CVS commit: pkgsrc/www/py-django-js-asset

["Adam Ciarcinski" <adam%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   adam
Date:           Thu Sep  3 09:20:44 UTC 2026

Modified Files:
        pkgsrc/www/py-django-js-asset: Makefile PLIST distinfo

Log Message:
py-django-js-asset: updated to 4.1.0

4.1 (2026-08-28)

- Fixed ``js_asset.Media`` crashing with an ``AttributeError`` when rendering an
  asset that only implements Django's plain ``__html__`` contract (neither a
  ``MediaAsset`` nor one of our ``ImportMap``/``JSON`` types). Such assets now
  fall back to ``__html__()`` exactly like ``django.forms.Media`` does; the
  nonce cannot be threaded into an opaque ``__html__`` asset, same as with stock
  Django.
- Fixed ``js_asset.Media`` treating html-safe strings -- e.g.
  ``mark_safe('<script defer src="..."></script>')``, a long-documented Django
  idiom for embedding a complete asset tag -- as asset paths, so they were run
  through ``static()`` and percent-encoded instead of being rendered verbatim.
  Anything providing ``__html__()`` now takes the verbatim path, matching
  ``django.forms.Media``.
- ``js_asset.Media`` additionally renders html-safe strings correctly on Django
  6.1, whose own ``forms.Media`` mangles them (fixed in Django for 6.1.1). Only
  media built through ``js_asset.Media`` benefits; assets adopted from a plain
  ``forms.Media`` -- including widget ``Media`` declarations, which Django
  always builds with ``forms.Media`` -- are already normalized before we see
  them.
- Fixed ``js_asset.Media`` dropping the CSP nonce when rendering through
  Django's ``{% csp_nonce_attr media %}`` template tag. The tag passes the lazy
  ``csp_nonce`` object, which is deliberately falsy until it is first read, so
  truth-testing it looked like "no nonce at all". Lazy nonces are now resolved
  (still only when there is something to render, so an empty media does not
  cause a nonce to be generated).
- Fixed ``js_asset.Media.render_css()`` and ``.render_js()`` -- part of
  ``forms.Media``'s public API -- rendering neither the CSP nonce nor the merged
  import map. Only the full ``render()`` did.
- Fixed ``media["css"]`` / ``media["js"]`` -- what ``{{ media.css }}`` and
  ``{{ media.js }}`` resolve to in templates, and what Django's admin renders
  with ``{% csp_nonce_attr media.js %}`` -- returning a plain
  ``django.forms.Media``, therefore losing the CSP nonce and the import-map
  merging. They now return a ``js_asset.Media`` carrying the same nonce.
- Fixed inline CSS (``CSS(css, inline=True)``) being HTML-escaped. A
  ``<style>`` element is raw text -- character references are not decoded inside
  it -- so escaping silently broke every rule containing ``>``, ``"``, ``'`` or
  ``&``: ``nav &gt; a`` matches nothing. Inline CSS now renders verbatim, and
  CSS containing ``</style`` (the one sequence which could close the element
  early) is rejected with a ``ValueError``.
- Corrected the docs around Django 6.1 support. Thanks James Bligh!
- Finally set up a documentation site at Read the Docs for django-js-asset.


To generate a diff of this commit:
cvs rdiff -u -r1.13 -r1.14 pkgsrc/www/py-django-js-asset/Makefile
cvs rdiff -u -r1.4 -r1.5 pkgsrc/www/py-django-js-asset/PLIST
cvs rdiff -u -r1.11 -r1.12 pkgsrc/www/py-django-js-asset/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/www/py-django-js-asset/Makefile
diff -u pkgsrc/www/py-django-js-asset/Makefile:1.13 pkgsrc/www/py-django-js-asset/Makefile:1.14
--- pkgsrc/www/py-django-js-asset/Makefile:1.13 Thu Oct  9 08:01:59 2025
+++ pkgsrc/www/py-django-js-asset/Makefile      Thu Sep  3 09:20:44 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.13 2025/10/09 08:01:59 wiz Exp $
+# $NetBSD: Makefile,v 1.14 2026/09/03 09:20:44 adam Exp $
 
-DISTNAME=      django_js_asset-3.1.2
+DISTNAME=      django_js_asset-4.1.0
 PKGNAME=       ${PYPKGPREFIX}-${DISTNAME:S/_/-/g}
 CATEGORIES=    www python
 MASTER_SITES=  ${MASTER_SITE_PYPI:=d/django-js-asset/}
@@ -10,7 +10,7 @@ HOMEPAGE=     https://github.com/matthiask/d
 COMMENT=       Script tag with additional attributes for django.forms.Media
 LICENSE=       modified-bsd
 
-TOOL_DEPENDS+= ${PYPKGPREFIX}-hatchling-[0-9]*:../../devel/py-hatchling
+TOOL_DEPENDS+= ${PYPKGPREFIX}-hatchling>=0:../../devel/py-hatchling
 DEPENDS+=      ${PYPKGPREFIX}-django>=4.2:../../www/py-django
 
 USE_LANGUAGES= # none

Index: pkgsrc/www/py-django-js-asset/PLIST
diff -u pkgsrc/www/py-django-js-asset/PLIST:1.4 pkgsrc/www/py-django-js-asset/PLIST:1.5
--- pkgsrc/www/py-django-js-asset/PLIST:1.4     Thu Mar 13 15:14:38 2025
+++ pkgsrc/www/py-django-js-asset/PLIST Thu Sep  3 09:20:44 2026
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST,v 1.4 2025/03/13 15:14:38 adam Exp $
+@comment $NetBSD: PLIST,v 1.5 2026/09/03 09:20:44 adam Exp $
 ${PYSITELIB}/${WHEEL_INFODIR}/METADATA
 ${PYSITELIB}/${WHEEL_INFODIR}/RECORD
 ${PYSITELIB}/${WHEEL_INFODIR}/WHEEL
@@ -6,9 +6,12 @@ ${PYSITELIB}/${WHEEL_INFODIR}/licenses/L
 ${PYSITELIB}/js_asset/__init__.py
 ${PYSITELIB}/js_asset/__init__.pyc
 ${PYSITELIB}/js_asset/__init__.pyo
-${PYSITELIB}/js_asset/context_processors.py
-${PYSITELIB}/js_asset/context_processors.pyc
-${PYSITELIB}/js_asset/context_processors.pyo
+${PYSITELIB}/js_asset/_compat.py
+${PYSITELIB}/js_asset/_compat.pyc
+${PYSITELIB}/js_asset/_compat.pyo
 ${PYSITELIB}/js_asset/js.py
 ${PYSITELIB}/js_asset/js.pyc
 ${PYSITELIB}/js_asset/js.pyo
+${PYSITELIB}/js_asset/media.py
+${PYSITELIB}/js_asset/media.pyc
+${PYSITELIB}/js_asset/media.pyo

Index: pkgsrc/www/py-django-js-asset/distinfo
diff -u pkgsrc/www/py-django-js-asset/distinfo:1.11 pkgsrc/www/py-django-js-asset/distinfo:1.12
--- pkgsrc/www/py-django-js-asset/distinfo:1.11 Thu Mar 13 15:14:38 2025
+++ pkgsrc/www/py-django-js-asset/distinfo      Thu Sep  3 09:20:44 2026
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.11 2025/03/13 15:14:38 adam Exp $
+$NetBSD: distinfo,v 1.12 2026/09/03 09:20:44 adam Exp $
 
-BLAKE2s (django_js_asset-3.1.2.tar.gz) = 2a74ccb7c7822942355dfb80e78e6b3f840ec12af813378d0d966f5d4217cfcc
-SHA512 (django_js_asset-3.1.2.tar.gz) = e564bbac86a2d2663e3bb36b677bdb2c12b3ec43501ff624dcacc808994bea40764da541ca8410c0473c8fbfc290d21b565655b4d1b1dc115bcb7a2f6066115e
-Size (django_js_asset-3.1.2.tar.gz) = 9471 bytes
+BLAKE2s (django_js_asset-4.1.0.tar.gz) = 99b65dca5f3b233a7197a84a2441fc87bfad40fa654901d708c2b24f56eeffd8
+SHA512 (django_js_asset-4.1.0.tar.gz) = 49a7b7e1a67e583305165569f6490731e267045167cfecb4820d17b9eb0602afe1a749da471d2ac4b995fa0b697219651558881e0f97e9222ffffb29da8a16c1
+Size (django_js_asset-4.1.0.tar.gz) = 37765 bytes