actionview 7.2.3.1 → 8.1.4.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 61f8e3426843a85e006134bb5d330f91e09457e3392025afab472d470d706929
-  data.tar.gz: c066f5cc2718465d6f24a8c81ee5361c3c9fcbef2288a8d04b77334e9c724ad9
+  metadata.gz: 4ad9b7f3e9b8677cd772d696b4056bda5f44b3cb2074877698060d83eeb8f501
+  data.tar.gz: 6d484d054ced5d8990d0ae4b8134879eb192fea59540f8c6f1dd112ed946ec06
 SHA512:
-  metadata.gz: 0a9f2a3f39681a4687a4b8a42b10e00be43c0ee413037c9f236b3bbc04961c8d9993ee955bb0b940a5f05c0024c8f17abb3106d4420f0dea593dd020f038df55
-  data.tar.gz: b259ce7c6e668708a25ca4e61551bbe65aee7c898cf6c2da3ba0d2c40f64e6ccc5adc2067f817e95ac1f913edbb34b9e75ec4de89e058899c7644ecf4fbf5fb5
+  metadata.gz: 47f094fac7bbc29736cf46dcaa570b42d25cdee803cdd522ae81e37a8351f029991b82099a3d4b64c253ae396412e1f112feb509f2e941f4bf806bcab4a95272
+  data.tar.gz: 07ee062127ab3554407ea34d293611e347789e5cd65012340302b7a690e18b01ce6630d85483be9eb5e575869df10a3808891ebd98d14ceb674499acdf904594

data/CHANGELOG.md

@@ -1,209 +1,298 @@
-## Rails 7.2.3.1 (March 23, 2026) ##
+## Rails 8.1.4.1 (November 03, 2026) ##
 
-*   Skip blank attribute names in tag helpers to avoid generating invalid HTML.
+*   Skip attribute names in tag helpers that are blank once converted to a
+    string.
 
-    [CVE-2026-33168]
+    A Symbol such as `:" "` is not blank, because `Symbol#blank?` is
+    `Symbol#empty?`, so it reached the escaping step and produced an attribute
+    with no name. The asset helpers symbolize their keys, so an ordinary String
+    key reached the same place.
+
+    [GHSA-68p9-83h6-5wpj]
 
     *Mike Dalessio*
 
+*   Fix `strip_tags` to encode `"` and `'` in its output.
 
-## Rails 7.2.3 (October 28, 2025) ##
+    `strip_tags` returns an `html_safe` string, but was not encoding quotation
+    marks. The method now encodes all five HTML-significant characters (`&`,
+    `<`, `>`, `"`, `'`), consistent with the existing `html_safe` convention.
 
-*   Fix `javascript_include_tag` `type` option to accept either strings and symbols.
+    Output used outside HTML, such as in a text template or JSON, now contains
+    `&quot;` and `&#39;` where it contained `"` and `'`. `CGI.unescapeHTML`
+    decodes them.
 
-    ```ruby
-    javascript_include_tag "application", type: :module
-    javascript_include_tag "application", type: "module"
-    ```
+    [GHSA-rq8q-p985-fjq7]
 
-    Previously, only the string value was recoginized.
+    *Mike Dalessio*
 
-    *Jean Boussier*
+*   Escape the matched phrase before substituting it into `highlight`'s
+    `:highlighter`.
 
-*   Fix `excerpt` helper with non-whitespace separator.
+    A match was copied into each `\1` of the highlighter as it appeared in
+    the sanitized text, which keeps `"` and `'` as they are, so a match
+    containing a quote ended a quoted attribute value such as the
+    documented `'<a href="search?q=\1">\1</a>'` and added attributes of
+    its own. Each substituted group now goes through
+    `ERB::Util.html_escape_once`, so quotes in a match render as `&quot;`
+    and `&#39;`. Only the numbered placeholders `\0` to `\9` are expanded,
+    and a match never replaces the `>` that closes a tag.
 
-    *Jonathan Hefner*
+    [GHSA-v6rj-xm57-3p59]
 
-*   Respect `html_options[:form]` when `collection_checkboxes` generates the
-    hidden `<input>`.
+    *Jeremy Daer*
 
-    *Riccardo Odone*
+*   Require rails-html-sanitizer 1.7.2 or later.
 
-*   Layouts have access to local variables passed to `render`.
+    With the HTML5 sanitizer, Nokogiri before 1.19.5 left `<` and `>`
+    unescaped in attribute values. `highlight` and `simple_format`, which
+    edit the sanitized HTML as a string, could then turn markup inside an
+    attribute value into live elements. rails-html-sanitizer 1.7.2 requires
+    Loofah 2.25.3, which requires Nokogiri 1.19.5.
 
-    This fixes #31680 which was a regression in Rails 5.1.
+    [GHSA-2p2f-4rq4-gjwc]
 
     *Mike Dalessio*
 
-*   Argument errors related to strict locals in templates now raise an
-    `ActionView::StrictLocalsError`, and all other argument errors are reraised as-is.
+## Rails 8.1.4 (September 24, 2026) ##
 
-    Previously, any `ArgumentError` raised during template rendering was swallowed during strict
-    local error handling, so that an `ArgumentError` unrelated to strict locals (e.g., a helper
-    method invoked with incorrect arguments) would be replaced by a similar `ArgumentError` with an
-    unrelated backtrace, making it difficult to debug templates.
+*   Fix non-ASCII strict locals defaults rendering as mojibake.
 
-    Now, any `ArgumentError` unrelated to strict locals is reraised, preserving the original
-    backtrace for developers.
+    When a template declared a non-ASCII default in its `locals:` magic comment
+    and its body was ASCII-only, the handler returned ASCII-8BIT code and the
+    compiled method definition was retagged with it, corrupting the default.
 
-    Also note that `ActionView::StrictLocalsError` is a subclass of `ArgumentError`, so any existing
-    code that rescues `ArgumentError` will continue to work.
+    *Carlos Daniel Pohlod*
 
-    Fixes #52227.
+*   Fix the `:ruby` render tracker not being registered for ERB templates when
+    `eager_load` is enabled.
 
-    *Mike Dalessio*
+    *Gabriel Quaresma*
 
-*   Fix stack overflow error in dependency tracker when dealing with circular dependencies
+*   Fix `Encoding::CompatibilityError` when digesting templates with non-ASCII
+    content via `DependencyTracker::RubyTracker`.
 
-    *Jean Boussier*
+    File-backed templates are loaded as ASCII-8BIT. `RubyTracker` now passes
+    `template.encode!` to the handler (matching `Template#compiled_source`) so
+    handlers such as Haml/Temple can concatenate static UTF-8 strings without
+    raising. Fixes #58203.
 
-*   Fix a crash in ERB template error highlighting when the error occurs on a
-    line in the compiled template that is past the end of the source template.
+    *Edil Talantbek uulu*
 
-    *Martin Emde*
+*   Fix `week_field` to not emit invalid  week strings at ISO year boundaries.
 
-*   Improve reliability of ERB template error highlighting.
-    Fix infinite loops and crashes in highlighting and
-    improve tolerance for alternate ERB handlers.
+    *Kenta Ishizaki*
 
-    *Martin Emde*
+*   Fix `ActionView::TestCase#render` to reset `rendered`.
+    The behavior was changed when memoization was added in #51093. Now it once again conforms to the documentation.
 
+    *Jeroen Versteeg*
 
-## Rails 7.2.2.2 (August 13, 2025) ##
+*   Fix `FormBuilder#to_partial_path` returning `nil` for subclasses whose
+    name does not end in `Builder`.
 
-*   No changes.
+    *Kenta Ishizaki*
+
+*   Fix `collection_radio_buttons` and `collection_check_boxes` generating
+    a label `for` attribute that does not match the input `id` when a
+    collection value is `nil`.
+
+    *Kenta Ishizaki*
 
 
-## Rails 7.2.2.1 (December 10, 2024) ##
+## Rails 8.1.3.1 (July 29, 2026) ##
 
 *   No changes.
 
 
-## Rails 7.2.2 (October 30, 2024) ##
+## Rails 8.1.3 (March 24, 2026) ##
 
-*   No changes.
+*   Fix encoding errors for string locals containing non-ASCII characters.
 
+    *Kataoka Katsuki*
 
-## Rails 7.2.1.2 (October 23, 2024) ##
+*   Fix collection caching to only forward `expires_in` argument if explicitly set.
 
-*   No changes.
+    *Pieter Visser*
 
+## Rails 8.1.2.1 (March 23, 2026) ##
 
-## Rails 7.2.1.1 (October 15, 2024) ##
+*   Fix possible XSS in DebugExceptions middleware
 
-*   No changes.
+    [CVE-2026-33167]
 
+    *John Hawthorn*
 
-## Rails 7.2.1 (August 22, 2024) ##
+*   Skip blank attribute names in tag helpers to avoid generating invalid HTML.
 
-*   No changes.
+    [CVE-2026-33168]
+
+    *Mike Dalessio*
+
+
+## Rails 8.1.2 (January 08, 2026) ##
+
+*   Fix `file_field` to join mime types with a comma when provided as Array
+
+    ```ruby
+    file_field(:article, :image, accept: ['image/png', 'image/gif', 'image/jpeg'])
+    ```
+
+    Now behaves likes:
 
+    ```
+    file_field(:article, :image, accept: 'image/png,image/gif,image/jpeg')
+    ```
+
+    *Bogdan Gusiev*
+
+*   Fix strict locals parsing to handle multiline definitions.
+
+    *Said Kaldybaev*
+
+*   Fix `content_security_policy_nonce` error in mailers when using `content_security_policy_nonce_auto` setting.
 
-## Rails 7.2.0 (August 09, 2024) ##
+    The `content_security_policy_nonce helper` is provided by `ActionController::ContentSecurityPolicy`, and it relies on `request.content_security_policy_nonc`e. Mailers lack both the module and the request object.
 
-*   Fix templates with strict locals to also include `local_assigns`.
+    *Jarrett Lusso*
 
-    Previously templates defining strict locals wouldn't receive the `local_assigns`
-    hash.
 
-    *Jean Boussier*
+## Rails 8.1.1 (October 28, 2025) ##
 
-*   Add queries count to template rendering instrumentation.
+*   Respect `remove_hidden_field_autocomplete` config in form builder `hidden_field`.
 
+    *Rafael Mendonça França*
+
+
+## Rails 8.1.0 (October 22, 2025) ##
+
+*   The BEGIN template annotation/comment was previously printed on the same line as the following element. We now insert a newline inside the comment so it spans two lines without adding visible whitespace to the HTML output to enhance readability.
+
+    Before:
+    ```
+    <!-- BEGIN /Users/siaw23/Desktop/rails/actionview/test/fixtures/actionpack/test/greeting.html.erb --><p>This is grand!</p>
     ```
-    # Before
-    Completed 200 OK in 3804ms (Views: 41.0ms | ActiveRecord: 33.5ms | Allocations: 112788)
 
-    # After
-    Completed 200 OK in 3804ms (Views: 41.0ms | ActiveRecord: 33.5ms (2 queries, 1 cached) | Allocations: 112788)
+    After:
+    ```
+    <!-- BEGIN /Users/siaw23/Desktop/rails/actionview/test/fixtures/actionpack/test/greeting.html.erb
+    --><p>This is grand!</p>
     ```
+    *Emmanuel Hayford*
 
-    *fatkodima*
+*   Add structured events for Action View:
+    - `action_view.render_template`
+    - `action_view.render_partial`
+    - `action_view.render_layout`
+    - `action_view.render_collection`
+    - `action_view.render_start`
 
-*   Raise `ArgumentError` if `:renderable` object does not respond to `#render_in`.
+    *Gannon McGibbon*
 
-    *Sean Doyle*
+*   Fix label with `for` option not getting prefixed by form `namespace` value
 
-*   Add the `nonce: true` option for `stylesheet_link_tag` helper to support automatic nonce generation for Content Security Policy.
+    *Abeid Ahmed*, *Hartley McGuire*
 
-    Works the same way as `javascript_include_tag nonce: true` does.
+*   Add `fetchpriority` to Link headers to match HTML generated by `preload_link_tag`.
 
-    *Akhil G Krishnan*, *AJ Esler*
+    *Guillermo Iguaran*
 
-*   Parse `ActionView::TestCase#rendered` HTML content as `Nokogiri::XML::DocumentFragment` instead of `Nokogiri::XML::Document`.
+*   Add CSP `nonce` to Link headers generated by `preload_link_tag`.
 
-    *Sean Doyle*
+    *Alexander Gitter*
 
-*   Rename `ActionView::TestCase::Behavior::Content` to `ActionView::TestCase::Behavior::RenderedViewContent`.
+*   Allow `current_page?` to match against specific HTTP method(s) with a `method:` option.
 
-    Make `RenderedViewContent` inherit from `String`. Make private API with `:nodoc:`
+    *Ben Sheldon*
 
-    *Sean Doyle*
+*   Remove `autocomplete="off"` on hidden inputs generated by the following
+    tags:
 
-*   Deprecate passing `nil` as value for the `model:` argument to the `form_with` method.
+    * `form_tag`, `token_tag`, `method_tag`
 
-    *Collin Jilbert*
+    As well as the hidden parameter fields included in `button_to`,
+    `check_box`, `select` (with `multiple`) and `file_field` forms.
 
-*   Alias `field_set_tag` helper to `fieldset_tag` to match `<fieldset>` element.
+    *nkulway*
 
-    *Sean Doyle*
+*   Enable configuring the strategy for tracking dependencies between Action
+    View templates.
 
-*   Deprecate passing content to void elements when using `tag.br` type tag builders.
+    The existing `:regex` strategy is kept as the default, but with
+    `load_defaults 8.1` the strategy will be `:ruby` (using a real Ruby parser).
 
     *Hartley McGuire*
 
-*   Fix the `number_to_human_size` view helper to correctly work with negative numbers.
+*   Introduce `relative_time_in_words` helper
 
-    *Earlopain*
+    ```ruby
+    relative_time_in_words(3.minutes.from_now) # => "in 3 minutes"
+    relative_time_in_words(3.minutes.ago) # => "3 minutes ago"
+    relative_time_in_words(10.seconds.ago, include_seconds: true) # => "less than 10 seconds ago"
+    ```
+
+    *Matheus Richard*
+
+*   Make `nonce: false` remove the nonce attribute from `javascript_tag`, `javascript_include_tag`, and `stylesheet_link_tag`.
+
+    *francktrouillez*
+
+*   Add `dom_target` helper to create `dom_id`-like strings from an unlimited
+    number of objects.
 
-*   Automatically discard the implicit locals injected by collection rendering for template that can't accept them.
+    *Ben Sheldon*
 
-    When rendering a collection, two implicit variables are injected, which breaks templates with strict locals.
+*   Respect `html_options[:form]` when `collection_checkboxes` generates the
+    hidden `<input>`.
+
+    *Riccardo Odone*
+
+*   Layouts have access to local variables passed to `render`.
 
-    Now they are only passed if the template will actually accept them.
+    This fixes #31680 which was a regression in Rails 5.1.
 
-    *Yasha Krasnou*, *Jean Boussier*
+    *Mike Dalessio*
 
-*   Fix `@rails/ujs` calling `start()` an extra time when using bundlers.
+*   Argument errors related to strict locals in templates now raise an
+    `ActionView::StrictLocalsError`, and all other argument errors are reraised as-is.
 
-    *Hartley McGuire*, *Ryunosuke Sato*
+    Previously, any `ArgumentError` raised during template rendering was swallowed during strict
+    local error handling, so that an `ArgumentError` unrelated to strict locals (e.g., a helper
+    method invoked with incorrect arguments) would be replaced by a similar `ArgumentError` with an
+    unrelated backtrace, making it difficult to debug templates.
 
-*   Fix the `capture` view helper compatibility with HAML and Slim.
+    Now, any `ArgumentError` unrelated to strict locals is reraised, preserving the original
+    backtrace for developers.
 
-    When a blank string was captured in HAML or Slim (and possibly other template engines)
-    it would instead return the entire buffer.
+    Also note that `ActionView::StrictLocalsError` is a subclass of `ArgumentError`, so any existing
+    code that rescues `ArgumentError` will continue to work.
 
-    *Jean Boussier*
+    Fixes #52227.
 
-*   Updated `@rails/ujs` files to ignore certain data-* attributes when element is contenteditable.
+    *Mike Dalessio*
 
-    This fix was already landed in >= 7.0.4.3, < 7.1.0.
-    [[CVE-2023-23913](https://github.com/advisories/GHSA-xp5h-f8jf-rc8q)]
+*   Improve error highlighting of multi-line methods in ERB templates or
+    templates where the error occurs within a do-end block.
 
-    *Ryunosuke Sato*
+    *Martin Emde*
 
-*   Added validation for HTML tag names in the `tag` and `content_tag` helper method.
+*   Fix a crash in ERB template error highlighting when the error occurs on a
+    line in the compiled template that is past the end of the source template.
 
-    The `tag` and `content_tag` method now checks that the provided tag name adheres to the HTML
-    specification. If an invalid HTML tag name is provided, the method raises an `ArgumentError`
-    with an appropriate error message.
+    *Martin Emde*
 
-    Examples:
+*   Improve reliability of ERB template error highlighting.
+    Fix infinite loops and crashes in highlighting and
+    improve tolerance for alternate ERB handlers.
 
-    ```ruby
-    # Raises ArgumentError: Invalid HTML5 tag name: 12p
-    content_tag("12p") # Starting with a number
+    *Martin Emde*
 
-    # Raises ArgumentError: Invalid HTML5 tag name: ""
-    content_tag("") # Empty tag name
+*   Allow `hidden_field` and `hidden_field_tag` to accept a custom autocomplete value.
 
-    # Raises ArgumentError: Invalid HTML5 tag name: div/
-    tag("div/") # Contains a solidus
+    *brendon*
 
-    # Raises ArgumentError: Invalid HTML5 tag name: "image file"
-    tag("image file") # Contains a space
-    ```
+*   Add a new configuration `content_security_policy_nonce_auto` for automatically adding a nonce to the tags affected by the directives specified by the `content_security_policy_nonce_directives` configuration option.
 
-    *Akhil G Krishnan*
+    *francktrouillez*
 
-Please check [7-1-stable](https://github.com/rails/rails/blob/7-1-stable/actionview/CHANGELOG.md) for previous changes.
+Please check [8-0-stable](https://github.com/rails/rails/blob/8-0-stable/actionview/CHANGELOG.md) for previous changes.

data/lib/action_view/base.rb

@@ -4,6 +4,7 @@ require "active_support/core_ext/module/attr_internal"
 require "active_support/core_ext/module/attribute_accessors"
 require "active_support/ordered_options"
 require "action_view/log_subscriber"
+require "action_view/structured_event_subscriber"
 require "action_view/helpers"
 require "action_view/context"
 require "action_view/template"
@@ -181,6 +182,10 @@ module ActionView # :nodoc:
     class_attribute :_routes
     class_attribute :logger
 
+    # Specify whether to omit autocomplete="off" on hidden inputs generated by helpers.
+    # Configured via `config.action_view.remove_hidden_field_autocomplete`
+    cattr_accessor :remove_hidden_field_autocomplete, default: false
+
     class << self
       delegate :erb_trim_mode=, to: "ActionView::Template::Handlers::ERB"
 
@@ -242,8 +247,6 @@ module ActionView # :nodoc:
     # :startdoc:
 
     def initialize(lookup_context, assigns, controller) # :nodoc:
-      @_config = ActiveSupport::InheritableOptions.new
-
       @lookup_context = lookup_context
 
       @view_renderer = ActionView::Renderer.new @lookup_context

data/lib/action_view/buffers.rb

@@ -45,7 +45,7 @@ module ActionView
         @raw_buffer << if value.html_safe?
           value
         else
-          CGI.escapeHTML(value)
+          ERB::Util.unwrapped_html_escape(value)
         end
       end
       self

data/lib/action_view/dependency_tracker/erb_tracker.rb

@@ -74,7 +74,7 @@ module ActionView
       end
 
       def dependencies
-        render_dependencies + explicit_dependencies
+        WildcardResolver.new(@view_paths, render_dependencies + explicit_dependencies).resolve
       end
 
       attr_reader :name, :template
@@ -90,15 +90,15 @@ module ActionView
         end
 
         def render_dependencies
-          render_dependencies = []
-          render_calls = source.split(/\brender\b/).drop(1)
+          dependencies = []
+          render_calls = source.scan(/<%(?:(?:(?!<%).)*?\brender\b((?:(?!%>).)*?))%>/m).flatten
 
           render_calls.each do |arguments|
-            add_dependencies(render_dependencies, arguments, LAYOUT_DEPENDENCY)
-            add_dependencies(render_dependencies, arguments, RENDER_ARGUMENTS)
+            add_dependencies(dependencies, arguments, LAYOUT_DEPENDENCY)
+            add_dependencies(dependencies, arguments, RENDER_ARGUMENTS)
           end
 
-          render_dependencies.uniq
+          dependencies
         end
 
         def add_dependencies(render_dependencies, arguments, pattern)
@@ -116,12 +116,37 @@ module ActionView
         end
 
         def add_static_dependency(dependencies, dependency, quote_type)
-          if quote_type == '"'
-            # Ignore if there is interpolation
-            return if dependency.include?('#{')
-          end
+          if quote_type == '"' && dependency.include?('#{')
+            scanner = StringScanner.new(dependency)
+
+            wildcard_dependency = +""
+
+            while !scanner.eos?
+              if scanner.scan_until(/\#{/)
+                unmatched_brackets = 1
+                wildcard_dependency << scanner.pre_match
+
+                while unmatched_brackets > 0 && !scanner.eos?
+                  found = scanner.scan_until(/[{}]/)
+                  return unless found
+
+                  case scanner.matched
+                  when "{"
+                    unmatched_brackets += 1
+                  when "}"
+                    unmatched_brackets -= 1
+                  end
+                end
+
+                wildcard_dependency << "*"
+              else
+                wildcard_dependency << scanner.rest
+                scanner.terminate
+              end
+            end
 
-          if dependency
+            dependencies << wildcard_dependency
+          elsif dependency
             if dependency.include?("/")
               dependencies << dependency
             else
@@ -130,24 +155,8 @@ module ActionView
           end
         end
 
-        def resolve_directories(wildcard_dependencies)
-          return [] unless @view_paths
-          return [] if wildcard_dependencies.empty?
-
-          # Remove trailing "/*"
-          prefixes = wildcard_dependencies.map { |query| query[0..-3] }
-
-          @view_paths.flat_map(&:all_template_paths).uniq.filter_map { |path|
-            path.to_s if prefixes.include?(path.prefix)
-          }.sort
-        end
-
         def explicit_dependencies
-          dependencies = source.scan(EXPLICIT_DEPENDENCY).flatten.uniq
-
-          wildcards, explicits = dependencies.partition { |dependency| dependency.end_with?("/*") }
-
-          (explicits + resolve_directories(wildcards)).uniq
+          source.scan(EXPLICIT_DEPENDENCY).flatten.uniq
         end
     end
   end

data/lib/action_view/dependency_tracker/ruby_tracker.rb

@@ -10,7 +10,7 @@ module ActionView
       end
 
       def dependencies
-        render_dependencies + explicit_dependencies
+        WildcardResolver.new(view_paths, render_dependencies + explicit_dependencies).resolve
       end
 
       def self.supports_view_paths? # :nodoc:
@@ -28,32 +28,15 @@ module ActionView
         def render_dependencies
           return [] unless template.source.include?("render")
 
-          compiled_source = template.handler.call(template, template.source)
+          compiled_source = template.handler.call(template, template.encode!)
 
           @parser_class.new(@name, compiled_source).render_calls.filter_map do |render_call|
-            next if render_call.end_with?("/_")
             render_call.gsub(%r|/_|, "/")
           end
         end
 
         def explicit_dependencies
-          dependencies = template.source.scan(EXPLICIT_DEPENDENCY).flatten.uniq
-
-          wildcards, explicits = dependencies.partition { |dependency| dependency.end_with?("/*") }
-
-          (explicits + resolve_directories(wildcards)).uniq
-        end
-
-        def resolve_directories(wildcard_dependencies)
-          return [] unless view_paths
-          return [] if wildcard_dependencies.empty?
-
-          # Remove trailing "/*"
-          prefixes = wildcard_dependencies.map { |query| query[0..-3] }
-
-          view_paths.flat_map(&:all_template_paths).uniq.filter_map { |path|
-            path.to_s if prefixes.include?(path.prefix)
-          }.sort
+          template.source.scan(EXPLICIT_DEPENDENCY).flatten.uniq
         end
     end
   end

data/lib/action_view/dependency_tracker/wildcard_resolver.rb

@@ -0,0 +1,32 @@
+# frozen_string_literal: true
+
+module ActionView
+  class DependencyTracker # :nodoc:
+    class WildcardResolver # :nodoc:
+      def initialize(view_paths, dependencies)
+        @view_paths = view_paths
+
+        @wildcard_dependencies, @explicit_dependencies =
+          dependencies.partition { |dependency| dependency.end_with?("/*") }
+      end
+
+      def resolve
+        return explicit_dependencies.uniq if !view_paths || wildcard_dependencies.empty?
+
+        (explicit_dependencies + resolved_wildcard_dependencies).uniq
+      end
+
+      private
+        attr_reader :explicit_dependencies, :wildcard_dependencies, :view_paths
+
+        def resolved_wildcard_dependencies
+          # Remove trailing "/*"
+          prefixes = wildcard_dependencies.map { |query| query[0..-3] }
+
+          view_paths.flat_map(&:all_template_paths).uniq.filter_map { |path|
+            path.to_s if prefixes.include?(path.prefix)
+          }.sort
+        end
+    end
+  end
+end

data/lib/action_view/dependency_tracker.rb

@@ -10,6 +10,7 @@ module ActionView
 
     autoload :ERBTracker
     autoload :RubyTracker
+    autoload :WildcardResolver
 
     @trackers = Concurrent::Map.new
 
@@ -35,6 +36,11 @@ module ActionView
       @trackers.delete(handler)
     end
 
-    register_tracker :erb, ERBTracker
+    case ActionView.render_tracker
+    when :ruby
+      register_tracker :erb, RubyTracker
+    else
+      register_tracker :erb, ERBTracker
+    end
   end
 end