Skip to content

Bump the ruby group with 4 updates - #23

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bundler/ruby-5cbda0e4f8
Closed

Bump the ruby group with 4 updates#23
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bundler/ruby-5cbda0e4f8

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 1, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the ruby group with 4 updates: rails, react_on_rails, terser and shakapacker.

Updates rails from 8.1.3 to 8.1.3.1

Release notes

Sourced from rails's releases.

8.1.3.1

Active Support

  • No changes.

Active Model

  • No changes.

Active Record

  • No changes.

Action View

  • No changes.

Action Pack

  • No changes.

Active Job

  • No changes.

Action Mailer

  • No changes.

Action Cable

  • No changes.

Active Storage

  • Disable libvips's unfuzzed image loaders and savers.

    libvips flags some of its loaders and savers as "unfuzzed" or "untrusted", meaning they are only safe for trusted content. Active Storage will call Vips.block_untrusted(true) to disable them while booting. An application that needs a specific loader or saver may re-enable it in an initializer.

... (truncated)

Commits

Updates react_on_rails from 17.0.0.rc.6 to 17.0.1

Release notes

Sourced from react_on_rails's releases.

v17.0.1

Fixed

  • Corrected the OSS npm package license metadata and packed license: react-on-rails now declares MIT, includes a package-local MIT license in the published tarball, and verifies the packed artifact cannot inherit React on Rails Pro commercial terms. PR 4792 by justin808.

v17.0.1.rc.0

Fixed

  • Corrected the OSS npm package license metadata and packed license: react-on-rails now declares MIT, includes a package-local MIT license in the published tarball, and verifies the packed artifact cannot inherit React on Rails Pro commercial terms. PR 4792 by justin808.

v17.0.0

Breaking Changes

  • [Pro] Removed the undocumented ReactOnRailsPro::Cache.fetch_react_component class API: Pro apps should use the supported cached helper APIs (cached_react_component, cached_react_component_hash, and related helpers) instead of calling the low-level cache class directly. The helper cache path still preserves generated-pack loading on cache hits, tag registration, and expires_at handling internally. Fixes #4497. #4541 by justin808.
  • [Pro] React Server Components now require the stable React 19.2.x RSC line: Pro RSC apps on React on Rails 17 require react-on-rails-rsc >= 19.2.1 < 19.3, React >= 19.2.7, and matching React DOM. Non-RSC Pro apps retain React 18 support. The Pro generator scaffolds that coordinated stable runtime and rejects all prerelease RSC packages while the stable floor is active. The adopted react-on-rails-rsc artifact uses the React on Rails Pro commercial terms rather than MIT and reports SEE LICENSE IN LICENSE.md in npm metadata. Set REACT_ON_RAILS_PRO_DISABLE_VERSION_CHECK=1 only as an emergency rollout escape hatch to downgrade startup errors to warnings. #4357. #4490 and #4670 by justin808.
  • Removed the inert config.server_render_method option: The open-source configuration no longer accepts config.server_render_method. The option never selected a server render method — the open-source gem always renders with ExecJS — and its validator raised ReactOnRails::Error at boot for any value other than blank or "ExecJS". Setting it now raises NoMethodError at boot, so delete any config.server_render_method = ... line from config/initializers/react_on_rails.rb; rake react_on_rails:doctor also flags the stale line. For a standalone Node rendering process, use React on Rails Pro's Node renderer, configured via ReactOnRailsPro.configure. Fixes #4415. #4423 by justin808.
  • Removed three deprecated configuration options (config.generated_assets_dirs, config.skip_display_none, config.defer_generated_component_packs): These were deprecated in v16 and are gone in v17. Setting any of them now raises NoMethodError at boot; delete the stale lines from config/initializers/react_on_rails.rb (rake react_on_rails:doctor flags them). Migration: delete config.generated_assets_dirs — public asset paths come from public_output_path in config/shakapacker.yml; delete config.skip_display_none — it had no runtime effect; replace config.defer_generated_component_packs = true with config.generated_component_packs_loading_strategy = :defer, and simply delete config.defer_generated_component_packs = false (the removed option was truthy-gated — only = true set :defer; = false was a no-op that fell through to the default strategy, so it did not mean :sync; set :sync explicitly only if you relied on synchronous loading). The default strategy is :async for Pro or :defer for non-Pro on Shakapacker 8.2.0+, and :sync on older Shakapacker. Fixes #4419. #4432 by justin808.
  • Removed the never-wired RenderRequest / JsCodeBuilder / RenderingStrategy rendering layer: The internal strategy-pattern classes ReactOnRails::RenderRequest, ReactOnRails::JsCodeBuilder, ReactOnRails::RenderingStrategy (with ExecJsStrategy), and — in Pro — ReactOnRailsPro::JsCodeBuilder and ReactOnRailsPro::RenderingStrategy::NodeStrategy, plus the undocumented ReactOnRails.rendering_strategy and ReactOnRails.js_code_builder module accessors, are removed. This scaffolding was built for the strategy-pattern refactor in #2905 (closed without wiring it in) and was never invoked on any production server-rendering path — SSR runs through ServerRenderingJsCode and ServerRenderingPool, which never touched this layer. These constants and accessors were internal and undocumented; if you reference them in application code, remove the reference (the layer performed no work). Fixes #4414. #4437 by justin808.
  • Removed undocumented ReactOnRails::Utils helpers: React on Rails 17 removes the unused ReactOnRails::Utils.server_rendering_is_enabled? and ReactOnRails::Utils.rails_version_less_than helper methods. Remove any application calls to those helpers; release-example generation now owns its private Rails-version check outside the public Utils surface. Fixes #4418. #4431 by justin808.
  • Ruby 3.3+ is required for React on Rails v17: The open-source gem now requires Ruby >= 3.3.0, aligning it with React on Rails Pro, create-react-on-rails-app, and the CI minimum matrix. React on Rails v16 remains the upgrade path for applications that must stay on Ruby 3.2 or older. #3500 by justin808.
  • [Pro] Node Renderer now requires Ruby 3.3+ for the async-http transport: The react-on-rails-pro gem now requires Ruby >= 3.3 (raised from >= 3.0) because async-http depends on Ruby 3.3 features. Upgrade Ruby before moving to this release. See docs/pro/updating.md for the full upgrade guide. #3320 by AbanoubGhadban.
  • [Pro] config.renderer_http_pool_size now limits async-http connections per renderer client: Existing numeric values now cap concurrent async-http connections for each renderer client instead of sizing a persistent process-wide connection pool. HTTP/2 may multiplex request streams over those pooled connections. Setting nil keeps the default connection limit and does not make the async-http client unlimited. Persistent connection reuse is automatic when a long-lived Fiber.scheduler is present. See docs/pro/updating.md for the full upgrade guide. #3320 by AbanoubGhadban.

Added

  • [Pro] React 18 support for non-RSC streaming SSR: stream_react_component with synchronous props is now explicitly supported on React 18 as well as React 19. Permanent packed-artifact coverage verifies a production Webpack build and progressive Suspense output on React 18 without installing or bundling react-on-rails-rsc; async props and React Server Components remain React 19-only. Fixes #4642. #4658 by justin808.
  • Generated Rails response TypeScript contracts: Rails apps can now register explicit JSON response contracts with ReactOnRails::TypeScriptResponseTypes and run rake react_on_rails:generate_response_types to emit importable .d.ts declarations plus a

... (truncated)

Changelog

Sourced from react_on_rails's changelog.

[17.0.1] - 2026-07-26

Fixed

  • Corrected the OSS npm package license metadata and packed license: react-on-rails now declares MIT, includes a package-local MIT license in the published tarball, and verifies the packed artifact cannot inherit React on Rails Pro commercial terms. PR 4792 by justin808.

[17.0.0] - 2026-07-16

Breaking Changes

  • [Pro] Removed the undocumented ReactOnRailsPro::Cache.fetch_react_component class API: Pro apps should use the supported cached helper APIs (cached_react_component, cached_react_component_hash, and related helpers) instead of calling the low-level cache class directly. The helper cache path still preserves generated-pack loading on cache hits, tag registration, and expires_at handling internally. Fixes Issue 4497. PR 4541 by justin808.
  • [Pro] React Server Components now require the stable React 19.2.x RSC line: Pro RSC apps on React on Rails 17 require react-on-rails-rsc >= 19.2.1 < 19.3, React >= 19.2.7, and matching React DOM. Non-RSC Pro apps retain React 18 support. The Pro generator scaffolds that coordinated stable runtime and rejects all prerelease RSC packages while the stable floor is active. The adopted react-on-rails-rsc artifact uses the React on Rails Pro commercial terms rather than MIT and reports SEE LICENSE IN LICENSE.md in npm metadata. Set REACT_ON_RAILS_PRO_DISABLE_VERSION_CHECK=1 only as an emergency rollout escape hatch to downgrade startup errors to warnings. Issue 4357. PR 4490 and PR 4670 by justin808.
  • Removed the inert config.server_render_method option: The open-source configuration no longer accepts config.server_render_method. The option never selected a server render method — the open-source gem always renders with ExecJS — and its validator raised ReactOnRails::Error at boot for any value other than blank or "ExecJS". Setting it now raises NoMethodError at boot, so delete any config.server_render_method = ... line from config/initializers/react_on_rails.rb; rake react_on_rails:doctor also flags the stale line. For a standalone Node rendering process, use React on Rails Pro's Node renderer, configured via ReactOnRailsPro.configure. Fixes Issue 4415. PR 4423 by justin808.
  • Removed three deprecated configuration options (config.generated_assets_dirs, config.skip_display_none, config.defer_generated_component_packs): These were deprecated in v16 and are gone in v17. Setting any of them now raises NoMethodError at boot; delete the stale lines from config/initializers/react_on_rails.rb (rake react_on_rails:doctor flags them). Migration: delete config.generated_assets_dirs — public asset paths come from public_output_path in config/shakapacker.yml; delete config.skip_display_none — it had no runtime effect; replace config.defer_generated_component_packs = true with config.generated_component_packs_loading_strategy = :defer, and simply delete config.defer_generated_component_packs = false (the removed option was truthy-gated — only = true set :defer; = false was a no-op that fell through to the default strategy, so it did not mean :sync; set :sync explicitly only if you relied on synchronous loading). The default strategy is :async for Pro or :defer for non-Pro on Shakapacker 8.2.0+, and :sync on older Shakapacker. Fixes Issue 4419. PR 4432 by justin808.
  • Removed the never-wired RenderRequest / JsCodeBuilder / RenderingStrategy rendering layer: The internal strategy-pattern classes ReactOnRails::RenderRequest, ReactOnRails::JsCodeBuilder, ReactOnRails::RenderingStrategy (with ExecJsStrategy), and — in Pro — ReactOnRailsPro::JsCodeBuilder and ReactOnRailsPro::RenderingStrategy::NodeStrategy, plus the undocumented ReactOnRails.rendering_strategy and ReactOnRails.js_code_builder module accessors, are removed. This scaffolding was built for the strategy-pattern refactor in Issue 2905 (closed without wiring it in) and was never invoked on any production server-rendering path — SSR runs through ServerRenderingJsCode and ServerRenderingPool, which never touched this layer. These constants and accessors were internal and undocumented; if you reference them in application code, remove the reference (the layer performed no work). Fixes Issue 4414. PR 4437 by justin808.
  • Removed undocumented ReactOnRails::Utils helpers: React on Rails 17 removes the unused ReactOnRails::Utils.server_rendering_is_enabled? and ReactOnRails::Utils.rails_version_less_than helper methods. Remove any application calls to those helpers; release-example generation now owns its private Rails-version check outside the public Utils surface. Fixes Issue 4418. PR 4431 by justin808.
  • Ruby 3.3+ is required for React on Rails v17: The open-source gem now requires Ruby >= 3.3.0, aligning it with React on Rails Pro, create-react-on-rails-app, and the CI minimum matrix. React on Rails v16 remains the upgrade path for applications that must stay on Ruby 3.2 or older. PR 3500 by justin808.
  • [Pro] Node Renderer now requires Ruby 3.3+ for the async-http transport: The react-on-rails-pro gem now requires Ruby >= 3.3 (raised from >= 3.0) because async-http depends on Ruby 3.3 features. Upgrade Ruby before moving to this release. See docs/pro/updating.md for the full upgrade guide. PR 3320 by AbanoubGhadban.
  • [Pro] config.renderer_http_pool_size now limits async-http connections per renderer client: Existing numeric values now cap concurrent async-http connections for each renderer client instead of sizing a persistent process-wide connection pool. HTTP/2 may multiplex request streams over those pooled connections. Setting nil keeps the default connection limit and does not make the async-http client unlimited. Persistent connection reuse is automatic when a long-lived Fiber.scheduler is present. See docs/pro/updating.md for the full upgrade guide. PR 3320 by AbanoubGhadban.

Added

  • [Pro] React 18 support for non-RSC streaming SSR: stream_react_component with synchronous props is now explicitly supported on React 18 as well as React 19. Permanent packed-artifact coverage verifies a production Webpack build and progressive Suspense output on React 18 without installing or bundling react-on-rails-rsc; async props and React Server Components remain React 19-only. Fixes Issue 4642. PR 4658 by justin808.

  • Generated Rails response TypeScript contracts: Rails apps can now register explicit JSON response contracts with ReactOnRails::TypeScriptResponseTypes and run rake react_on_rails:generate_response_types to emit importable .d.ts declarations plus a RailsResponseTypes lookup map for TanStack Query clients. Fixes Issue 4247. PR 4259 by justin808.

  • Typed Rails action callers for TanStack Query mutations: The react-on-rails/railsAction subpath now exports createRailsAction, a same-origin JSON caller that attaches Rails CSRF headers and lets mutation code type responses with the generated RailsResponseType<'controller.action'> lookup. Fixes Issue 4248. PR 4260 by justin808.

... (truncated)

Commits
  • 88c0de5 Bump version to 17.0.1
  • ba1bb13 Bump version to 17.0.1.rc.0
  • d2e64e4 Bump version to 17.0.0
  • cd94519 Bump version to 17.0.0.rc.12
  • 6a59bff Release: report the checked-out retry version (#4686)
  • 8601d96 Release: backport strict HEAD retry evidence to 17.0.0 (#4684)
  • 695a21e CI: backport hosted Pro compatibility coverage to 17.0.0 (#4677)
  • c31bc69 Release: backport fail-closed prerelease retry to 17.0.0 (#4676)
  • 14efd39 Bump version to 17.0.0.rc.11
  • ded1858 Adopt stable RSC 19.2.1 for Pro 17 (#4670)
  • Additional commits viewable in compare view

Updates terser from 1.2.7 to 1.2.8

Changelog

Sourced from terser's changelog.

1.2.8 (08 July 2026)

  • update TerserJS to [5.49.0]
Commits

Updates shakapacker from 10.2.0 to 10.3.0

Release notes

Sourced from shakapacker's releases.

v10.3.0

Added

Fixed

  • Fixed implicit SWC defaults for existing webpack/Babel apps without swc-loader. [PR #1206](shakacode/shakapacker#1206) by justin808. Webpack apps that omit both javascript_transpiler and the deprecated webpack_loader now fall back to Babel with a warning when Shakapacker's bundled SWC default is active, swc-loader is missing, and Babel is present. Explicit transpiler settings, webpack apps with swc-loader, and Rspack's built-in SWC path keep their existing behavior. Closes #1203.
  • Fixed JavaScript config loading for missing Rails environments to use the production fallback. [PR #1206](shakacode/shakapacker#1206) by justin808. When RAILS_ENV has no matching section in config/shakapacker.yml, the Node package config now merges the production section instead of only bundled defaults, matching Ruby configuration loading and honoring explicit production javascript_transpiler, source_path, dev_server, and related settings for custom environments such as staging.
  • Fixed helper binstubs delegating Node resolution to Ruby exec in unset and empty PATH environments. [PR #1200](shakacode/shakapacker#1200) and [PR #1201](shakacode/shakapacker#1201) by justin808. Restores shell-compatible Node lookup for bin/shakapacker-config and bin/diff-bundler-config after the v10.2.0 Ruby-binstub regression, while keeping friendly missing-Node errors for ENOENT and EACCES.
Changelog

Sourced from shakapacker's changelog.

[v10.3.0] - July 5, 2026

Added

Fixed

  • Fixed implicit SWC defaults for existing webpack/Babel apps without swc-loader. [PR #1206](shakacode/shakapacker#1206) by justin808. Webpack apps that omit both javascript_transpiler and the deprecated webpack_loader now fall back to Babel with a warning when Shakapacker's bundled SWC default is active, swc-loader is missing, and Babel is present. Explicit transpiler settings, webpack apps with swc-loader, and Rspack's built-in SWC path keep their existing behavior. Closes #1203.
  • Fixed JavaScript config loading for missing Rails environments to use the production fallback. [PR #1206](shakacode/shakapacker#1206) by justin808. When RAILS_ENV has no matching section in config/shakapacker.yml, the Node package config now merges the production section instead of only bundled defaults, matching Ruby configuration loading and honoring explicit production javascript_transpiler, source_path, dev_server, and related settings for custom environments such as staging.
  • Added a shakapacker:doctor warning for Rspack React Refresh v2 configs that still use the v1 default-export constructor pattern. [PR #1207](shakacode/shakapacker#1207) by justin808. Existing configs with const ReactRefreshPlugin = require("@rspack/plugin-react-refresh") followed by new ReactRefreshPlugin() can fail after upgrading to @rspack/plugin-react-refresh v2 with ReactRefreshPlugin is not a constructor; Doctor now points to the affected JS/TS config file and suggests the named-export/default/module compatibility form. Fixes #1204.
  • Fixed helper binstubs delegating Node resolution to Ruby exec in unset and empty PATH environments. [PR #1200](shakacode/shakapacker#1200) and [PR #1201](shakacode/shakapacker#1201) by justin808. Restores shell-compatible Node lookup for bin/shakapacker-config and bin/diff-bundler-config after the v10.2.0 Ruby-binstub regression, while keeping friendly missing-Node errors for ENOENT and EACCES.
Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the ruby group with 4 updates
65c11b2 
Bumps the ruby group with 4 updates: [rails](https://github.com/rails/rails), [react_on_rails](https://github.com/shakacode/react_on_rails), [terser](https://github.com/ahorek/terser-ruby) and [shakapacker](https://github.com/shakacode/shakapacker).


Updates `rails` from 8.1.3 to 8.1.3.1
- [Release notes](https://github.com/rails/rails/releases)
- [Commits](rails/rails@v8.1.3...v8.1.3.1)

Updates `react_on_rails` from 17.0.0.rc.6 to 17.0.1
- [Release notes](https://github.com/shakacode/react_on_rails/releases)
- [Changelog](https://github.com/shakacode/react_on_rails/blob/main/CHANGELOG.md)
- [Commits](shakacode/react_on_rails@v17.0.0.rc.6...v17.0.1)

Updates `terser` from 1.2.7 to 1.2.8
- [Release notes](https://github.com/ahorek/terser-ruby/releases)
- [Changelog](https://github.com/ahorek/terser-ruby/blob/master/CHANGELOG.md)
- [Commits](ahorek/terser-ruby@1.2.7...1.2.8)

Updates `shakapacker` from 10.2.0 to 10.3.0
- [Release notes](https://github.com/shakacode/shakapacker/releases)
- [Changelog](https://github.com/shakacode/shakapacker/blob/main/CHANGELOG.md)
- [Commits](shakacode/shakapacker@v10.2.0...v10.3.0)

---
updated-dependencies:
- dependency-name: rails
  dependency-version: 8.1.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: ruby
- dependency-name: react_on_rails
  dependency-version: 17.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: ruby
- dependency-name: terser
  dependency-version: 1.2.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: ruby
- dependency-name: shakapacker
  dependency-version: 10.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: ruby
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file ruby Pull requests that update ruby code labels Aug 1, 2026
@dependabot @github

dependabot Bot commented on behalf of github Sep 1, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Sep 1, 2026
@dependabot
dependabot Bot deleted the dependabot/bundler/ruby-5cbda0e4f8 branch September 1, 2026 22:57
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file ruby Pull requests that update ruby code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants