build(deps): bump view_component from 4.12.0 to 4.14.0

[dependabot]

Bumps view_component from 4.12.0 to 4.14.0.

Release notes

Sourced from view_component's releases.

4.14.0

• Freeze ReusedInstanceError::MESSAGE and update test_renders_component_with_asset_url to build a fresh AssetComponent per render, fixing CI regressions introduced by the GHSA-8qw7-6phv-7q6p remediation.

  Joel Hawksley

• [Security] Fix incomplete remediation for CVE-2026-54497 (GHSA-8qw7-6phv-7q6p): reused ViewComponent instances could still leak with_content and renders_one/renders_many slot content from an earlier render into a later render because slot state and content set via with_content are populated by the caller before render_in runs and were not cleared by the previous per-render reset. Reinstate the ViewComponent::ReusedInstanceError guard that raises when a component instance is rendered more than once. Rebuild collection child components per render and dup collection spacer components before each render so that legitimate re-rendering of Collection/spacer objects continues to work.

  Yazan Balawneh, Cystack.ps

• Update GitHub Actions workflows to use actions/checkout v7.

  Richard Macklin

4.13.0

• Add support for Turbo-streaming ViewComponents.

  Ben Sheldon, Joel Hawksley

• Reduce allocations and avoid redundant compiler work when rendering components and collections.

  Joel Hawksley

• Stabilize rendering allocation tests with explicit warmups and exact expectations by Rails and Ruby.

  Joel Hawksley

• Replace the custom memory allocation test helper with minitest-memory, preserving Ruby-version-specific allocation thresholds while improving failure diagnostics.

  Joel Hawksley

• Add zizmor security analysis for GitHub Actions workflows to CI.

  Joel Hawksley

• Remove the $PROGRAM_NAME version-printing line from version.rb so the file no longer reads a global variable (unshareable across Ractors). The version is still available via ViewComponent::VERSION::STRING.

  Joel Hawksley

• Fix intermittent template compilation failures where line-number offsets and annotation stripping were decided when a template object was created instead of when it was compiled, so later changes to coverage or annotation settings produced off-by-one backtraces or blank output.

  Joel Hawksley

• Freeze ViewComponent::VERSION::STRING so the version constant is immutable and Ractor-shareable.

  Joel Hawksley

• Add audition Ractor-readiness checks to CI. Applied safe .freeze auto-fixes to string constants in ViewComponent::Errors and baselined existing findings so the gate fails only on new Ractor-isolation violations.

  Joel Hawksley

... (truncated)

Changelog

Sourced from view_component's changelog.

4.14.0

• Freeze ReusedInstanceError::MESSAGE and update test_renders_component_with_asset_url to build a fresh AssetComponent per render, fixing CI regressions introduced by the GHSA-8qw7-6phv-7q6p remediation.

  Joel Hawksley

• [Security] Fix incomplete remediation for CVE-2026-54497 (GHSA-8qw7-6phv-7q6p): reused ViewComponent instances could still leak with_content and renders_one/renders_many slot content from an earlier render into a later render because slot state and content set via with_content are populated by the caller before render_in runs and were not cleared by the previous per-render reset. Reinstate the ViewComponent::ReusedInstanceError guard that raises when a component instance is rendered more than once. Rebuild collection child components per render and dup collection spacer components before each render so that legitimate re-rendering of Collection/spacer objects continues to work.

  Yazan Balawneh, Cystack.ps

• Update GitHub Actions workflows to use actions/checkout v7.

  Richard Macklin

4.13.0

• Add support for Turbo-streaming ViewComponents.

  Ben Sheldon, Joel Hawksley

• Reduce allocations and avoid redundant compiler work when rendering components and collections.

  Joel Hawksley

• Stabilize rendering allocation tests with explicit warmups and exact expectations by Rails and Ruby.

  Joel Hawksley

• Replace the custom memory allocation test helper with minitest-memory, preserving Ruby-version-specific allocation thresholds while improving failure diagnostics.

  Joel Hawksley

• Add zizmor security analysis for GitHub Actions workflows to CI.

  Joel Hawksley

• Remove the $PROGRAM_NAME version-printing line from version.rb so the file no longer reads a global variable (unshareable across Ractors). The version is still available via ViewComponent::VERSION::STRING.

  Joel Hawksley

• Fix intermittent template compilation failures where line-number offsets and annotation stripping were decided when a template object was created instead of when it was compiled, so later changes to coverage or annotation settings produced off-by-one backtraces or blank output.

  Joel Hawksley

• Freeze ViewComponent::VERSION::STRING so the version constant is immutable and Ractor-shareable.

  Joel Hawksley

• Add audition Ractor-readiness checks to CI. Applied safe .freeze auto-fixes to string constants in ViewComponent::Errors and baselined existing findings so the gate fails only on new Ractor-isolation violations.

... (truncated)

Commits

• efc3085 Merge pull request #2703 from ViewComponent/joelhawksley-redesigned-sniffle
• 2845005 Dispatch push_gem against the tag ref (env-protection-compatible)
• d1fd891 Merge pull request #2702 from ViewComponent/joelhawksley-redesigned-sniffle
• a7c846d Trigger push_gem workflow after tagging, and allow manual dispatch
• b7094df Merge pull request #2701 from ViewComponent/joelhawksley-redesigned-sniffle
• 1911ced Skip push-permission probe in script/publish under GitHub Actions
• 50cb920 Merge pull request #2700 from ViewComponent/joelhawksley-redesigned-sniffle
• 257b159 Fix publish-release workflow trigger and push auth
• 427caca Merge pull request #2697 from ViewComponent/release-4-14-0
• a7d1d89 release 4.14.0
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	gem/​view_component@​4.12.0 ⏵ 4.14.0	+1

View full report

[dependabot]

Superseded by #1217.