senren-ui 0.4.0 → 0.4.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 99b7430e710e44023cbc886c862b4d237d06bb489a4a00f5e30685b59768f6dc
-  data.tar.gz: 6ead04eac8e4e518cbf7129c65dfb63ad683db3dfb44b13a794366eee8be37dd
+  metadata.gz: 6a7c6c06cf2fbc28902f954562926b0b5a75a5b22591074c2bd7bc94a398ebf0
+  data.tar.gz: 1c272c73f0008bca421d43a85ca55d217c10d563aa8ec0880083fad0c412dab0
 SHA512:
-  metadata.gz: 7cf42a8f5992b7de9bc4135c7d6bea7c44987ca3844de06b575876957877efd773711cdfcb9cd54d2ddc1ca878f38842d4df082b0fb7451b5b63613c9bb5f056
-  data.tar.gz: e3c329bc7eb8ef0c7b90af18971c92f24dfdea4822e17a9e43faff3b1e94a6815ed4b6c18cff30a2e65932cd8bf96d88b2e64153671d72e2a52c8ffe2d759c76
+  metadata.gz: b200e044d76d070cfa3657f967603adff7236a1b224a20ee08ed3e5a9e9ff35492d57a28782257b470df1c2901112ec6a60874556e292f5fc075a7ee5f29abb9
+  data.tar.gz: edee24c78567f1199468eebe25c676f23044fb622122a0bdb1658cbb4398fd3e8ac9d664812d7ccd3b13a52c8cfbe9039e61aa5e49ecbeeb124f01da13df24f6

data/CHANGELOG.md

@@ -7,6 +7,41 @@ and adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 v0.x is a pre-stable line: minor bumps may break things; patch bumps are
 bug fixes only.
 
+## [0.4.2] — 2026-10-26
+
+### Security
+
+- Refuse `senren:install` destinations that resolve outside the host app,
+  including symlinked files, parent directories, and dangling links, before
+  creating or changing files.
+- Detect component source exposed through symlinked asset paths before a
+  deployed app boots or precompiles assets. Dedicated sidecar asset directories
+  remain supported.
+- Require Crass 1.0.8 and ViewComponent 4.14.0 or newer so consumer bundles
+  enforce the CSS sanitizer and render-state security fixes.
+- Update development tooling's `source-map-js` to 1.2.2 for CVE-2026-93749
+  and add JavaScript dependency audits to local and GitHub CI.
+
+## [0.4.1] — 2026-10-08
+
+### Fixed
+
+- `bin/rails senren:locales vi`, as the README, `docs/i18n.md` and the install
+  generator write it, failed with `Unrecognized command "vi"`: the task was a
+  rake task only, so Rails passed `vi` to rake as a second task name, and the
+  one spelling that worked was `bin/rails 'senren:locales[vi]'`. It is now a
+  Rails command, like `senren:add`, so `bin/rails senren:locales vi`,
+  `senren:locales en vi` and `senren:locales vi --force` work as documented.
+- `bin/rails senren:doctor` reported `✗ ViewComponent gem available` and exited
+  1 on a healthy app. It checked only whether the `ViewComponent` constant was
+  loaded, and a host's Gemfile lists `senren-ui`, not `view_component`, so
+  nothing loads it until the first component renders. The check now also asks
+  whether the gem is installed, as the Turbo check already did.
+- `bin/rails senren:add` and `senren:locales` given a name they do not know (or
+  `senren:add` given none) printed a Thor backtrace with the useful line at the
+  top of it. They now print the message alone and exit 1, as the rake tasks
+  always did.
+
 ## [0.4.0] — 2026-10-08
 
 ### Added

data/lib/commands/senren/add/add_command.rb

@@ -22,7 +22,10 @@ module Senren
           force: options[:force]
         )
       rescue ArgumentError => e
-        raise ::Rails::Command::Base::Error, e.message
+        # The message alone, as the rake task prints it. Rails does not rescue
+        # an error raised from a command, so raising printed a Thor backtrace
+        # with the one line that says what to type buried at the top of it.
+        abort e.message
       end
 
       private

data/lib/commands/senren/locales/locales_command.rb

@@ -0,0 +1,38 @@
+# frozen_string_literal: true
+
+require 'rails/command'
+require 'senren/rails'
+require 'senren/rails/locale_installer'
+
+module Senren
+  module Command
+    # `bin/rails senren:locales vi` as the docs write it. As a rake task only,
+    # Rails handed `vi` to rake as a second task name and failed with
+    # `Unrecognized command "vi"`; the only spelling that worked was
+    # `bin/rails 'senren:locales[vi]'`. A Rails command receives the words after
+    # it as arguments, the same way senren:add does.
+    class LocalesCommand < ::Rails::Command::Base
+      class_option :force, type: :boolean, default: false,
+                           desc: 'Replace a locale file that already exists with the shipped one.'
+
+      desc 'locales LOCALE [LOCALE...]',
+           'Copy shipped Senren translations into config/locales.'
+      def perform(*names)
+        require_application!
+
+        locale_installer.install(locales: names.flat_map { |name| name.split(',') }, force: options[:force])
+      rescue ArgumentError => e
+        # The message alone, as the rake task prints it. Rails does not rescue
+        # an error raised from a command, so raising printed a Thor backtrace
+        # with the one line that says what to type buried at the top of it.
+        abort e.message
+      end
+
+      private
+
+      def locale_installer
+        Senren::Rails::LocaleInstaller.new
+      end
+    end
+  end
+end

data/lib/generators/senren/install/install_generator.rb

@@ -29,6 +29,25 @@ module Senren
       class_option :force_locales, type: :boolean, default: false,
                                    desc: 'Replace locale files that already exist with the shipped ones.'
 
+      # Thor's template/copy/gsub actions follow destination symlinks. Check
+      # every destination before the first directory is created, including
+      # files read before rewriting and links whose targets do not exist yet.
+      def validate_install_destinations
+        destinations = [
+          host_paths.senren_dir, host_paths.components_dir, host_paths.stimulus_dir,
+          host_paths.stylesheet_path, host_paths.stylesheet_path.dirname.join('senren_themes.css'),
+          host_paths.base_component_path, host_paths.conventions_file, host_paths.installed_components,
+          host_paths.registry_mirror, host_paths.skill_file, host_paths.agent_rules_file,
+          host_paths.codex_agents_md, host_paths.claude_md, host_paths.copilot_instructions,
+          host_paths.cursor_rule_file,
+          host_paths.root.join('app/javascript/controllers/index.js'), host_paths.root.join('config/importmap.rb')
+        ]
+        destinations.concat(options[:locales].map { |locale| host_paths.locale_file(locale) })
+        destinations.each do |path|
+          Senren::Rails::SafeWrite.assert_inside!(path, host_paths.root, 'senren:install')
+        end
+      end
+
       def create_senren_dir
         empty_directory '.senren'
       end

data/lib/generators/senren/install/templates/installed_components.yml.tt

@@ -1,4 +1,4 @@
 # This file is the ledger of Senren components installed in this app.
-# It is updated by `bin/rails senren:add` and `bin/rails senren:install`.
+# It is updated by `bin/rails senren:add` and `bin/rails generate senren:install`.
 # Do not edit by hand unless you know what you are doing.
 installed: []

data/lib/senren/rails/asset_path_guard.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require 'pathname'
+
 module Senren
   module Rails
     # Refuses to let component source be served as a static asset.
@@ -58,23 +60,20 @@ module Senren
         components = components_dir(app)
         return [] unless components&.directory?
 
-        asset_paths(app).select { |path| publishes_source?(path, components) }
+        sources = component_sources(components)
+        return [] if sources.empty?
+
+        asset_paths(app).select { |path| publishes_source?(path, sources) }
       end
 
-      # Whether serving this asset path would serve component source.
-      #
-      # `source_files?` used to be asked once about app/components as a whole,
-      # which is the wrong question for a descendant path: with that shape,
-      # app/components/assets holding nothing but CSS looked identical to
-      # app/components/senren holding every component. Only the overlapping
-      # subtree can publish anything, and that subtree is the deeper of the two
-      # paths.
-      def publishes_source?(asset_path, components)
+      # Propshaft follows directory and file symlinks when collecting assets.
+      # Compare their real targets, including links nested below an asset path,
+      # so an alias cannot publish source past the production boot guard.
+      def publishes_source?(asset_path, sources)
         asset = Pathname.new(asset_path.to_s).expand_path
-        components = components.expand_path
-        return false unless overlap?(asset, components)
+        return false unless asset.directory?
 
-        source_files?(asset.to_s.length >= components.to_s.length ? asset : components)
+        each_file(asset).any? { |_, target| sources.key?(target) }
       end
 
       def components_dir(app)
@@ -83,8 +82,30 @@ module Senren
         nil
       end
 
-      def source_files?(dir)
-        SOURCE_EXTENSIONS.any? { |ext| Dir.glob(dir.join("**/*#{ext}")).any? }
+      def component_sources(components)
+        each_file(components).with_object({}) do |(path, target), sources|
+          sources[target] = true if [path.extname, target.extname].any? { |ext| SOURCE_EXTENSIONS.include?(ext) }
+        end
+      end
+
+      # Track real directory identities so aliases and cycles are visited once.
+      # Keep the original filename as well: widget.rb may point to a differently
+      # named file outside app/components, which is still component source.
+      def each_file(path, visited = {}, &block)
+        return enum_for(__method__, path, visited) unless block
+
+        target = path.realpath
+        if target.directory?
+          return if visited[target]
+
+          visited[target] = true
+          target.children.each { |child| each_file(child, visited, &block) }
+        else
+          block.call(path, target)
+        end
+      rescue Errno::ENOENT, Errno::ENOTDIR, Errno::ELOOP
+        # Broken links cannot publish content; visited directories stop cycles.
+        nil
       end
 
       def asset_paths(app)
@@ -93,24 +114,6 @@ module Senren
         []
       end
 
-      # Two paths overlap when one contains the other, in EITHER direction, and
-      # the test has to be separator-aware:
-      #
-      #   app/components         is an ancestor  -> publishes everything
-      #   app/components/senren  is a descendant -> publishes the components
-      #   app/comp               shares a prefix -> publishes nothing
-      #
-      # The first version tested only the ancestor direction with a bare
-      # start_with?, so it missed the descendant case — which is what a
-      # developer writes after reading this module's own remediation text — and
-      # it blocked production boots over an unrelated app/comp directory.
-      def overlap?(one, other)
-        a = "#{one}#{File::SEPARATOR}"
-        b = "#{other}#{File::SEPARATOR}"
-
-        a.start_with?(b) || b.start_with?(a)
-      end
-
       def message_for(offenders)
         <<~MESSAGE.strip
           app/components is on the asset load path (#{offenders.join(', ')}).

data/lib/senren/rails/doctor.rb

@@ -50,7 +50,11 @@ module Senren
 
       def runtime_checks
         [
-          check('ViewComponent gem available')    { defined?(::ViewComponent) },
+          # Not just defined?(::ViewComponent): a host's Gemfile lists senren-ui,
+          # not view_component, so Bundler.require never loads it, and nothing
+          # does until BaseComponent is autoloaded on the first render. A healthy
+          # app booted for this task failed the check.
+          check('ViewComponent gem available')    { defined?(::ViewComponent) || gem_loadable?('view_component') },
           check('TailwindCSS stylesheet present') { paths.stylesheet_path.exist? },
           check('Stimulus directory present')     { paths.stimulus_dir.directory? },
           check('Turbo gem available')            { defined?(::Turbo) || gem_loadable?('turbo-rails') }

data/lib/senren/rails/version.rb

@@ -2,6 +2,6 @@
 
 module Senren
   module Rails
-    VERSION = '0.4.0'
+    VERSION = '0.4.2'
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: senren-ui
 version: !ruby/object:Gem::Version
-  version: 0.4.0
+  version: 0.4.2
 platform: ruby
 authors:
 - vutt
@@ -9,6 +9,20 @@ bindir: bin
 cert_chain: []
 date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
+- !ruby/object:Gem::Dependency
+  name: crass
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 1.0.8
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 1.0.8
 - !ruby/object:Gem::Dependency
   name: rails
   requirement: !ruby/object:Gem::Requirement
@@ -29,14 +43,14 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 4.9.0
+        version: 4.14.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 4.9.0
+        version: 4.14.0
 description: |
   Senren UI is a Rails-native UI component library inspired by the developer
   experience of shadcn/ui. It ships generators, a registry, and a centralized
@@ -59,6 +73,7 @@ files:
 - docs/performance_testing.md
 - docs/visual_style.md
 - lib/commands/senren/add/add_command.rb
+- lib/commands/senren/locales/locales_command.rb
 - lib/generators/senren/component/component_generator.rb
 - lib/generators/senren/component/templates/component.html.erb.tt
 - lib/generators/senren/component/templates/component.rb.tt