Update dependency view_component to v4.11.0 #9

Open

renovate wants to merge 1 commit from renovate/view_component-4.x-lockfile into main

pull from: renovate/view_component-4.x-lockfile

merge into: hobbypunk:main

hobbypunk:main

hobbypunk:renovate/bootsnap-1.x-lockfile

hobbypunk:renovate/faker-3.x-lockfile

hobbypunk:renovate/turbo-rails-2.x-lockfile

hobbypunk:renovate/debug-1.x-lockfile

hobbypunk:renovate/i18n-tasks-1.x-lockfile

hobbypunk:renovate/foreman-0.x-lockfile

hobbypunk:renovate/solid_cache-1.x-lockfile

hobbypunk:renovate/omniauth-packages

hobbypunk:renovate/cssbundling-rails-1.x-lockfile

Conversation 0 Commits 1 Files changed 1 +13 -12

renovate commented 2025-11-12 00:02:00 +00:00

Collaborator

Copy link

This PR contains the following updates:

Package	Change	Age	Confidence
view_component (source, changelog)	4.1.0 → 4.11.0

---

⚠️ Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

viewcomponent/view_component (view_component)

v4.11.0: 4.11.0

Compare Source

• Update render_in signature to accept **_ for compatibility with Rails #​50623.

  Joel Hawksley

• Fix translation scope resolution in nested lambda-backed slots. Relative t(".key") calls inside lambda-backed slots were resolving against an intermediate component's scope instead of the original partial's scope where the block was defined.

  Artin Boghosian

v4.10.0: 4.10.0

Compare Source

• Fix NameError: uninitialized constant ViewComponent::SystemTestControllerNefariousPathError when booting in the test environment with eager_load = true.

  Joel Hawksley

• Fix yielded content rendered at wrong location when using form helpers.

  Joel Hawksley, Markus

v4.9.0: 4.9.0

Compare Source

• Fix path traversal vulnerability in ViewComponentsSystemTestController where sibling directories sharing a string prefix with the allowed temp directory could bypass the path containment check. The start_with? check has been replaced with a separator-aware prefix check, and nefarious path errors now return a 404 instead of an unhandled exception.

  Joel Hawksley

• Fix preview route vulnerability where inherited methods on ViewComponent::Preview (such as render_with_template) could be invoked via the preview URL, allowing arbitrary internal Rails templates to be rendered with attacker-controlled locals and request parameters. render_args now raises AbstractController::ActionNotFound for any example not explicitly declared on the preview subclass.

  Joel Hawksley

• Add yard-lint to CI.

  Joel Hawksley

v4.8.0: 4.8.0

Compare Source

• Add compile.view_component ActiveSupport::Notifications event for eager compilation at boot time.

  Joel Hawksley, GitHub Copilot

v4.7.0: 4.7.0

Compare Source

• Fix stale content cache when slots are accessed before render_in.

  Jared Armstrong

• Add rubocop-view_component to resources.

  Andy Waite

• Fix bug where inheritance of components with formatless templates improperly raised a NoMethodError.

  GitHub Copilot, Joel Hawksley, Cameron Dutro

v4.6.0: 4.6.0

Compare Source

• Add view_identifier to the render.view_component instrumentation event payload, containing the path to the component's template file (e.g. app/components/my_component.html.erb). For components using inline render methods, view_identifier will be nil.

  GitHub Copilot

• Replace deprecated require_dependency with require in preview loading.

  GitHub Copilot

• Return html_safe empty string from render_in when render? is false.

  GitHub Copilot

v4.5.0: 4.5.0

Compare Source

• Fix initialization ordering issue causing missing asset errors in Sprockets.

  Cameron Dutro

v4.4.0: 4.4.0

Compare Source

• Fix segfaults when Ruby coverage is enabled.

  George Holborn, Joel Hawksley

• Add protocol parameter to with_request_url test helper to enable testing with HTTPS protocol.

  Joel Hawksley

v4.3.0: 4.3.0

Compare Source

• Fix load order issues for 3rd-party template handlers.

  Cameron Dutro

• Fix segfault when Ruby coverage is enabled with Rails 8.1 ERB templates.

  George Holborn

• Automatically merge dependabot PRs.

  Joel Hawksley

• Use Ruby 4.0.0 in CI and dev.

  Joel Hawksley

v4.2.0: 4.2.0

Compare Source

• Fix translation scope resolution in deeply nested component blocks (3+ levels). Translations called inside deeply nested slot blocks using renders_many/renders_one were incorrectly resolving to an intermediate component's scope instead of the partial's scope where the block was defined. The fix captures the virtual path at block definition time and restores it during block execution, ensuring translations always resolve relative to where the block was created regardless of nesting depth.

  Nathaniel Watts

• Allow render_inline with Nokogiri::HTML5 to parse more arbitrary content including bare table content otherwise illegal fragments like <td>.

  Jonathan Rochkind

• Remove known issue from docs as ActiveScaffold is now compatible with ViewComponent.

  David Löwenfels

• Add test to document the current behavior for resolving relative translation keys within partial blocks. When rendering a partial, relative translation keys are resolved relative to the partial's own path rather than the caller’s path. This test ensures that this behavior remains consistent.

  Oussama Hilal

• Allow I18n calls in render?.

  23tux

• ViewComponent now works without rails and railties gems loaded, enabling compatibility with Bridgetown 2.0.

  Tom Lord

• Capture partial block in the component's context, allowing access to the component instance inside the block.

  23tux

• Add after_compile class method hook to enable extensions to run logic after component compilation.

  Jose Solás

• Fix outdated reference to preview layout configuration in docs.

  Lucas Geron

• Allow ruby-head CI job to fail without failing workflow.

  Hakan Ensari

• Fix bug where error line numbers were incorrect in Rails 8.1.

  Joel Hawksley

• Remove < 8.2 upper bound for activesupport and actionview dependencies.

  Hans Lemuet

• Test compatibility with Herb/ReActionView.

  Joel Hawksley

• Remove Who Uses ViewComponent section from docs.

  Joel Hawksley

v4.1.1: 4.1.1

Compare Source

• Add Consultport to list of companies using ViewComponent.

  Sebastian Nepote

• Resolve deprecation warning for ActiveSupport::Configurable.

  Simon Fish

• Make ViewComponent::VERSION accessible to other gems by default.

  Hans Lemuet

• Added Reinvented Hospitality to the list of companies using ViewComponent.

  Torgil Zechel

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [view_component](https://viewcomponent.org) ([source](https://github.com/viewcomponent/view_component), [changelog](https://github.com/ViewComponent/view_component/blob/main/docs/CHANGELOG.md)) | `4.1.0` → `4.11.0` |  |  | --- > ⚠️ **Warning** > > Some dependencies could not be looked up. Check the Dependency Dashboard for more information. --- ### Release Notes <details> <summary>viewcomponent/view_component (view_component)</summary> ### [`v4.11.0`](https://github.com/ViewComponent/view_component/releases/tag/v4.11.0): 4.11.0 [Compare Source](https://github.com/viewcomponent/view_component/compare/v4.10.0...v4.11.0) - Update `render_in` signature to accept `**_` for compatibility with Rails [#&#8203;50623](https://github.com/rails/rails/pull/50623). *Joel Hawksley* - Fix translation scope resolution in nested lambda-backed slots. Relative `t(".key")` calls inside lambda-backed slots were resolving against an intermediate component's scope instead of the original partial's scope where the block was defined. *Artin Boghosian* ### [`v4.10.0`](https://github.com/ViewComponent/view_component/releases/tag/v4.10.0): 4.10.0 [Compare Source](https://github.com/viewcomponent/view_component/compare/v4.9.0...v4.10.0) - Fix `NameError: uninitialized constant ViewComponent::SystemTestControllerNefariousPathError` when booting in the test environment with `eager_load = true`. *Joel Hawksley* - Fix yielded content rendered at wrong location when using form helpers. *Joel Hawksley*, *Markus* ### [`v4.9.0`](https://github.com/ViewComponent/view_component/releases/tag/v4.9.0): 4.9.0 [Compare Source](https://github.com/viewcomponent/view_component/compare/v4.8.0...v4.9.0) - Fix path traversal vulnerability in `ViewComponentsSystemTestController` where sibling directories sharing a string prefix with the allowed temp directory could bypass the path containment check. The `start_with?` check has been replaced with a separator-aware prefix check, and nefarious path errors now return a 404 instead of an unhandled exception. *Joel Hawksley* - Fix preview route vulnerability where inherited methods on `ViewComponent::Preview` (such as `render_with_template`) could be invoked via the preview URL, allowing arbitrary internal Rails templates to be rendered with attacker-controlled locals and request parameters. `render_args` now raises `AbstractController::ActionNotFound` for any example not explicitly declared on the preview subclass. *Joel Hawksley* - Add `yard-lint` to CI. *Joel Hawksley* ### [`v4.8.0`](https://github.com/ViewComponent/view_component/releases/tag/v4.8.0): 4.8.0 [Compare Source](https://github.com/viewcomponent/view_component/compare/v4.7.0...v4.8.0) - Add `compile.view_component` ActiveSupport::Notifications event for eager compilation at boot time. *Joel Hawksley*, *GitHub Copilot* ### [`v4.7.0`](https://github.com/ViewComponent/view_component/releases/tag/v4.7.0): 4.7.0 [Compare Source](https://github.com/viewcomponent/view_component/compare/v4.6.0...v4.7.0) - Fix stale content cache when slots are accessed before `render_in`. *Jared Armstrong* - Add rubocop-view\_component to resources. *Andy Waite* - Fix bug where inheritance of components with formatless templates improperly raised a NoMethodError. *GitHub Copilot*, *Joel Hawksley*, *Cameron Dutro* ### [`v4.6.0`](https://github.com/ViewComponent/view_component/releases/tag/v4.6.0): 4.6.0 [Compare Source](https://github.com/viewcomponent/view_component/compare/v4.5.0...v4.6.0) - Add `view_identifier` to the `render.view_component` instrumentation event payload, containing the path to the component's template file (e.g. `app/components/my_component.html.erb`). For components using inline render methods, `view_identifier` will be `nil`. *GitHub Copilot* - Replace deprecated `require_dependency` with `require` in preview loading. *GitHub Copilot* - Return `html_safe` empty string from `render_in` when `render?` is false. *GitHub Copilot* ### [`v4.5.0`](https://github.com/ViewComponent/view_component/releases/tag/v4.5.0): 4.5.0 [Compare Source](https://github.com/viewcomponent/view_component/compare/v4.4.0...v4.5.0) - Fix initialization ordering issue causing missing asset errors in Sprockets. *Cameron Dutro* ### [`v4.4.0`](https://github.com/ViewComponent/view_component/releases/tag/v4.4.0): 4.4.0 [Compare Source](https://github.com/viewcomponent/view_component/compare/v4.3.0...v4.4.0) - Fix segfaults when Ruby coverage is enabled. *George Holborn*, *Joel Hawksley* - Add `protocol` parameter to `with_request_url` test helper to enable testing with HTTPS protocol. *Joel Hawksley* ### [`v4.3.0`](https://github.com/ViewComponent/view_component/releases/tag/v4.3.0): 4.3.0 [Compare Source](https://github.com/viewcomponent/view_component/compare/v4.2.0...v4.3.0) - Fix load order issues for 3rd-party template handlers. *Cameron Dutro* - Fix segfault when Ruby coverage is enabled with Rails 8.1 ERB templates. *George Holborn* - Automatically merge dependabot PRs. *Joel Hawksley* - Use Ruby 4.0.0 in CI and dev. *Joel Hawksley* ### [`v4.2.0`](https://github.com/ViewComponent/view_component/releases/tag/v4.2.0): 4.2.0 [Compare Source](https://github.com/viewcomponent/view_component/compare/v4.1.1...v4.2.0) - Fix translation scope resolution in deeply nested component blocks (3+ levels). Translations called inside deeply nested slot blocks using `renders_many`/`renders_one` were incorrectly resolving to an intermediate component's scope instead of the partial's scope where the block was defined. The fix captures the virtual path at block definition time and restores it during block execution, ensuring translations always resolve relative to where the block was created regardless of nesting depth. *Nathaniel Watts* - Allow `render_inline` with Nokogiri::HTML5 to parse more arbitrary content including bare table content otherwise illegal fragments like `<td>`. *Jonathan Rochkind* - Remove known issue from docs as ActiveScaffold is [now compatible](https://github.com/activescaffold/active_scaffold/pull/743) with ViewComponent. *David Löwenfels* - Add test to document the current behavior for resolving relative translation keys within partial blocks. When rendering a partial, relative translation keys are resolved relative to the partial's own path rather than the caller’s path. This test ensures that this behavior remains consistent. *Oussama Hilal* - Allow I18n calls in `render?`. *23tux* - ViewComponent now works without `rails` and `railties` gems loaded, enabling compatibility with Bridgetown 2.0. *Tom Lord* - Capture partial block in the component's context, allowing access to the component instance inside the block. *23tux* - Add `after_compile` class method hook to enable extensions to run logic after component compilation. *Jose Solás* - Fix outdated reference to preview layout configuration in docs. *Lucas Geron* - Allow ruby-head CI job to fail without failing workflow. *Hakan Ensari* - Fix bug where error line numbers were incorrect in Rails 8.1. *Joel Hawksley* - Remove `< 8.2` upper bound for `activesupport` and `actionview` dependencies. *Hans Lemuet* - Test compatibility with Herb/ReActionView. *Joel Hawksley* - Remove Who Uses ViewComponent section from docs. *Joel Hawksley* ### [`v4.1.1`](https://github.com/ViewComponent/view_component/releases/tag/v4.1.1): 4.1.1 [Compare Source](https://github.com/viewcomponent/view_component/compare/v4.1.0...v4.1.1) - Add Consultport to list of companies using ViewComponent. *Sebastian Nepote* - Resolve deprecation warning for `ActiveSupport::Configurable`. *Simon Fish* - Make `ViewComponent::VERSION` accessible to other gems by default. *Hans Lemuet* - Added Reinvented Hospitality to the list of companies using ViewComponent. *Torgil Zechel* </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0Mi4yLjAiLCJ1cGRhdGVkSW5WZXIiOiI0Mi43MS4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->

renovate added 1 commit 2025-11-12 00:02:01 +00:00

Update dependency view_component to v4.1.1 6df221ae26

renovate force-pushed renovate/view_component-4.x-lockfile from 6df221ae26 to 2143e9e61a 2026-01-10 00:01:37 +00:00 Compare

renovate changed title from Update dependency view_component to v4.1.1 to Update dependency view_component to v4.2.0 2026-01-10 00:01:39 +00:00

renovate force-pushed renovate/view_component-4.x-lockfile from 2143e9e61a to 437d4311fc 2026-01-12 00:01:42 +00:00 Compare

renovate force-pushed renovate/view_component-4.x-lockfile from 437d4311fc to 26d0e7e5a6 2026-02-12 00:01:54 +00:00 Compare

renovate changed title from Update dependency view_component to v4.2.0 to Update dependency view_component to v4.3.0 2026-02-12 00:01:57 +00:00

renovate force-pushed renovate/view_component-4.x-lockfile from 26d0e7e5a6 to 0032fdff83 2026-02-14 00:01:31 +00:00 Compare

renovate changed title from Update dependency view_component to v4.3.0 to Update dependency view_component to v4.4.0 2026-02-14 00:01:35 +00:00

renovate force-pushed renovate/view_component-4.x-lockfile from 0032fdff83 to a2a8d5ccfb 2026-02-27 00:01:37 +00:00 Compare

renovate changed title from Update dependency view_component to v4.4.0 to Update dependency view_component to v4.5.0 2026-02-27 00:01:40 +00:00

renovate force-pushed renovate/view_component-4.x-lockfile from a2a8d5ccfb to 1dd9f08439 2026-03-31 00:01:41 +00:00 Compare

renovate changed title from Update dependency view_component to v4.5.0 to Update dependency view_component to v4.6.0 2026-03-31 00:01:44 +00:00

renovate force-pushed renovate/view_component-4.x-lockfile from 1dd9f08439 to d1a078749c 2026-04-18 00:01:43 +00:00 Compare

renovate changed title from Update dependency view_component to v4.6.0 to Update dependency view_component to v4.7.0 2026-04-18 00:01:46 +00:00

renovate force-pushed renovate/view_component-4.x-lockfile from d1a078749c to 5db33e798b 2026-04-23 00:01:52 +00:00 Compare

renovate changed title from Update dependency view_component to v4.7.0 to Update dependency view_component to v4.8.0 2026-04-23 00:01:55 +00:00

renovate force-pushed renovate/view_component-4.x-lockfile from 5db33e798b to 0568e1e1c6 2026-05-06 00:01:38 +00:00 Compare

renovate changed title from Update dependency view_component to v4.8.0 to Update dependency view_component to v4.9.0 2026-05-06 00:01:41 +00:00

renovate force-pushed renovate/view_component-4.x-lockfile from 0568e1e1c6 to 79dc38980c 2026-05-12 00:01:59 +00:00 Compare

renovate changed title from Update dependency view_component to v4.9.0 to Update dependency view_component to v4.10.0 2026-05-12 00:02:03 +00:00

renovate force-pushed renovate/view_component-4.x-lockfile from 79dc38980c to 82be3549d2 2026-05-19 00:01:17 +00:00 Compare

renovate changed title from Update dependency view_component to v4.10.0 to Update dependency view_component to v4.11.0 2026-05-19 00:01:21 +00:00

Some checks failed

Hide all checks

build.yml / Update dependency view_component to v4.11.0 (push) Failing after 0s

Details

deploy.yml / Update dependency view_component to v4.11.0 (push) Failing after 0s

Details

build.yml / Update dependency view_component to v4.11.0 (pull_request) Failing after 0s

Details

deploy.yml / Update dependency view_component to v4.11.0 (pull_request) Failing after 0s

Details

Release Drafter / update_release_draft (pull_request) Has been cancelled

Details

This pull request can be merged automatically.

This branch is out-of-date with the base branch

You are not authorized to merge this pull request.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin renovate/view_component-4.x-lockfile:renovate/view_component-4.x-lockfile

git switch renovate/view_component-4.x-lockfile

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch main

git merge --no-ff renovate/view_component-4.x-lockfile

git switch renovate/view_component-4.x-lockfile

git rebase main

git switch main

git merge --ff-only renovate/view_component-4.x-lockfile

git switch renovate/view_component-4.x-lockfile

git rebase main

git switch main

git merge --no-ff renovate/view_component-4.x-lockfile

git switch main

git merge --squash renovate/view_component-4.x-lockfile

git switch main

git merge --ff-only renovate/view_component-4.x-lockfile

git switch main

git merge renovate/view_component-4.x-lockfile

git push origin main

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

hobbypunk/discord-santa!9

No description provided.