Bump view_component from 4.6.0 to 4.10.0

[dependabot]

Bumps view_component from 4.6.0 to 4.10.0.

Release notes

Sourced from view_component's releases.

4.10.0

• Fix NameError: uninitialized constant ViewComponent::SystemTestControllerNefariousPathError when booting in the test environment with eager_load = true.

  Joel Hawksley

• Fix yielded content rendered at wrong location when using form helpers.

  Joel Hawksley, Markus

4.9.0

• Fix path traversal vulnerability in ViewComponentsSystemTestController where sibling directories sharing a string prefix with the allowed temp directory could bypass the path containment check. The start_with? check has been replaced with a separator-aware prefix check, and nefarious path errors now return a 404 instead of an unhandled exception.

  Joel Hawksley

• Fix preview route vulnerability where inherited methods on ViewComponent::Preview (such as render_with_template) could be invoked via the preview URL, allowing arbitrary internal Rails templates to be rendered with attacker-controlled locals and request parameters. render_args now raises AbstractController::ActionNotFound for any example not explicitly declared on the preview subclass.

  Joel Hawksley

• Add yard-lint to CI.

  Joel Hawksley

4.8.0

• Add compile.view_component ActiveSupport::Notifications event for eager compilation at boot time.

  Joel Hawksley, GitHub Copilot

4.7.0

• Fix stale content cache when slots are accessed before render_in.

  Jared Armstrong

• Add rubocop-view_component to resources.

  Andy Waite

• Fix bug where inheritance of components with formatless templates improperly raised a NoMethodError.

  GitHub Copilot, Joel Hawksley, Cameron Dutro

Changelog

Sourced from view_component's changelog.

4.10.0

• Fix NameError: uninitialized constant ViewComponent::SystemTestControllerNefariousPathError when booting in the test environment with eager_load = true.

  Joel Hawksley

• Fix yielded content rendered at wrong location when using form helpers.

  Joel Hawksley, Markus

4.9.0

• Fix path traversal vulnerability in ViewComponentsSystemTestController where sibling directories sharing a string prefix with the allowed temp directory could bypass the path containment check. The start_with? check has been replaced with a separator-aware prefix check, and nefarious path errors now return a 404 instead of an unhandled exception.

  Joel Hawksley

• Fix preview route vulnerability where inherited methods on ViewComponent::Preview (such as render_with_template) could be invoked via the preview URL, allowing arbitrary internal Rails templates to be rendered with attacker-controlled locals and request parameters. render_args now raises AbstractController::ActionNotFound for any example not explicitly declared on the preview subclass.

  Joel Hawksley

• Add yard-lint to CI.

  Joel Hawksley

4.8.0

• Add compile.view_component ActiveSupport::Notifications event for eager compilation at boot time.

  Joel Hawksley, GitHub Copilot

4.7.0

• Fix stale content cache when slots are accessed before render_in.

  Jared Armstrong

• Add rubocop-view_component to resources.

  Andy Waite

• Fix bug where inheritance of components with formatless templates improperly raised a NoMethodError.

  GitHub Copilot, Joel Hawksley, Cameron Dutro

Commits

• e799229 Merge pull request #2631 from ViewComponent/release-4-10-0
• 9c30e56 fix
• c03ee1f release 4.10.0
• 273e11e attempt to fix release script toil
• 5e660eb Merge pull request #2630 from ViewComponent/2629
• 8262e77 changelog
• e166232 Fix NameError on boot with eager_load=true
• 5888ac9 Add eager_load_check rake task to catch missing requires
• 6873b25 Merge pull request #2627 from ViewComponent/more-yard-lint
• 63fdc5a spacing
• Additional commits viewable in compare view

[dependabot]

Superseded by #44.