Skip to content

Bump React on Rails RC dependencies #768

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
justin808 merged 3 commits into from
Jun 23, 2026
Merged

Bump React on Rails RC dependencies #768

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
a6dafd5
Bump React on Rails RC dependencies
justin808 Jun 23, 2026
8689125
Pin RSC transport dependency explicitly
justin808 Jun 23, 2026
1267e17
Refresh concurrent-ruby advisory patch
justin808 Jun 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion Gemfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ git_source(:github) { |repo| "https://github.com/#{repo}.git" }
ruby "3.4.6"

gem "cpflow", "5.1.1", require: false
gem "react_on_rails_pro", "17.0.0.rc.3"
gem "react_on_rails_pro", "17.0.0.rc.6"

@claude claude Bot Jun 23, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The base react_on_rails gem (at 17.0.0.rc.6) is not directly pinned here — it only appears in the lockfile as a transitive dep of react_on_rails_pro. RC gems can be yanked from RubyGems.org; if that happens, bundle install fails on fresh checkouts with no recourse.

Consider adding a direct pin:

Suggested change
gem "react_on_rails_pro", "17.0.0.rc.6"
gem "react_on_rails_pro", "17.0.0.rc.6"
gem "react_on_rails", "17.0.0.rc.6"

gem "shakapacker", "10.1.0"

# Bundle edge Rails instead: gem "rails", github: "rails/rails"
Expand Down
14 changes: 7 additions & 7 deletions Gemfile.lock
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -132,7 +132,7 @@ GEM
coffee-script-source
execjs
coffee-script-source (1.12.2)
concurrent-ruby (1.3.6)
concurrent-ruby (1.3.7)
connection_pool (3.0.2)
console (1.36.0)
fiber-annotation
Expand Down Expand Up @@ -191,8 +191,8 @@ GEM
interception (0.5)
io-console (0.8.2)
io-endpoint (0.17.2)
io-event (1.16.1)
io-stream (0.13.0)
io-event (1.16.2)
io-stream (0.13.1)
irb (1.18.0)
pp (>= 0.6.0)
prism (>= 1.3.0)
Expand Down Expand Up @@ -346,22 +346,22 @@ GEM
erb
psych (>= 4.0.0)
tsort
react_on_rails (17.0.0.rc.3)
react_on_rails (17.0.0.rc.6)
addressable
connection_pool
execjs (~> 2.5)
rails (>= 5.2)
rainbow (~> 3.0)
shakapacker (>= 6.0)
react_on_rails_pro (17.0.0.rc.3)
react_on_rails_pro (17.0.0.rc.6)
addressable
async (>= 2.29)
async-http (~> 0.95)
execjs (~> 2.9)
io-endpoint (~> 0.17.0)
jwt (>= 2.5, < 4)
rainbow
react_on_rails (= 17.0.0.rc.3)
react_on_rails (= 17.0.0.rc.6)
redcarpet (3.6.0)
redis (5.3.0)
redis-client (>= 0.22.0)
Expand Down Expand Up @@ -549,7 +549,7 @@ DEPENDENCIES
rails-html-sanitizer
rails_best_practices
rainbow
react_on_rails_pro (= 17.0.0.rc.3)
react_on_rails_pro (= 17.0.0.rc.6)
redcarpet
redis (~> 5.0)
rspec-rails (~> 6.0.0)
Expand Down
11 changes: 6 additions & 5 deletions package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -78,17 +78,18 @@
"postcss-loader": "7.3.3",
"postcss-preset-env": "^8.5.0",
"prop-types": "^15.8.1",
"react": "~19.0.4",
"react-dom": "~19.0.4",
"react": "~19.2.7",
"react-dom": "~19.2.7",
Comment on lines +81 to +82

@claude claude Bot Jun 23, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Version triangle: three RSC packages must stay in lockstep but have independent pins

react, react-dom, and react-server-dom-webpack are all at ~19.2.7 today, but they are three separate dependencies entries. Running yarn upgrade react react-dom in a future maintenance window — without also bumping react-server-dom-webpack — will produce a mismatch between the React core packages and the RSC webpack bridge. React's own cross-package assertion throws at startup: "react-server-dom-webpack requires react and react-dom to be loaded."

Consider anchoring all three together via a resolutions block so they can only move in a single commit:

"resolutions": {
  "react": "~19.2.7",
  "react-dom": "~19.2.7",
  "react-server-dom-webpack": "~19.2.7"
}

Or at minimum add a comment above all three entries calling out that they must be bumped together.

"react-error-boundary": "^4.1.2",
"react-intl": "^6.4.4",
"react-on-rails-pro": "17.0.0-rc.3",
"react-on-rails-pro-node-renderer": "17.0.0-rc.3",
"react-on-rails-rsc": "19.0.5-rc.7",
"react-on-rails-pro": "17.0.0-rc.6",
"react-on-rails-pro-node-renderer": "17.0.0-rc.6",
"react-on-rails-rsc": "19.2.0-rc.3",

@claude claude Bot Jun 23, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This version introduces react-server-dom-webpack "~19.2.7" as a new transitive dependency (the previous 19.0.5-rc.7 had no such dependency). That package is a React-internal RSC module that must be version-matched exactly to react and react-dom. Since it only arrives transitively, there's no direct pin in package.json to enforce this alignment.

Suggested change
"react-on-rails-rsc": "19.2.0-rc.3",
"react-on-rails-rsc": "19.2.0-rc.3",
"react-server-dom-webpack": "~19.2.7",

Adding it as a direct dependency makes the constraint explicit, ensures it moves in lockstep with react/react-dom, and surfaces the version in reviews of future dependency bumps.

"react-redux": "^8.1.0",

@claude claude Bot Jun 23, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

react-redux 8.1.3 declares peerDependencies: { react: "^16.8.3 || ^17 || ^18" } — React 19 is not in that range. With react now at ~19.2.7, yarn install will emit peer dependency warnings. The app's use of connect() + Provider means it likely functions at runtime (no removed APIs are hit), but react-redux v9 was released specifically to add React 18/19 to the peer dep declaration.

Consider upgrading to ^9.0.0 in a follow-up PR (v9 has some API changes worth reviewing separately).

"react-router": "^6.13.0",
"react-router-dom": "^6.13.0",
"react-router-redux": "^4.0.8",
"react-server-dom-webpack": "~19.2.7",

@claude claude Bot Jun 23, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Redundant direct pin — no app code imports this package

react-server-dom-webpack is not imported anywhere in the application's source files; it's already a hard dependency of react-on-rails-rsc@19.2.0-rc.3 (confirmed in yarn.lock). Pinning it here as well creates a maintenance trap: if a future react-on-rails-rsc update changes its internal range (e.g. to ~19.3.x), Yarn 1 may resolve two separate copies. React's RSC runtime performs identity checks on its own modules, so a version split silently breaks Server Component streaming.

If the goal is to lock the version independently of react-on-rails-rsc, consider using a resolutions block instead:

Suggested change
"react-server-dom-webpack": "~19.2.7",
"react-server-dom-webpack": "~19.2.7",

(Alternatively, remove this line entirely and let it be managed transitively — the yarn.lock already locks it to 19.2.7.)

@claude claude Bot Jun 23, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This package is never directly imported in the application source — all RSC usage goes through react-on-rails-rsc, which already declares react-server-dom-webpack "~19.2.7" as its own dependency (see yarn.lock). Yarn 1 currently deduplicates the two identical ~19.2.7 ranges to a single resolved entry, so there is no breakage today.

The concern is forward-looking: when react-on-rails-rsc ships a future RC that bumps its range to ~19.3.x, this pin stays at ~19.2.7 and Yarn 1 installs two separate copies. Because the RSC Flight wire format uses module identity, mismatched react-server-dom-webpack versions can corrupt server component payloads in ways that are difficult to diagnose.

If the goal is to keep react-server-dom-webpack pinned to the same minor as React (good idea), prefer resolutions over a direct dep:

Suggested change
"react-server-dom-webpack": "~19.2.7",

...and add in the top-level resolutions field:

"resolutions": {
  "react-server-dom-webpack": "~19.2.7"
}

That enforces the version without making this project responsible for manually upgrading a package it never directly uses.

@claude claude Bot Jun 23, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

react-server-dom-webpack is a webpack plugin used at build time — it is not imported anywhere in application source code. It should go in devDependencies rather than dependencies.

Suggested change
"react-server-dom-webpack": "~19.2.7",
"react-server-dom-webpack": "~19.2.7",

Move this entry to the devDependencies section (alongside webpack-dev-server, which is already correctly placed there). The same applies to webpack, webpack-cli, and the other loaders/plugins that are currently miscategorised in dependencies — this PR is a good opportunity to start correcting that pattern.

"react-transition-group": "4.4.5",
"redux": "^4.2.1",
"redux-thunk": "^2.2.0",
Expand Down
70 changes: 40 additions & 30 deletions yarn.lock
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8714,12 +8714,12 @@ react-deep-force-update@^1.0.0:
resolved "https://registry.npmjs.org/react-deep-force-update/-/react-deep-force-update-1.1.2.tgz"
integrity sha512-WUSQJ4P/wWcusaH+zZmbECOk7H5N2pOIl0vzheeornkIMhu+qrNdGFm0bDZLCb0hSF0jf/kH1SgkNGfBdTc4wA==

react-dom@~19.0.4:
version "19.0.5"
resolved "https://registry.npmjs.org/react-dom/-/react-dom-19.0.5.tgz#7666ca4385dd1f1d2ac2445423077b2f232aa3c0"
integrity sha512-yqJj7o8tlj5FiLpycpClCCTp1f1FXvMgCkFej41N1iTmVDiTeDIay6Y69sn8w9JXSCzZyCLP3fotgEhZagDZWw==
react-dom@~19.2.7:
version "19.2.7"
resolved "https://registry.npmjs.org/react-dom/-/react-dom-19.2.7.tgz#0450dc9ae9ddbff76ef196401cd8b8c7fb466ccc"
integrity sha512-t0BRVXvbiE/o20Hfw669rLbMCDWtYZLvmJigy2f0MxsXF+71pxhR3xOkspmsO8h3ZlNzyibAmtCa3l4lYKk6gQ==
dependencies:
scheduler "^0.25.0"
scheduler "^0.27.0"

react-error-boundary@^4.1.2:
version "4.1.2"
Expand Down Expand Up @@ -8759,10 +8759,10 @@ react-is@^18.0.0, react-is@^18.3.1:
resolved "https://registry.npmjs.org/react-is/-/react-is-18.3.1.tgz"
integrity sha512-/LLMVyas0ljjAtoYiPqYiL8VWXzUUdThrmU5+n20DZv+a+ClRoevUzw5JxU+Ieh5/c87ytoTBV9G1FiKfNJdmg==

react-on-rails-pro-node-renderer@17.0.0-rc.3:
version "17.0.0-rc.3"
resolved "https://registry.npmjs.org/react-on-rails-pro-node-renderer/-/react-on-rails-pro-node-renderer-17.0.0-rc.3.tgz#e816f76eea918f59eb40dade10ad462d7c61b905"
integrity sha512-Red3GaNEF33XhjtfCSkYAM4+GEoiCEjP0Yt1eknH5LmWqVnO1NMqWoFhtBfxaVr/K++qTVYY5yV28iNh6gTqzg==
react-on-rails-pro-node-renderer@17.0.0-rc.6:
version "17.0.0-rc.6"
resolved "https://registry.npmjs.org/react-on-rails-pro-node-renderer/-/react-on-rails-pro-node-renderer-17.0.0-rc.6.tgz#1fef0e21a7a13eb9d4525e05b6989a0ed79fb9c2"
integrity sha512-nX9Nmgb3hiUMPItC5xfV/W/FGnYLLzefr5qJOURPxrkHgEa6dw1ndnH2mRPyh0zFkOaCB2FBIy8lkWfXvRpfiA==
dependencies:
"@fastify/formbody" "^7.4.0 || ^8.0.2"
"@fastify/multipart" "^8.3.1 || ^9.0.3"
Expand All @@ -8772,26 +8772,27 @@ react-on-rails-pro-node-renderer@17.0.0-rc.3:
lockfile "^1.0.4"
pino "^9.14.0 || ^10.1.0"

react-on-rails-pro@17.0.0-rc.3:
version "17.0.0-rc.3"
resolved "https://registry.npmjs.org/react-on-rails-pro/-/react-on-rails-pro-17.0.0-rc.3.tgz#a9a7546ad1c4ee7ef0d5150f04d7f58d6e7d1476"
integrity sha512-DzBHKrDX+bHY2ojnNjH5cNxFXmwIncaL3SQL1SCVibU+G2I32IV8gKB3cUTZgNhMY3p1Onsgjt/cVt0x6+Cqhw==
react-on-rails-pro@17.0.0-rc.6:
version "17.0.0-rc.6"
resolved "https://registry.npmjs.org/react-on-rails-pro/-/react-on-rails-pro-17.0.0-rc.6.tgz#41dc95ed0e3513822a2f0c9b4b25b34c607106be"
integrity sha512-Uc4IUmNYAJIk4iy4RatLN0qVM7MAi8zgXVvd7vZMEnVkGGhHqvj1A82ft97yJqgfqF9mm3eSPPyU3gyXrH5CsQ==
dependencies:
react-on-rails "17.0.0-rc.3"
react-on-rails "17.0.0-rc.6"

react-on-rails-rsc@19.0.5-rc.7:
version "19.0.5-rc.7"
resolved "https://registry.npmjs.org/react-on-rails-rsc/-/react-on-rails-rsc-19.0.5-rc.7.tgz#cbca0fcec9eb4b82b2faa9cf3c6fbfedd4ecf9b6"
integrity sha512-cyQwZm7YW9FS0PEgwael5P9S5HsNeHwhnMm10ScgepZTv38dOeidf+gWf9x+z6w0wrgJ92aExZ8uLjCgpImxcQ==
react-on-rails-rsc@19.2.0-rc.3:
version "19.2.0-rc.3"
resolved "https://registry.npmjs.org/react-on-rails-rsc/-/react-on-rails-rsc-19.2.0-rc.3.tgz#9b0d24a78c12a5e3d45d711d1c8612d4387cac08"
integrity sha512-lthw7rRbPdUOeZQMVR2rH1FdA3sp7wiZfMljmld1c/2epYtA7SYLLhg7jTn9FcVEIjWLZiyzC7GkNrNnLB4IOQ==
dependencies:
acorn-loose "^8.3.0"
neo-async "^2.6.1"
react-server-dom-webpack "~19.2.7"
webpack-sources "^3.2.0"

react-on-rails@17.0.0-rc.3:
version "17.0.0-rc.3"
resolved "https://registry.npmjs.org/react-on-rails/-/react-on-rails-17.0.0-rc.3.tgz#626024849887bd52f828683555f26521f5f1af2b"
integrity sha512-VpLWgVt4mE6ETo1mGj5yLCL/sEK+SPYIut7nVqx10HY0F/P1IQodEWm18IYQ5ZBBxdAngvSsOArjypVUcFLP0w==
react-on-rails@17.0.0-rc.6:
version "17.0.0-rc.6"
resolved "https://registry.npmjs.org/react-on-rails/-/react-on-rails-17.0.0-rc.6.tgz#4372994d13e7dcff4acaf06efad7b413da4bc42d"
integrity sha512-/u2hzYvuUN+1HnH0gEdbfQvkWkgLMSN2kl/2x9CCOInIHffBvilgXzBgJrP5NlvjWpguUWSxO6PrYpgV0BzLMA==

react-proxy@^1.1.7:
version "1.1.8"
Expand Down Expand Up @@ -8838,6 +8839,15 @@ react-router@6.30.1, react-router@^6.13.0:
dependencies:
"@remix-run/router" "1.23.0"

react-server-dom-webpack@~19.2.7:
version "19.2.7"
resolved "https://registry.npmjs.org/react-server-dom-webpack/-/react-server-dom-webpack-19.2.7.tgz#ec4ca821297a039df2c6119a5fe14e49c9423573"
integrity sha512-bYfuvqPJnHB4CHo2Ze7fQyJAO77TUu1W/aKFt81ICXbLiOTg5jHaO/NPDlpvGWUALoEGaGb7Oi1uXAaO+Bw6jw==
dependencies:
acorn-loose "^8.3.0"
neo-async "^2.6.1"
webpack-sources "^3.2.0"

react-transform-hmr@^1.0.4:
version "1.0.4"
resolved "https://registry.npmjs.org/react-transform-hmr/-/react-transform-hmr-1.0.4.tgz"
Expand All @@ -8856,10 +8866,10 @@ react-transition-group@4.4.5:
loose-envify "^1.4.0"
prop-types "^15.6.2"

react@~19.0.4:
version "19.0.5"
resolved "https://registry.npmjs.org/react/-/react-19.0.5.tgz#b9406da29c7085e446e4c2372dcfe4f7c4801aec"
integrity sha512-yIoQWl4moQfHFKNGmyJavhOki09GwCRcMFuXv3y3KMXoQrGnDi0ZHGe4H9EtQE+jrMWU4hgxaILMS4rxTkJdGw==
react@~19.2.7:
version "19.2.7"
resolved "https://registry.npmjs.org/react/-/react-19.2.7.tgz#1f47a1bfc06f8ec885752c6f4af14369a9f8260b"
integrity sha512-HNe9WslTbXmFK8o8cmwgAeJFSBvt1bPdHCVKtaaV+WlAN36mpT4hcRpwbf3fY56ar2oIXzsBpOAiIRHAdY0OlQ==

read-cache@^1.0.0:
version "1.0.0"
Expand Down Expand Up @@ -9290,10 +9300,10 @@ saxes@^6.0.0:
dependencies:
xmlchars "^2.2.0"

scheduler@^0.25.0:
version "0.25.0"
resolved "https://registry.npmjs.org/scheduler/-/scheduler-0.25.0.tgz#336cd9768e8cceebf52d3c80e3dcf5de23e7e015"
integrity sha512-xFVuu11jh+xcO7JOAGJNOXld8/TcEHK/4CituBUeUb5hqxJLj9YuemAEuvm9gQ/+pgXYfbQuqAkiYu+u7YEsNA==
scheduler@^0.27.0:
version "0.27.0"
resolved "https://registry.npmjs.org/scheduler/-/scheduler-0.27.0.tgz#0c4ef82d67d1e5c1e359e8fc76d3a87f045fe5bd"
integrity sha512-eNv+WrVbKu1f3vbYJT/xtiF5syA5HPIMtf9IgY/nKg0sWqzAUEvqY/xm7OcZc/qafLx/iO9FgOmeSAp4v5ti/Q==

schema-utils@^3.0.0, schema-utils@^3.3.0:
version "3.3.0"
Expand Down
Loading