }

data/app/javascript/alchemy_admin/components/tags_autocomplete.js

@@ -1,6 +1,6 @@
 import { setupSelectLocale } from "alchemy_admin/i18n"
 
-class TagsAutocomplete extends HTMLElement {
+export class TagsAutocomplete extends HTMLElement {
   async connectedCallback() {
     await setupSelectLocale()
 

data/app/javascript/alchemy_admin/components/tinymce.js

@@ -5,7 +5,7 @@ import { currentLocale } from "alchemy_admin/i18n"
 const DARK_THEME = "alchemy-dark"
 const LIGHT_THEME = "alchemy"
 
-class Tinymce extends AlchemyHTMLElement {
+export class Tinymce extends AlchemyHTMLElement {
   #min_height = null
 
   /**

data/app/javascript/alchemy_admin.js

@@ -53,6 +53,11 @@ document.addEventListener("turbo:load", Initializer)
 
 // Public API for extensions
 export { RemoteSelect } from "alchemy_admin/components/remote_select"
+export { PageSelect } from "alchemy_admin/components/page_select"
+export { AttachmentSelect } from "alchemy_admin/components/attachment_select"
+export { ElementSelect } from "alchemy_admin/components/element_select"
+export { TagsAutocomplete } from "alchemy_admin/components/tags_autocomplete"
+export { Tinymce } from "alchemy_admin/components/tinymce"
 export { on } from "alchemy_admin/utils/events"
 
 // Page-specific modules - bundled to avoid dual-loading

data/config/importmap.rb

@@ -13,7 +13,18 @@ pin "@rails/ujs", to: "rails-ujs.min.js", preload: true # @7.1.2
 pin "tinymce", to: "tinymce.min.js", preload: true
 
 pin "alchemy_admin", to: "alchemy/alchemy_admin.min.js", preload: true
-pin "alchemy_admin/components/remote_select", to: "alchemy/alchemy_admin.min.js"
+# Individually importable admin components. These resolve to their source
+# files (not the bundle) so host engines can import a single component without
+# loading and executing the whole admin bundle. Not preloaded, so they add no
+# fetches to normal admin page loads (which import the bundle instead).
+pin "alchemy_admin/components/page_select"
+pin "alchemy_admin/components/attachment_select"
+pin "alchemy_admin/components/element_select"
+pin "alchemy_admin/components/tags_autocomplete"
+pin "alchemy_admin/components/tinymce"
+pin "alchemy_admin/components/remote_select"
+pin "alchemy_admin/components/select"
+pin "alchemy_admin/i18n"
 pin "alchemy_admin/image_cropper", to: "alchemy/alchemy_admin.min.js"
 pin "alchemy_admin/image_overlay", to: "alchemy/alchemy_admin.min.js"
 pin "alchemy_admin/picture_selector", to: "alchemy/alchemy_admin.min.js"

data/db/migrate/20260702090038_add_index_to_elements_pages_join_table.rb

@@ -0,0 +1,14 @@
+class AddIndexToElementsPagesJoinTable < ActiveRecord::Migration[7.2]
+  disable_ddl_transaction! if connection.adapter_name.match?(/postgres/i)
+
+  def change
+    add_index :alchemy_elements_alchemy_pages, :element_id, if_not_exists: true, algorithm: algorithm
+    add_index :alchemy_elements_alchemy_pages, :page_id, if_not_exists: true, algorithm: algorithm
+  end
+
+  private
+
+  def algorithm
+    connection.adapter_name.match?(/postgres/i) ? :concurrently : nil
+  end
+end

data/lib/alchemy/version.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 module Alchemy
-  VERSION = "8.2.7"
+  VERSION = "8.2.9"
 
   def self.version
     VERSION

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: alchemy_cms
 version: !ruby/object:Gem::Version
-  version: 8.2.7
+  version: 8.2.9
 platform: ruby
 authors:
 - Thomas von Deyen
@@ -1285,6 +1285,7 @@ files:
 - db/migrate/20260102121232_add_metadata_to_page_versions.rb
 - db/migrate/20260115164704_add_publication_timestamps_to_alchemy_elements.rb
 - db/migrate/20260115164705_add_index_to_element_publication_timestamps.rb
+- db/migrate/20260702090038_add_index_to_elements_pages_join_table.rb
 - lib/alchemy.rb
 - lib/alchemy/ability_helper.rb
 - lib/alchemy/admin/locale.rb
@@ -1490,7 +1491,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements:
 - ImageMagick (libmagick), v6.6 or greater.
-rubygems_version: 4.0.10
+rubygems_version: 4.0.16
 specification_version: 4
 summary: A powerful, userfriendly and flexible CMS for Rails
 test_files: []