From 9b66d88c9b678d779a6cf3a850d5e3f756391286 Mon Sep 17 00:00:00 2001 From: Joel Hawksley Date: Mon, 24 Aug 2026 14:53:56 -0600 Subject: [PATCH] release 3.27.0 --- Gemfile.lock | 2 +- docs/CHANGELOG.md | 2 ++ docs/_data/library.yml | 2 +- lib/view_component/version.rb | 2 +- 4 files changed, 5 insertions(+), 3 deletions(-) diff --git a/Gemfile.lock b/Gemfile.lock index 80952f333..5f2bebd78 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -1,7 +1,7 @@ PATH remote: . specs: - view_component (3.26.0) + view_component (3.27.0) activesupport (>= 5.2.0, < 8.2) concurrent-ruby (~> 1) method_source (~> 1.0) diff --git a/docs/CHANGELOG.md b/docs/CHANGELOG.md index 0c0049e46..ada1107f8 100644 --- a/docs/CHANGELOG.md +++ b/docs/CHANGELOG.md @@ -10,6 +10,8 @@ nav_order: 6 ## main +## 3.27.0 + * [Security] Fix incomplete remediation for CVE-2026-54497 (GHSA-8qw7-6phv-7q6p): reused ViewComponent instances could still leak `with_content` and `renders_one`/`renders_many` slot content from an earlier render into a later render because slot state and content set via `with_content` are populated by the caller before `render_in` runs and were not cleared by the previous per-render reset. Reinstate the `ViewComponent::ReusedInstanceError` guard that raises when a component instance is rendered more than once. Rebuild collection child components per render and dup collection spacer components before each render so that legitimate re-rendering of `Collection`/spacer objects continues to work. *Yazan Balawneh, Cystack.ps* diff --git a/docs/_data/library.yml b/docs/_data/library.yml index a8376d491..8391e35e4 100644 --- a/docs/_data/library.yml +++ b/docs/_data/library.yml @@ -1 +1 @@ -version: 3.26.0 +version: 3.27.0 diff --git a/lib/view_component/version.rb b/lib/view_component/version.rb index 349cd3281..377ab22c6 100644 --- a/lib/view_component/version.rb +++ b/lib/view_component/version.rb @@ -3,7 +3,7 @@ module ViewComponent module VERSION MAJOR = 3 - MINOR = 26 + MINOR = 27 PATCH = 0 PRE = nil