[myabc]

🤖 Opened by an agent on Alex's behalf.

Syncs the fork with primer/view_components through upstream v0.52.2 — merge target cbd8efbc4 (parent of Release Tracking primer#4109).

Upstream changes included

• Reject javascript:/vbscript: URI schemes in href (defense in depth) — new Primer::SafeHrefHelper, applied in Label, Button, Link, BaseComponent.
• Blankslate: heading/body text now default to compact sizes; removed the now-redundant responsive @container block.
• Fix incorrect label for attribute when scope_id_to_model: false.
• ToggleSwitch: fixed knob spacing/border-radius to match primer/react.
• Various actions/checkout v6 → v7 bumps across CI workflows.

Conflicts resolved

• 17 workflow YAML files conflicted on actions/checkout: fork pins to an immutable SHA + persist-credentials: false (zizmor hardening) where upstream uses an unpinned @v7 tag. Kept the fork's pinned-SHA pattern, updated the pin to v7's SHA (3d3c42e5aac5ba805825da76410c181273ba90b1). Re-validated every file with ruby -ryaml.
• .github/workflows/release_conductor.yml: fork deliberately removed this (human commit, not upstream-inherited) — kept it deleted.
• demo/Gemfile: kept the fork's view_component pin at 4.9.0 — a Dependabot bump to 4.11.0 (Bump view_component from 4.9.0 to 4.11.0 in /demo primer/view_components#4081) exists upstream of this fork but was never merged, so upstream's 4.12.0 wasn't taken either.
• package.json/package-lock.json: kept fork identity (name/version/description); lockfile fully regenerated via npm install rather than hand-resolving ~100 transitive-dependency conflict hunks.

Notes

• Also carries the static/previews.json determinism fix from Sort previews.json output deterministically #508 (not yet merged) — sorts Lookbook.previews by lookup_path before generating, so this sync doesn't trigger the CI reorder-autocommit churn seen on Sync Primer view_components upstream through v0.52.0 #506/Sync Primer view_components upstream through v0.52.1 #507. Once Sort previews.json output deterministically #508 merges this becomes a no-op diff here.
• Static files regenerated from a clean tree (git clean -fdx -- app/ first) — no phantom classes leaked into static/classes.json / classnames.*.
• nokogiri already matched upstream (1.19.4) — no dependency replay needed.
• npm audit: same 14 pre-existing vulnerabilities as main, nothing new introduced by this sync.
• Ran the tests touching this batch's changed files (safe_href_helper, base_component, label, button, forms/input) — all green.

[changeset-bot]

🦋 Changeset detected

Latest commit: 6b8116b

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@openproject/primer-view-components	Minor

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[Copilot]

Pull request overview

Syncs this fork with upstream primer/view_components through v0.52.2, bringing in security hardening, component behavior/style fixes, and CI/dependency updates while preserving fork-specific workflow pinning and package identity.

Changes:

• Add Primer::SafeHrefHelper and enforce javascript: / vbscript: href sanitization (raise in non-production; drop href in production) across anchor-rendering components via BaseComponent.
• Fix Primer::Forms label for handling so scoped/unscoped IDs remain correctly associated.
• Update component styles/behaviors (Blankslate typography defaults, ToggleSwitch knob spacing) and make static/previews.json generation deterministic; refresh dependencies and workflow actions/checkout pins.

Reviewed changes

Copilot reviewed 35 out of 38 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
test/lib/safe_href_helper_test.rb	Adds unit tests for unsafe href scheme detection and normalization edge cases.
test/lib/primer/forms/input_test.rb	Extends form input tests to assert correct <label for=...> associations across scoping/id cases.
test/components/primer/beta/button_test.rb	Adds coverage for rejecting/neutralizing unsafe href when Button is rendered as an anchor.
test/components/beta/label_test.rb	Adds coverage for rejecting/neutralizing unsafe href when Label is rendered as an anchor.
test/components/base_component_test.rb	Adds core tests for unsafe href rejection in non-production and neutralization in production.
app/lib/primer/safe_href_helper.rb	Introduces helper for detecting dangerous URI schemes in href with whitespace/control-char bypass handling.
app/components/primer/component.rb	Adds sanitize_href! hook implementation (raise vs. neutralize) and mixes in the helper.
app/components/primer/base_component.rb	Calls sanitize_href! during initialization so unsafe href never reaches rendered HTML.
app/lib/primer/forms/dsl/input.rb	Adjusts label for assignment to avoid breaking Rails-generated scoped associations.
lib/primer/static/generate_previews.rb	Sorts previews by lookup_path to make generated static/previews.json stable across platforms.
app/components/primer/beta/blankslate.pcss	Updates default typography sizing and removes redundant responsive container overrides.
app/components/primer/alpha/toggle_switch.pcss	Fixes ToggleSwitch knob inset/offset and border-radius to better match Primer React.
package.json	Bumps @oddbird/popover-polyfill range.
package-lock.json	Regenerates lockfile to reflect updated dependency resolution.
demo/Gemfile	Bumps spring constraint for the demo app.
demo/Gemfile.lock	Updates demo lockfile for the spring bump.
.github/workflows/triage.yml	Updates pinned actions/checkout SHA to v7.
.github/workflows/test-visual.yml	Updates pinned actions/checkout SHA to v7.
.github/workflows/test-system.yml	Updates pinned actions/checkout SHA to v7.
.github/workflows/test-selectors.yml	Updates pinned actions/checkout SHA to v7.
.github/workflows/test-performance.yml	Updates pinned actions/checkout SHA to v7.
.github/workflows/test-lib.yml	Updates pinned actions/checkout SHA to v7.
.github/workflows/test-components.yml	Updates pinned actions/checkout SHA to v7.
.github/workflows/test-accessibility.yml	Updates pinned actions/checkout SHA to v7.
.github/workflows/static-files.yml	Updates pinned actions/checkout SHA to v7 while retaining persist-credentials: true for autocommit pushes.
.github/workflows/release.yml	Updates pinned actions/checkout SHA to v7.
.github/workflows/release-checklist.yml	Updates pinned actions/checkout SHA to v7.
.github/workflows/preview-deploy.yml	Updates pinned actions/checkout SHA to v7.
.github/workflows/lint.yml	Updates pinned actions/checkout SHA to v7 across lint jobs.
.github/workflows/demo-production-deploy.yml	Updates pinned actions/checkout SHA to v7 across demo deploy jobs.
.github/workflows/demo-preview-destroy.yml	Updates pinned actions/checkout SHA to v7.
.github/workflows/demo-preview-cleanup.yml	Updates pinned actions/checkout SHA to v7.
.github/workflows/codeql-analysis.yml	Updates pinned actions/checkout SHA to v7.
.changeset/toggle-switch-knob-styling.md	Records patch-level release note for ToggleSwitch knob styling fix.
.changeset/sanitize-href-uri-scheme.md	Records patch-level release note for unsafe href sanitization behavior.
.changeset/chatty-pants-hang.md	Records patch-level release note for the forms label for association fix.
.changeset/blankslate-size-scale.md	Records minor release note for Blankslate default typography sizing change.

[github-actions]

⚠️ Visual or ARIA snapshot differences found

Our visual and ARIA snapshot tests found UI differences. Please review the differences by viewing the files changed tab to ensure that the changes were intentional.

Review differences