@@ -4,6 +4,7 @@ on:
   push:
     branches:
       - main
+  workflow_dispatch:
 
 permissions:
   contents: read
@@ -16,18 +17,26 @@ jobs:
     permissions:
       contents: write
       pull-requests: read
-    # Only run if this is a release commit (created by script/release)
-    if: startsWith(github.event.head_commit.message, 'release ')
+    # Only run if this is a release commit created by script/release.
+    # Match either the direct commit message from script/release
+    # ("release X.Y.Z") or the merge-commit body containing the release
+    # PR title ("Release X.Y.Z"), so a normal PR merge still triggers.
+    # Also always run on manual workflow_dispatch.
+    if: |
+      github.event_name == 'workflow_dispatch' ||
+      startsWith(github.event.head_commit.message, 'release ') ||
+      contains(github.event.head_commit.message, 'Release ')
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           fetch-depth: 0
           token: ${{ secrets.GITHUB_TOKEN }}
-          persist-credentials: false
+          persist-credentials: true
 
       - name: Set up Ruby
         uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b
         with:
+          ruby-version: 4.0
           bundler-cache: true
 
       - name: Harden runner
 
@@ -4,6 +4,7 @@ on:
   push:
     tags:
       - v*
+  workflow_dispatch:
 
 permissions:
   contents: read
 
@@ -109,11 +109,12 @@ jobs:
         with:
           fetch-depth: 0
           token: ${{ secrets.GITHUB_TOKEN }}
-          persist-credentials: false
+          persist-credentials: true
 
       - name: Set up Ruby
         uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b
         with:
+          ruby-version: 4.0
           bundler-cache: true
 
       - name: Configure git
 
@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    view_component (4.13.0)
+    view_component (4.14.0)
       actionview (>= 7.1.0)
       activesupport (>= 7.1.0)
       concurrent-ruby (~> 1)
@@ -644,7 +644,7 @@ CHECKSUMS
   unicode-emoji (4.2.0) sha256=519e69150f75652e40bf736106cfbc8f0f73aa3fb6a65afe62fefa7f80b0f80f
   uri (1.1.1) sha256=379fa58d27ffb1387eaada68c749d1426738bd0f654d812fcc07e7568f5c57c6
   useragent (0.16.11) sha256=700e6413ad4bb954bb63547fa098dddf7b0ebe75b40cc6f93b8d54255b173844
-  view_component (4.13.0)
+  view_component (4.14.0)
   warning (1.6.0) sha256=a49cdfae19fb77d19afff2efbe45f8ab759e9cd25b4e4ce2c79dbaf46bdb6c9e
   webrick (1.9.2) sha256=beb4a15fc474defed24a3bda4ffd88a490d517c9e4e6118c3edce59e45864131
   websocket (1.2.11) sha256=b7e7a74e2410b5e85c25858b26b3322f29161e300935f70a0e0d3c35e0462737
 
@@ -34,6 +34,16 @@ nav_order: 6
 
     *Reegan Viljoen*, *Godfrey Chan*, *JWShuff*, *timburgan*, *Patrick Arnett*, *ozzyaaron*, *pinzonjulian*, *Derek Kniffin*, *cannikin*, *rnestler*, *Joel Hawksley*
 
+## 4.14.0
+
+* Freeze `ReusedInstanceError::MESSAGE` and update `test_renders_component_with_asset_url` to build a fresh `AssetComponent` per render, fixing CI regressions introduced by the GHSA-8qw7-6phv-7q6p remediation.
+
+    *Joel Hawksley*
+
+* [Security] Fix incomplete remediation for CVE-2026-54497 (GHSA-8qw7-6phv-7q6p): reused ViewComponent instances could still leak `with_content` and `renders_one`/`renders_many` slot content from an earlier render into a later render because slot state and content set via `with_content` are populated by the caller before `render_in` runs and were not cleared by the previous per-render reset. Reinstate the `ViewComponent::ReusedInstanceError` guard that raises when a component instance is rendered more than once. Rebuild collection child components per render and dup collection spacer components before each render so that legitimate re-rendering of `Collection`/spacer objects continues to work.
+
+    *Yazan Balawneh, Cystack.ps*
+
 * Update GitHub Actions workflows to use `actions/checkout` v7.
 
     *Richard Macklin*
 
@@ -1,23 +1,29 @@
 ---
 usernames:
+- 23tux
 - adillari
 - adrianthedev
 - aduth
 - agrobbin
-- allan-pires
 - allmarkedup
 - alvincrespo
 - amhol
 - andrewjtait
 - andrewmcodes
 - andreyazimov
+- andypple83
+- andyw8
+- armstrjare
+- aronmoshe-m
+- artinboghosian
 - asgerb
 - avinoth
 - ayushn21
 - bankair
 - baygeldin
 - bdewater
 - being-frank
+- bensheldon
 - berniechiu
 - betogrun
 - bigbigdoudou
@@ -43,6 +49,7 @@ usernames:
 - claudiob
 - cllns
 - compostbrain
+- copilot
 - cover
 - crookedgrin
 - cyupa
@@ -59,6 +66,7 @@ usernames:
 - dixpac
 - dkniffin
 - dlinch
+- dmrwebdev
 - donapieppo
 - dpaola2
 - drbragg
@@ -84,11 +92,13 @@ usernames:
 - fugufish
 - fwolfst
 - g13ydson
+- george-bit
 - github-actions[bot]
 - gonzric1
 - grekko
 - guillaumebriday
 - hachi8833
+- hakanensari
 - halo
 - henrikbjorn
 - hirurg103
@@ -99,6 +109,8 @@ usernames:
 - htcarr3
 - igor-drozdov
 - ihollander
+- j127
+- jackozi
 - jacob-carlborg-apoex
 - janklimo
 - jaredcwhite
@@ -108,6 +120,7 @@ usernames:
 - jcoyne
 - jdelstrother
 - jdennes
+- jell
 - jess
 - joelhawksley
 - jogetblock
@@ -118,6 +131,8 @@ usernames:
 - joshmgross
 - joshuaclayton
 - jpbalarini
+- jrochkind
+- jsolas
 - juanmanuelramallo
 - jwshuff
 - jyunderwood
@@ -130,6 +145,7 @@ usernames:
 - kenyonj
 - khiga8
 - konnorrogers
+- koppen
 - krazylegz
 - kulturbande
 - kylefox
@@ -138,14 +154,16 @@ usernames:
 - leighhalliday
 - lfalcao
 - llenk
+- lucasgeron
 - luccastera
+- luizkowalski
 - lxxxvi
 - lyams
 - mamhoff
 - manuelpuyol
 - marckohlbrugge
 - marcoroth
-- matheuspolicamilo
+- matheus-poli
 - matheusrich
 - matt-yorkley
 - mattbearman
@@ -156,19 +174,18 @@ usernames:
 - mbuckley
 - mec
 - meganemura
-- mellowfish
 - meneerprins
 - metade
 - mhw
 - michaelem
 - mikemcquaid
 - mikepmunroe
+- mikz
 - milk1000cc
-- mitchellhenke
 - mixergtz
 - mkanakana
 - mkdynamic
-- moekiorg
+- moeki0
 - mrjonesbot
 - mrloop
 - mrrooijen
@@ -216,10 +233,11 @@ usernames:
 - richardmarbach
 - rickychilcott
 - rmacklin
+- robrieba
 - romaricpascal
+- rordevelopernik
 - rubensmit
 - rylanb
-- ryogift
 - sahglie
 - salazarjosh
 - sammyhenningsson
@@ -232,6 +250,7 @@ usernames:
 - skryukov
 - smashwilson
 - sn3p
+- snepote
 - spdawson
 - spone
 - srt32
@@ -240,20 +259,24 @@ usernames:
 - sunny
 - svetlins
 - swanson
+- talentohq
 - talltorp
 - talum
 - tastypi
 - tclem
 - tdak
 - tgaff
+- thewatts
 - thomascchen
 - thutterer
 - tkowalewski
 - tmaier
 - tmbv93
 - tmecklem
+- tom-lord
 - tomasc
 - tonkpils
+- torgilz
 - traels
 - triskweline
 - tysongach
 
@@ -1 +1 @@
-version: 4.13.0
+version: 4.14.0
@@ -565,6 +565,14 @@ COMPONENT declares a slot named SLOT_NAME, which is a reserved word in the ViewC
 
 To fix this issue, choose a different name.
 
+### `ReusedInstanceError`
+
+ViewComponent instances are single-use; a COMPONENT instance was rendered more than once.
+
+Reusing a component instance across renders can leak request-scoped state (controller, helpers, request, view_flow, slot content, `with_content`) from an earlier render into a later one, which has security and correctness implications (GHSA-8qw7-6phv-7q6p).
+
+To fix this issue, create a new component instance per render.
+
 ### `SlotPredicateNameError`
 
 COMPONENT declares a slot named SLOT_NAME, which ends with a question mark.
 
@@ -14,6 +14,7 @@ _Is this page missing a link? Open a PR!_
 - [GOV.UK Rails Components](https://govuk-components.x-govuk.org/)
 - [Polaris ViewComponents](https://github.com/baoagency/polaris_view_components)
 - [Rails Designer](https://railsdesigner.com/)
+- [Flowbite Components](https://flowbite-components.substancelab.com)
 
 ## Frameworks using ViewComponent
 
 
@@ -1,7 +1,7 @@
 PATH
   remote: ..
   specs:
-    view_component (4.13.0)
+    view_component (4.14.0)
       actionview (>= 7.1.0)
       activesupport (>= 7.1.0)
       concurrent-ruby (~> 1)