Merge pull request #2697 from ViewComponent/release-4-14-0

Release 4.14.0

Author: joelhawksley

Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    view_component (4.13.0)
+    view_component (4.14.0)
       actionview (>= 7.1.0)
       activesupport (>= 7.1.0)
       concurrent-ruby (~> 1)
@@ -644,7 +644,7 @@ CHECKSUMS
   unicode-emoji (4.2.0) sha256=519e69150f75652e40bf736106cfbc8f0f73aa3fb6a65afe62fefa7f80b0f80f
   uri (1.1.1) sha256=379fa58d27ffb1387eaada68c749d1426738bd0f654d812fcc07e7568f5c57c6
   useragent (0.16.11) sha256=700e6413ad4bb954bb63547fa098dddf7b0ebe75b40cc6f93b8d54255b173844
-  view_component (4.13.0)
+  view_component (4.14.0)
   warning (1.6.0) sha256=a49cdfae19fb77d19afff2efbe45f8ab759e9cd25b4e4ce2c79dbaf46bdb6c9e
   webrick (1.9.2) sha256=beb4a15fc474defed24a3bda4ffd88a490d517c9e4e6118c3edce59e45864131
   websocket (1.2.11) sha256=b7e7a74e2410b5e85c25858b26b3322f29161e300935f70a0e0d3c35e0462737

docs/CHANGELOG.md

@@ -10,6 +10,8 @@ nav_order: 6
 
 ## main
 
+## 4.14.0
+
 * Freeze `ReusedInstanceError::MESSAGE` and update `test_renders_component_with_asset_url` to build a fresh `AssetComponent` per render, fixing CI regressions introduced by the GHSA-8qw7-6phv-7q6p remediation.
 
     *Joel Hawksley*

docs/_data/contributors.yml

@@ -1,23 +1,29 @@
 ---
 usernames:
+- 23tux
 - adillari
 - adrianthedev
 - aduth
 - agrobbin
-- allan-pires
 - allmarkedup
 - alvincrespo
 - amhol
 - andrewjtait
 - andrewmcodes
 - andreyazimov
+- andypple83
+- andyw8
+- armstrjare
+- aronmoshe-m
+- artinboghosian
 - asgerb
 - avinoth
 - ayushn21
 - bankair
 - baygeldin
 - bdewater
 - being-frank
+- bensheldon
 - berniechiu
 - betogrun
 - bigbigdoudou
@@ -43,6 +49,7 @@ usernames:
 - claudiob
 - cllns
 - compostbrain
+- copilot
 - cover
 - crookedgrin
 - cyupa
@@ -59,6 +66,7 @@ usernames:
 - dixpac
 - dkniffin
 - dlinch
+- dmrwebdev
 - donapieppo
 - dpaola2
 - drbragg
@@ -84,11 +92,13 @@ usernames:
 - fugufish
 - fwolfst
 - g13ydson
+- george-bit
 - github-actions[bot]
 - gonzric1
 - grekko
 - guillaumebriday
 - hachi8833
+- hakanensari
 - halo
 - henrikbjorn
 - hirurg103
@@ -99,6 +109,8 @@ usernames:
 - htcarr3
 - igor-drozdov
 - ihollander
+- j127
+- jackozi
 - jacob-carlborg-apoex
 - janklimo
 - jaredcwhite
@@ -108,6 +120,7 @@ usernames:
 - jcoyne
 - jdelstrother
 - jdennes
+- jell
 - jess
 - joelhawksley
 - jogetblock
@@ -118,6 +131,8 @@ usernames:
 - joshmgross
 - joshuaclayton
 - jpbalarini
+- jrochkind
+- jsolas
 - juanmanuelramallo
 - jwshuff
 - jyunderwood
@@ -130,6 +145,7 @@ usernames:
 - kenyonj
 - khiga8
 - konnorrogers
+- koppen
 - krazylegz
 - kulturbande
 - kylefox
@@ -138,14 +154,16 @@ usernames:
 - leighhalliday
 - lfalcao
 - llenk
+- lucasgeron
 - luccastera
+- luizkowalski
 - lxxxvi
 - lyams
 - mamhoff
 - manuelpuyol
 - marckohlbrugge
 - marcoroth
-- matheuspolicamilo
+- matheus-poli
 - matheusrich
 - matt-yorkley
 - mattbearman
@@ -156,19 +174,18 @@ usernames:
 - mbuckley
 - mec
 - meganemura
-- mellowfish
 - meneerprins
 - metade
 - mhw
 - michaelem
 - mikemcquaid
 - mikepmunroe
+- mikz
 - milk1000cc
-- mitchellhenke
 - mixergtz
 - mkanakana
 - mkdynamic
-- moekiorg
+- moeki0
 - mrjonesbot
 - mrloop
 - mrrooijen
@@ -216,10 +233,11 @@ usernames:
 - richardmarbach
 - rickychilcott
 - rmacklin
+- robrieba
 - romaricpascal
+- rordevelopernik
 - rubensmit
 - rylanb
-- ryogift
 - sahglie
 - salazarjosh
 - sammyhenningsson
@@ -232,6 +250,7 @@ usernames:
 - skryukov
 - smashwilson
 - sn3p
+- snepote
 - spdawson
 - spone
 - srt32
@@ -240,20 +259,24 @@ usernames:
 - sunny
 - svetlins
 - swanson
+- talentohq
 - talltorp
 - talum
 - tastypi
 - tclem
 - tdak
 - tgaff
+- thewatts
 - thomascchen
 - thutterer
 - tkowalewski
 - tmaier
 - tmbv93
 - tmecklem
+- tom-lord
 - tomasc
 - tonkpils
+- torgilz
 - traels
 - triskweline
 - tysongach

docs/_data/library.yml

@@ -1 +1 @@
-version: 4.13.0
+version: 4.14.0

docs/api.md

@@ -551,6 +551,14 @@ COMPONENT declares a slot named SLOT_NAME, which is a reserved word in the ViewC
 
 To fix this issue, choose a different name.
 
+### `ReusedInstanceError`
+
+ViewComponent instances are single-use; a COMPONENT instance was rendered more than once.
+
+Reusing a component instance across renders can leak request-scoped state (controller, helpers, request, view_flow, slot content, `with_content`) from an earlier render into a later one, which has security and correctness implications (GHSA-8qw7-6phv-7q6p).
+
+To fix this issue, create a new component instance per render.
+
 ### `SlotPredicateNameError`
 
 COMPONENT declares a slot named SLOT_NAME, which ends with a question mark.

gemfiles/rails_7.1.gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: ..
   specs:
-    view_component (4.13.0)
+    view_component (4.14.0)
       actionview (>= 7.1.0)
       activesupport (>= 7.1.0)
       concurrent-ruby (~> 1)

gemfiles/rails_7.2.gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: ..
   specs:
-    view_component (4.13.0)
+    view_component (4.14.0)
       actionview (>= 7.1.0)
       activesupport (>= 7.1.0)
       concurrent-ruby (~> 1)

gemfiles/rails_8.0.gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: ..
   specs:
-    view_component (4.13.0)
+    view_component (4.14.0)
       actionview (>= 7.1.0)
       activesupport (>= 7.1.0)
       concurrent-ruby (~> 1)

gemfiles/rails_8.1.gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: ..
   specs:
-    view_component (4.13.0)
+    view_component (4.14.0)
       actionview (>= 7.1.0)
       activesupport (>= 7.1.0)
       concurrent-ruby (~> 1)

gemfiles/rails_main.gemfile.lock

@@ -110,7 +110,7 @@ GIT
 PATH
   remote: ..
   specs:
-    view_component (4.13.0)
+    view_component (4.14.0)
       actionview (>= 7.1.0)
       activesupport (>= 7.1.0)
       concurrent-ruby (~> 1)
@@ -641,7 +641,7 @@ CHECKSUMS
   unicode-emoji (4.2.0) sha256=519e69150f75652e40bf736106cfbc8f0f73aa3fb6a65afe62fefa7f80b0f80f
   uri (1.1.1) sha256=379fa58d27ffb1387eaada68c749d1426738bd0f654d812fcc07e7568f5c57c6
   useragent (0.16.11) sha256=700e6413ad4bb954bb63547fa098dddf7b0ebe75b40cc6f93b8d54255b173844
-  view_component (4.13.0)
+  view_component (4.14.0)
   warning (1.6.0) sha256=a49cdfae19fb77d19afff2efbe45f8ab759e9cd25b4e4ce2c79dbaf46bdb6c9e
   webrick (1.9.2) sha256=beb4a15fc474defed24a3bda4ffd88a490d517c9e4e6118c3edce59e45864131
   websocket (1.2.11) sha256=b7e7a74e2410b5e85c25858b26b3322f29161e300935f70a0e0d3c35e0462737