chore(deps): update dependency view_component to v2.83.0 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
view_component (source, changelog)	2.53.0 -> 2.83.0

GitHub Vulnerability Alerts

CVE-2024-21636

Impact

What kind of vulnerability is it? Who is impacted?

This is an XSS vulnerability that has the potential to impact anyone rendering a component directly from a controller with the view_component gem. Note that only components that define a #call method (i.e. instead of using a sidecar template) are affected. The return value of the #call method is not sanitized and can include user-defined content.

In addition, the return value of the #output_postamble method is not sanitized, which can also lead to XSS issues.

Patches

Has the problem been patched? What versions should users upgrade to?

Versions 3.9.0 has been released and fully mitigates both the #call and the #output_postamble vulnerabilities.

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

Sanitize the return value of #call, eg:

class MyComponent < ApplicationComponent
  def call
    html_escape("<div>#{user_input}</div>")
  end
end

References

Are there any links users can visit to find out more?

https://github.com/ViewComponent/view_component/pull/1950

For more information

If you have any questions or comments about this advisory:

Open an issue in the github/view_component project.

---

Release Notes

viewcomponent/view_component (view_component)

v2.83.0

Compare Source

• Ensure HTML output safety.

  Cameron Dutro

v2.82.0

Compare Source

• Revert "Avoid loading ActionView::Base during initialization (#​1528)"

  Jon Rohan

• Fix tests using with_rendered_component_path with custom layouts.

  Ian Hollander

v2.81.0

Compare Source

• Adjust the way response objects are set on the preview controller to work around a recent change in Rails main.

  Cameron Dutro

• Fix typo in "Generate a Stimulus controller" documentation.

  Ben Trewern

• Modify the render_in_view_context test helper to forward its args to the block.

  Cameron Dutro

v2.80.0

Compare Source

• Move system test endpoint out of the unrelated previews controller.

  Edwin Mak

• Display Ruby 2.7 deprecation notice only once, when starting the application.

  Henrik Hauge Bjørnskov

• Require Rails 5.2+ in gemspec and update documentation.

  Drew Bragg

• Add documentation for using with_rendered_component_path with RSpec.

  Edwin Mak

v2.79.0

Compare Source

• Add ability to pass explicit preview_path to preview generator.

  Erinna Chen

• Add with_rendered_component_path helper for writing component system tests.

  Edwin Mak

• Include gem name and deprecation horizon in every deprecation message.

  Jan Klimo

v2.78.0

Compare Source

• Support variants with dots in their names.

  Javi Martín

v2.77.0

Compare Source

• Support variants with dashes in their names.

  Javi Martín

v2.76.0

Compare Source

• Component.with_collection supports components that accept splatted keyword arguments.

  Zee Spencer

• Remove config.view_component.use_consistent_rendering_lifecycle since it is no longer planned for 3.0.

  Blake Williams

• Prevent polymorphic slots from calculating content when setting a slot.

  Blake Williams

• Add ability to pass in the preview class to render_preview.

  Jon Rohan

• Fix issue causing PVC tests to fail in CI.

  Cameron Dutro

• Fix YARD docs build task.

  Hans Lemuet

• Add Startup Jobs to list of companies using ViewComponent.

  Marc Köhlbrugge

• Run PVC's accessibility tests in a single process to avoid resource contention in CI.

  Cameron Dutro

v2.75.0

Compare Source

• Avoid loading ActionView::Base during Rails initialization.

  Jonathan del Strother

• Mention lambda slots rendering returned values lazily in the guide.

  Graham Rogers

• Add "ViewComponent In The Wild" articles to resources.

  Alexander Baygeldin

v2.74.1

Compare Source

• Add more users of ViewComponent to docs.

  Joel Hawksley

• Add a known issue for usage with turbo_frame_tag to the documentation.

  Vlad Radulescu

• Add note about system testing components with previews.

  Joel Hawksley

• Remove locking mechanisms from the compiler.

  Cameron Dutro

v2.74.0

Compare Source

• Add Avo to list of companies using ViewComponent.

  Adrian Marin

• Promote experimental _output_postamble method to public API as output_postamble.

  Joel Hawksley

• Promote experimental _sidecar_files method to public API as sidecar_files.

  Joel Hawksley

• Fix show_previews regression introduced in 2.73.0.

  Andy Baranov

• with_request_url test helper supports router constraints (such as Devise).

  Aotokitsuruya

v2.73.0

Compare Source

• Remove experimental _after_compile lifecycle method.

  Joel Hawksley

• Fix capitalization of JavaScript in docs.

  Erinna Chen

• Add PrintReleaf to list of companies using ViewComponent.

  Ry Kulp

• Simplify CI configuration to a single build per Ruby/Rails version.

  Joel Hawksley

• Correctly document generate.sidecar config option.

  Ruben Smit

• Add Yobbers to list of companies using ViewComponent.

  Anton Prins

v2.72.0

Compare Source

• Deprecate support for Ruby < 2.7 for removal in v3.0.0.

  Joel Hawksley

• Add changelog_uri to gemspec.

  Joel Hawksley

• Link to CHANGELOG.md instead of symlink.

  Joel Hawksley

• Add Aluuno to list of companies using ViewComponent.

  Daniel Naves de Carvalho

• Add source_code_uri to gemspec.

  Yoshiyuki Hirano

• Update link to benchmark script in docs.

  Daniel Diekmeier

• Add special exception message for renders_one :content explaining that content passed as a block will be assigned to the content accessor without having to create an explicit slot.

  Daniel Diekmeier

v2.71.0

Compare Source

ViewComponent has moved to a new organization: https://github.com/viewcomponent/view_component. See #​1424 for more details.

v2.70.0

Compare Source

• render_preview can pass parameters to preview.

  Joel Hawksley

• Fix docs typos.

  Joel Hawksley

• Add architectural decisions to documentation and rename sidebar sections.

  Joel Hawksley

• Clarify documentation on testability of Rails views.

  Joel Hawksley

• Add Arrows to list of companies using ViewComponent.

  Matt Swanson

• Add WIP to list of companies using ViewComponent.

  Marc Köhlbrugge

• Update slots documentation to include how to reference slots.

  Brittany Ellich

• Add Clio to list of companies using ViewComponent.

  Mike Buckley

v2.69.0

Compare Source

• Add missing require to fix pvc build.

  Joel Hawksley

• Add config.view_component.use_consistent_rendering_lifecycle to ensure side-effects in content are consistently evaluated before components are rendered. This change effectively means that content is evaluated for every component render where render? returns true. As a result, code that's passed to a component via a block/content will now always be evaluated, before #call, which can reveal bugs in existing components. This configuration option defaults to false but will be enabled in 3.0 and the old behavior will be removed.

  Blake Williams

• Update Prism to version 1.28.0.

  Thomas Hutterer

• Corrects the deprecation warning for named slots to show the file and line where the slot is called.

  River Bailey

v2.68.0

Compare Source

• Update gemspec author to be ViewComponent team.

  Joel Hawksley

• Fix bug where ViewComponent::Compiler wasn't required.

  Joel Hawksley

v2.67.0

Compare Source

• Use ViewComponent::Base.config as the internal endpoint for config.

  Simon Fish

• Fix bug where #with_request_url, when used with query string, set the incorrect request.path and request.fullpath.

  Franz Liedke

• Add link to ViewComponentAttributes in Resources section of docs.

  Romaric Pascal

• render_preview test helper is available by default. It is no longer necessary to include ViewComponent::RenderPreviewHelper.

  Joel Hawksley

v2.66.0

Compare Source

• Add missing generate.sidecar, generate.stimulus_controller, generate.locale, generate.distinct_locale_files, generate.preview config options to config.view_component.

  Simon Fish

v2.65.0

Compare Source

• Raise ArgumentError when conflicting Slots are defined.

  Before this change it was possible to define Slots with conflicting names, for example:

  class MyComponent < ViewComponent::Base
    renders_one :item
    renders_many :items
  end

  Joel Hawksley

v2.64.0

Compare Source

• Add warn_on_deprecated_slot_setter flag to opt-in to deprecation warning.

  In v2.54.0, the Slots API was updated to require the with_* prefix for setting Slots. The non-with_* setters will be deprecated in a coming version and removed in v3.0.

  To enable the coming deprecation warning, add warn_on_deprecated_slot_setter:

  class DeprecatedSlotsSetterComponent < ViewComponent::Base
    warn_on_deprecated_slot_setter
  end

  Joel Hawksley

• Add m to development environment.

  Joel Hawksley

• Fix potential deadlock scenario in the compiler's development mode.

  Blake Williams

v2.63.0

Compare Source

• Fixed typo in renders_many documentation.

  Graham Rogers

• Add documentation about working with turbo-rails.

  Matheus Poli Camilo

• Fix issue causing helper methods to not be available in nested components when the render monkey patch is disabled and render_component is used.

  Daniel Scheffknecht

v2.62.0

Compare Source

• Remove the experimental global output buffer feature.

• Restore functionality that used to attempt to compile templates on each call to #render_in.

• Un-pin rails main dependency.

  Cameron Dutro

• Add blank space between "in" and "ViewComponent" in a deprecation warning.

  Vikram Dighe

• Add HappyCo to list of companies using ViewComponent.

  Josh Clayton

v2.61.1

Compare Source

• Revert Expose Capybara DSL methods directly inside tests. This change unintentionally broke other Capybara methods and thus introduced a regression. We aren't confident that we can fail forward so we have decided to revert this change.

  Joel Hawksley, Blake Williams

• Revert change making content evaluation consistent.

  Blake Williams

• Pin rails main dependency due to incompatibility with Global Output Buffer.

  Joel Hawksley

v2.61.0

Compare Source

• Ensure side-effects in content are consistently evaluated before components are rendered. This change effectively means that content is evaluated for every component render where render? returns true. As a result, code that is passed to a component via a block/content will now always be evaluated, before #call, which can reveal bugs in existing components.

  Blake Williams

v2.60.0

Compare Source

• Add support for render_preview in RSpec tests.

  Thomas Hutterer

v2.59.0

Compare Source

• Expose Capybara DSL methods directly inside tests.

  The following Capybara methods are now available directly without having to use the page method:

  • all
  • first
  • text
  • find
  • find_all
  • find_button
  • find_by_id
  • find_field
  • find_link
  • has_content?
  • has_text?
  • has_css?
  • has_no_content?
  • has_no_text?
  • has_no_css?
  • has_no_xpath?
  • has_xpath?
  • has_link?
  • has_no_link?
  • has_button?
  • has_no_button?
  • has_field?
  • has_no_field?
  • has_checked_field?
  • has_unchecked_field?
  • has_no_table?
  • has_table?
  • has_select?
  • has_no_select?
  • has_selector?
  • has_no_selector?
  • has_no_checked_field?
  • has_no_unchecked_field?

• Add support for within* Capybara DLS methods:

  • within

  • within_element

  • within_fieldset

  • within_table

    Jacob Carlborg

v2.58.0

Compare Source

Welcome to the team, Hans and Simon! ❤️

• Add @​boardfish and @​spone as maintainers.

  Joel Hawksley, Cameron Dutro, Blake Williams

• Switch to standardrb.

  Joel Hawksley

• Add BootrAils article to resources.

  Joel Hawksley

• Re-compile updated, inherited templates when class caching is disabled.

  Patrick Arnett

• Add the latest version to the docs index.

• Improve the docs: add the versions various features were introduced in.

  Hans Lemuet

• Update docs to reflect lack of block content support in controllers.

  Joel Hawksley

• Prevent adding duplicates to autoload_paths.

  Thomas Hutterer

• Add FreeAgent to list of companies using ViewComponent.

  Simon Fish

• Include polymorphic slots in ViewComponent::Base by default.

  Cameron Dutro

• Add per-component config option for stripping newlines from templates before compilation.

  Cameron Dutro

• Add link to article by Matouš Borák.

  Joel Hawksley

v2.57.1

Compare Source

• Fix issue causing NoMethodErrors when calling helper methods from components rendered as part of a collection.

• Fix syntax error in the ERB example in the polymorphic slots docs.

  Cameron Dutro

v2.57.0

Compare Source

• Add missing require for Translatable module in Base.

  Hans Lemuet

• Allow anything that responds to #render_in to be rendered in the parent component's view context.

  Cameron Dutro

• Fix script/release so it honors semver.

  Cameron Dutro

v2.56.2

Compare Source

• Restore removed rendered_component, marking it for deprecation in v3.0.0.

  Tyson Gach, Richard Macklin, Joel Hawksley

v2.56.1

Compare Source

• Rename private accessor rendered_component to rendered_content.

  Yoshiyuki Hirano, Simon Dawson

v2.56.0

Compare Source

• Introduce experimental render_preview test helper. Note: @rendered_component in TestHelpers has been renamed to @rendered_content.

  Joel Hawksley

• Move framework tests into sandbox application.

  Joel Hawksley

• Add G2 to list of companies that use ViewComponent.

  Jack Shuff

• Add Within3 to list of companies that use ViewComponent.

  Drew Bragg

• Add Mission Met to list of companies that use ViewComponent.

  Nick Smith

• Fix #with_request_url test helper not parsing nested query parameters into nested hashes.

  Richard Marbach

v2.55.0

Compare Source

• Add render_parent convenience method to avoid confusion between <%= super %> and <% super %> in template code.

  Cameron Dutro

• Add note about discouraging inheritance.

  Joel Hawksley

• Clean up grammar in documentation.

  Joel Hawksley

• The ViewComponent team at GitHub is hiring! We're looking for a Rails engineer with accessibility experience: https://boards.greenhouse.io/github/jobs/4020166. Reach out to joelhawksley@github.com with any questions!

• The ViewComponent team is hosting a happy hour at RailsConf. Join us for snacks, drinks, and stickers: https://www.eventbrite.com/e/viewcomponent-happy-hour-tickets-304168585427

v2.54.1

Compare Source

• Update docs dependencies.

  Joel Hawksley

• Resolve warning in slots API.

• Raise in the test environment when ViewComponent code emits a warning.

  Blake Williams

v2.54.0

Compare Source

• Add with_* slot API for defining slots. Note: we plan to deprecate the non with_* API for slots in an upcoming release.

  Blake Williams

• Add QuickNode to list of companies that heavily rely on ViewComponent.

  Luc Castera

• Include the Translatable module by default.

  Elia Schito

• Update docs dependencies.

  Joel Hawksley

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: Gemfile.lock

Fetching gem metadata from https://rubygems.org/.........
Resolving dependencies...................

Bundler could not find compatible versions for gem "view_component":
  In Gemfile:
    view_component (~> 3.0)

    lookbook (~> 0.8.0) was resolved to 0.8.1, which depends on
      view_component (~> 2.0)