Skip to content

Bump view_component from 4.9.0 to 4.12.0 - #4119

Merged
francinelucca merged 1 commit into
mainfrom
dependabot/bundler/view_component-4.12.0
Jul 2, 2026
Merged

Bump view_component from 4.9.0 to 4.12.0#4119
francinelucca merged 1 commit into
mainfrom
dependabot/bundler/view_component-4.12.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 1, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps view_component from 4.9.0 to 4.12.0.

Release notes

Sourced from view_component's releases.

4.12.0

  • Fix stale render context on reused component instances. A ViewComponent::Base instance memoized its controller, helpers, request, view context, lookup context, view flow, and requested format details on first render via ||=. Rendering the same instance a second time (intentionally or via aliasing) reused that stale context, which could leak data across requests, sessions, or users. #render_in now resets these ivars on every call so each render derives its context from the current view.

    Joel Hawksley

  • Fix HTML-safety bypass in around_render. ViewComponent::Base#around_render could return HTML-unsafe strings that bypassed the escaping applied to normal #call return values, creating an XSS risk. The vulnerability was amplified in ViewComponent::Collection#render_in, which joined per-item results and unconditionally marked the output html_safe. HTML-unsafe strings returned from around_render are now escaped (with a warning) and Collection#render_in now uses safe_join so unsafe per-item output is escaped instead of laundered into a SafeBuffer. Joel Hawksley

4.11.0

  • Update render_in signature to accept **_ for compatibility with Rails #50623.

    Joel Hawksley

  • Fix translation scope resolution in nested lambda-backed slots. Relative t(".key") calls inside lambda-backed slots were resolving against an intermediate component's scope instead of the original partial's scope where the block was defined.

    Artin Boghosian

4.10.0

  • Fix NameError: uninitialized constant ViewComponent::SystemTestControllerNefariousPathError when booting in the test environment with eager_load = true.

    Joel Hawksley

  • Fix yielded content rendered at wrong location when using form helpers.

    Joel Hawksley, Markus

Changelog

Sourced from view_component's changelog.

4.12.0

  • Fix stale render context on reused component instances. A ViewComponent::Base instance memoized its controller, helpers, request, view context, lookup context, view flow, and requested format details on first render via ||=. Rendering the same instance a second time (intentionally or via aliasing) reused that stale context, which could leak data across requests, sessions, or users. #render_in now resets these ivars on every call so each render derives its context from the current view.

    Joel Hawksley

  • Fix HTML-safety bypass in around_render. ViewComponent::Base#around_render could return HTML-unsafe strings that bypassed the escaping applied to normal #call return values, creating an XSS risk. The vulnerability was amplified in ViewComponent::Collection#render_in, which joined per-item results and unconditionally marked the output html_safe. HTML-unsafe strings returned from around_render are now escaped (with a warning) and Collection#render_in now uses safe_join so unsafe per-item output is escaped instead of laundered into a SafeBuffer.

    Joel Hawksley

4.11.0

  • Update render_in signature to accept **_ for compatibility with Rails #50623.

    Joel Hawksley

  • Fix translation scope resolution in nested lambda-backed slots. Relative t(".key") calls inside lambda-backed slots were resolving against an intermediate component's scope instead of the original partial's scope where the block was defined.

    Artin Boghosian

4.10.0

  • Fix NameError: uninitialized constant ViewComponent::SystemTestControllerNefariousPathError when booting in the test environment with eager_load = true.

    Joel Hawksley

  • Fix yielded content rendered at wrong location when using form helpers.

    Joel Hawksley, Markus

Commits

@dependabot dependabot Bot added bundler Gemfile dependencies dependencies Pull requests that update a dependency file skip changeset Pull requests that don't change the library output labels Jul 1, 2026
@dependabot
dependabot Bot requested a review from a team as a code owner July 1, 2026 10:03
@dependabot
dependabot Bot requested a review from francinelucca July 1, 2026 10:03
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file skip changeset Pull requests that don't change the library output bundler Gemfile dependencies labels Jul 1, 2026
@changeset-bot

changeset-bot Bot commented Jul 1, 2026 •
edited
Loading

Copy link
Copy Markdown

⚠️ No Changeset found

Latest commit: 8a5f4b1

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@dependabot
Bump view_component from 4.9.0 to 4.12.0
8a5f4b1 
Bumps [view_component](https://github.com/viewcomponent/view_component) from 4.9.0 to 4.12.0.
- [Release notes](https://github.com/viewcomponent/view_component/releases)
- [Changelog](https://github.com/ViewComponent/view_component/blob/main/docs/CHANGELOG.md)
- [Commits](ViewComponent/view_component@v4.9.0...v4.12.0)

---
updated-dependencies:
- dependency-name: view_component
  dependency-version: 4.12.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/bundler/view_component-4.12.0 branch from 7dcad88 to 8a5f4b1 Compare July 2, 2026 02:08
@francinelucca
francinelucca merged commit c0e6cbd into main Jul 2, 2026
32 checks passed
@francinelucca
francinelucca deleted the dependabot/bundler/view_component-4.12.0 branch July 2, 2026 02:33
myabc added a commit to opf/primer_view_components that referenced this pull request Jul 21, 2026
@myabc
Sync Primer view_components upstream through v0.53.0
9ad3954 
Merges primer/view_components through the release-tracking batch
ending at 0098814 (v0.53.0), bringing in three dependabot bumps:

- Bump view_component from 4.9.0 to 4.12.0 (primer#4119)
- Bump @primer/css from 22.1.1 to 22.3.0 (primer#4126)
- Downgrade @oddbird/popover-polyfill to ^0.5.2 (primer#4133)

Resolves the package.json rename/version conflict in favor of the
fork's identity and keeps the fork's newer @primer/primitives and
@primer/stylelint-config pins. Regenerates Gemfile.lock,
package-lock.json, static assets, and docs via script/setup on a
clean tree.
@myabc myabc mentioned this pull request Jul 21, 2026
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@francinelucca francinelucca francinelucca approved these changes

Assignees

No one assigned

Labels

bundler Gemfile dependencies dependencies Pull requests that update a dependency file skip changeset Pull requests that don't change the library output

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@francinelucca