Gate TanStack starter on React on Rails 17 rc10

AGENTS.md

@@ -30,7 +30,7 @@ code first and then update the docs or this file in the same change.
   Rspack default. The route also includes a provider-backed RSC prefetch action
   through `prefetchServerComponent`.
 - `/hello_server` demonstrates streaming RSC. Rspack client-reference manifests
-  are available with `react-on-rails-rsc@19.2.1-rc.0`; the remaining strict
+  are available with `react-on-rails-rsc@19.2.1-rc.1`; the remaining strict
   production CSP hydration limitation is documented in
   `docs/11-rsc-csp-nonce-spike.md`.
 - The root path `/` is a public Rails landing page (`home#index`). It leads with
@@ -279,7 +279,7 @@ Rules:
 - Production-assets mode must run with optimized assets and the React on Rails
   Pro Node renderer.
 - Treat interactive RSC client-reference manifest generation on Rspack as
-  expected behavior with `react-on-rails-rsc@19.2.1-rc.0` or newer. Keep
+  expected behavior with `react-on-rails-rsc@19.2.1-rc.1` or newer. Keep
   `pnpm run repro:rspack-rsc` available as the small regression check.
 - When validating unreleased `react_on_rails` or `react_on_rails_rsc` branches,
   follow `docs/12-upstream-branch-testing.md`. Do not leave local path or git

Gemfile

@@ -65,9 +65,9 @@ group :test do
   gem "selenium-webdriver"
 end
 
-gem "react_on_rails", "17.0.0.rc.7"
+gem "react_on_rails", "17.0.0.rc.10"
 
-gem "react_on_rails_pro", "17.0.0.rc.7"
+gem "react_on_rails_pro", "17.0.0.rc.10"
 
 gem "shakapacker", "10.2.0"
 

Gemfile.lock

@@ -78,7 +78,7 @@ GEM
     addressable (2.9.0)
       public_suffix (>= 2.0.2, < 8.0)
     ast (2.4.3)
-    async (2.39.0)
+    async (2.42.0)
       console (~> 1.29)
       fiber-annotation
       io-event (~> 1.11)
@@ -123,7 +123,7 @@ GEM
       logger (~> 1.5)
     concurrent-ruby (1.3.7)
     connection_pool (3.0.2)
-    console (1.36.0)
+    console (1.37.0)
       fiber-annotation
       fiber-local (~> 1.1)
       json
@@ -153,15 +153,16 @@ GEM
     fugit (1.12.1)
       et-orbi (~> 1.4)
       raabro (~> 1.4)
-    globalid (1.3.0)
+    globalid (1.4.0)
       activesupport (>= 6.1)
     i18n (1.15.2)
       concurrent-ruby (~> 1.0)
     image_processing (2.0.2)
     io-console (0.8.2)
     io-endpoint (0.17.2)
-    io-event (1.16.1)
-    io-stream (0.13.0)
+    io-event (1.19.2)
+    io-stream (0.13.2)
+      openssl (>= 3.3)
     irb (1.18.0)
       pp (>= 0.6.0)
       prism (>= 1.3.0)
@@ -170,7 +171,7 @@ GEM
     jbuilder (2.15.1)
       actionview (>= 7.0.0)
       activesupport (>= 7.0.0)
-    json (2.20.0)
+    json (2.21.1)
     jwt (3.2.0)
       base64
     kamal (2.12.0)
@@ -201,7 +202,7 @@ GEM
     loofah (2.25.1)
       crass (~> 1.0.2)
       nokogiri (>= 1.12.0)
-    mail (2.9.0)
+    mail (2.9.1)
       logger
       mini_mime (>= 0.1.1)
       net-imap
@@ -244,6 +245,7 @@ GEM
       racc (~> 1.4)
     nokogiri (1.19.4-x86_64-linux-musl)
       racc (~> 1.4)
+    openssl (4.0.2)
     ostruct (0.6.3)
     package_json (0.2.0)
     parallel (2.1.0)
@@ -265,7 +267,7 @@ GEM
       activesupport (>= 7.0.0)
       rack
     protocol-hpack (1.5.1)
-    protocol-http (0.62.2)
+    protocol-http (0.63.0)
     protocol-http1 (0.39.0)
       protocol-http (~> 0.62)
     protocol-http2 (0.26.0)
@@ -330,21 +332,21 @@ GEM
       prism (>= 1.6.0)
       rbs (>= 4.0.0)
       tsort
-    react_on_rails (17.0.0.rc.7)
+    react_on_rails (17.0.0.rc.10)
       addressable
       connection_pool
       execjs (~> 2.5)
       rails (>= 5.2)
       rainbow (~> 3.0)
       shakapacker (>= 6.0)
-    react_on_rails_pro (17.0.0.rc.7)
+    react_on_rails_pro (17.0.0.rc.10)
       async (>= 2.29)
       async-http (~> 0.95)
       execjs (~> 2.9)
       io-endpoint (~> 0.17.0)
       jwt (>= 2.5, < 4)
       nokogiri (>= 1.12, < 2)
-      react_on_rails (= 17.0.0.rc.7)
+      react_on_rails (= 17.0.0.rc.10)
     regexp_parser (2.12.0)
     reline (0.6.3)
       io-console (~> 0.5)
@@ -491,8 +493,8 @@ DEPENDENCIES
   puma (>= 5.0)
   rack-attack (~> 6.8)
   rails (~> 8.1.3)
-  react_on_rails (= 17.0.0.rc.7)
-  react_on_rails_pro (= 17.0.0.rc.7)
+  react_on_rails (= 17.0.0.rc.10)
+  react_on_rails_pro (= 17.0.0.rc.10)
   rspec-rails (~> 8.0)
   rubocop-rails-omakase
   selenium-webdriver

README.md

@@ -50,7 +50,7 @@ Each route demonstrates a deliberate rendering choice, not a fallback:
   Flight stream, and composes that server-streamed tree beside ordinary client
   React. It now includes an in-app status panel that separates the working RSC
   payload route from the lower-level streaming client-island limitation. It runs
-  on the default Rspack bundler with `react-on-rails-rsc@19.2.1-rc.0` and
+  on the default Rspack bundler with `react-on-rails-rsc@19.2.1-rc.1` and
   exercises the provider-backed RSC prefetch path.
 - **`/hello_server`** demonstrates streaming React Server Components. The demo
   keeps an interactive `LikeButton` client island inside a server-rendered
@@ -78,20 +78,20 @@ Rspack is the default Shakapacker bundler for local development and the
 deployed image. Use `config/shakapacker.yml`, `config/rspack/`, and the
 `.controlplane/Dockerfile` build ARG as the source of truth for the default
 path. The Rspack RSC plugin in
-`react-on-rails-rsc@19.2.1-rc.0` emits the client/server manifests the Pro RSC
+`react-on-rails-rsc@19.2.1-rc.1` emits the client/server manifests the Pro RSC
 client-reference path needs. Webpack remains an opt-in bridge/comparison path
 via `SHAKAPACKER_ASSETS_BUNDLER=webpack`.
 
 | Component | Version |
 | --- | --- |
-| React on Rails / Pro | `17.0.0.rc.7` / `17.0.0-rc.7` |
-| React on Rails RSC | `19.2.1-rc.0` |
+| React on Rails / Pro | `17.0.0.rc.10` / `17.0.0-rc.10` |
+| React on Rails RSC | `19.2.1-rc.1` |
 | Shakapacker / Shakapacker Rspack | `10.2.0` |
 | React | `19.2.7` |
 | Rails | `8.1.x` |
 | Language / tooling | TypeScript, pnpm |
 
-Shakapacker stays on `10.2.0` for this release; the React on Rails 17 RC7
+Shakapacker stays on `10.2.0` for this release; the React on Rails 17 RC10
 upgrade did not require a coupled Shakapacker bump.
 
 ## Setup

SPIKE.md

@@ -15,7 +15,7 @@ The remaining limitation is separate from the bundler: `/hello_server`'s client
 island still waits on the upstream React on Rails Pro streaming CSP nonce fix in
 strict production CSP mode. See `docs/11-rsc-csp-nonce-spike.md`.
 
-The app was bootstrapped with `create-react-on-rails-app --rsc --rspack --package-manager pnpm` and the current release stack targets React on Rails Pro `17.0.0-rc.7`, React on Rails RSC `19.2.1-rc.0`, and Shakapacker `10.2.0`. Shakapacker stays on `10.2.0` because the React on Rails 17 RC7 upgrade did not require a coupled Shakapacker bump. The Rails/Rspack/React on Rails Pro setup passes `react_on_rails:doctor` with the expected warning that both Rspack and Webpack configs are present.
+The app was bootstrapped with `create-react-on-rails-app --rsc --rspack --package-manager pnpm` and the current release stack targets React on Rails Pro `17.0.0-rc.10`, React on Rails RSC `19.2.1-rc.1`, and Shakapacker `10.2.0`. Shakapacker stays on `10.2.0` because the React on Rails 17 RC10 upgrade did not require a coupled Shakapacker bump. The Rails/Rspack/React on Rails Pro setup passes `react_on_rails:doctor` with the expected warning that both Rspack and Webpack configs are present.
 
 ## Validation Goals
 
@@ -27,8 +27,8 @@ The app was bootstrapped with `create-react-on-rails-app --rsc --rspack --packag
 ## What Worked
 
 - Rails 8.1 app scaffolded with PostgreSQL and SolidQueue.
-- React on Rails and React on Rails Pro release stack: `17.0.0.rc.7`.
-- React on Rails RSC stack: `19.2.1-rc.0`.
+- React on Rails and React on Rails Pro release stack: `17.0.0.rc.10`.
+- React on Rails RSC stack: `19.2.1-rc.1`.
 - Shakapacker launch stack: `10.2.0`.
 - Rspack builds complete successfully and emit the RSC client-reference
   manifests with `react-on-rails-rsc@19.0.5-rc.2`.
@@ -46,10 +46,10 @@ manifests present.
 Current stance:
 
 - Keep Rspack as the bundler.
-- Keep the React on Rails Pro `17.0.0-rc.7`, React on Rails RSC `19.2.1-rc.0`, and Shakapacker `10.2.0` release stack.
+- Keep the React on Rails Pro `17.0.0-rc.10`, React on Rails RSC `19.2.1-rc.1`, and Shakapacker `10.2.0` release stack.
 - Keep the Rspack/RSC client boundary repro in `pnpm run repro:rspack-rsc`.
 - Keep direct Rspack packages aligned with the Shakapacker Rspack 2 adapter: `@rspack/core` / `@rspack/cli` `2.0.4` and `@rspack/dev-server` `2.0.1`.
-- Keep `react-on-rails-rsc` on `19.2.1-rc.0` or newer when requiring Rspack RSC
+- Keep `react-on-rails-rsc` on `19.2.1-rc.1` or newer when requiring Rspack RSC
   client-reference manifests.
 
 Impact:

docs/01-architecture.md

@@ -1,8 +1,8 @@
 # Architecture
 
-This starter begins from `create-react-on-rails-app --rsc --rspack` and currently targets the React on Rails Pro `17.0.0-rc.7` RC stack with React on Rails RSC `19.2.1-rc.0` and Shakapacker `10.2.0`.
+This starter begins from `create-react-on-rails-app --rsc --rspack` and currently targets the React on Rails Pro `17.0.0-rc.10` RC stack with React on Rails RSC `19.2.1-rc.1` and Shakapacker `10.2.0`.
 
-Shakapacker remains on `10.2.0` because the React on Rails 17 RC7 upgrade did not require a coupled Shakapacker bump. Rspack is the checked-in local and deploy default. `react-on-rails-rsc@19.2.1-rc.0` provides the Rspack RSC manifest support this starter needs, while Webpack remains an opt-in bridge/comparison path.
+Shakapacker remains on `10.2.0` because the React on Rails 17 RC10 upgrade did not require a coupled Shakapacker bump. Rspack is the checked-in local and deploy default. `react-on-rails-rsc@19.2.1-rc.1` provides the Rspack RSC manifest support this starter needs, while Webpack remains an opt-in bridge/comparison path.
 
 ## Related React On Rails Docs
 
@@ -104,7 +104,7 @@ Vite, file-based routing, Hotwire, or Stimulus.
 Rspack is the active bundler in `config/shakapacker.yml`. Development disables client lazy compilation at the config top level and at `experiments.lazyCompilation`, uses live reload by default for this RC stack, and gates TanStack devtools behind `localStorage["tanstack-devtools"] = "1"` to avoid dev-server overlay requests from optional chunks. Explicit HMR mode enables React Fast Refresh through Shakapacker's Rspack wiring, while static and production-assets dev modes remain free of Rspack dev-server clients.
 
 The public React Server Components path is green on the local Rspack default
-with `react-on-rails-rsc@19.2.1-rc.0`. The Rspack client, server, and
+with `react-on-rails-rsc@19.2.1-rc.1`. The Rspack client, server, and
 server-only RSC bundles compile and emit the React client/server manifests
 expected by the React on Rails RSC client-reference path. The Webpack bridge
 remains documented in [RSC Webpack Bundler Spike](09-rsc-webpack-bundler-spike.md)

docs/02-vs-inertia.md

@@ -149,7 +149,7 @@ renderer such as React on Rails Pro. That is an architectural inference, not a
 claim about Inertia's roadmap.
 
 The Rspack status is also intentionally conservative. Rspack remains the local
-and deploy default, and `react-on-rails-rsc@19.2.1-rc.0` emits the RSC
+and deploy default, and `react-on-rails-rsc@19.2.1-rc.1` emits the RSC
 client-reference manifests required by React on Rails Pro. The status is tracked
 in [SPIKE.md](../SPIKE.md) and [Tested Modes](06-tested-modes.md). The Webpack
 bridge remains an opt-in comparison path.

docs/06-tested-modes.md

@@ -1,9 +1,9 @@
 # Tested Modes
 
 This starter keeps the TanStack dashboard on Rspack and the launch RC stack:
-React on Rails Pro `17.0.0-rc.7`, React on Rails RSC `19.2.1-rc.0`, and
+React on Rails Pro `17.0.0-rc.10`, React on Rails RSC `19.2.1-rc.1`, and
 Shakapacker `10.2.0`.
-Shakapacker remains on `10.2.0` because the React on Rails 17 RC7 upgrade did
+Shakapacker remains on `10.2.0` because the React on Rails 17 RC10 upgrade did
 not require a coupled Shakapacker bump.
 Rspack is the default local and deploy bundler in the checked-in matrix.
 Webpack has explicit opt-in bridge/comparison smokes below.
@@ -62,7 +62,7 @@ build, rendering, or routing behavior.
 | HMR dev | `bin/test hmr` or `SHAKAPACKER_DEV_SERVER_HMR=true bin/dev --no-open-browser --route=dashboard` | CI | Boots the same default dev stack with `hmr: true`, `live_reload: false`, and React Fast Refresh enabled by Shakapacker's Rspack integration, then verifies the authenticated TanStack routes hydrate, navigate, and observe a browser-open source edit. This smoke does not assert state-preserving React Fast Refresh updates. |
 | Webpack HMR bridge | `bin/test webpack-hmr` or `SHAKAPACKER_ASSETS_BUNDLER=webpack node script/dev-mode-smoke.mjs hmr` | Webpack bridge sentinel | Boots Rails, Webpack dev-server, SolidQueue, the Node renderer, and the server/RSC bundle watchers with HMR enabled, then verifies the authenticated TanStack routes hydrate, navigate, and observe a browser-open source edit. This keeps the optional Webpack path covered without changing the Rspack default. |
 | Webpack HMR RSC bridge | `bin/test webpack-hmr-rsc` or `SHAKAPACKER_ASSETS_BUNDLER=webpack REQUIRE_RSC_MANIFESTS=true node script/dev-mode-smoke.mjs hmr hello-server` | Webpack RSC/HMR sentinel | Boots the Webpack HMR stack against `/hello_server`, waits for both RSC client-reference manifests, and fails if the route falls back before rendering the RSC page. This verifies the optional Webpack dev-server writes the client manifest where React on Rails Pro can consume it while still excluding hot-update artifacts from disk. |
-| Rspack/RSC client boundary repro | `bin/test rsc-repro` or `pnpm run repro:rspack-rsc` | CI status, upstream repro | Builds Rspack bundles, verifies the generated `HelloServer` RSC example still contains a `'use client'` boundary, and confirms both RSC client-reference manifests are emitted with `react-on-rails-rsc@19.2.1-rc.0`. Use `REQUIRE_RSC_MANIFESTS=true` when this focused check must fail hard on a manifest regression. |
+| Rspack/RSC client boundary repro | `bin/test rsc-repro` or `pnpm run repro:rspack-rsc` | CI status, upstream repro | Builds Rspack bundles, verifies the generated `HelloServer` RSC example still contains a `'use client'` boundary, and confirms both RSC client-reference manifests are emitted with `react-on-rails-rsc@19.2.1-rc.1`. Use `REQUIRE_RSC_MANIFESTS=true` when this focused check must fail hard on a manifest regression. |
 | `/hello_server` RSC route smoke | `bin/test hello-server-rsc` or `pnpm run test:hello-server-rsc` | RSC route sentinel | Boots the static-assets dev stack against `/hello_server` and verifies the route renders the demo shell with the RSC manifests available. Use `REQUIRE_RSC_MANIFESTS=true` when intentionally requiring interactive RSC client-reference manifests. |
 | Production precompile | `bin/test production-precompile` or `RAILS_ENV=production SECRET_KEY_BASE_DUMMY=1 REACT_ON_RAILS_STARTER_TANSTACK_DATABASE_PASSWORD=dummy bin/rails assets:precompile` | Release-impacting checks | Confirms production Rspack client, server, and RSC bundles compile. The expected Pro license warning is non-fatal. |
 | Production boot smoke | `bin/test production-boot` or `node script/production-boot-smoke.mjs` | CI, release-impacting checks | Precompiles production assets with dummy secrets, prepares production-mode databases, starts `client/node-renderer.js` from compiled output, boots Rails in `RAILS_ENV=production`, checks `/up`, signs in as `demo@example.com / password`, and checks `/projects?status=active&sort=name&dir=asc` with `X-Forwarded-Proto: https`. |
@@ -116,5 +116,5 @@ build, rendering, or routing behavior.
   with `experiments.lazyCompilation = false` kept explicit for compatibility.
   Otherwise dynamic TanStack devtools imports can route through Rspack
   lazy-trigger URLs that return 404s in development.
-- Historical Rspack/RSC manifest tracking lives in [shakacode/react_on_rails#1828](https://github.com/shakacode/react_on_rails/issues/1828). The starter requires `react-on-rails-rsc@19.2.1-rc.0` or newer for the Rspack manifest path.
+- Historical Rspack/RSC manifest tracking lives in [shakacode/react_on_rails#1828](https://github.com/shakacode/react_on_rails/issues/1828). The starter requires `react-on-rails-rsc@19.2.1-rc.1` or newer for the Rspack manifest path.
 - The React on Rails Pro TanStack Router private-store compatibility issue is tracked in [shakacode/react_on_rails#3375](https://github.com/shakacode/react_on_rails/issues/3375).

docs/08-why-rsc-on-rails.md

@@ -226,7 +226,7 @@ inside one Rails app.
 ## Limitations And Current State
 
 This starter intentionally keeps Rspack as the local and deploy default.
-`react-on-rails-rsc@19.2.1-rc.0` provides the Rspack plugin path that emits the
+`react-on-rails-rsc@19.2.1-rc.1` provides the Rspack plugin path that emits the
 RSC client-reference manifests required by React on Rails Pro. That status is
 tracked in [SPIKE.md](../SPIKE.md), and the small reproduction remains available
 through `pnpm run repro:rspack-rsc`.

docs/09-rsc-webpack-bundler-spike.md

@@ -149,7 +149,7 @@ With `RSCRspackPlugin`, Rspack now has its own manifest-generation path.
 
 | Dimension            | Rspack (default)         | Webpack (RSC-capable)               |
 | -------------------- | ------------------------ | ----------------------------------- |
-| Interactive RSC      | ✅ manifests emitted with `react-on-rails-rsc@19.2.1-rc.0` | ✅ manifests emitted, island renders |
+| Interactive RSC      | ✅ manifests emitted with `react-on-rails-rsc@19.2.1-rc.1` | ✅ manifests emitted, island renders |
 | Clean prod build     | ~2.8 s                   | ~8.3 s (≈3× slower)                 |
 | Client JS total      | ~2.6 MB                  | ~2.6 MB (comparable)                |
 | Dev server / HMR     | `@rspack/plugin-react-refresh` | `@pmmmwh/react-refresh-webpack-plugin`; dashboard and `/hello_server` HMR smokes pass |

docs/10-rsc-tanstack-loader-spike.md

@@ -2,7 +2,7 @@
 
 This spike verifies the default Rspack bundler can compose a React on Rails Pro
 React Server Component payload inside a plain `@tanstack/react-router` route
-with `react-on-rails-rsc@19.2.1-rc.0`. It does not use TanStack Start, Vite,
+with `react-on-rails-rsc@19.2.1-rc.1`. It does not use TanStack Start, Vite,
 file-based routing, Hotwire, or Stimulus.
 
 ## Related React On Rails Docs
@@ -83,7 +83,7 @@ Browser verification against `http://127.0.0.1:3400/rsc-showcase` confirmed:
 ## Rspack Default Behavior
 
 Rspack remains the default in `config/shakapacker.yml` and the deploy image.
-`react-on-rails-rsc@19.2.1-rc.0` emits the RSC client-reference manifests on
+`react-on-rails-rsc@19.2.1-rc.1` emits the RSC client-reference manifests on
 Rspack, so `/rsc-showcase` fetches the payload on the default path. The route
 still checks manifest availability before rendering `RSCRoute`, so it can render
 an honest fallback if a future dependency regression removes the manifests.

package.json

@@ -44,9 +44,9 @@
     "prop-types": "15.8.1",
     "react": "19.2.7",
     "react-dom": "19.2.7",
-    "react-on-rails-pro": "17.0.0-rc.7",
-    "react-on-rails-pro-node-renderer": "17.0.0-rc.7",
-    "react-on-rails-rsc": "19.2.1-rc.0",
+    "react-on-rails-pro": "17.0.0-rc.10",
+    "react-on-rails-pro-node-renderer": "17.0.0-rc.10",
+    "react-on-rails-rsc": "19.2.1-rc.1",
     "react-server-dom-webpack": "19.2.7",
     "rspack-manifest-plugin": "5.2.2",
     "sass": "1.101.0",