Skip to content

Bump React on Rails RC dependencies #768

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
justin808 merged 3 commits into from
Jun 23, 2026
Merged

Bump React on Rails RC dependencies #768

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
a6dafd5
Bump React on Rails RC dependencies
justin808 Jun 23, 2026
8689125
Pin RSC transport dependency explicitly
justin808 Jun 23, 2026
1267e17
Refresh concurrent-ruby advisory patch
justin808 Jun 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion Gemfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ git_source(:github) { |repo| "https://github.com/#{repo}.git" }
ruby "3.4.6"

gem "cpflow", "5.1.1", require: false
gem "react_on_rails_pro", "17.0.0.rc.3"
gem "react_on_rails_pro", "17.0.0.rc.6"

@claude claude Bot Jun 23, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The base react_on_rails gem (at 17.0.0.rc.6) is not directly pinned here — it only appears in the lockfile as a transitive dep of react_on_rails_pro. RC gems can be yanked from RubyGems.org; if that happens, bundle install fails on fresh checkouts with no recourse.

Consider adding a direct pin:

Suggested change
gem "react_on_rails_pro", "17.0.0.rc.6"
gem "react_on_rails_pro", "17.0.0.rc.6"
gem "react_on_rails", "17.0.0.rc.6"

gem "shakapacker", "10.1.0"

# Bundle edge Rails instead: gem "rails", github: "rails/rails"
Expand Down
12 changes: 6 additions & 6 deletions Gemfile.lock
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -191,8 +191,8 @@ GEM
interception (0.5)
io-console (0.8.2)
io-endpoint (0.17.2)
io-event (1.16.1)
io-stream (0.13.0)
io-event (1.16.2)
io-stream (0.13.1)
irb (1.18.0)
pp (>= 0.6.0)
prism (>= 1.3.0)
Expand Down Expand Up @@ -346,22 +346,22 @@ GEM
erb
psych (>= 4.0.0)
tsort
react_on_rails (17.0.0.rc.3)
react_on_rails (17.0.0.rc.6)
addressable
connection_pool
execjs (~> 2.5)
rails (>= 5.2)
rainbow (~> 3.0)
shakapacker (>= 6.0)
react_on_rails_pro (17.0.0.rc.3)
react_on_rails_pro (17.0.0.rc.6)
addressable
async (>= 2.29)
async-http (~> 0.95)
execjs (~> 2.9)
io-endpoint (~> 0.17.0)
jwt (>= 2.5, < 4)
rainbow
react_on_rails (= 17.0.0.rc.3)
react_on_rails (= 17.0.0.rc.6)
redcarpet (3.6.0)
redis (5.3.0)
redis-client (>= 0.22.0)
Expand Down Expand Up @@ -549,7 +549,7 @@ DEPENDENCIES
rails-html-sanitizer
rails_best_practices
rainbow
react_on_rails_pro (= 17.0.0.rc.3)
react_on_rails_pro (= 17.0.0.rc.6)
redcarpet
redis (~> 5.0)
rspec-rails (~> 6.0.0)
Expand Down
10 changes: 5 additions & 5 deletions package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -78,13 +78,13 @@
"postcss-loader": "7.3.3",
"postcss-preset-env": "^8.5.0",
"prop-types": "^15.8.1",
"react": "~19.0.4",
"react-dom": "~19.0.4",
"react": "~19.2.7",
"react-dom": "~19.2.7",
Comment on lines +81 to +82

@claude claude Bot Jun 23, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Version triangle: three RSC packages must stay in lockstep but have independent pins

react, react-dom, and react-server-dom-webpack are all at ~19.2.7 today, but they are three separate dependencies entries. Running yarn upgrade react react-dom in a future maintenance window — without also bumping react-server-dom-webpack — will produce a mismatch between the React core packages and the RSC webpack bridge. React's own cross-package assertion throws at startup: "react-server-dom-webpack requires react and react-dom to be loaded."

Consider anchoring all three together via a resolutions block so they can only move in a single commit:

"resolutions": {
  "react": "~19.2.7",
  "react-dom": "~19.2.7",
  "react-server-dom-webpack": "~19.2.7"
}

Or at minimum add a comment above all three entries calling out that they must be bumped together.

"react-error-boundary": "^4.1.2",
"react-intl": "^6.4.4",
"react-on-rails-pro": "17.0.0-rc.3",
"react-on-rails-pro-node-renderer": "17.0.0-rc.3",
"react-on-rails-rsc": "19.0.5-rc.7",
"react-on-rails-pro": "17.0.0-rc.6",
"react-on-rails-pro-node-renderer": "17.0.0-rc.6",
"react-on-rails-rsc": "19.2.0-rc.3",

@claude claude Bot Jun 23, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This version introduces react-server-dom-webpack "~19.2.7" as a new transitive dependency (the previous 19.0.5-rc.7 had no such dependency). That package is a React-internal RSC module that must be version-matched exactly to react and react-dom. Since it only arrives transitively, there's no direct pin in package.json to enforce this alignment.

Suggested change
"react-on-rails-rsc": "19.2.0-rc.3",
"react-on-rails-rsc": "19.2.0-rc.3",
"react-server-dom-webpack": "~19.2.7",

Adding it as a direct dependency makes the constraint explicit, ensures it moves in lockstep with react/react-dom, and surfaces the version in reviews of future dependency bumps.

"react-redux": "^8.1.0",

@claude claude Bot Jun 23, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

react-redux 8.1.3 declares peerDependencies: { react: "^16.8.3 || ^17 || ^18" } — React 19 is not in that range. With react now at ~19.2.7, yarn install will emit peer dependency warnings. The app's use of connect() + Provider means it likely functions at runtime (no removed APIs are hit), but react-redux v9 was released specifically to add React 18/19 to the peer dep declaration.

Consider upgrading to ^9.0.0 in a follow-up PR (v9 has some API changes worth reviewing separately).

"react-router": "^6.13.0",
"react-router-dom": "^6.13.0",
Expand Down
70 changes: 40 additions & 30 deletions yarn.lock
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8714,12 +8714,12 @@ react-deep-force-update@^1.0.0:
resolved "https://registry.npmjs.org/react-deep-force-update/-/react-deep-force-update-1.1.2.tgz"
integrity sha512-WUSQJ4P/wWcusaH+zZmbECOk7H5N2pOIl0vzheeornkIMhu+qrNdGFm0bDZLCb0hSF0jf/kH1SgkNGfBdTc4wA==

react-dom@~19.0.4:
version "19.0.5"
resolved "https://registry.npmjs.org/react-dom/-/react-dom-19.0.5.tgz#7666ca4385dd1f1d2ac2445423077b2f232aa3c0"
integrity sha512-yqJj7o8tlj5FiLpycpClCCTp1f1FXvMgCkFej41N1iTmVDiTeDIay6Y69sn8w9JXSCzZyCLP3fotgEhZagDZWw==
react-dom@~19.2.7:
version "19.2.7"
resolved "https://registry.npmjs.org/react-dom/-/react-dom-19.2.7.tgz#0450dc9ae9ddbff76ef196401cd8b8c7fb466ccc"
integrity sha512-t0BRVXvbiE/o20Hfw669rLbMCDWtYZLvmJigy2f0MxsXF+71pxhR3xOkspmsO8h3ZlNzyibAmtCa3l4lYKk6gQ==
dependencies:
scheduler "^0.25.0"
scheduler "^0.27.0"

react-error-boundary@^4.1.2:
version "4.1.2"
Expand Down Expand Up @@ -8759,10 +8759,10 @@ react-is@^18.0.0, react-is@^18.3.1:
resolved "https://registry.npmjs.org/react-is/-/react-is-18.3.1.tgz"
integrity sha512-/LLMVyas0ljjAtoYiPqYiL8VWXzUUdThrmU5+n20DZv+a+ClRoevUzw5JxU+Ieh5/c87ytoTBV9G1FiKfNJdmg==

react-on-rails-pro-node-renderer@17.0.0-rc.3:
version "17.0.0-rc.3"
resolved "https://registry.npmjs.org/react-on-rails-pro-node-renderer/-/react-on-rails-pro-node-renderer-17.0.0-rc.3.tgz#e816f76eea918f59eb40dade10ad462d7c61b905"
integrity sha512-Red3GaNEF33XhjtfCSkYAM4+GEoiCEjP0Yt1eknH5LmWqVnO1NMqWoFhtBfxaVr/K++qTVYY5yV28iNh6gTqzg==
react-on-rails-pro-node-renderer@17.0.0-rc.6:
version "17.0.0-rc.6"
resolved "https://registry.npmjs.org/react-on-rails-pro-node-renderer/-/react-on-rails-pro-node-renderer-17.0.0-rc.6.tgz#1fef0e21a7a13eb9d4525e05b6989a0ed79fb9c2"
integrity sha512-nX9Nmgb3hiUMPItC5xfV/W/FGnYLLzefr5qJOURPxrkHgEa6dw1ndnH2mRPyh0zFkOaCB2FBIy8lkWfXvRpfiA==
dependencies:
"@fastify/formbody" "^7.4.0 || ^8.0.2"
"@fastify/multipart" "^8.3.1 || ^9.0.3"
Expand All @@ -8772,26 +8772,27 @@ react-on-rails-pro-node-renderer@17.0.0-rc.3:
lockfile "^1.0.4"
pino "^9.14.0 || ^10.1.0"

react-on-rails-pro@17.0.0-rc.3:
version "17.0.0-rc.3"
resolved "https://registry.npmjs.org/react-on-rails-pro/-/react-on-rails-pro-17.0.0-rc.3.tgz#a9a7546ad1c4ee7ef0d5150f04d7f58d6e7d1476"
integrity sha512-DzBHKrDX+bHY2ojnNjH5cNxFXmwIncaL3SQL1SCVibU+G2I32IV8gKB3cUTZgNhMY3p1Onsgjt/cVt0x6+Cqhw==
react-on-rails-pro@17.0.0-rc.6:
version "17.0.0-rc.6"
resolved "https://registry.npmjs.org/react-on-rails-pro/-/react-on-rails-pro-17.0.0-rc.6.tgz#41dc95ed0e3513822a2f0c9b4b25b34c607106be"
integrity sha512-Uc4IUmNYAJIk4iy4RatLN0qVM7MAi8zgXVvd7vZMEnVkGGhHqvj1A82ft97yJqgfqF9mm3eSPPyU3gyXrH5CsQ==
dependencies:
react-on-rails "17.0.0-rc.3"
react-on-rails "17.0.0-rc.6"

react-on-rails-rsc@19.0.5-rc.7:
version "19.0.5-rc.7"
resolved "https://registry.npmjs.org/react-on-rails-rsc/-/react-on-rails-rsc-19.0.5-rc.7.tgz#cbca0fcec9eb4b82b2faa9cf3c6fbfedd4ecf9b6"
integrity sha512-cyQwZm7YW9FS0PEgwael5P9S5HsNeHwhnMm10ScgepZTv38dOeidf+gWf9x+z6w0wrgJ92aExZ8uLjCgpImxcQ==
react-on-rails-rsc@19.2.0-rc.3:
version "19.2.0-rc.3"
resolved "https://registry.npmjs.org/react-on-rails-rsc/-/react-on-rails-rsc-19.2.0-rc.3.tgz#9b0d24a78c12a5e3d45d711d1c8612d4387cac08"
integrity sha512-lthw7rRbPdUOeZQMVR2rH1FdA3sp7wiZfMljmld1c/2epYtA7SYLLhg7jTn9FcVEIjWLZiyzC7GkNrNnLB4IOQ==
dependencies:
acorn-loose "^8.3.0"
neo-async "^2.6.1"
react-server-dom-webpack "~19.2.7"
webpack-sources "^3.2.0"

react-on-rails@17.0.0-rc.3:
version "17.0.0-rc.3"
resolved "https://registry.npmjs.org/react-on-rails/-/react-on-rails-17.0.0-rc.3.tgz#626024849887bd52f828683555f26521f5f1af2b"
integrity sha512-VpLWgVt4mE6ETo1mGj5yLCL/sEK+SPYIut7nVqx10HY0F/P1IQodEWm18IYQ5ZBBxdAngvSsOArjypVUcFLP0w==
react-on-rails@17.0.0-rc.6:
version "17.0.0-rc.6"
resolved "https://registry.npmjs.org/react-on-rails/-/react-on-rails-17.0.0-rc.6.tgz#4372994d13e7dcff4acaf06efad7b413da4bc42d"
integrity sha512-/u2hzYvuUN+1HnH0gEdbfQvkWkgLMSN2kl/2x9CCOInIHffBvilgXzBgJrP5NlvjWpguUWSxO6PrYpgV0BzLMA==

react-proxy@^1.1.7:
version "1.1.8"
Expand Down Expand Up @@ -8838,6 +8839,15 @@ react-router@6.30.1, react-router@^6.13.0:
dependencies:
"@remix-run/router" "1.23.0"

react-server-dom-webpack@~19.2.7:
version "19.2.7"
resolved "https://registry.npmjs.org/react-server-dom-webpack/-/react-server-dom-webpack-19.2.7.tgz#ec4ca821297a039df2c6119a5fe14e49c9423573"
integrity sha512-bYfuvqPJnHB4CHo2Ze7fQyJAO77TUu1W/aKFt81ICXbLiOTg5jHaO/NPDlpvGWUALoEGaGb7Oi1uXAaO+Bw6jw==
dependencies:
acorn-loose "^8.3.0"
neo-async "^2.6.1"
webpack-sources "^3.2.0"

react-transform-hmr@^1.0.4:
version "1.0.4"
resolved "https://registry.npmjs.org/react-transform-hmr/-/react-transform-hmr-1.0.4.tgz"
Expand All @@ -8856,10 +8866,10 @@ react-transition-group@4.4.5:
loose-envify "^1.4.0"
prop-types "^15.6.2"

react@~19.0.4:
version "19.0.5"
resolved "https://registry.npmjs.org/react/-/react-19.0.5.tgz#b9406da29c7085e446e4c2372dcfe4f7c4801aec"
integrity sha512-yIoQWl4moQfHFKNGmyJavhOki09GwCRcMFuXv3y3KMXoQrGnDi0ZHGe4H9EtQE+jrMWU4hgxaILMS4rxTkJdGw==
react@~19.2.7:
version "19.2.7"
resolved "https://registry.npmjs.org/react/-/react-19.2.7.tgz#1f47a1bfc06f8ec885752c6f4af14369a9f8260b"
integrity sha512-HNe9WslTbXmFK8o8cmwgAeJFSBvt1bPdHCVKtaaV+WlAN36mpT4hcRpwbf3fY56ar2oIXzsBpOAiIRHAdY0OlQ==

read-cache@^1.0.0:
version "1.0.0"
Expand Down Expand Up @@ -9290,10 +9300,10 @@ saxes@^6.0.0:
dependencies:
xmlchars "^2.2.0"

scheduler@^0.25.0:
version "0.25.0"
resolved "https://registry.npmjs.org/scheduler/-/scheduler-0.25.0.tgz#336cd9768e8cceebf52d3c80e3dcf5de23e7e015"
integrity sha512-xFVuu11jh+xcO7JOAGJNOXld8/TcEHK/4CituBUeUb5hqxJLj9YuemAEuvm9gQ/+pgXYfbQuqAkiYu+u7YEsNA==
scheduler@^0.27.0:
version "0.27.0"
resolved "https://registry.npmjs.org/scheduler/-/scheduler-0.27.0.tgz#0c4ef82d67d1e5c1e359e8fc76d3a87f045fe5bd"
integrity sha512-eNv+WrVbKu1f3vbYJT/xtiF5syA5HPIMtf9IgY/nKg0sWqzAUEvqY/xm7OcZc/qafLx/iO9FgOmeSAp4v5ti/Q==

schema-utils@^3.0.0, schema-utils@^3.3.0:
version "3.3.0"
Expand Down
Loading