view_component 3.25.0 → 3.27.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 17958e9ab2fbfbce6d2d397332fb0683315d805bb2ca94920a570fcf544c43e8
-  data.tar.gz: 76b1b5f122715ac0086e78b8010dc5f03e9fad57180ce444c68f556b148d1a59
+  metadata.gz: ea3b7eaa6244e04ffa83e7c9d4aeafca18230bedcce0fb160b1001b0441270b0
+  data.tar.gz: aa605998a6e975f74c307faca61ec6d10b837cdee83c48fe2424e5b6421daf8a
 SHA512:
-  metadata.gz: 1ef7030f4690849614463924c9f10953609ef1a74508718cbe5d5f5049256ffcc51c67671a1b95a770bd96c0cd0b3b1f0f438bf56c3ba2265b252d1072f3faad
-  data.tar.gz: b54825e954ceef4e0f45bbc71cc59f92689275f02da9707e46c3fb30b30eb280b9e01b0b3585b3e6996da92dd5ce2c822d9dd839373e8a89660203a665a0ebb3
+  metadata.gz: a3ec820b42851cb62062972e1473ebb508798e0acd63bfff6e6fda1087c62776806c0199a9e11d6b13bd2914330bf0ad1cb899511c55f62af1538be7a9292a13
+  data.tar.gz: 748b43b70dec2efc5319bec3379f6b7cf115789f731e3a32af789c304644d20f14d62c9bc727ab88baa4a52dbeba806f8f403dcee1bcf1bc9a6df6ee73f0d412

data/app/helpers/preview_helper.rb

@@ -23,7 +23,7 @@ module PreviewHelper
   end
 
   def find_template_data_for_preview_source(lookup_context:, template_identifier:)
-    template = lookup_context.find_template(template_identifier)
+    template = find_template_for_preview_source(lookup_context, template_identifier)
 
     if Rails.version.to_f >= 6.1 || template.source.present?
       {
@@ -61,6 +61,14 @@ module PreviewHelper
 
   private
 
+  def find_template_for_preview_source(lookup_context, template_identifier)
+    if lookup_context.respond_to?(:find_template)
+      lookup_context.find_template(template_identifier)
+    else
+      lookup_context.find(template_identifier)
+    end
+  end
+
   def prism_language_name_by_template(template:)
     language = template.identifier.split(".").last
 

data/docs/CHANGELOG.md

@@ -10,6 +10,22 @@ nav_order: 6
 
 ## main
 
+## 3.27.0
+
+* [Security] Fix incomplete remediation for CVE-2026-54497 (GHSA-8qw7-6phv-7q6p): reused ViewComponent instances could still leak `with_content` and `renders_one`/`renders_many` slot content from an earlier render into a later render because slot state and content set via `with_content` are populated by the caller before `render_in` runs and were not cleared by the previous per-render reset. Reinstate the `ViewComponent::ReusedInstanceError` guard that raises when a component instance is rendered more than once. Rebuild collection child components per render and dup collection spacer components before each render so that legitimate re-rendering of `Collection`/spacer objects continues to work.
+
+    *Yazan Balawneh, Cystack.ps*
+
+## 3.26.0
+
+* Fix rendering partials from components rendered as a collection when the original view context is explicitly stashed as `nil`.
+
+    *Justin Coyne, Joel Hawksley*
+
+* Restore compatibility with Rails main after `ActionView::Template.template_handler_extensions` and `ActionView::LookupContext#find_template` were removed.
+
+    *Joel Hawksley*
+
 ## 3.25.0
 
 * Support Rails `render_in` options signature. Rails [#50623](https://github.com/rails/rails/pull/50623) changed the `render_in` signature from `render_in(view_context, &block)` to `render_in(view_context, **options, &block)`. `ViewComponent::Base#render_in`, `ViewComponent::Collection#render_in`, and `ViewComponent::Instrumentation#render_in` now accept `**options`, restoring compatibility with Rails main and silencing the deprecation warning.

data/lib/view_component/base.rb

@@ -83,12 +83,13 @@ module ViewComponent
     def render_in(view_context, **options, &block)
       self.class.compile(raise_errors: true)
 
+      __vc_check_reused_instance!
       __vc_reset_render_state!
 
       @view_context = view_context
       self.__vc_original_view_context =
         if instance_variable_defined?(:@__vc_pending_original_view_context)
-          remove_instance_variable(:@__vc_pending_original_view_context)
+          remove_instance_variable(:@__vc_pending_original_view_context) || view_context
         else
           view_context
         end
@@ -137,6 +138,7 @@ module ViewComponent
       end
     ensure
       @current_template = old_current_template
+      @__vc_rendered = true
     end
 
     # Subclass components that call `super` inside their template code will cause a
@@ -410,7 +412,9 @@ module ViewComponent
     # state from a previous render. Slot state (`@__vc_set_slots`,
     # `@__vc_content_set_by_with_content`) is intentionally preserved because it
     # is populated by callers _before_ `render_in` runs (e.g. via `with_*`
-    # slot setters or `with_content`).
+    # slot setters or `with_content`); reuse of an instance that has slot or
+    # `with_content` state is guarded against separately by
+    # `__vc_check_reused_instance!`.
     def __vc_reset_render_state!
       %i[
         @__vc_controller
@@ -422,6 +426,17 @@ module ViewComponent
       end
     end
 
+    # Raises when a component instance is rendered more than once.
+    # Reusing a component instance across renders can leak request-scoped state
+    # (controller, helpers, request, view_flow, slot content, `with_content`)
+    # from an earlier render into a later one. See
+    # `ViewComponent::ReusedInstanceError` and GHSA-8qw7-6phv-7q6p.
+    def __vc_check_reused_instance!
+      return unless defined?(@__vc_rendered) && @__vc_rendered
+
+      raise ReusedInstanceError.new(self.class.name)
+    end
+
     # Configuration for generators.
     #
     # All options under this namespace default to `false` unless otherwise

data/lib/view_component/collection.rb

@@ -72,13 +72,18 @@ module ViewComponent
       @options.merge(item_options)
     end
 
+    # Render the spacer through a fresh `dup` so a collection rendered multiple
+    # times does not reuse (and trip the single-render guard on) the spacer
+    # instance passed by the caller.
     def rendered_spacer(view_context)
-      if @spacer_component
-        @spacer_component.set_original_view_context(__vc_original_view_context) if @spacer_component.respond_to?(:set_original_view_context)
-        @spacer_component.render_in(view_context)
-      else
-        ""
+      return "" unless @spacer_component
+
+      spacer = @spacer_component.dup
+      if spacer.instance_variable_defined?(:@__vc_rendered)
+        spacer.remove_instance_variable(:@__vc_rendered)
       end
+      spacer.set_original_view_context(__vc_original_view_context) if spacer.respond_to?(:set_original_view_context)
+      spacer.render_in(view_context)
     end
   end
 end

data/lib/view_component/compiler.rb

@@ -170,7 +170,7 @@ module ViewComponent
       @templates ||=
         begin
           templates = @component.sidecar_files(
-            ActionView::Template.template_handler_extensions
+            template_handler_extensions
           ).map do |path|
             # Extract format and variant from template filename
             this_format, variant =
@@ -225,5 +225,13 @@ module ViewComponent
           templates
         end
     end
+
+    def template_handler_extensions
+      if ActionView::Template.respond_to?(:template_handler_extensions)
+        ActionView::Template.template_handler_extensions
+      else
+        ActionView::Template::Handlers.extensions.map(&:to_s)
+      end
+    end
   end
 end

data/lib/view_component/errors.rb

@@ -175,6 +175,19 @@ module ViewComponent
       "To fix this issue, pass a value."
   end
 
+  class ReusedInstanceError < StandardError
+    MESSAGE =
+      "ViewComponent instances are single-use; a COMPONENT instance was rendered more than once.\n\n" \
+      "Reusing a component instance across renders can leak request-scoped state " \
+      "(controller, helpers, request, view_flow, slot content, `with_content`) from an earlier render " \
+      "into a later one, which has security and correctness implications (GHSA-8qw7-6phv-7q6p).\n\n" \
+      "To fix this issue, create a new component instance per render."
+
+    def initialize(klass_name)
+      super(MESSAGE.gsub("COMPONENT", klass_name.to_s))
+    end
+  end
+
   class TranslateCalledBeforeRenderError < BaseError
     MESSAGE =
       "`#translate` can't be used before rendering as it depends " \

data/lib/view_component/version.rb

@@ -3,7 +3,7 @@
 module ViewComponent
   module VERSION
     MAJOR = 3
-    MINOR = 25
+    MINOR = 27
     PATCH = 0
     PRE = nil
 

metadata

@@ -1,14 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: view_component
 version: !ruby/object:Gem::Version
-  version: 3.25.0
+  version: 3.27.0
 platform: ruby
 authors:
 - ViewComponent Team
-autorequire: 
 bindir: bin
 cert_chain: []
-date: 2026-06-05 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -450,8 +449,118 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: 0.0.1
-description: 
-email: 
+- !ruby/object:Gem::Dependency
+  name: net-imap
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: net-pop
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: net-smtp
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: base64
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: bigdecimal
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: drb
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: mutex_m
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: propshaft
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 1.1.0
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 1.1.0
 executables: []
 extensions: []
 extra_rdoc_files: []
@@ -532,7 +641,6 @@ metadata:
   allowed_push_host: https://rubygems.org
   source_code_uri: https://github.com/viewcomponent/view_component
   changelog_uri: https://github.com/ViewComponent/view_component/blob/main/docs/CHANGELOG.md
-post_install_message: 
 rdoc_options: []
 require_paths:
 - lib
@@ -547,8 +655,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.0.3.1
-signing_key: 
+rubygems_version: 3.6.9
 specification_version: 4
 summary: A framework for building reusable, testable & encapsulated view components
   in Ruby on Rails.