ux-autocomplete security release + LiveComponent bugs

Hi!

This release contains an important security release for symfony/ux-autocomplete: https://symfony.com/blog/cve-2023-41336-symfony-ux-autocomplete-prevent-injection-of-invalid-entity-ids-for-autocomplete-fields

If you are using symfony/ux-autocomplete, you should upgrade immediately:

composer update symfony/ux-autocomplete

Other changes:

LiveComponents

• [bug] Only consider Live components in InterceptChildComponentRenderSubscriber by @sneakyvv in #1097
• [bug] Don't store ux_live_component URLs in setTargetPath of the security component by @gbere in #1096

New Contributors

• @andersmateusz made their first contribution in #1100
• @mariecharles made their first contribution in #1058
• @gbere made their first contribution in #1096

Full Changes: v2.11.1...v2.11.2

v2.11.1 - Twig & Live Component bug fixes

Hi UX'ers!

A small release to address a few bug fixes:

What's Changed

• [LiveComponent] Add priority to PreDehydrate & PostHydrate hooks by @sneakyvv in #1074
• [LiveComponent] Use display:revert for data-loading style by @norkunas in #1079
• [TwigComponent][LiveComponent] Fix Live embedded component within namespaced template by @sneakyvv in #1082
• [TwigComponent][LiveComponent] Fix DataModelPropsSubscriber for embedded components by @sneakyvv in #1093

Full Changes: v2.11.0...v2.11.1

Have fun!

v2.11.0: TogglePassword Component, Anonymous Twig Components + more!

Hi UX People!

This release contains a bucketload of good stuff:

New Component!

• UX Toggle Password: add "hide/show" links to toggle the password to plain-text!

TwigComponent

• Support ...spread operator with html syntax (requires Twig 3.7.0 or higher)
• Add support for anonymous Twig components.
• Add RenderedComponent::crawler() and toString() methods.
• Allow a block outside a Twig component to be available inside via outerBlocks.
• Fix <twig:component> syntax where an attribute is set to an empty value.

LiveComponent

• Add helper for testing live components.
• Add initial file upload support.
• Respect data-turbo="false" when handling redirects.
• Fix checksum calculation for deeply nested data.

New Contributors

• @youassi made their first contribution in #987
• @ngrie made their first contribution in #993
• @DennisdeBest made their first contribution in #1001
• @gpetraroli made their first contribution in #1011
• @asispts made their first contribution in #1019
• @feymo made their first contribution in #1000
• @leonardsimonse made their first contribution in #1020
• @sponno made their first contribution in #1035
• @yassinefikri made their first contribution in #1040
• @jcrombez made their first contribution in #1054
• @Jasperator made their first contribution in #1067

Full Changes: v2.10.0...v2.11.0

v2.10.0

Hi UX People!

This release contains various new features and big fixes:

BC Breaks

• [LiveComponent] A BC break was made to ComponentWithFormTrait in #967: some methods were renamed.

Features

• [All] bump to php >=8.1 everywhere by @bendavies in #946
• [TwigComponent] Support passing blocks to nested embedded components by @sneakyvv in #920
• [TwigComponent] add test helper by @kbond in #821
• [LiveComponent] resetForm() method to get a fresh form by @weaverryan in #884
• [LiveComponent] Method Name changes in ComponentWithFormTrait + expanded docs by @weaverryan in #967
• [Autocomplete] When min chars is not set, keep loading after initial load by @weaverryan in #919
• Stimulus controllers: allow to define outlets by @jmsche in #942

Bug Fixes

• Fix Doctrine Persistence deprecation by @jmsche in #918
• [Live] Removing docs showing the proxied component by @weaverryan in #926
• [TwigComponent] Fix opening of default block inside an open twig block by @sneakyvv in #892
• [TwigComponent] Ignore verbatim block during Prelexing by @WebMamba in #949
• [TwigComponent] Fix escaping stimulus attributes by @1ed in #969
• [LiveComponent] Working around issue where FormView is passed to the component by @weaverryan in #943
• [Turbo] Fixing a bug where saving a proxy would not trigger Broadcasts by @weaverryan in #951
• [Live] Fixing bug with data-action="live#update" and inside clickable elements by @weaverryan in #950
• [Translator] generate unique constants name (fix #938) by @Kocal in #945
• [StimulusBundle] Fix controller name conversion by @jon-ht in #953
• [StimulusBundle] Fixing bug where new custom controllers were not seen due to cache by @weaverryan in #964

Full Changes: v2.9.1...v2.10.0

Various compatibility bug fixes

Hi UX people!

This release fixes several bugs with the 2.9.0 release that caused problems when updating.

• More precisely initializing services/config for asset mapper by @weaverryan in #911
• [LiveComponent] Fix array valued checkboxes change event handling by @welcoMattic in #910
• [StimulusBundle] Marking only the AssetMapper integration as experimental by @weaverryan in #908
• [TwigComponent] Fix breaking (deprecation instead) when using .add() + StimulusBundle by @weaverryan in #914

Upgrading

Like with version 2.9.0, if you're upgrading from a 2.8 or earlier, you may get this error after running composer update:

Uncaught Exception: The service "chartjs.twig_extension" has a dependency on a non-existent service "stimulus.helper"

To fix this, run composer update one more time. The problem is, after the first update, Symfony Flex may not properly add StimulusBundle to config/bundles.php. After the 2nd update, it should be added, and the error will go away. See #907.

Diff: v2.9.0...v2.9.1

Cheers!

New StimulusBundle + AssetMapper Support

Hi UX people!

This release includes significant, but lower-level changes:

A) A new StimulusBundle was added! This is the new home for the {{ stimulus_controller() }}, {{ stimulus_action() }} and {{ stimulus_target() }} Twig functions that were previously part of WebpackEncoreBundle. These functions work the same as before, though the internals of how they do their job was improved.

B) Several UX packages (e.g. ux/chartjs) that previously relied on WebpackEncoreBundle internally now rely on StimulusBundle. Though, you shouldn't notice any difference.

C) Support for Symfony 6.3's new AssetMapper component were added to all packages.

In addition to this, several bugs were fixed in TwigComponent's new HTML syntax, LiveComponent and Chart.js.

Upgrading

Due to a bug in Symfony Flex, when upgrading your dependencies, you may get an error like:

Uncaught Exception: The service "chartjs.twig_extension" has a dependency on a non-existent service "stimulus.helper"

To fix this, run composer update one more time. The problem is, after the first update, Symfony Flex may not properly add StimulusBundle to config/bundles.php. After the 2nd update, it should be added, and the error will go away. See #907.

Diff: v2.8.1...v2.9.0

Cheers!

Collection of bug fixes across LiveComponents, TwigComponents, Chartjs

Hi UX people!

This release contains a number of nice bug fixes across several components:

ChartJs

• [Bug] Adding a better way to register Chartjs plugins by @weaverryan in #870

TwigComponent

• [Bug] Fix lexer to escape attribute name when it contains dashes by @norkunas in #837
• [Bug] Ignore twig comments when prelexing by @WebMamba in #842
• [Bug] fixing issue with files finishing with comments by @WebMamba in #847
• [Bug] Fix lexer to escape truthy attribute names by @norkunas in #848
• [Bug] Fixing bug where traditional blocks aren't handled correctly by @weaverryan in #859

LiveComponent

• [Bug] Throw clear error when using union types for LiveProps by @sneakyvv in #856
• [Bug] Fixing bug with ComponentWithFormTrait and empty collections by @weaverryan in #857
• [Bug] Smarter form trait data extracting by @weaverryan in #866
• [Bug] Upping priority on LiveComponentSubscriber by @weaverryan in #868

Diff: v2.8.0...v2.8.1

Happy UX'ing!

2 new components, Twig HTML Syntax + Big Live Updates

Hi UX people!

This is a BIG release full of a new Twig component HTML syntax (<twig:Component/>), massive live components updates and various other items.

• 2 new components: ux-translator and ux-svelte!
• LiveComponents: new smart rendering system, better handling for LiveProp data types, emit() to other components + much more - see the full CHANGELOG
• TwigComponents: new <twig:ComponentName/> HTML syntax and other improvements - CHANGELOG
• Chartjs: Chart now smartly re-renders if any Stimulus values passed to it change CHANGELOG
• Autocomplete: Added support for optiongroup & updating of the smart select when the underlying options change - CHANGELOG.

Diff: v2.7.1...v2.8.0

Cheers!

Fixing missing CSS files in packages

Hi UX people!

This release fixes a problem where some packages were missing their associated CSS files, do to an overeager .gitattributes setting. That's it - nice and simple.

Diff: v2.7.0...v2.7.1

Cheers!

TypeScript Types, JavaScript Bubbling & Many LiveComponent Improvements

Hi UX people!

This release is a big mixture of a lot of nice changes. The most notable are that (A) TypeScript types are now included in the packages, (B) all Stimulus events (e.g. chartjs:connect) now "bubble" so that you can attach listeners around the controllers (this was already the case for some packages, but not all) and (C) MANY continued improvements and fixes for LiveComponents.

Diff: v2.6.1...v2.7.0

UX Autocomplete

• Add assets/src to .gitattributes to exclude them from the installation

• Fix minCharacters option default value handling when using a falsy value like 0.

• Fix TypeScript types

• Add a new route parameter to AsEntityAutocompleteField, which allows to choose another route for Ajax calls.

• Fix minCharacters option default value handling when using a falsy value like 0.

• Fix TypeScript types

• Add a way to detect if a field is an "autocomplete" field in form themes - #608

UX Chartjs

• The chartjs:connect JavaScript event now bubbles up.

• Add assets/src to .gitattributes to exclude source TypeScript files from
  installing.

• TypeScript types are now included.

UX Cropperjs

• The JavaScript events now bubble up.

• Add assets/src to .gitattributes to exclude source TypeScript files from
  installing.

• TypeScript types are now included.

Dropzone

• The JavaScript events now bubble up.

• Add assets/src to .gitattributes to exclude source TypeScript files from
  installing.

• TypeScript types are now included.

LazyImage

• The JavaScript events now bubble up.

• Add assets/src to .gitattributes to exclude source TypeScript files from
  installing.

• TypeScript types are now included.

LiveComponent

• [BC BREAK]: The "key" used to load the controller in your assets/controllers.json
  file changed from typed to live. Update your assets/controllers.json
  file to change this key.

• Add a strategy for adding a Stimulus controller to a Twig component - #589.

• Added a new getCompontent() function in JavaScript as the best way to find
  a Component object for a given element.

• Fixed various bugs related to child component handling - #596

• Added a new route parameter to AsLiveComponent, which allows to choose
  another route for Ajax calls.

• Add assets/src to .gitattributes to exclude source TypeScript files from
  installing.

• TypeScript types are now included.

• Added new response:error JavaScript component hook for custom handling Ajax errors - #587.

Notify

• Add assets/src to .gitattributes to exclude source TypeScript files from
  installing.

• TypeScript types are now included.

React

• Add assets/src to .gitattributes to exclude source TypeScript files from
  installing.

• TypeScript types are now included.

Swup

• The JavaScript events now bubble up.

• Add assets/src to .gitattributes to exclude source TypeScript files from
  installing.

• TypeScript types are now included.

Turbo

• Add assets/src to .gitattributes to exclude source TypeScript files from
  installing.

• TypeScript types are now included.

TwigComponent

• PreMount and PostMount hooks can now return nothing.

Typed

• Add assets/src to .gitattributes to exclude source TypeScript files from
  installing.

• TypeScript types are now included.

Vue

• Add assets/src to .gitattributes to exclude source TypeScript files from
  installing.

• TypeScript types are now included.

Cheers!