The function itself is not an event handler -- it accepts a string -- but is intended to be included in one within the tag.
The issue is that the function seems to be added to the <search-tag> as an event handler for the "search" event. I would not have expected this unless I used the "onsearch" attribute. I suspect that Riot adds any attribute with a function value as an event handler regardless of the attribute name.
I'm not sure that this is a bug but should Riot only attach event handlers for valid event attributes, i.e., only for attribute names matching "on*"? If I did this outside of Riot, <div click="alert('Hello')">, the browser would not fire the alert because the correct attribute is onclick, not click.
@GianlucaGuarini you created a breaking change for all the people that were using that feature. If attributes handled by a function were considered as event handler by your test suite, you are not allowed to change this in a patch or even a minor version.
How can we rely on your library if you create breaking changed outside of major versions? A lot of our projects were based on that feature and we now have to rewrite all of them because we were handling the click event using the click attribute. Which was working with email@example.com and thus was validated by your test suite and thus was set in stone.