Bump primer upstream 0.24.1

.changeset/olive-wasps-call.md

@@ -0,0 +1,5 @@
+---
+"@openproject/primer-view-components": patch
+---
+
+Update Ruby dependencies to address upstream security notices

.changeset/warm-wombats-notice.md

@@ -0,0 +1,5 @@
+---
+"@openproject/primer-view-components": patch
+---
+
+Revert tab container upgrade

.github/workflows/lint.yml

@@ -12,7 +12,7 @@ jobs:
     - uses: actions/checkout@v4
     - name: Get specific changed files
       id: changed-files
-      uses: tj-actions/changed-files@v44.3.0
+      uses: tj-actions/changed-files@v44.4.0
       with:
         files: |
           docs/**/*.md
@@ -39,7 +39,7 @@ jobs:
     - uses: actions/checkout@v4
     - name: Get specific changed files
       id: changed-files
-      uses: tj-actions/changed-files@v44.3.0
+      uses: tj-actions/changed-files@v44.4.0
       with:
         files: |
           app/**/*.rb
@@ -62,7 +62,7 @@ jobs:
     - uses: actions/checkout@v4
     - name: Get changed files
       id: changed-files
-      uses: tj-actions/changed-files@v44.3.0
+      uses: tj-actions/changed-files@v44.4.0
       with:
         files: |
           app/components/**/*.erb
@@ -82,7 +82,7 @@ jobs:
     - uses: actions/checkout@v4
     - name: Get changed files
       id: changed-files
-      uses: tj-actions/changed-files@v44.3.0
+      uses: tj-actions/changed-files@v44.4.0
       with:
         files: |
           app/components/**/*.ts
@@ -103,7 +103,7 @@ jobs:
     - uses: actions/checkout@v4
     - name: Get changed files
       id: changed-files
-      uses: tj-actions/changed-files@v44.3.0
+      uses: tj-actions/changed-files@v44.4.0
       with:
         files: |
           app/components/**/*.pcss

.github/workflows/release-canary.yml

@@ -10,7 +10,7 @@ jobs:
   release-canary:
     name: npm
     if: ${{ github.repository == 'opf/primer_view_components' }}
-    uses: primer/.github/.github/workflows/release_canary.yml@v1.0.0
+    uses: primer/.github/.github/workflows/release_canary.yml@v2.0.1
     with:
       install: npm i
     secrets:

.github/workflows/release-candidate.yml

@@ -9,7 +9,7 @@ jobs:
   release-candidate:
     name: npm
     if: ${{ github.repository == 'opf/primer_view_components' }}
-    uses: primer/.github/.github/workflows/release_candidate.yml@v1.0.0
+    uses: primer/.github/.github/workflows/release_candidate.yml@v2.0.1
     secrets:
       gh_token: ${{ secrets.GITHUB_TOKEN }}
       npm_token: ${{ secrets.NPM_AUTH_TOKEN_SHARED }}

.github/workflows/release_tracking.yml

@@ -0,0 +1,19 @@
+name: Release Event Tracking
+# Measure a datadog event every time a release occurs
+
+on:
+  pull_request:
+    types:
+      - closed
+      - opened
+      - reopened
+
+  release:
+    types: [published]
+
+jobs:
+  release-tracking:
+    name: Release Tracking
+    uses: primer/.github/.github/workflows/release_tracking.yml@create_release_tracking_workflow
+    secrets:
+      datadog_api_key: ${{ secrets.DATADOG_API_KEY }}

Gemfile

@@ -35,7 +35,7 @@ gem "webpacker", "~> 5.0"
 # Reduces boot times through caching; required in config/boot.rb
 gem "bootsnap", ">= 1.4.2", require: false
 
-gem "lookbook", "~> 2.2.2" unless rails_version.to_f < 7
+gem "lookbook", "~> 2.3.0" unless rails_version.to_f < 7
 gem "view_component", path: ENV["VIEW_COMPONENT_PATH"] if ENV["VIEW_COMPONENT_PATH"]
 
 gem "kramdown", "~> 2.4"
@@ -48,7 +48,6 @@ end
 # development dependencies
 group :development do
   gem "allocation_stats", "~> 0.1"
-  gem "allocation_tracer", "~> 0.6.3"
   gem "benchmark-ips", "~> 2.13.0"
   gem "capybara", "~> 3.39.2"
   gem "cuprite", "~> 0.15"

Gemfile.lock

@@ -40,19 +40,18 @@ GEM
     addressable (2.8.6)
       public_suffix (>= 2.0.2, < 6.0)
     allocation_stats (0.1.5)
-    allocation_tracer (0.6.3)
     ansi (1.5.0)
     ast (2.4.2)
     base64 (0.2.0)
     benchmark-ips (2.13.0)
-    better_html (2.0.2)
+    better_html (2.1.1)
       actionview (>= 6.0)
       activesupport (>= 6.0)
       ast (~> 2.0)
       erubi (~> 1.4)
       parser (>= 2.4)
       smart_properties
-    bigdecimal (3.1.7)
+    bigdecimal (3.1.8)
     bootsnap (1.18.3)
       msgpack (~> 1.2)
     builder (3.2.4)
@@ -72,7 +71,7 @@ GEM
       bigdecimal
       rexml
     crass (1.0.6)
-    css_parser (1.16.0)
+    css_parser (1.17.1)
       addressable
     cuprite (0.15)
       capybara (~> 3.0)
@@ -100,11 +99,11 @@ GEM
     hashdiff (1.1.0)
     htmlbeautifier (1.4.3)
     htmlentities (4.3.4)
-    i18n (1.14.4)
+    i18n (1.14.5)
       concurrent-ruby (~> 1.0)
     io-console (0.7.2)
-    irb (1.12.0)
-      rdoc
+    irb (1.13.1)
+      rdoc (>= 4.0.0)
       reline (>= 0.4.2)
     json (2.7.2)
     kramdown (2.4.0)
@@ -116,7 +115,7 @@ GEM
     loofah (2.22.0)
       crass (~> 1.0.2)
       nokogiri (>= 1.12.0)
-    lookbook (2.2.2)
+    lookbook (2.3.0)
       activemodel
       css_parser
       htmlbeautifier (~> 1.3)
@@ -132,33 +131,33 @@ GEM
     matrix (0.4.2)
     method_source (1.1.0)
     mini_mime (1.1.5)
-    mini_portile2 (2.8.5)
+    mini_portile2 (2.8.6)
     minitest (5.22.3)
     mocha (2.2.0)
       ruby2_keywords (>= 0.0.5)
     msgpack (1.7.2)
     mutex_m (0.2.0)
-    nio4r (2.7.0)
-    nokogiri (1.16.3)
+    nio4r (2.7.3)
+    nokogiri (1.16.5)
       mini_portile2 (~> 2.8.2)
       racc (~> 1.4)
-    nokogiri (1.16.3-x86_64-linux)
+    nokogiri (1.16.5-x86_64-linux)
       racc (~> 1.4)
     openproject-octicons (19.9.0)
     parallel (1.24.0)
-    parser (3.3.0.5)
+    parser (3.3.1.0)
       ast (~> 2.4.1)
       racc
     pry (0.14.2)
       coderay (~> 1.1)
       method_source (~> 1.0)
     psych (5.1.2)
       stringio
-    public_suffix (5.0.4)
+    public_suffix (5.0.5)
     puma (6.4.2)
       nio4r (~> 2.0)
     racc (1.7.3)
-    rack (3.0.10)
+    rack (3.0.11)
     rack-cors (2.0.2)
       rack (>= 2.0.0)
     rack-proxy (0.7.7)
@@ -193,12 +192,12 @@ GEM
     rdoc (6.6.3.1)
       psych (>= 4.0.0)
     redcarpet (3.6.0)
-    regexp_parser (2.9.0)
-    reline (0.5.0)
+    regexp_parser (2.9.1)
+    reline (0.5.6)
       io-console (~> 0.5)
     rexml (3.2.6)
-    rouge (4.2.0)
-    rubocop (1.63.2)
+    rouge (4.2.1)
+    rubocop (1.63.5)
       json (~> 2.3)
       language_server-protocol (>= 3.17.0)
       parallel (~> 1.10)
@@ -209,8 +208,8 @@ GEM
       rubocop-ast (>= 1.31.1, < 2.0)
       ruby-progressbar (~> 1.7)
       unicode-display_width (>= 2.4.0, < 3.0)
-    rubocop-ast (1.31.2)
-      parser (>= 3.3.0.4)
+    rubocop-ast (1.31.3)
+      parser (>= 3.3.1.0)
     rubocop-github (0.20.0)
       rubocop (>= 1.37)
       rubocop-performance (>= 1.15)
@@ -228,7 +227,7 @@ GEM
     ruby-progressbar (1.13.0)
     ruby2_keywords (0.0.5)
     rubyzip (2.3.2)
-    selenium-webdriver (4.19.0)
+    selenium-webdriver (4.20.1)
       base64 (~> 0.2)
       rexml (~> 3.2, >= 3.2.5)
       rubyzip (>= 1.2.2, < 3.0)
@@ -293,7 +292,6 @@ DEPENDENCIES
   activemodel (= 7.1.1)
   activesupport (= 7.1.1)
   allocation_stats (~> 0.1)
-  allocation_tracer (~> 0.6.3)
   benchmark-ips (~> 2.13.0)
   bootsnap (>= 1.4.2)
   capybara (~> 3.39.2)
@@ -303,7 +301,7 @@ DEPENDENCIES
   erblint-github (~> 0.5.1)
   kramdown (~> 2.4)
   listen (~> 3.9)
-  lookbook (~> 2.2.2)
+  lookbook (~> 2.3.0)
   matrix (~> 0.4.2)
   mocha
   openproject-primer_view_components!

app/components/primer/alpha/banner.rb

@@ -5,25 +5,25 @@ module Alpha
     # Use `Banner` to highlight important information.
     #
     # @accessibility
-    #   Given that Banner is made visually prominent to sighted users through the use of icons and color, consider providing a heading and designating the Banner as a region landmark to improve navigability and discoverability of the Banner of assistive technology users. At this time, the PVC Banner does not render a heading nor render as a region landmark by default. This may be introduced in the future [as a breaking API change](https://github.com/primer/view_components/issues/2619). For now, consider providing an appropriate heading inside of the Banner and rendering the Banner as a `<section>` tag with `aria-labelledby="switch-this-with-banner-heading-id"` to implicitly designate the Banner as a region landmark.
+    #  ### Improve discoverability with a heading and landmark
+    #  Banners are made visually prominent with icons and colors to immediately draw attention.
     #
-    #   A Banner can be used in one of two ways – to highlight information on a page, or to communicate an urgent message/feedback for a user action. For the latter scenario, it may be necessary to use a live region or focus management technique to ensure that the Banner is discoverable and accessible for all users. Otherwise, the Banner can easily be missed, including by those using magnification software or screen reader users who may not realize that a Banner has appeared. The appropriate technique to use is highly context-dependent. Visit the [Banner's Accessibility section](https://primer.style/components/banner#accessibility) or defer to the accessibility team to determine if your scenario requires either techniques.
+    #  To ensure the Banner is also easily discoverable for assistive technology users, consider:
+    #  1. Providing a heading inside of the Banner that describes the purpose of the Banner.
+    #  2. Designating the Banner as a `region` landmark. This can be achieved by rendering the Banner as a `section`  with an `aria-labelledby` pointing to the heading.
     #
-    #   ### Announcing a Banner
-    #     When a Banner is used to communicate non-critical feedback, or is used in critical scenarios where moving focus is considered too disruptive, use a live region announcement to announce the content of the Banner to screen reader users.
+    #  ### Communicating feedback
+    #  When a Banner is used to communicate feedback, a live region or focus management technique should be in place to ensure that assistive technology users are aware of the feedback, especially when the Banner is shown client-side. Visit the [Banner's Accessibility section](https://primer.style/components/banner#accessibility), or defer to the accessibility team.
     #
-    #     Live regions can be finicky and don't work well when injected dynamically. Setting a live region attribute on the Banner itself is discouraged as it will not announce as expected for most screen readers.
+    #  #### Approach 1: Announcing a Banner
+    #  A live region announcement can be used to communicate non-critical feedback, such as a success message.
     #
-    #     To ensure a Banner is announced reliably, make sure that there's a live region container that is already on the page. When the Banner is shown, populate the live region container with the content of the Banner. This can be done in one of two ways. The first is to rely on a global live region container that is guaranteed to be on the page. When the Banner appears, populate this global live region container with the Banner content. The second technique is to hide or show the Banner within a live region wrapper that is guaranteed to always be on the page.
+    #  To successfully trigger a live region announcement for a Banner that is un-`hidden` or dynamically injected onto the page, **do not** set the live region attribute/role on the Banner itself. Instead, it's important to rely on a live region that is already guaranteed to be on the page. Learn more about specific techniques at: [Staff only: Challenges with live regions](https://github.com/github/accessibility/blob/main/docs/coaching-recommendations/toast-flash-banner/accessible-banner-prototype.md#challenges-with-dynamically-inserted-live-region).
     #
-    #     For more information about either technique, visit [Staff only: Challenges with live regions](https://github.com/github/accessibility/blob/main/docs/coaching-recommendations/toast-flash-banner/accessible-banner-prototype.md#challenges-with-dynamically-inserted-live-region). This guidance is subject to change.
+    #  #### Approach 2: Focusing a Banner
+    #  Focusing the Banner can be appropriate for critical feedback scenarios, such as a [form validation error summary](https://primer.style/ui-patterns/forms/overview#interactive-summary-of-errors) where the Banner contains actions to help unblock the user.
     #
-    #   ### Focusing a Banner
-    #     Focusing a Banner when it appears helps to maximize discoverability of the message, especially in critical scenarios.
-    #
-    #     To properly focus a banner, add a `tabindex="-1"` to the Banner container, and focus that container (one way is using the [`focus()` API](https://developer.mozilla.org/en-US/docs/Web/API/HTMLElement/focus)).
-    #
-    #     For more information about the focus management technique, visit the [Staff only: Accessible Banner Prototype docs](https://github.com/github/accessibility/blob/main/docs/coaching-recommendations/toast-flash-banner/accessible-banner-prototype.md#consideration). This guidance is subject to change.
+    #  To properly focus a Banner, add a `tabindex="-1"` place focus with JavaScript (using the [`focus()` API](https://developer.mozilla.org/en-US/docs/Web/API/HTMLElement/focus)).
     class Banner < Primer::Component
       status :alpha
 

app/components/primer/alpha/tab_nav.pcss

@@ -13,11 +13,6 @@
   overflow: auto;
 }
 
-.tabnav::part(tablist-wrapper) {
-  margin-bottom: var(--stack-gap-normal);
-  border-bottom: var(--borderWidth-thin) solid var(--borderColor-default);
-}
-
 .tabnav-tab {
   display: inline-block;
   flex-shrink: 0;
@@ -71,11 +66,6 @@
   }
 }
 
-tab-container .tabnav-tab {
-  margin-bottom: -1px;
-}
-
-
 /* Tabnav extras
 **
 ** Tabnav extras are non-tab elements that sit in the tabnav. Usually they're

app/components/primer/alpha/tab_panels.html.erb

@@ -1,9 +1,13 @@
-<%= render Primer::BaseComponent.new(**@system_arguments) do %>
-  <%= extra if @align == :left %>
-  <% tabs.each do |tab| %>
-    <%= tab %>
+<%= tab_container_wrapper(with_panel: true, **@wrapper_arguments) do %>
+  <%= render Primer::BaseComponent.new(**@system_arguments) do %>
+    <%= extra if @align == :left %>
+    <%= render Primer::BaseComponent.new(**@body_arguments) do %>
+      <% tabs.each do |tab| %>
+        <%= tab %>
+      <% end %>
+    <% end %>
+    <%= extra if @align == :right %>
   <% end %>
-  <%= extra if @align == :right %>
   <% tabs.each do |tab| %>
     <%= tab.panel %>
   <% end %>

app/components/primer/alpha/tab_panels.rb

@@ -26,7 +26,7 @@ class TabPanels < Primer::Component
         Primer::Alpha::Navigation::Tab.new(
           selected: selected,
           with_panel: true,
-          list: false,
+          list: true,
           panel_id: "panel-#{id}",
           **system_arguments
         )
@@ -43,14 +43,23 @@ class TabPanels < Primer::Component
 
       # @param label [String] Sets an `aria-label` that helps assistive technology users understand the purpose of the tabs.
       # @param align [Symbol] <%= one_of(Primer::TabNavHelper::EXTRA_ALIGN_OPTIONS) %> - Defaults to <%= Primer::TabNavHelper::EXTRA_ALIGN_DEFAULT %>
+      # @param body_arguments [Hash] <%= link_to_system_arguments_docs %> for the body wrapper.
+      # @param wrapper_arguments [Hash] <%= link_to_system_arguments_docs %> for the `TabContainer` wrapper.
       # @param system_arguments [Hash] <%= link_to_system_arguments_docs %>
       def initialize(label:, body_arguments: {}, wrapper_arguments: {}, **system_arguments)
         @align = EXTRA_ALIGN_DEFAULT
+        @wrapper_arguments = wrapper_arguments
 
-        @system_arguments = { **deny_tag_argument(**system_arguments), **deny_tag_argument(**wrapper_arguments) }
-        @system_arguments[:tag] = :"tab-container"
+        @system_arguments = deny_tag_argument(**system_arguments)
+        @system_arguments[:tag] = :div
         @system_arguments[:classes] = tab_nav_classes(@system_arguments[:classes])
-        @system_arguments[:"aria-label"] = label
+
+        @body_arguments = deny_tag_argument(**body_arguments)
+        @body_arguments[:tag] = :ul
+        @body_arguments[:classes] = tab_nav_body_classes(@body_arguments[:classes])
+
+        @body_arguments[:role] = :tablist
+        @body_arguments[:"aria-label"] = label
       end
 
       def before_render

app/components/primer/alpha/underline_nav.pcss

@@ -21,13 +21,7 @@
   }
 }
 
-.UnderlineNav::part(tablist-wrapper) {
-  width: 100%;
-  box-shadow: inset 0 -1px 0 var(--borderColor-muted);
-  padding: var(--control-medium-gap) 0;
-}
-
-.UnderlineNav-body,.UnderlineNav::part(tablist) {
+.UnderlineNav-body {
   display: flex;
   align-items: center;
   gap: var(--control-medium-gap);