Bump React on Rails RC dependencies#768
Conversation
|
Warning Review limit reached
More reviews will be available in 38 minutes and 43 seconds. Learn how PR review limits work. Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file). ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits. 🚦 How do rate limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan refill rate. For paid Pro and Pro+ PR reviews, CodeRabbit uses rolling per-developer review limits. Reviews become available again as older review attempts age out of the rolling limit window. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (2)
📒 Files selected for processing (2)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
🚀 Quick Review App CommandsWelcome! Here are the commands you can use in this PR:
|
PR Review: Bump React on Rails RC dependenciesThis PR bumps Findings1.
Recommendation: Add 2. With React bumped to Recommendation: Upgrade Non-issues noted (for visibility)
|
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
| "react-on-rails-rsc": "19.0.5-rc.7", | ||
| "react-on-rails-pro": "17.0.0-rc.6", | ||
| "react-on-rails-pro-node-renderer": "17.0.0-rc.6", | ||
| "react-on-rails-rsc": "19.2.0-rc.3", |
There was a problem hiding this comment.
This version introduces react-server-dom-webpack "~19.2.7" as a new transitive dependency (the previous 19.0.5-rc.7 had no such dependency). That package is a React-internal RSC module that must be version-matched exactly to react and react-dom. Since it only arrives transitively, there's no direct pin in package.json to enforce this alignment.
| "react-on-rails-rsc": "19.2.0-rc.3", | |
| "react-on-rails-rsc": "19.2.0-rc.3", | |
| "react-server-dom-webpack": "~19.2.7", |
Adding it as a direct dependency makes the constraint explicit, ensures it moves in lockstep with react/react-dom, and surfaces the version in reviews of future dependency bumps.
| "react-on-rails-pro": "17.0.0-rc.6", | ||
| "react-on-rails-pro-node-renderer": "17.0.0-rc.6", | ||
| "react-on-rails-rsc": "19.2.0-rc.3", | ||
| "react-redux": "^8.1.0", |
There was a problem hiding this comment.
react-redux 8.1.3 declares peerDependencies: { react: "^16.8.3 || ^17 || ^18" } — React 19 is not in that range. With react now at ~19.2.7, yarn install will emit peer dependency warnings. The app's use of connect() + Provider means it likely functions at runtime (no removed APIs are hit), but react-redux v9 was released specifically to add React 18/19 to the peer dep declaration.
Consider upgrading to ^9.0.0 in a follow-up PR (v9 has some API changes worth reviewing separately).
| "react-router": "^6.13.0", | ||
| "react-router-dom": "^6.13.0", | ||
| "react-router-redux": "^4.0.8", | ||
| "react-server-dom-webpack": "~19.2.7", |
There was a problem hiding this comment.
Redundant direct pin — no app code imports this package
react-server-dom-webpack is not imported anywhere in the application's source files; it's already a hard dependency of react-on-rails-rsc@19.2.0-rc.3 (confirmed in yarn.lock). Pinning it here as well creates a maintenance trap: if a future react-on-rails-rsc update changes its internal range (e.g. to ~19.3.x), Yarn 1 may resolve two separate copies. React's RSC runtime performs identity checks on its own modules, so a version split silently breaks Server Component streaming.
If the goal is to lock the version independently of react-on-rails-rsc, consider using a resolutions block instead:
| "react-server-dom-webpack": "~19.2.7", | |
| "react-server-dom-webpack": "~19.2.7", |
(Alternatively, remove this line entirely and let it be managed transitively — the yarn.lock already locks it to 19.2.7.)
| "react": "~19.2.7", | ||
| "react-dom": "~19.2.7", |
There was a problem hiding this comment.
Version triangle: three RSC packages must stay in lockstep but have independent pins
react, react-dom, and react-server-dom-webpack are all at ~19.2.7 today, but they are three separate dependencies entries. Running yarn upgrade react react-dom in a future maintenance window — without also bumping react-server-dom-webpack — will produce a mismatch between the React core packages and the RSC webpack bridge. React's own cross-package assertion throws at startup: "react-server-dom-webpack requires react and react-dom to be loaded."
Consider anchoring all three together via a resolutions block so they can only move in a single commit:
"resolutions": {
"react": "~19.2.7",
"react-dom": "~19.2.7",
"react-server-dom-webpack": "~19.2.7"
}Or at minimum add a comment above all three entries calling out that they must be bumped together.
Review: Bump React on Rails RC dependenciesThis PR advances the React on Rails Pro suite from rc.3 to rc.6, steps Findings1. Redundant direct pin for 2. 3. Check whether 4. The Gemfile/Gemfile.lock changes are clean — format, version constraints, and transitive bumps ( |
Review: Bump React on Rails RC dependenciesThis PR advances the React on Rails Pro gem and npm packages from rc.3 to rc.6, lifts React and React DOM from ~19.0.4 to ~19.2.7, updates react-on-rails-rsc to track the new React minor (19.2.0-rc.3), and adds Finding
No source file in this repository directly imports The risk is future maintenance: when Recommendation: Remove the direct dep and let "resolutions": {
"react-server-dom-webpack": "~19.2.7"
}Everything else looks good
|
| "react-router": "^6.13.0", | ||
| "react-router-dom": "^6.13.0", | ||
| "react-router-redux": "^4.0.8", | ||
| "react-server-dom-webpack": "~19.2.7", |
There was a problem hiding this comment.
This package is never directly imported in the application source — all RSC usage goes through react-on-rails-rsc, which already declares react-server-dom-webpack "~19.2.7" as its own dependency (see yarn.lock). Yarn 1 currently deduplicates the two identical ~19.2.7 ranges to a single resolved entry, so there is no breakage today.
The concern is forward-looking: when react-on-rails-rsc ships a future RC that bumps its range to ~19.3.x, this pin stays at ~19.2.7 and Yarn 1 installs two separate copies. Because the RSC Flight wire format uses module identity, mismatched react-server-dom-webpack versions can corrupt server component payloads in ways that are difficult to diagnose.
If the goal is to keep react-server-dom-webpack pinned to the same minor as React (good idea), prefer resolutions over a direct dep:
| "react-server-dom-webpack": "~19.2.7", |
...and add in the top-level resolutions field:
"resolutions": {
"react-server-dom-webpack": "~19.2.7"
}That enforces the version without making this project responsible for manually upgrading a package it never directly uses.
|
+review-app-deploy |
🎉 Deploy Complete!Open Review AppDeployment successful for PR #768, commit 1267e17 🎮 Control Plane Console |
Greptile SummaryThis PR bumps React on Rails RC packages to
Confidence Score: 4/5Safe to merge; all version pins are internally consistent across package.json, yarn.lock, Gemfile, and Gemfile.lock, but all promoted packages remain release candidates. Every changed package is an RC build rather than a stable release, so the upgrade carries the inherent uncertainty of pre-release software. Within those constraints the bump is clean: React/React DOM, scheduler, react-server-dom-webpack, and the react-on-rails-rsc version jump all align correctly, and the new react-server-dom-webpack direct dependency in package.json is appropriately pinned to match the transitive requirement introduced by react-on-rails-rsc 19.2.0-rc.3. No files require special attention; the lockfiles faithfully reflect the manifest pins. Important Files Changed
Flowchart%%{init: {'theme': 'neutral'}}%%
flowchart TD
A[package.json] --> B[react 19.2.7]
A --> C[react-dom 19.2.7]
A --> D[react-on-rails-pro 17.0.0-rc.6]
A --> E[react-on-rails-pro-node-renderer 17.0.0-rc.6]
A --> F[react-on-rails-rsc 19.2.0-rc.3]
A --> G[react-server-dom-webpack 19.2.7 NEW]
C --> H[scheduler 0.27.0]
D --> I[react-on-rails 17.0.0-rc.6]
F --> G
Gemfile --> J[react_on_rails_pro gem 17.0.0.rc.6]
J --> K[react_on_rails gem 17.0.0.rc.6]
%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
flowchart TD
A[package.json] --> B[react 19.2.7]
A --> C[react-dom 19.2.7]
A --> D[react-on-rails-pro 17.0.0-rc.6]
A --> E[react-on-rails-pro-node-renderer 17.0.0-rc.6]
A --> F[react-on-rails-rsc 19.2.0-rc.3]
A --> G[react-server-dom-webpack 19.2.7 NEW]
C --> H[scheduler 0.27.0]
D --> I[react-on-rails 17.0.0-rc.6]
F --> G
Gemfile --> J[react_on_rails_pro gem 17.0.0.rc.6]
J --> K[react_on_rails gem 17.0.0.rc.6]
Reviews (1): Last reviewed commit: "Refresh concurrent-ruby advisory patch" | Re-trigger Greptile |
✅ Review App DeletedReview app for PR #768 is deleted |
Review: Bump React on Rails RC dependenciesThis PR advances React on Rails Pro (Ruby gem + npm) from rc.3 to rc.6, bumps React/ReactDOM from 19.0.x to 19.2.x, and promotes Two findings survived verification: 1.
|
|
|
||
| gem "cpflow", "5.1.1", require: false | ||
| gem "react_on_rails_pro", "17.0.0.rc.3" | ||
| gem "react_on_rails_pro", "17.0.0.rc.6" |
There was a problem hiding this comment.
The base react_on_rails gem (at 17.0.0.rc.6) is not directly pinned here — it only appears in the lockfile as a transitive dep of react_on_rails_pro. RC gems can be yanked from RubyGems.org; if that happens, bundle install fails on fresh checkouts with no recourse.
Consider adding a direct pin:
| gem "react_on_rails_pro", "17.0.0.rc.6" | |
| gem "react_on_rails_pro", "17.0.0.rc.6" | |
| gem "react_on_rails", "17.0.0.rc.6" |
| "react-router": "^6.13.0", | ||
| "react-router-dom": "^6.13.0", | ||
| "react-router-redux": "^4.0.8", | ||
| "react-server-dom-webpack": "~19.2.7", |
There was a problem hiding this comment.
react-server-dom-webpack is a webpack plugin used at build time — it is not imported anywhere in application source code. It should go in devDependencies rather than dependencies.
| "react-server-dom-webpack": "~19.2.7", | |
| "react-server-dom-webpack": "~19.2.7", |
Move this entry to the devDependencies section (alongside webpack-dev-server, which is already correctly placed there). The same applies to webpack, webpack-cli, and the other loaders/plugins that are currently miscategorised in dependencies — this PR is a good opportunity to start correcting that pattern.
1 participant
Summary
Validation