build(deps): bump view_component from 4.12.0 to 4.13.0

[dependabot]

Bumps view_component from 4.12.0 to 4.13.0.

Release notes

Sourced from view_component's releases.

4.13.0

• Add support for Turbo-streaming ViewComponents.

  Ben Sheldon, Joel Hawksley

• Reduce allocations and avoid redundant compiler work when rendering components and collections.

  Joel Hawksley

• Stabilize rendering allocation tests with explicit warmups and exact expectations by Rails and Ruby.

  Joel Hawksley

• Replace the custom memory allocation test helper with minitest-memory, preserving Ruby-version-specific allocation thresholds while improving failure diagnostics.

  Joel Hawksley

• Add zizmor security analysis for GitHub Actions workflows to CI.

  Joel Hawksley

• Remove the $PROGRAM_NAME version-printing line from version.rb so the file no longer reads a global variable (unshareable across Ractors). The version is still available via ViewComponent::VERSION::STRING.

  Joel Hawksley

• Fix intermittent template compilation failures where line-number offsets and annotation stripping were decided when a template object was created instead of when it was compiled, so later changes to coverage or annotation settings produced off-by-one backtraces or blank output.

  Joel Hawksley

• Freeze ViewComponent::VERSION::STRING so the version constant is immutable and Ractor-shareable.

  Joel Hawksley

• Add audition Ractor-readiness checks to CI. Applied safe .freeze auto-fixes to string constants in ViewComponent::Errors and baselined existing findings so the gate fails only on new Ractor-isolation violations.

  Joel Hawksley

• Update link to GOV.UK Components library in resources list to govuk-components.x-govuk.org

  Peter Yates

• Fix NoMethodError: undefined method 'template_handler_extensions' when gathering sidecar templates on Rails main. Action View removed the ActionView::Template.template_handler_extensions method in newer versions; the compiler now reads the registered extensions through ActionView::Template::Handlers.extensions, which is the supported read-path API across all supported Rails versions (7.1+).

  Luiz Kowalski

Changelog

Sourced from view_component's changelog.

4.13.0

• Add support for Turbo-streaming ViewComponents.

  Ben Sheldon, Joel Hawksley

• Reduce allocations and avoid redundant compiler work when rendering components and collections.

  Joel Hawksley

• Stabilize rendering allocation tests with explicit warmups and exact expectations by Rails and Ruby.

  Joel Hawksley

• Replace the custom memory allocation test helper with minitest-memory, preserving Ruby-version-specific allocation thresholds while improving failure diagnostics.

  Joel Hawksley

• Add zizmor security analysis for GitHub Actions workflows to CI.

  Joel Hawksley

• Remove the $PROGRAM_NAME version-printing line from version.rb so the file no longer reads a global variable (unshareable across Ractors). The version is still available via ViewComponent::VERSION::STRING.

  Joel Hawksley

• Fix intermittent template compilation failures where line-number offsets and annotation stripping were decided when a template object was created instead of when it was compiled, so later changes to coverage or annotation settings produced off-by-one backtraces or blank output.

  Joel Hawksley

• Freeze ViewComponent::VERSION::STRING so the version constant is immutable and Ractor-shareable.

  Joel Hawksley

• Add audition Ractor-readiness checks to CI. Applied safe .freeze auto-fixes to string constants in ViewComponent::Errors and baselined existing findings so the gate fails only on new Ractor-isolation violations.

  Joel Hawksley

• Update link to GOV.UK Components library in resources list to govuk-components.x-govuk.org

  Peter Yates

• Fix NoMethodError: undefined method 'template_handler_extensions' when gathering sidecar templates on Rails main. Action View removed the ActionView::Template.template_handler_extensions method in newer versions; the compiler now reads the registered extensions through ActionView::Template::Handlers.extensions, which is the supported read-path API across all supported Rails versions (7.1+).

  Luiz Kowalski

Commits

• 3dd767c Merge pull request #2683 from ViewComponent/release-4-13-0
• f37039c Fix code injection in validate-inputs and update to non-vulnerable action ver...
• 19f6185 Remove action hash comments and simplify shell variable usage
• 4c6a683 Pin all action hashes to validated commits fetched via git ls-remote
• 476c89c Fix zizmor errors: use tag-based action references and proper environment var...
• 26c603f Fix zizmor security findings: use correct action hashes and proper input hand...
• 8d4f268 Automate release workflow with security hardening
• 6138674 automate publishing
• c00ec30 script/release creates pr
• 979d863 check for release permissions
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	gem/​view_component@​4.12.0 ⏵ 4.13.0	+1

View full report

[dependabot]

Superseded by #1210.