A security release for the 1.1 line.
Security
- This release and 1.2.1 include a fix for GHSA-vq5h-rg2r-wfm5 (React component props); see the advisory for details.
Fixed
- React component props are serialised as real JSON and fully escaped. A capitalised component tag such as
<Greeting who="{{ name }}" />wrote its props intodata-react-propswith only"escaped, so a value with an apostrophe, backslash or control character produced JSON the client could not parse. The template renderer, the hydration pass andReactComponentRegistry.render()now build the JSON with a real encoder and entity-escape the attribute value; readers decode it as before (dataset.reactProps). The hydration pass no longer re-resolves{{ var }}inside prop values the renderer has already resolved, so a context value that itself reads{{ other }}stays literal. Entities in literal props now reach the client as written:label="Tom &amp; Jerry"arrives asTom &amp; Jerry, where it used to arrive decoded once.