fix(deps): update dependency com.fizzed:rocker-runtime to v2

.github/renovate.json

@@ -12,7 +12,15 @@
   "packageRules": [
     {
       "matchPackagePatterns": ["actions.*"],
-      "dependencyDashboardApproval": true
+      "dependencyDashboardApproval": true,
+      "matchUpdateTypes": ["patch"],
+      "matchCurrentVersion": "!/^0/",
+      "automerge": true
+    },
+    {
+      "matchUpdateTypes": ["patch"],
+      "matchCurrentVersion": "!/^0/",
+      "automerge": true
     }
   ]
 }

.github/workflows/gradle.yml

@@ -45,14 +45,14 @@ jobs:
           fetch-depth: 0
 
       - name: "🔧 Setup GraalVM CE"
-        uses: graalvm/[email protected].1
+        uses: graalvm/[email protected].5
         with:
           distribution: 'graalvm'
           java-version: ${{ matrix.java }}
           github-token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: "🔧 Setup Gradle"
-        uses: gradle/gradle-build-action@v3.3.0
+        uses: gradle/gradle-build-action@v3.5.0
 
       - name: "❓ Optional setup step"
         run: |
@@ -70,15 +70,15 @@ jobs:
 
       - name: "📊 Publish Test Report"
         if: always()
-        uses: mikepenz/action-junit-report@v4
+        uses: mikepenz/action-junit-report@v5
         with:
           check_name: Java CI / Test Report (${{ matrix.java }})
           report_paths: '**/build/test-results/test/TEST-*.xml'
           check_retries: 'true'
 
       - name: "📜 Upload binary compatibility check results"
         if: matrix.java == '17'
-        uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
+        uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
         with:
           name: binary-compatibility-reports
           path: "**/build/reports/binary-compatibility-*.html"

.github/workflows/release.yml

@@ -66,13 +66,13 @@ jobs:
           # Store the hash in a file, which is uploaded as a workflow artifact.
           sha256sum $ARTIFACTS | base64 -w0 > artifacts-sha256
       - name: Upload build artifacts
-        uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
+        uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
         with:
           name: gradle-build-outputs
           path: build/repo/${{ steps.publish.outputs.group }}/*/${{ steps.publish.outputs.version }}/*
           retention-days: 5
       - name: Upload artifacts-sha256
-        uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
+        uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
         with:
           name: artifacts-sha256
           path: artifacts-sha256
@@ -115,7 +115,7 @@ jobs:
       artifacts-sha256: ${{ steps.set-hash.outputs.artifacts-sha256 }}
     steps:
       - name: Download artifacts-sha256
-        uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
+        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
         with:
           name: artifacts-sha256
       # The SLSA provenance generator expects the hash digest of artifacts to be passed as a job
@@ -134,7 +134,7 @@ jobs:
       actions: read # To read the workflow path.
       id-token: write # To sign the provenance.
       contents: write # To add assets to a release.
-    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.10.0
+    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.0.0
     with:
       base64-subjects: "${{ needs.provenance-subject.outputs.artifacts-sha256 }}"
       upload-assets: true # Upload to a new release.
@@ -146,11 +146,9 @@ jobs:
     if: startsWith(github.ref, 'refs/tags/')
     steps:
       - name: Checkout repository
-        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - name: Download artifacts
-        # Important: update actions/download-artifact to v4 only when generator_generic_slsa3.yml is also compatible.
-        # See https://github.com/slsa-framework/slsa-github-generator/issues/3068
-        uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
+        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
         with:
           name: gradle-build-outputs
           path: build/repo
@@ -162,6 +160,6 @@ jobs:
       - name: Upload assets
         # Upload the artifacts to the existing release. Note that the SLSA provenance will
         # attest to each artifact file and not the aggregated ZIP file.
-        uses: softprops/action-gh-release@de2c0eb89ae2a093876385947365aca7b0e5f844 # v0.1.15
+        uses: softprops/action-gh-release@e7a8f85e1c67a31e6ed99a94b41bd0b71bbee6b8 # v2.0.9
         with:
           files: artifacts.zip

buildSrc/src/main/groovy/io.micronaut.build.internal.views-fieldset-tck.gradle

@@ -13,9 +13,9 @@ dependencies {
 
     testImplementation(projects.micronautViewsFieldset)
     testImplementation(projects.micronautViewsFieldsetTck)
-    testImplementation(libs.junit.jupiter.api)
+    testImplementation(mnTest.junit.jupiter.api)
     testImplementation(mnTest.micronaut.test.junit5)
-    testImplementation(libs.junit.jupiter.engine)
+    testImplementation(mnTest.junit.jupiter.engine)
     testImplementation(libs.junit.platform.engine)
 }
 test {

gradle.properties

@@ -1,4 +1,4 @@
-projectVersion=5.3.0-SNAPSHOT
+projectVersion=5.6.0-SNAPSHOT
 projectGroup=io.micronaut.views
 
 title=Micronaut Views
@@ -18,6 +18,8 @@ testsviewsRocker=views-rocker/src/test
 testsviewsPebble=views-pebble/src/test
 testsviewsJte=views-jte/src/test
 testsviewsJstachio=views-jstachio/src/test
+srcjsReact=views-react/src/test/js
+srcjsReactRender=views-react/src/main/resources/io/micronaut/views/react
 
 org.gradle.caching=true
 org.gradle.jvmargs=-Xmx1g

gradle/libs.versions.toml

@@ -1,29 +1,31 @@
 [versions]
-micronaut = "4.4.4"
-micronaut-platform = "4.3.1"
+micronaut = "4.7.2"
+micronaut-platform = "4.6.3"
 micronaut-docs = '2.0.0'
-micronaut-test = "4.0.1"
-micronaut-data = "4.7.0"
-micronaut-sql = "5.5.2"
-micronaut-security = "4.6.9"
-micronaut-serde = "2.8.2"
-micronaut-validation = "4.4.4"
-micronaut-gradle-plugin = "4.3.6"
-managed-freemarker = "2.3.32"
+micronaut-test = "4.5.0"
+micronaut-data = "4.9.6"
+micronaut-sql = "5.8.2"
+micronaut-security = "4.11.0"
+micronaut-serde = "2.12.0"
+micronaut-validation = "4.8.0"
+micronaut-gradle-plugin = "4.4.4"
+managed-freemarker = "2.3.33"
 managed-handlebars = "4.3.1"
-managed-jstachio = "1.3.5"
-managed-jte = "3.1.10"
-managed-rocker = "1.4.0"
+managed-jstachio = "1.3.6"
+managed-jte = "3.1.13"
+managed-rocker = "2.0.1"
 managed-soy = "2023-09-13"
+org-json = "20240303"
 managed-thymeleaf = "3.1.2.RELEASE"
-managed-velocity = "2.3"
+managed-velocity = "2.4.1"
+graal = "24.1.1"
 
 pebble = "3.2.2"
 thymeleaf-extra-java8time = "3.0.4.RELEASE"
-kotlin = "1.9.23"
-kotlinx-coroutines = "1.8.0"
+kotlin = "1.9.25"
+kotlinx-coroutines = "1.9.0"
 
-micronaut-logging = "1.2.3"
+micronaut-logging = "1.5.0"
 
 [libraries]
 # Core
@@ -42,22 +44,28 @@ managed-handlebars = { module = "com.github.jknack:handlebars", version.ref = "m
 managed-jstachio = { module = "io.jstach:jstachio", version.ref = "managed-jstachio" }
 managed-jstachio-apt = { module = "io.jstach:jstachio-apt", version.ref = "managed-jstachio" }
 managed-jte = { module = "gg.jte:jte", version.ref = "managed-jte" }
+managed-jte-native-resources = { module = "gg.jte:jte-native-resources", version.ref = "managed-jte" }
 managed-jte-kotlin = { module = "gg.jte:jte-kotlin", version.ref = "managed-jte" }
 managed-rocker-runtime = { module = "com.fizzed:rocker-runtime", version.ref = "managed-rocker" }
 managed-soy = { module = "com.google.template:soy", version.ref = "managed-soy" }
+org-json = { module = "org.json:json", version.ref = "org-json" }
 managed-thymeleaf = { module = "org.thymeleaf:thymeleaf", version.ref = "managed-thymeleaf" }
 managed-velocity-engine-core = { module = "org.apache.velocity:velocity-engine-core", version.ref = "managed-velocity" }
 
-junit-jupiter-api = { module = "org.junit.jupiter:junit-jupiter-api" }
-junit-jupiter-engine = { module = "org.junit.jupiter:junit-jupiter-engine" }
 junit-platform-engine = { module = "org.junit.platform:junit-platform-suite-engine" }
 pebble = { module = "io.pebbletemplates:pebble", version.ref = "pebble" }
 thymeleaf-extras-java8time = { module = "org.thymeleaf.extras:thymeleaf-extras-java8time", version.ref = "thymeleaf-extra-java8time" }
 kotlin-stdlib-jdk8 = { module = "org.jetbrains.kotlin:kotlin-stdlib-jdk8", version.ref = "kotlin" }
 kotlinx-coroutines-core = { module = "org.jetbrains.kotlinx:kotlinx-coroutines-core", version.ref = "kotlinx-coroutines" }
 groovy-json = { module = "org.apache.groovy:groovy-json" }
 
+graal-polyglot = { module = "org.graalvm.polyglot:polyglot", version.ref = "graal" }
+graal-js = { module = "org.graalvm.polyglot:js", version.ref = "graal" }
+
 [plugins]
 kotlin-jvm = { id = "org.jetbrains.kotlin.jvm", version.ref = "kotlin" }
 kotlin-kapt = { id = "org.jetbrains.kotlin.kapt", version.ref = "kotlin" }
 jte = { id = "gg.jte.gradle", version.ref = "managed-jte" }
+buildtools-native = { id = "org.graalvm.buildtools.native"}
+
+

gradle/wrapper/gradle-wrapper.properties

@@ -1,6 +1,6 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionUrl=https\://services.gradle.org/distributions/gradle-8.7-bin.zip
+distributionUrl=https\://services.gradle.org/distributions/gradle-8.10.2-bin.zip
 networkTimeout=10000
 validateDistributionUrl=true
 zipStoreBase=GRADLE_USER_HOME

gradlew

@@ -15,6 +15,8 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 #
+# SPDX-License-Identifier: Apache-2.0
+#
 
 ##############################################################################
 #
@@ -55,7 +57,7 @@
 #       Darwin, MinGW, and NonStop.
 #
 #   (3) This script is generated from the Groovy template
-#       https://github.com/gradle/gradle/blob/HEAD/subprojects/plugins/src/main/resources/org/gradle/api/internal/plugins/unixStartScript.txt
+#       https://github.com/gradle/gradle/blob/HEAD/platforms/jvm/plugins-application/src/main/resources/org/gradle/api/internal/plugins/unixStartScript.txt
 #       within the Gradle project.
 #
 #       You can find Gradle at https://github.com/gradle/gradle/.
@@ -84,7 +86,8 @@ done
 # shellcheck disable=SC2034
 APP_BASE_NAME=${0##*/}
 # Discard cd standard output in case $CDPATH is set (https://github.com/gradle/gradle/issues/25036)
-APP_HOME=$( cd "${APP_HOME:-./}" > /dev/null && pwd -P ) || exit
+APP_HOME=$( cd -P "${APP_HOME:-./}" > /dev/null && printf '%s
+' "$PWD" ) || exit
 
 # Use the maximum available, or set MAX_FD != -1 to use that value.
 MAX_FD=maximum

gradlew.bat

@@ -13,6 +13,8 @@
 @rem See the License for the specific language governing permissions and
 @rem limitations under the License.
 @rem
+@rem SPDX-License-Identifier: Apache-2.0
+@rem
 
 @if "%DEBUG%"=="" @echo off
 @rem ##########################################################################

settings.gradle

@@ -6,7 +6,7 @@ pluginManagement {
 }
 
 plugins {
-    id("io.micronaut.build.shared.settings") version "6.7.0"
+    id("io.micronaut.build.shared.settings") version "7.2.3"
 }
 
 enableFeaturePreview 'TYPESAFE_PROJECT_ACCESSORS'
@@ -23,16 +23,21 @@ include 'views-handlebars'
 include 'views-thymeleaf'
 include 'views-htmx'
 include 'views-velocity'
+include 'views-react'
 include 'views-rocker'
 include 'views-pebble'
 include 'views-jte'
 include 'views-jstachio'
 
 include "test-suite"
+include "test-suite-csrf"
 include "test-suite-http"
 include "test-suite-groovy"
 include "test-suite-kotlin"
 include "test-suite-thymeleaf-fieldset"
+if (JavaVersion.current().isCompatibleWith(JavaVersion.VERSION_21)) {
+include "test-suite-jte-fieldset"
+}
 include "test-suite-freemarker-fieldset"
 include "test-suite-graal:test-suite-graal-common"
 include "test-suite-graal:test-suite-graal-freemarker"

src/main/docs/guide/toc.yml

@@ -22,6 +22,15 @@ views:
       title: JStachio
       jstachioInstallation: JStachio Installation
       jstachioExample: JStachio Example
+    react:
+      title: React SSR
+      reactpreparingjs: Preparing your Javascript
+      reactsettingproperties: Setting serving properties
+      preact: Integrating with Preact
+      reactrenderscripts:
+        title: Render scripts
+        reactheadmanagers: Using head managers
+      reacttodo: Known limitations
   model:
     title: Working with Models
     custom: Dynamically Enriching Models
@@ -30,6 +39,7 @@ views:
     fieldsetExample: Form Generation Example
     fieldsetAnnotations: Fieldset Annotations
     fieldsetFetcher: Radio, Checkbox and Option Fetcher
+    csrfHidden: CSRF Token Hidden Field
     customFormElement: Custom Form Elements
   htmx:
     title: HTMX

src/main/docs/guide/views/fieldset/csrfHidden.adoc

@@ -0,0 +1 @@
+If you use the https://micronaut-projects.github.io/micronaut-security/latest/guide/#csrf[Micronaut Security CSRF module], and a CSRF token is resolved, the generated form automatically contains a hidden input with the CSRF token as the value. 

src/main/docs/guide/views/htmx/outOfBandSwaps.adoc

@@ -1,3 +1,3 @@
-You can return an API:views.htmx.HtmxResponse[] in a controller method to render multiple views in a single HTMX response—for example, to do https://htmx.org/docs/#oob_swaps[Out Of Band Swaps].
+You can return an api:views.htmx.http.HtmxResponse[] in a controller method to render multiple views in a single HTMX response—for example, to do https://htmx.org/docs/#oob_swaps[Out Of Band Swaps].
 
-snippet::io.micronaut.views.docs.htmx.HtmxTest[tags="outOfBandSwaps",indent=0]
+snippet::io.micronaut.views.docs.htmx.HtmxTest[tags="outOfBandSwaps",indent=0]

src/main/docs/guide/views/security/csp.adoc

@@ -42,6 +42,14 @@ That's it! After applying the above configuration, HTTP responses might include
 Content-Security-Policy: default-src https: self:; script-src 'nonce-4ze2IRazk4Yu/j5K6SEzjA';
 ```
 
+The nonce value can be accessed on the server as a request attribute named `cspNonce`. This is the value to use
+in the `nonce` attribute on `script` and related tags.  For example (adapt as appropriate for your template language):
+
+[source,html]
+----
+<script type="text/javascript" src="/path/to/script.js" nonce="${cspNonce}" />
+----
+
 Inline scripts which aren't otherwise whitelisted will be declined for execution, unless CSP is operating in report-only
 mode. Inline scripts can be whitelisted with the syntax:
 

src/main/docs/guide/views/security/security-model-enhancement.adoc

@@ -25,3 +25,14 @@ include::{testsSuite}/resources/views/securitydecorator.vm[tag=html]
 ----
 
 You can access information about the current user with the `security` map.
+
+=== CSRF Token View Model Processor
+
+If you use the https://micronaut-projects.github.io/micronaut-security/latest/guide/#csrf[Micronaut Security CSRF module], there is also a view model processor for a model of type `Map<String, Object>`.
+If a CSRF Token can be resolved,  `CSRFViewModelProcessor` adds it to the model.
+
+The following properties allow you to customize the injection:
+
+include::{includedir}configurationProperties/io.micronaut.views.model.security.CsrfViewModelProcessorConfigurationProperties.adoc[]
+
+

src/main/docs/guide/views/templates/jstachio/jstachioInstallation.adoc

@@ -6,4 +6,6 @@ Additionally, you need to add JStachio's Java annotation processor.
 
 dependency:jstachio-apt[groupId="io.jstach",scope="annotationProcessor"]
 
+NOTE: For Kotlin, add the `jstachio-apt` dependency in https://docs.micronaut.io/4.4.3/guide/#kaptOrKsp[kapt or ksp scope], and for Groovy add `jstachio-apt` in compileOnly scope.
+
 Read the https://jstach.io/doc/jstachio/1.2.1/apidocs/#installation[Jstachio's user guide] to learn more.

src/main/docs/guide/views/templates/jte.adoc

@@ -5,6 +5,10 @@ Add the `micronaut-views-jte` dependency to your classpath.
 
 dependency:micronaut-views-jte[groupId="io.micronaut.views"]
 
+If you want to write your views in Kotlin, you can include an additional dependency:
+
+dependency:jte-kotlin[groupId="gg.jte"]
+
 The example shown in the <<views, Views>> section, could be rendered with the following Jte template:
 
 [source,html]