style_capsule 2.0.1 → 2.0.3

data/lib/style_capsule/stylesheet_registry.rb

@@ -1,7 +1,9 @@
 # frozen_string_literal: true
 
+require "cgi"
 require_relative "instrumentation"
 require_relative "asset_path"
+require_relative "css_processor"
 
 module StyleCapsule
   # Helper to determine the parent class for StylesheetRegistry
@@ -72,14 +74,18 @@ module StyleCapsule
   class StylesheetRegistry < StyleCapsule.stylesheet_registry_parent_class
     # Default namespace for backward compatibility
     DEFAULT_NAMESPACE = :default
+    MAX_INLINE_CACHE_ENTRIES = 256
+    FALLBACK_LINK_OPTION_NAME = /\A(?:media|title|crossorigin|integrity|nonce|type|id|class|data-[a-zA-Z0-9_-]+)\z/
 
     # Process-wide manifest for static file paths (like Propshaft)
     # Organized by namespace: { namespace => { logical_path => { file_path:, options: } } }
     @manifest = {} # rubocop:disable Style/ClassVars, ThreadSafety/MutableClassInstanceVariable
+    @manifest_mutex = Mutex.new
 
     # Process-wide cache for inline CSS (with expiration support)
     # Structure: { cache_key => { css_content: String, cached_at: Time, expires_at: Time } }
     @inline_cache = {} # rubocop:disable Style/ClassVars, ThreadSafety/MutableClassInstanceVariable
+    @inline_cache_mutex = Mutex.new
 
     # Track last cleanup time for lazy cleanup (prevents excessive cleanup calls)
     @last_cleanup_time = nil # rubocop:disable Style/ClassVars
@@ -222,8 +228,10 @@ module StyleCapsule
         inline_size: nil,
         cache_strategy: :none
       ) do
-        @manifest[ns] ||= {}
-        @manifest[ns][path] = {file_path: path, options: options}
+        with_manifest do
+          @manifest[ns] ||= {}
+          @manifest[ns][path] = {file_path: path, options: options}
+        end
       end
     end
 
@@ -350,11 +358,10 @@ module StyleCapsule
     # @param namespace [Symbol] Namespace (for proc strategy)
     # @return [String, nil] Cached CSS content or nil if not cached/expired
     def self.cached_inline(cache_key, cache_strategy:, cache_ttl: nil, cache_proc: nil, css_content: nil, capsule_id: nil, namespace: nil)
-      # Lazy cleanup: remove expired entries if it's been a while (every 5 minutes)
-      # This prevents memory leaks in long-running processes without impacting performance
-      cleanup_expired_cache_if_needed
-
-      cached_entry = @inline_cache[cache_key]
+      cached_entry = with_inline_cache do
+        cleanup_expired_cache_unlocked_if_needed
+        @inline_cache[cache_key]
+      end
       return nil unless cached_entry
 
       # Check expiration based on strategy
@@ -402,11 +409,16 @@ module StyleCapsule
         end
       end
 
-      @inline_cache[cache_key] = {
-        css_content: css_content,
-        cached_at: current_time,
-        expires_at: expires_at
-      }
+      with_inline_cache do
+        unless @inline_cache.key?(cache_key)
+          @inline_cache.shift while @inline_cache.size >= MAX_INLINE_CACHE_ENTRIES
+        end
+        @inline_cache[cache_key] = {
+          css_content: css_content,
+          cached_at: current_time,
+          expires_at: expires_at
+        }
+      end
     end
 
     # Clear inline CSS cache
@@ -414,10 +426,12 @@ module StyleCapsule
     # @param cache_key [String, nil] Specific cache key to clear (nil clears all)
     # @return [void]
     def self.clear_inline_cache(cache_key = nil)
-      if cache_key
-        @inline_cache.delete(cache_key)
-      else
-        @inline_cache.clear
+      with_inline_cache do
+        if cache_key
+          @inline_cache.delete(cache_key)
+        else
+          @inline_cache.clear
+        end
       end
     end
 
@@ -437,13 +451,16 @@ module StyleCapsule
     #   # In a scheduled job or initializer
     #   StyleCapsule::StylesheetRegistry.cleanup_expired_cache
     def self.cleanup_expired_cache
+      with_inline_cache { cleanup_expired_cache_unlocked }
+    end
+
+    def self.cleanup_expired_cache_unlocked
       return 0 if @inline_cache.empty?
 
       now = current_time
       expired_keys = []
 
       @inline_cache.each do |cache_key, entry|
-        # Remove entries that have an expires_at time and it's in the past
         if entry[:expires_at] && now > entry[:expires_at]
           expired_keys << cache_key
         end
@@ -455,23 +472,24 @@ module StyleCapsule
       expired_keys.size
     end
 
-    # Check if cleanup is needed and perform it if so
-    #
-    # Only performs cleanup if it's been more than 5 minutes since the last cleanup.
-    # This prevents excessive cleanup calls while still preventing memory leaks.
-    #
-    # @return [void]
-    # @api private
-    def self.cleanup_expired_cache_if_needed
-      # Cleanup every 5 minutes (300 seconds) to balance memory usage and performance
+    def self.cleanup_expired_cache_unlocked_if_needed
       cleanup_interval = 300
 
       if @last_cleanup_time.nil? || (current_time - @last_cleanup_time) > cleanup_interval
-        cleanup_expired_cache
+        cleanup_expired_cache_unlocked
       end
     end
 
-    private_class_method :cleanup_expired_cache_if_needed
+    def self.with_inline_cache
+      @inline_cache_mutex.synchronize { yield }
+    end
+
+    def self.with_manifest
+      @manifest_mutex.synchronize { yield }
+    end
+
+    private_class_method :cleanup_expired_cache_unlocked, :cleanup_expired_cache_unlocked_if_needed,
+      :with_inline_cache, :with_manifest
 
     # Get all registered file paths from process-wide manifest (organized by namespace)
     #
@@ -540,11 +558,13 @@ module StyleCapsule
     # @param namespace [Symbol, String, nil] Optional namespace to clear (nil clears all)
     # @return [void]
     def self.clear_manifest(namespace: nil)
-      if namespace.nil?
-        @manifest = {}
-      else
-        ns = normalize_namespace(namespace)
-        @manifest.delete(ns)
+      with_manifest do
+        if namespace.nil?
+          @manifest = {}
+        else
+          ns = normalize_namespace(namespace)
+          @manifest.delete(ns)
+        end
       end
     end
 
@@ -564,7 +584,17 @@ module StyleCapsule
     #   If nil, falls back to basic HTML generation
     # @param namespace [Symbol, String, nil] Optional namespace to render (nil/blank renders all namespaces)
     # @return [String] HTML-safe string with stylesheet tags
-    # rubocop:disable Metrics/AbcSize, Metrics/PerceivedComplexity -- renders mixed inline and file registrations
+    def self.render_stylesheet_entries(stylesheets, view_context)
+      stylesheets.map do |stylesheet|
+        if stylesheet[:type] == :inline
+          render_inline_stylesheet(stylesheet, view_context)
+        else
+          render_file_stylesheet(stylesheet, view_context)
+        end
+      end.join("\n").then { |s| safe_string(s) }
+    end
+
+    # rubocop:disable Metrics/AbcSize, Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity -- renders mixed inline and file registrations
     def self.render_head_stylesheets(view_context = nil, namespace: nil)
       if namespace.nil? || namespace.to_s.strip.empty?
         request_files_snapshot = request_file_stylesheets.transform_values { |files| files.keys.dup }
@@ -578,16 +608,9 @@ module StyleCapsule
 
         return safe_string("") if all_stylesheets.empty?
 
-        rendered = all_stylesheets.map do |stylesheet|
-          if stylesheet[:type] == :inline
-            render_inline_stylesheet(stylesheet, view_context)
-          else
-            render_file_stylesheet(stylesheet, view_context)
-          end
-        end.join("\n").then { |s| safe_string(s) }
+        rendered = render_stylesheet_entries(all_stylesheets, view_context)
 
         clear_snapshotted_request_registrations(request_files_snapshot, request_inline_snapshot)
-        rendered
 
       else
         # Render specific namespace
@@ -598,24 +621,19 @@ module StyleCapsule
 
         return safe_string("") if stylesheets.empty?
 
-        rendered = stylesheets.map do |stylesheet|
-          if stylesheet[:type] == :inline
-            render_inline_stylesheet(stylesheet, view_context)
-          else
-            render_file_stylesheet(stylesheet, view_context)
-          end
-        end.join("\n").then { |s| safe_string(s) }
+        rendered = render_stylesheet_entries(stylesheets, view_context)
 
         clear_snapshotted_request_registrations_for_namespace(
           ns,
           file_paths: snapshotted_file_paths,
           snapshotted_inline_stylesheets: snapshotted_inline
         )
-        rendered
 
       end
+
+      rendered
     end
-    # rubocop:enable Metrics/AbcSize, Metrics/PerceivedComplexity
+    # rubocop:enable Metrics/AbcSize, Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity
 
     # Check if there are any registered stylesheets
     #
@@ -668,6 +686,7 @@ module StyleCapsule
     end
 
     # @api private
+    # rubocop:disable Metrics/AbcSize, Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity -- clears snapshotted request registries per namespace
     def self.clear_snapshotted_request_registrations_for_namespace(namespace, file_paths:, snapshotted_inline_stylesheets:)
       ns = normalize_namespace(namespace)
 
@@ -694,6 +713,7 @@ module StyleCapsule
 
       self.inline_stylesheets = inline_registry
     end
+    # rubocop:enable Metrics/AbcSize, Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity
 
     # Inject pending request-scoped stylesheets into an HTML document before +</head>+.
     #
@@ -708,10 +728,16 @@ module StyleCapsule
       return html if pending_stylesheets.empty?
 
       closing_head_index = html.match(%r{</head>}i)&.begin(0)
-      return html unless closing_head_index
+      unless closing_head_index
+        clear
+        return html
+      end
 
       tags = render_stylesheet_tags(pending_stylesheets, view_context)
-      return html if tags.empty?
+      if tags.empty?
+        clear
+        return html
+      end
 
       injected = html.dup
       injected.insert(closing_head_index, "#{tags}\n")
@@ -793,20 +819,24 @@ module StyleCapsule
       else
         # Fallback if no view context (logical path validated in .register)
         href = "/assets/#{file_path}.css"
-        tag_options = options.map { |k, v| %(#{k}="#{v}") }.join(" ")
+        tag_options = fallback_link_option_attributes(options)
         safe_string(%(<link rel="stylesheet" href="#{href}"#{" #{tag_options}" unless tag_options.empty?}>))
       end
     end
 
+    def self.fallback_link_option_attributes(options)
+      options.filter_map do |key, value|
+        name = key.to_s
+        next unless name.match?(FALLBACK_LINK_OPTION_NAME)
+
+        %(#{name}="#{CGI.escapeHTML(value.to_s)}")
+      end.join(" ")
+    end
+
     # Render an inline stylesheet
-    def self.render_inline_stylesheet(stylesheet, view_context)
-      # CSS content is already scoped when registered from components
-      # capsule_id is stored for reference but CSS is pre-processed
+    def self.render_inline_stylesheet(stylesheet, _view_context)
       css_content = stylesheet[:css_content]
-
-      # Construct HTML manually to avoid any HTML escaping issues
-      # CSS content should not be HTML-escaped as it's inside a <style> tag
-      # Using string interpolation with html_safe ensures CSS is not escaped
+      CssProcessor.reject_style_element_breakout!(css_content)
       safe_string(%(<style type="text/css">#{css_content}</style>))
     end
 
@@ -822,6 +852,7 @@ module StyleCapsule
       end
     end
 
-    private_class_method :render_file_stylesheet, :render_inline_stylesheet, :safe_string
+    private_class_method :render_file_stylesheet, :render_inline_stylesheet, :safe_string,
+      :fallback_link_option_attributes
   end
 end

data/lib/style_capsule/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module StyleCapsule
-  VERSION = "2.0.1"
+  VERSION = "2.0.3"
 end

data/lib/style_capsule/view_component.rb

@@ -167,7 +167,7 @@ module StyleCapsule
 
         # File caching is only allowed for class method component_styles
         if cache_strategy == :file && !file_caching_allowed?
-          # Fall back to :none strategy if file caching requested but not allowed
+          warn_file_cache_fallback(self.class)
           cache_strategy = :none
           cache_ttl = nil
           cache_proc = nil

data/sig/style_capsule.rbs

@@ -6,9 +6,13 @@ module StyleCapsule
   end
 
   module CssProcessor
+    MAX_CSS_SIZE: Integer
+    NON_SCOPING_AT_RULES: Array[String]
+    HOISTABLE_AT_RULES: Array[String]
+
     def self.scope_selectors: (String css_string, String capsule_id, ?component_class: Class | String | nil) -> String
     def self.scope_with_nesting: (String css_string, String capsule_id, ?component_class: Class | String | nil) -> String
-    def self.strip_comments: (String css) -> String
+    def self.reject_style_element_breakout!: (String | nil css_string) -> void
   end
 
   class CssFileWriter
@@ -24,6 +28,7 @@ module StyleCapsule
   # At runtime inherits Object when ActiveSupport::CurrentAttributes is unavailable.
   class StylesheetRegistry
     DEFAULT_NAMESPACE: Symbol
+    MAX_INLINE_CACHE_ENTRIES: Integer
 
     def self.normalize_namespace: (Symbol | String | nil namespace) -> Symbol
     def self.register: (String file_path, ?namespace: Symbol | String | nil, **Hash[untyped, untyped] options) -> void

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: style_capsule
 version: !ruby/object:Gem::Version
-  version: 2.0.1
+  version: 2.0.3
 platform: ruby
 authors:
 - Andrei Makarov
@@ -15,7 +15,7 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '6.0'
+        version: '7.0'
     - - "<"
       - !ruby/object:Gem::Version
         version: '9.0'
@@ -25,7 +25,7 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '6.0'
+        version: '7.0'
     - - "<"
       - !ruby/object:Gem::Version
         version: '9.0'
@@ -35,7 +35,7 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '6.0'
+        version: '7.0'
     - - "<"
       - !ruby/object:Gem::Version
         version: '9.0'
@@ -45,7 +45,7 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '6.0'
+        version: '7.0'
     - - "<"
       - !ruby/object:Gem::Version
         version: '9.0'
@@ -67,16 +67,16 @@ dependencies:
   name: polyrun
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: 1.5.0
+        version: 2.2.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: 1.5.0
+        version: 2.2.0
 - !ruby/object:Gem::Dependency
   name: webmock
   requirement: !ruby/object:Gem::Requirement
@@ -105,48 +105,6 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '13'
-- !ruby/object:Gem::Dependency
-  name: simplecov
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '0.22'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '0.22'
-- !ruby/object:Gem::Dependency
-  name: rspec_junit_formatter
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '0.6'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '0.6'
-- !ruby/object:Gem::Dependency
-  name: simplecov-cobertura
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '3'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '3'
 - !ruby/object:Gem::Dependency
   name: standard
   requirement: !ruby/object:Gem::Requirement
@@ -273,20 +231,6 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '2'
-- !ruby/object:Gem::Dependency
-  name: memory_profiler
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '1'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '1'
 - !ruby/object:Gem::Dependency
   name: rbs
   requirement: !ruby/object:Gem::Requirement
@@ -329,11 +273,8 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '4.0'
-description: Provides component-scoped CSS encapsulation using [data-capsule] attributes
-  for Phlex components, ViewComponent components, and ERB templates. Styles are automatically
-  scoped to prevent leakage between components. Inspired by component-based CSS approaches
-  like Angular's view encapsulation and CSS modules. Works with Rails and can be used
-  standalone in other Ruby frameworks (Sinatra, Hanami, etc.) or plain Ruby scripts.
+description: Attribute-based CSS scoping via [data-capsule] for Phlex, ViewComponent,
+  and ERB. Works with Rails and standalone in other Ruby frameworks or plain Ruby.
 email:
 - contact@kiskolabs.com
 executables: []
@@ -344,7 +285,16 @@ files:
 - LICENSE.md
 - README.md
 - SECURITY.md
+- docs/changelogs/20260904180000_audit-fixes.md
+- docs/changelogs/20260925094000_head-injection-bufferable-chunked.md
+- docs/changelogs/20260928193000_sync-appraisal-locks-after-version-bump.md
+- docs/dependencies/20260904174500_json-cve-2026-71847.md
+- docs/issues/20260904174500_engineering-and-dependency-audit.md
+- docs/issues/20260917123253_ci-drop-automatic-dependency-audit.md
+- docs/issues/20261103150931_engineering-prose-release-audit.md
 - docs/non_rails_support.md
+- docs/reviews/20261028_engineering-audit-release-preparation.md
+- docs/reviews/20261103150931_engineering-prose-release-audit.md
 - lib/style_capsule.rb
 - lib/style_capsule/asset_path.rb
 - lib/style_capsule/class_registry.rb
@@ -383,14 +333,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: '3.0'
+      version: '3.4'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.3
+rubygems_version: 4.0.6
 specification_version: 4
 summary: Attribute-based CSS scoping for Phlex, ViewComponent, and ERB templates.
 test_files: []