Prepare 19.0.5-rc.8 changelog

[justin808]

Links #65

Summary

• Stamps CHANGELOG.md for 19.0.5-rc.8.
• Sets package.json to 19.0.5-rc.8 so the GitHub Actions release workflow version-agreement guard can pass after merge.
• Carries the user-visible rc.8 entries for Build client manifest from client-reference dependency chunk groups (#22) #54 and Apply React 19.0.7 RSC reply-decode DoS fixes (CVE-2026-23869, CVE-2026-23870) to vendored runtime #86.

Classification Sweep (19.0.5-rc.7..origin/main)

PR	Title	Result	Category	Reason
#54	Build client manifest from client-reference dependency chunk groups	entry-needed	product code	Changes Webpack client manifest chunk mapping and emitted preload behavior.
#74	Add agent batch/review skill suite ported from react_on_rails	no-entry	internal	Agent workflow docs/skills only.
#80	Docs: Option 5 stock npm runtime go/no-go decision (#55 spike)	no-entry	internal	Documentation/research only.
#85	Add packed-tarball E2E pipeline suite	no-entry	internal	Test/release validation harness only.
#87	Extract and own the webpack RSC plugin as TypeScript source	no-entry	internal	Refactor/source ownership with intended public behavior parity.
#88	Make PR skill workflows discoverable	no-entry	internal	Agent workflow discoverability only.
#76	Harden dependency and Claude automation	no-entry	release-process	Dependabot/review automation and release-it pinning only.
#86	Apply React 19.0.7 RSC reply-decode DoS fixes	entry-needed	product code	Security/runtime update users receive in the package.
#77	Add release artifact verification gate	no-entry	release-process	Release verification tooling and CI only.
#95	Allow artifact verifier to accept covering root peer ranges	no-entry	release-process	Artifact verifier fix only.
#75	Document release dist-tag policy and artifact parity checks	no-entry	release-process	Release docs only.
#78	Add Flight client error path coverage	no-entry	internal	Tests/error-path coverage only.
#79	Document runtime versioning policy and live backlog pointers	no-entry	internal	Documentation only.
#83	Add compatibility matrix and canary signal	no-entry	release-process	CI compatibility signal only.
#82	Add Claude agent setup and workflow skill stubs	no-entry	internal	Agent setup/workflow scaffolding only.
#84	Release from GitHub Actions with trusted publishing	no-entry	release-process	Release automation only.

No UNKNOWN rows.

Validation

• yarn install --frozen-lockfile
• yarn verify:artifacts packed and validated react-on-rails-rsc-19.0.5-rc.8.tgz.
• yarn build
• yarn test
• git diff --check
• yarn release:dry-run read CHANGELOG.md and package.json as 19.0.5-rc.8, confirmed prerelease next, then exited before mutation because the worker branch is not main.

Current Release State

• npm dist-tags: latest=19.0.4, next=19.0.5-rc.7, stale rc=19.0.5-rc.5.
• npm versions: 19.0.5-rc.8 absent.
• Git tag 19.0.5-rc.8: absent on origin.
• GitHub release 19.0.5-rc.8: absent.

Maintainer-Run Checklist

After this PR is merged to main, dispatch the protected Actions release workflow; do not run these from an agent worker branch:

git checkout main
git pull --ff-only origin main
yarn release:dry-run

gh workflow run release.yml \
  --ref main \
  -f version=19.0.5-rc.8 \
  -f confirm_publish=publish

npm view react-on-rails-rsc dist-tags versions --json
git ls-remote --tags origin 'refs/tags/19.0.5-rc.8' 'refs/tags/19.0.5-rc.8^{}'
gh release view 19.0.5-rc.8 --json tagName,name,isPrerelease,publishedAt,url

Final promotion stays gated until rc.8 downstream verification/soak passes and a final 19.0.5 changelog/package PR lands.

Merge Criteria

• Full gh pr checks 81 list is green; skipped advisory jobs are acceptable.
• All review threads are resolved or explicitly triaged non-blocking.
• Branch is mergeable into main with no conflicts.
• Merge only when maintainers are ready for 19.0.5-rc.8 release motion; actual npm publish, tag push, and GitHub release creation remain maintainer-only through the protected release workflow.

[coderabbitai]

Warning

Review limit reached

@justin808, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 6 minutes and 3 seconds. Learn how PR review limits work.

Your organization has run out of usage credits. Purchase more credits in the billing tab to continue.

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: daecd3e1-6968-4872-bff0-fbd902c3e678

📥 Commits

Reviewing files that changed from the base of the PR and between cbe61d5 and 1ee783f.

📒 Files selected for processing (2)

• CHANGELOG.md
• package.json

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch jg-codex/65-1905-release-motion

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[claude]

Code Review — PR #81: Prepare 19.0.5-rc.8 Changelog

Risk level: Low — documentation-only, zero runtime/build code changes.

What this PR does

Stamps a 19.0.5-rc.8 entry in CHANGELOG.md documenting the Webpack client-manifest chunk-binding fix from #54, and adds the corresponding compare link and PR reference anchor.

Changelog format ✅

• Date (2026-06-12) is correct and matches today.
• Version header, ### Fixed section, reference links, and PR anchor all follow the established Keep a Changelog style used consistently throughout the file.
• The rc.8 compare link is correctly inserted in version-descending order alongside the other links at the bottom.

Entry content ✅

The fixed-entry description is accurate and detailed enough: it names the mechanism (chunk group binding), the problem solved (cross-reference over-preloads), and the preserved edge case (eager-imported client references). Matches the scope of #54.

One thing to be aware of (not blocking)

The compare link 19.0.5-rc.7...19.0.5-rc.8 will be a dead link until the 19.0.5-rc.8 git tag is created by the maintainer release script. This is intentional per the PR description and consistent with how other rc entries were handled, but worth confirming the tag gets created atomically with the npm publish step.

Verdict

LGTM. No issues. Merging this is safe whenever the maintainer is ready to cut the rc.8 release.

[greptile-apps]

Greptile Summary

Stamps CHANGELOG.md as 19.0.5-rc.8 (dated 2026-06-13) and bumps package.json to match, unblocking the GitHub Actions release workflow's version-agreement guard after merge.

• CHANGELOG.md: replaces [Unreleased] with the [19.0.5-rc.8] heading; adds the ### Fixed entry for Build client manifest from client-reference dependency chunk groups (#22) #54 (client manifest chunk-group binding) and retains the Apply React 19.0.7 RSC reply-decode DoS fixes (CVE-2026-23869, CVE-2026-23870) to vendored runtime #86 CVE entry with a slight prose trim; drops the ### Changed block for Extract and own the webpack RSC plugin as TypeScript source #87 (classified internal/no-entry); adds the rc.8 comparison link and [#54] PR reference.
• package.json: single-field version change from 19.0.5-rc.7 → 19.0.5-rc.8; no other package metadata changed.

Confidence Score: 5/5

Safe to merge — both files are changelog/version metadata only; no runtime code is touched.

The only changes are stamping the changelog with the rc.8 header and comparison link, adding the two product-code entries (#54 and #86), and bumping the version field in package.json. The classification sweep entries align with the diff, the date matches, and both PR references are correctly wired. No logic, build, or runtime code is affected.

No files require special attention.

Important Files Changed

Filename	Overview
CHANGELOG.md	Stamps [Unreleased] as [19.0.5-rc.8] dated 2026-06-13; drops the no-entry #87 Changed block; adds #54 Fixed entry; trims the #86 wire-format compatibility note; adds rc.8 comparison link and #54 PR reference.
package.json	Single-field version bump from 19.0.5-rc.7 to 19.0.5-rc.8; no other fields changed.

Sequence Diagram

sequenceDiagram
    participant Dev as Developer
    participant PR as This PR (main)
    participant GA as GitHub Actions
    participant npm as npm Registry

    Dev->>PR: Merge CHANGELOG + package.json bump (19.0.5-rc.8)
    PR->>GA: Trigger protected release.yml workflow
    GA->>GA: "Version-agreement guard: package.json == 19.0.5-rc.8"
    GA->>GA: yarn build + yarn test
    GA->>npm: npm publish --tag next
    npm-->>GA: "dist-tag next = 19.0.5-rc.8"
    GA->>GA: Push git tag 19.0.5-rc.8
    GA->>GA: Create GitHub release (pre-release)

Loading

_{Reviews (1): Last reviewed commit: "Merge remote-tracking branch 'origin/mai..." | Re-trigger Greptile}