chore(deps): bump view_component from 4.1.0 to 4.9.0

[dependabot]

Bumps view_component from 4.1.0 to 4.9.0.

Release notes

Sourced from view_component's releases.

4.9.0

• Fix path traversal vulnerability in ViewComponentsSystemTestController where sibling directories sharing a string prefix with the allowed temp directory could bypass the path containment check. The start_with? check has been replaced with a separator-aware prefix check, and nefarious path errors now return a 404 instead of an unhandled exception.

  Joel Hawksley

• Fix preview route vulnerability where inherited methods on ViewComponent::Preview (such as render_with_template) could be invoked via the preview URL, allowing arbitrary internal Rails templates to be rendered with attacker-controlled locals and request parameters. render_args now raises AbstractController::ActionNotFound for any example not explicitly declared on the preview subclass.

  Joel Hawksley

• Add yard-lint to CI.

  Joel Hawksley

4.8.0

• Add compile.view_component ActiveSupport::Notifications event for eager compilation at boot time.

  Joel Hawksley, GitHub Copilot

4.7.0

• Fix stale content cache when slots are accessed before render_in.

  Jared Armstrong

• Add rubocop-view_component to resources.

  Andy Waite

• Fix bug where inheritance of components with formatless templates improperly raised a NoMethodError.

  GitHub Copilot, Joel Hawksley, Cameron Dutro

4.6.0

• Add view_identifier to the render.view_component instrumentation event payload, containing the path to the component's template file (e.g. app/components/my_component.html.erb). For components using inline render methods, view_identifier will be nil.

  GitHub Copilot

• Replace deprecated require_dependency with require in preview loading.

  GitHub Copilot

• Return html_safe empty string from render_in when render? is false.

  GitHub Copilot

4.5.0

• Fix initialization ordering issue causing missing asset errors in Sprockets.

  Cameron Dutro

4.4.0

... (truncated)

Changelog

Sourced from view_component's changelog.

4.9.0

• Fix path traversal vulnerability in ViewComponentsSystemTestController where sibling directories sharing a string prefix with the allowed temp directory could bypass the path containment check. The start_with? check has been replaced with a separator-aware prefix check, and nefarious path errors now return a 404 instead of an unhandled exception.

  Joel Hawksley

• Fix preview route vulnerability where inherited methods on ViewComponent::Preview (such as render_with_template) could be invoked via the preview URL, allowing arbitrary internal Rails templates to be rendered with attacker-controlled locals and request parameters. render_args now raises AbstractController::ActionNotFound for any example not explicitly declared on the preview subclass.

  Joel Hawksley

• Add yard-lint to CI.

  Joel Hawksley

4.8.0

• Add compile.view_component ActiveSupport::Notifications event for eager compilation at boot time.

  Joel Hawksley, GitHub Copilot

4.7.0

• Fix stale content cache when slots are accessed before render_in.

  Jared Armstrong

• Add rubocop-view_component to resources.

  Andy Waite

• Fix bug where inheritance of components with formatless templates improperly raised a NoMethodError.

  GitHub Copilot, Joel Hawksley, Cameron Dutro

4.6.0

• Add view_identifier to the render.view_component instrumentation event payload, containing the path to the component's template file (e.g. app/components/my_component.html.erb). For components using inline render methods, view_identifier will be nil.

  GitHub Copilot

• Replace deprecated require_dependency with require in preview loading.

  GitHub Copilot

• Return html_safe empty string from render_in when render? is false.

  GitHub Copilot

4.5.0

... (truncated)

Commits

• 458281b Merge pull request #2626 from ViewComponent/release-4-9-0
• 5eea779 release 4.9.0
• 9a4bac9 Merge commit from fork
• b70deae add changelog
• da99314 fix advisory
• a243dd2 reproduce advisory
• 765d7bc fix advisory
• cca62ec reproduce report
• 8c76bd3 Merge pull request #2625 from ViewComponent/2567-yardlint
• a59a5ae cleanup
• Additional commits viewable in compare view