lean_cms 0.2.12 → 0.2.14

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: cf29b9988643df801321311e1154d6f553ad2919ecede28dec23027a8ef57a96
-  data.tar.gz: fea9f113f47e67371e5f97a97bbe80342ed0206bd5512befc629e12067079f2f
+  metadata.gz: 2c3bd4652704809211640b7ae93d01adeea6aed91b100fcdd3130de31c64f88f
+  data.tar.gz: 20ea98a3f29b8f6946fe733e57c36613d13a5620ea879d32657011a84484fdb2
 SHA512:
-  metadata.gz: 54d383a8799e2391a5f7ac84d1a3aa07ac332798a7394866ce98b5cab46c11614d7fc5be719aa9cba5e33e18fdcb04693e0ea73aba9d3a36f555c2e03e2fe0f7
-  data.tar.gz: 230440bd456f36ab053e8855968ef6f189eec98b04b0cd75aab11aeec902b8c4c710c064a3f937063ea7637ea1593738deaac2ba41cf87997d1b3eed9faa978d
+  metadata.gz: 5cd6ee260ad53ac9dc842641e52c79d0db0ddba7b8ed852514526aaa21c9d55724e501a3be35af5bac4c5bd21a5d3d0f3e7f4db90dcf165184f38f83f250a317
+  data.tar.gz: c9bcdf31ccfea9b99d1a57af5a71a502b40c065080143fc956420230ad6ddfa44eeccc834be980a590ad98ed3da2fb6909ab00456d1a4a1e847870c569f8759f

data/CHANGELOG.md

@@ -7,6 +7,29 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.2.14] — 2026-11-03
+
+Security maintenance release — no feature or behavior changes.
+
+### Security
+- **`view_component` minimum raised to `>= 4.14`** (still `~> 4.0`). Versions before 4.12 are affected by an `around_render` HTML-safety bypass (CVE-2026-54498, high) and stale render context on reused component instances (CVE-2026-54497); 4.14 completes the fix for slot/`with_content` state leaking across reused instances (GHSA-8qw7-6phv-7q6p). Hosts on a recent 4.x are unaffected by the bump.
+- **Host apps: keep Rails patched.** Lean CMS uses Active Storage variants, which are affected by an arbitrary file read / RCE advisory in variant processing. Run Rails `>= 8.0.5.1` (8.0.x) or `>= 8.1.3.1` (8.1.x). The gemspec's `rails ~> 8.0` constraint is unchanged since no single constraint excludes every affected version across both series; `bundle-audit` in your app will flag it.
+
+### Changed
+- `.ruby-version` (local development) bumped `3.4.7` → `3.4.12`, matching the floating Ruby 3.4 now used in CI.
+
+## [0.2.13] — 2026-05-15
+
+Metadata-only bump after the initial v0.2.12 RubyGems publish — no code changes.
+
+### Changed
+- **Gemspec author:** `OvrlandServices` → `Matt Thompson`. RubyGems doesn't hyperlink author names; the Ovrland Services association lives in the homepage.
+- **Gemspec email:** `hello@ovrlandservices.com` → `matt@ovrland.io` (correct personal address).
+- **Gemspec description** no longer says "Designed for SQLite-based marketing sites" — now reflects the v0.2.12 reality of "SQLite happy path with full Postgres/MySQL compatibility."
+
+### Added
+- **Gemspec metadata** gains `documentation_uri` (https://leancms.dev/docs/) and `bug_tracker_uri` (https://github.com/Ovrland-Services/lean-cms/issues) so RubyGems renders both in the sidebar.
+
 ## [0.2.12] — 2026-05-15
 
 ### Changed
@@ -218,7 +241,9 @@ Hosts moving from in-app auth to gem auth should:
 - `lean_cms:stats` rake task — prints content field counts by page
 - `LeanCms::SyncHelper` — SQLite database sync between local and production
 
-[Unreleased]: https://github.com/Ovrland-Services/lean-cms/compare/v0.2.12...HEAD
+[Unreleased]: https://github.com/Ovrland-Services/lean-cms/compare/v0.2.14...HEAD
+[0.2.14]: https://github.com/Ovrland-Services/lean-cms/compare/v0.2.13...v0.2.14
+[0.2.13]: https://github.com/Ovrland-Services/lean-cms/compare/v0.2.12...v0.2.13
 [0.2.12]: https://github.com/Ovrland-Services/lean-cms/compare/v0.2.11...v0.2.12
 [0.2.11]: https://github.com/Ovrland-Services/lean-cms/compare/v0.2.10...v0.2.11
 [0.2.10]: https://github.com/Ovrland-Services/lean-cms/compare/v0.2.9...v0.2.10

data/lib/lean_cms/version.rb

@@ -1,3 +1,3 @@
 module LeanCms
-  VERSION = "0.2.12"
+  VERSION = "0.2.14"
 end

metadata

@@ -1,13 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: lean_cms
 version: !ruby/object:Gem::Version
-  version: 0.2.12
+  version: 0.2.14
 platform: ruby
 authors:
-- OvrlandServices
+- Matt Thompson
+autorequire: 
 bindir: bin
 cert_chain: []
-date: 1980-01-02 00:00:00.000000000 Z
+date: 2026-11-03 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -44,6 +45,9 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '4.0'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '4.14'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -51,6 +55,9 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '4.0'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '4.14'
 - !ruby/object:Gem::Dependency
   name: kaminari
   requirement: !ruby/object:Gem::Requirement
@@ -151,9 +158,9 @@ dependencies:
         version: '5.0'
 description: Lean CMS is a Rails Engine that adds in-context content editing, page
   content management, blog/portfolio, settings, and notifications to any Rails 8 application.
-  Designed for SQLite-based marketing sites.
+  Built for marketing sites — SQLite happy path with full Postgres/MySQL compatibility.
 email:
-- hello@ovrlandservices.com
+- matt@ovrland.io
 executables: []
 extensions: []
 extra_rdoc_files: []
@@ -293,6 +300,9 @@ metadata:
   homepage_uri: https://leancms.dev
   source_code_uri: https://github.com/Ovrland-Services/lean-cms
   changelog_uri: https://github.com/Ovrland-Services/lean-cms/blob/main/CHANGELOG.md
+  documentation_uri: https://leancms.dev/docs/
+  bug_tracker_uri: https://github.com/Ovrland-Services/lean-cms/issues
+post_install_message: 
 rdoc_options: []
 require_paths:
 - lib
@@ -307,7 +317,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.6.9
+rubygems_version: 3.0.3.1
+signing_key: 
 specification_version: 4
 summary: Lightweight Rails CMS with in-context editing for marketing sites.
 test_files: []