build(deps): bump view_component from 4.12.0 to 4.15.0

[dependabot]

Bumps view_component from 4.12.0 to 4.15.0.

Release notes

Sourced from view_component's releases.

4.15.0

• Add experimental caching support, opt-in per component via include ViewComponent::ExperimentallyCacheable.

  Components have never participated in Rails' template digests, so a <% cache %> block wrapping render MyComponent.new was never invalidated when the component changed (#234, open since 2020).

  Including the module registers the component with Rails' own ActionView::Digestor, so fragment caches are invalidated when the component's template, Ruby class, sidecar files, superclasses, child components, or rendered partials change. This includes components and partials rendered from inline templates and #call methods. Adding cache_on caches the component's own rendered output, optionally guarded by if:/unless:, and .cache_digest exposes the digest for use outside a request.

  class MessageComponent < ViewComponent::Base
    include ViewComponent::ExperimentallyCacheable
  cache_on :message, unless: -> { message.draft? }
  def initialize(message:)
  @​message = message
  end
  end

  This API is experimental and may change or be removed in a non-major release. It's shipping opt-in and per-component precisely so we can iterate on it in response to real-world use. Please try it and tell us what breaks, what's missing, and what feels wrong in #234. We're especially interested in feedback on: whether cache_on is the right shape for declaring cache keys, how the feature behaves with slots and content blocks, and whether the # Template Dependency: escape hatch is sufficient for dynamic renders. See the caching guide for details and known caveats.

  This work builds directly on prior art from the community. The cache_on API and the case for component-local caching come from #2126 by Reegan Viljoen. The approach of integrating with Rails' digest tree rather than reimplementing it comes from view_component-cache_digest by Godfrey Chan. The invalidation cases it's tested against were contributed by JWShuff and timburgan, drawing on view_component-fragment_caching by Patrick Arnett. The issue was opened and researched by ozzyaaron, pinzonjulian, and Derek Kniffin, and the digest workaround that surfaced the superclass gap came from cannikin and rnestler. Cache-key correctness issues (formats sharing an entry, positional nil collisions, conditional caching, and ignored cache_on blocks) were found and reported by Reegan Viljoen.

  Reegan Viljoen, Godfrey Chan, JWShuff, timburgan, Patrick Arnett, ozzyaaron, pinzonjulian, Derek Kniffin, cannikin, rnestler, Joel Hawksley

4.14.0

• Freeze ReusedInstanceError::MESSAGE and update test_renders_component_with_asset_url to build a fresh AssetComponent per render, fixing CI regressions introduced by the GHSA-8qw7-6phv-7q6p remediation.

  Joel Hawksley

• [Security] Fix incomplete remediation for CVE-2026-54497 (GHSA-8qw7-6phv-7q6p): reused ViewComponent instances could still leak with_content and renders_one/renders_many slot content from an earlier render into a later render because slot state and content set via with_content are populated by the caller before render_in runs and were not cleared by the previous per-render reset. Reinstate the ViewComponent::ReusedInstanceError guard that raises when a component instance is rendered more than once. Rebuild collection child components per render and dup collection spacer components before each render so that legitimate re-rendering of Collection/spacer objects continues to work.

  Yazan Balawneh, Cystack.ps

• Update GitHub Actions workflows to use actions/checkout v7.

  Richard Macklin

4.13.0

• Add support for Turbo-streaming ViewComponents.

  Ben Sheldon, Joel Hawksley

• Reduce allocations and avoid redundant compiler work when rendering components and collections.

  Joel Hawksley

• Stabilize rendering allocation tests with explicit warmups and exact expectations by Rails and Ruby.

  Joel Hawksley

... (truncated)

Changelog

Sourced from view_component's changelog.

4.15.0

• Add experimental caching support, opt-in per component via include ViewComponent::ExperimentallyCacheable.

  Components have never participated in Rails' template digests, so a <% cache %> block wrapping render MyComponent.new was never invalidated when the component changed (#234, open since 2020).

  Including the module registers the component with Rails' own ActionView::Digestor, so fragment caches are invalidated when the component's template, Ruby class, sidecar files, superclasses, child components, or rendered partials change. This includes components and partials rendered from inline templates and #call methods. Adding cache_on caches the component's own rendered output, optionally guarded by if:/unless:, and .cache_digest exposes the digest for use outside a request.

  class MessageComponent < ViewComponent::Base
    include ViewComponent::ExperimentallyCacheable
  cache_on :message, unless: -> { message.draft? }
  def initialize(message:)
  @​message = message
  end
  end

  This API is experimental and may change or be removed in a non-major release. It's shipping opt-in and per-component precisely so we can iterate on it in response to real-world use. Please try it and tell us what breaks, what's missing, and what feels wrong in #234. We're especially interested in feedback on: whether cache_on is the right shape for declaring cache keys, how the feature behaves with slots and content blocks, and whether the # Template Dependency: escape hatch is sufficient for dynamic renders. See the caching guide for details and known caveats.

  This work builds directly on prior art from the community. The cache_on API and the case for component-local caching come from #2126 by Reegan Viljoen. The approach of integrating with Rails' digest tree rather than reimplementing it comes from view_component-cache_digest by Godfrey Chan. The invalidation cases it's tested against were contributed by JWShuff and timburgan, drawing on view_component-fragment_caching by Patrick Arnett. The issue was opened and researched by ozzyaaron, pinzonjulian, and Derek Kniffin, and the digest workaround that surfaced the superclass gap came from cannikin and rnestler. Cache-key correctness issues (formats sharing an entry, positional nil collisions, conditional caching, and ignored cache_on blocks) were found and reported by Reegan Viljoen.

  Reegan Viljoen, Godfrey Chan, JWShuff, timburgan, Patrick Arnett, ozzyaaron, pinzonjulian, Derek Kniffin, cannikin, rnestler, Joel Hawksley

4.14.0

• Freeze ReusedInstanceError::MESSAGE and update test_renders_component_with_asset_url to build a fresh AssetComponent per render, fixing CI regressions introduced by the GHSA-8qw7-6phv-7q6p remediation.

  Joel Hawksley

• [Security] Fix incomplete remediation for CVE-2026-54497 (GHSA-8qw7-6phv-7q6p): reused ViewComponent instances could still leak with_content and renders_one/renders_many slot content from an earlier render into a later render because slot state and content set via with_content are populated by the caller before render_in runs and were not cleared by the previous per-render reset. Reinstate the ViewComponent::ReusedInstanceError guard that raises when a component instance is rendered more than once. Rebuild collection child components per render and dup collection spacer components before each render so that legitimate re-rendering of Collection/spacer objects continues to work.

  Yazan Balawneh, Cystack.ps

• Update GitHub Actions workflows to use actions/checkout v7.

  Richard Macklin

4.13.0

• Add support for Turbo-streaming ViewComponents.

  Ben Sheldon, Joel Hawksley

• Reduce allocations and avoid redundant compiler work when rendering components and collections.

  Joel Hawksley

... (truncated)

Commits

• e0f40c5 Merge pull request #2707 from ViewComponent/release-4-15-0
• 3258db0 release 4.15.0
• 0071477 Merge pull request #2685 from ViewComponent/experimentally-cacheable
• 1948a8e Rescue Errno::ENOENT in system-test entrypoint controller
• 6d92d61 Rewrite CHANGELOG em-dash clauses as separate sentence and parenthetical
• f1da3e3 Restore Microsoft.Dashes rule; unspace em-dashes in CHANGELOG
• 46d5b6c Disable Microsoft.Dashes; keep spaced em-dashes as house style
• 449bd26 Fix vale warnings on PR-added lines and make vale fail CI
• 510e36c Recompile components after modify_file to prevent test pollution
• f8f987c Merge branch 'main' into experimentally-cacheable
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)