[dependabot]

Bumps the ruby group with 7 updates in the / directory:

Package	From	To
rails	8.1.3	8.1.3.1
sqlite3	2.9.5	2.9.6
mini_racer	0.21.4	0.22.1
react_on_rails	17.0.0.rc.6	17.1.0.rc.0
terser	1.2.7	1.2.8
bootsnap	1.24.6	1.25.0
shakapacker	10.2.0	10.3.2

Updates rails from 8.1.3 to 8.1.3.1

Release notes

Sourced from rails's releases.

8.1.3.1

Active Support

• No changes.

Active Model

• No changes.

Active Record

• No changes.

Action View

• No changes.

Action Pack

• No changes.

Active Job

• No changes.

Action Mailer

• No changes.

Action Cable

• No changes.

Active Storage

• Disable libvips's unfuzzed image loaders and savers.

  libvips flags some of its loaders and savers as "unfuzzed" or "untrusted", meaning they are only safe for trusted content. Active Storage will call Vips.block_untrusted(true) to disable them while booting. An application that needs a specific loader or saver may re-enable it in an initializer.

... (truncated)

Commits

• 3989ebf Preparing for 8.1.3.1 release
• 349e7a5 Disable libvips's unfuzzed image loaders and savers
• See full diff in compare view

Updates sqlite3 from 2.9.5 to 2.9.6

Release notes

Sourced from sqlite3's releases.

2.9.6 / 2026-08-11

Security / Stability

• Fix a garbage collection bug where the argument array passed to a custom aggregate function's step was not visible to the GC, so arguments could be collected mid-conversion when the aggregate takes two or more arguments, corrupting the values passed to step or crashing the process. See GHSA-mwm8-39rw-8826 for more information. #733 @​jeremy

Fixed

• Fix a leak where custom aggregate handler instances were never released, so a connection accumulated one instance per GROUP BY group per query for its lifetime. #722 @​djmb
• Fix GC compaction issues with custom functions, aggregates, collations, #trace and #authorizer=. These callbacks were registered with sqlite by passing a raw Ruby object pointer as user data; keeping the object reachable prevented collection but not relocation, after which sqlite held a stale address and the next call could raise NoMethodError, return a wrong result, or segfault. Affects applications that call GC.compact or run with GC.auto_compact = true. The equivalent issue in #busy_handler was fixed in #466. #723 @​djmb
• Fix the private methods Database#open_v2 and #open16 silently replacing a live connection and leaking the previous connection handle when invoked via send on an open database. They now raise SQLite3::Exception. #729 @​flavorjones
• Fix TEXT values containing an embedded NUL byte being truncated at the first NUL when passed as arguments to functions created with Database#define_function. #730 @​flavorjones
• Fix an exception raised inside a Database#define_function block leaving the connection's sqlite mutex held, which deadlocked any other thread that later used the connection. The exception now propagates to the caller and the connection remains usable. #731 @​flavorjones
• Database.new now raises ArgumentError when the filename or VFS name contains an embedded NUL byte (or an embedded 0x0000 code unit in a UTF-16 filename), instead of silently opening a path truncated at the NUL. #732 @​flavorjones

Improved

• When Database.new fails to open the database file, the underlying sqlite3 connection handle is now closed immediately instead of waiting for the garbage collector to clean it up. #719 @​katafrakt

d8b1f7d23efd7abac285775a9566562fc7debfef79d594e3a20354406fb7907c  gems/sqlite3-2.9.6-aarch64-linux-gnu.gem
3579e1c98cdc7ff5c3722847bb63ed4e1efb7ff675cb5e1e48ef2d4da5fb3bc9  gems/sqlite3-2.9.6-aarch64-linux-musl.gem
33541500e3615da02afe54a9cc38b17a6985d3cf9d8b76d6d0a83002f114e7ec  gems/sqlite3-2.9.6-arm-linux-gnu.gem
c5490af48bb228fefa54314e9541375c3907e70f8109f3881b5ff97e1c93ae33  gems/sqlite3-2.9.6-arm-linux-musl.gem
849b5d7f795e60fe25076d62c72dd722beb45b3850b516ad978d60ee848ec15b  gems/sqlite3-2.9.6-arm64-darwin.gem
1f2b88f417fd0a8c1d5ef19c7e817d8b9c61bee6e33b6b36255fb6e40148e6f8  gems/sqlite3-2.9.6-x64-mingw-ucrt.gem
fbaa9f46f9708f57dd8a459b37fc269f9613e0cacf1547df01aa439cc45c20c0  gems/sqlite3-2.9.6-x86-linux-gnu.gem
6715026fbb5530e810b28ef43b9c4f84cd3c991f67b9d808a31fcc32b847abbd  gems/sqlite3-2.9.6-x86-linux-musl.gem
b5842fea77781c14da03fa7bc0feb82db03a69e135affcb6f5399cbd2797a5f3  gems/sqlite3-2.9.6-x86_64-darwin.gem
613188ce02f614126ddbc38c5e217ccffd6306d0dcd9adca9764547aa890a634  gems/sqlite3-2.9.6-x86_64-linux-gnu.gem
d493b11818a3573387a1d56e1ee8fa00da23a683a7a1cc063e7a0feeed843abf  gems/sqlite3-2.9.6-x86_64-linux-musl.gem
956fe606956420d04ac7157d3ace620c8caba2135b2e05c76e483493da24d08e  gems/sqlite3-2.9.6.gem

Changelog

Sourced from sqlite3's changelog.

2.9.6 / 2026-08-11

Security / Stability

• Fix a garbage collection bug where the argument array passed to a custom aggregate function's step was not visible to the GC, so arguments could be collected mid-conversion when the aggregate takes two or more arguments, corrupting the values passed to step or crashing the process. See GHSA-mwm8-39rw-8826 for more information. #733 @​jeremy

Fixed

• Fix a leak where custom aggregate handler instances were never released, so a connection accumulated one instance per GROUP BY group per query for its lifetime. #722 @​djmb
• Fix GC compaction issues with custom functions, aggregates, collations, #trace and #authorizer=. These callbacks were registered with sqlite by passing a raw Ruby object pointer as user data; keeping the object reachable prevented collection but not relocation, after which sqlite held a stale address and the next call could raise NoMethodError, return a wrong result, or segfault. Affects applications that call GC.compact or run with GC.auto_compact = true. The equivalent issue in #busy_handler was fixed in #466. #723 @​djmb
• Fix the private methods Database#open_v2 and #open16 silently replacing a live connection and leaking the previous connection handle when invoked via send on an open database. They now raise SQLite3::Exception. #729 @​flavorjones
• Fix TEXT values containing an embedded NUL byte being truncated at the first NUL when passed as arguments to functions created with Database#define_function. #730 @​flavorjones
• Fix an exception raised inside a Database#define_function block leaving the connection's sqlite mutex held, which deadlocked any other thread that later used the connection. The exception now propagates to the caller and the connection remains usable. #731 @​flavorjones
• Database.new now raises ArgumentError when the filename or VFS name contains an embedded NUL byte (or an embedded 0x0000 code unit in a UTF-16 filename), instead of silently opening a path truncated at the NUL. #732 @​flavorjones

Improved

• When Database.new fails to open the database file, the underlying sqlite3 connection handle is now closed immediately instead of waiting for the garbage collector to clean it up. #719 @​katafrakt

Commits

• a52dc0d version bump to v2.9.6
• cc5ac0c Root the aggregate argument array so GC cannot free live values (GHSA-mwm8-39...
• abcb0f6 Reject database filenames and VFS names containing NUL (#732)
• 1d86b7a Raise when open_v2 or open16 is called on an open database (#729)
• 7230171 Stop a raise inside a UDF block from deadlocking other threads (#731)
• 2677f9a Pass TEXT values containing embedded NULs to UDFs intact (#730)
• 3de8f6e doc: update CHANGELOG.md
• ac6bd2f Release aggregate instances when sqlite finishes with them (#722)
• 32460e9 Stop sqlite calling into moved Ruby objects (#723)
• f600993 build(deps-dev): update rubocop-minitest requirement (#727)
• Additional commits viewable in compare view

Updates mini_racer from 0.21.4 to 0.22.1

Changelog

Sourced from mini_racer's changelog.

• 0.22.1 - 27-08-2026

  • Fix building with Clang 22+ and big-endian bigint serialization by making bigint serialization byte-oriented instead of relying on native uint64_t/unsigned long representations
  • Fix Ruby integers at or above 512 bits being silently truncated when passed to JavaScript, and large JavaScript bigints producing an invalid internal value when returned to Ruby
  • Support Ruby and JavaScript bigints up to a 16 MiB magnitude, using allocation-free conversion for common sizes and bounded dynamic storage for larger values

• 0.22.0 - 12-08-2026

  • Add Context#call_await and Context#eval_await: like call/eval but block until a returned Promise settles and return the settled value; rejections raise MiniRacer::RuntimeError
  • Fix a call or eval made from a Ruby callback taking the timeout or stop meant for the evaluation around it, which then kept running
  • Fix a timeout that fires just after its own evaluation ends, where it would stop the next evaluation instead
  • Fix a race introduced in 0.21.4 where a request sent right after a nested dispatch (e.g. perform_microtask_checkpoint or a nested call from an attached callback) could be dropped, deadlocking the context

Commits

• 413b119 version bump
• bfe3414 Add a community section (#439)
• 554923f FIX: support clang 22+ compilation (#434)
• 6ca86db deflake and agents.md
• 3ea3783 Bump actions/checkout from 7.0.0 to 7.0.1 (#437)
• 1491d72 FEATURE: add Context#call_await and Context#eval_await (#441)
• 14209e3 FIX: don't drop requests that arrive before v8_roundtrip is re-entered (#440)
• ff88d42 Bump ruby/setup-ruby from 1.314.0 to 1.319.0 (#436)
• 5bd2f7b Bump ruby/setup-ruby from 1.310.0 to 1.314.0 (#432)
• f32fde4 Bump actions/checkout from 6.0.3 to 7.0.0 (#431)
• Additional commits viewable in compare view

Updates react_on_rails from 17.0.0.rc.6 to 17.1.0.rc.0

Release notes

Sourced from react_on_rails's releases.

v17.1.0.rc.0

Fixed

• [Pro] Expected Node Renderer cold starts no longer emit OpenTelemetry error spans: The ror.bundle.build_execution_context cache-first probe previously ended with status ERROR when a worker had not compiled a bundle's VM context yet, even though the normal cache-miss path then rendered successfully. The probe now treats that expected miss as normal control flow while preserving error spans for genuine failures. #4908 by sashakhar1.

• [Pro] Hydrated Redux stores no longer leak across Turbo/Turbolinks navigations: The hydrated-store registry is now cleared on client-side page unload (soft navigation), alongside the existing component teardown. Previously a leftover entry from the previous page made getOrWaitForStore resolve immediately with the previous page's store, silently defeating the store_dependencies hydration gate — most visibly with deferred stores (redux_store(..., defer: true)), where a mid-page component could render the previous page's Redux state instead of waiting for its own page's hydration data. Registered store generators are unaffected and persist across navigations. Note for apps that relied on a store surviving a soft navigation without re-rendering its hydration data: each page using a store must now render its own redux_store call (the documented model). Fixes #4861. #4871 by AbanoubGhadban.

• On-demand renders initialize only the island's declared store dependencies: reactOnRailsComponentLoaded walked every store element on the page even when asked to render a single component, so an unrelated store element whose generator was not registered (e.g. its bundle had not loaded yet) aborted the requested render, and unrelated new stores were hydrated as a side effect. It now reads the data-store-dependencies attribute the react_component helper already emits (defaulted to the stores registered in the request, or set explicitly with the store_dependencies option) and initializes exactly those stores, matching the Pro renderer's dependency gating; a declared dependency that cannot initialize is logged without aborting the render. Markup without the attribute keeps the previous initialize-every-store behavior, and reactOnRailsPageLoaded/full page loads are unchanged. Completes #4862. #4870 by AbanoubGhadban.

• [Pro] Rails requests to the Node Renderer once again continue OpenTelemetry traces: The async-http transport now creates a CLIENT span and injects W3C trace context for regular and streaming renders, incremental async-props renders, raw-render requests, and asset uploads when the Rails application has configured the OpenTelemetry SDK. OpenTelemetry remains optional, and spans record only the HTTP method, normalized request path, response status, and request/response byte sizes. Fixes #4866. #4869 by sashakhar1.

• [Pro] Node Renderer transport follow-ups now expose protocol errors and accurate Fastify modes: Rails retries continue for network disconnects and peer-reset HTTP/2 streams, while HTTP parser and framing errors surface directly. Public configureFastify callbacks and fastifyServerOptions now reflect both HTTP/1.1 and HTTP/2 runtime modes.

... (truncated)

Commits

• 83e9785 Fix release dry-run gate discovery (#4935)
• 31a8f43 Release: make the safe operator path one command (#4931)
• 8d8daca Release: fence and unblock 17.1.0.rc.0 publication (#4928)
• 8e4358c Bump version to 17.1.0.rc.0
• 4c9b938 Merge remote-tracking branch 'origin/main' into sasha-release-17.1.0-refresh
• 0dd0a0c Fix on-demand renders touching every store: scope initialization to the islan...
• 0182661 Pin the prewarmed renderer generation across rolling deploys (#4811)
• ee81d33 Fix malformed renderer URL credential redaction (#4845)
• 39399e9 Silence routine startup diagnostics for Rails commands (#4849)
• 9d2f878 Detect unnoticed changes across generated webpack/Rspack configs (#4839)
• Additional commits viewable in compare view

Updates terser from 1.2.7 to 1.2.8

Changelog

Sourced from terser's changelog.

1.2.8 (08 July 2026)

• update TerserJS to [5.49.0]

Commits

• 3b834aa Merge pull request #68 from ahorek/terser5490
• dbdc8a1 update ruby matrix
• a12a175 add new compress options
• 29c83c1 terser 5.49.0
• See full diff in compare view

Updates bootsnap from 1.24.6 to 1.25.0

Release notes

Sourced from bootsnap's releases.

v1.25.0

What's Changed

• Improve YAML parsing cache to more efficiently handle Time, Date and DateTime.

• Don't invalidate the compile cache when YJIT is toggled. YJIT is a runtime JIT and doesn't change the serialized instruction sequences that are cached, but enabling it (via --yjit, RUBYOPT, or RubyVM::YJIT.enable) adds a +YJIT marker to RUBY_DESCRIPTION ( +YJIT <token> on YJIT_SUPPORT builds), which is part of the cache key. This previously discarded the entire compile cache whenever YJIT was enabled at runtime but not at precompile time (or vice versa). The marker is now stripped before hashing.

• Fix CompileCache::Native.fetch and .precompile reading a non-String path argument (e.g. a Pathname) with RSTRING_PTR. Regression from 1.24.0.

Full Changelog: rails/bootsnap@v1.24.6...v1.25.0

Changelog

Sourced from bootsnap's changelog.

1.25.0

• Improve YAML parsing cache to more efficiently handle Time, Date and DateTime.

• Don't invalidate the compile cache when YJIT is toggled. YJIT is a runtime JIT and doesn't change the serialized instruction sequences that are cached, but enabling it (via --yjit, RUBYOPT, or RubyVM::YJIT.enable) adds a +YJIT marker to RUBY_DESCRIPTION ( +YJIT <token> on YJIT_SUPPORT builds), which is part of the cache key. This previously discarded the entire compile cache whenever YJIT was enabled at runtime but not at precompile time (or vice versa). The marker is now stripped before hashing.

• Fix CompileCache::Native.fetch and .precompile reading a non-String path argument (e.g. a Pathname) with RSTRING_PTR. Regression from 1.24.0.

Commits

• e099ec7 Release 1.25.0
• b694a11 Merge pull request #563 from stanhu/sh-ignore-yjit-in-compile-cache-key
• 51898f9 Ignore YJIT status in the compile cache key
• 1ad589b Merge pull request #560 from rails/hm-qnqlnylzkqkltqsz
• 21fbd65 Merge pull request #561 from jeremy/fix-path-conversion-entry-points
• 4898853 Convert the path argument in the frame that reads it
• 8ee47c4 Add MessagePack::Bigint type
• 49e3eb7 Replace Date Marshalling with recursive msgpack
• 711fd0b Bump minimum msgpack to 1.5.0
• 160fc10 Merge pull request #558 from viralpraxis/fix-yaml-cache-kwargs-mutation
• Additional commits viewable in compare view

Updates shakapacker from 10.2.0 to 10.3.2

Release notes

Sourced from shakapacker's releases.

v10.3.2

Changed

• Bumped the development and CI pin for Rspack from 2.0.1 to 2.2.0. [PR #1258](shakacode/shakapacker#1258) by justin808. The @rspack/core, @rspack/cli, @rspack/dev-server, and @rspack/plugin-react-refresh peer ranges are unchanged at ^2.0.0, so applications may stay on any Rspack 2.x release; only this repository's own development pins and dummy-app lockfiles move, so CI now exercises Rspack 2.2 against the range it already advertises. Annotated config exports (bin/shakapacker-config --annotate) also now list the complete optimization.moduleIds and optimization.chunkIds value sets for both bundlers, including 'compat-hashed', which requires Rspack 2.2 or newer and is documented as opt-in rather than made a default.

Fixed

• Fixed shakapacker:doctor not telling Rspack apps that a .swcrc is ignored outright. [PR #1276](shakacode/shakapacker#1276) by justin808. Doctor previously told Rspack apps only that moving .swcrc settings into config/swc.config.js would not help, while deliberately making no claim about the .swcrc itself, because the behavior had never been verified. It has now been verified against @rspack/core 2.0.1 and 2.2.0: Rspack's builtin:swc-loader never reads .swcrc. A .swcrc setting jsc.target and injecting an optimizer global produced byte-identical output to no .swcrc at all, while the same options passed inline as loader options did change the output. A .swcrc enabling decorator syntax likewise failed to unblock a decorator source, including with empty loader options and with swcrc/configFile set, so this is not merely inline options taking precedence. Doctor now states that a .swcrc is not read on Rspack and that every setting in it is silently inert - the mirror image of the config/swc.config.js case in #1259 - and continues to point at overriding the built-in builtin:swc-loader rule. Webpack messaging is unchanged. Fixes #1263.
• Fixed shakapacker:doctor staying silent about SWC configuration on Rspack apps that do not set javascript_transpiler: swc. [PR #1269](shakacode/shakapacker#1269) by justin808. Shakapacker's Rspack rules always transpile with builtin:swc-loader and never consult javascript_transpiler, so config/swc.config.js goes unread on an Rspack app configured for Babel or esbuild exactly as it does on one configured for SWC. Doctor's Rspack SWC-configuration warnings were gated on javascript_transpiler: swc, so those apps got no warning at all. Those warnings now reach any Rspack app: that config/swc.config.js is not read, and, for a .swcrc, that moving its settings into config/swc.config.js would not affect the build. The webpack-only SWC content checks and the "merged with Shakapacker's defaults" messaging stay gated on javascript_transpiler: swc, and apps with javascript_transpiler: none remain opted out. Fixes #1265.
• Fixed shakapacker:doctor and rake shakapacker:migrate_to_swc telling Rspack apps that config/swc.config.js is merged into their build. [PR #1260](shakacode/shakapacker#1260) by justin808. Rspack builds never read config/swc.config.js, because Shakapacker's Rspack rules set their builtin:swc-loader options inline. Doctor now warns that the file is unread on Rspack instead of reporting it as merged (and skips its content checks there), and no longer tells Rspack users with a .swcrc to migrate those settings into config/swc.config.js. The migrator's post-migration guidance and the generated file header instead show how to override the built-in builtin:swc-loader rule: apply webpack-merge's mergeWithRules to the output of generateRspackConfig(), since that function merges with plain merge, which concatenates module.rules, so an override passed into it is appended alongside the built-in rule rather than replacing it. Webpack apps keep the existing messaging. Fixes #1259.
• Fixed post-publish GitHub release failures hiding successful package publication details. The release task now prints its normal publication summary and the exact sync_github_release recovery command before exiting nonzero. [PR #1250](shakacode/shakapacker#1250) by justin808.
• Fixed helper binstubs to fail closed when PATH is unset. [PR #1240](shakacode/shakapacker#1240) by justin808. bin/shakapacker-config and bin/diff-bundler-config now report the missing-Node error without executing an app-root node binary when PATH is unset, while explicit PATH values retain their existing Node-resolution behavior. Fixes #1234.
• Fixed the deprecation warning for the legacy bundler config key claiming the value was understood while it was ignored. [PR #1270](shakacode/shakapacker#1270) by justin808. An app whose config/shakapacker.yml set only bundler: was told the key was deprecated and then built with a different bundler, because assets_bundler always resolves from the bundled defaults and the legacy key was never read. The warning now states that the value is ignored, names the bundler actually in use, and tells you to set assets_bundler instead. One resolution change accompanies it: a config that leaves assets_bundler: blank while setting bundler: previously resolved the legacy value in Ruby and now resolves webpack, matching what package/config.ts already built for it. Fixes #1262.

v10.3.1

Fixed

• Fixed 502 responses for proxied dev server assets under rack-proxy v1. [PR #1222](shakacode/shakapacker#1222) by jcbpl. Fixes #1220.
• Fixed dev-server liveness checks treating refused macOS 27 connections as running. The Ruby probe now verifies the connected socket's SO_ERROR result before proxying asset requests, avoiding false-positive dev-server detection and resulting 502 responses. [PR #1225](shakacode/shakapacker#1225) by justin808. Fixes #1224.
• Fixed webpack Babel, SWC, and esbuild rules skipping explicitly included .cjs files. [PR #1219](shakacode/shakapacker#1219) by oiahoon. Fixes #1218.
• Added a shakapacker:doctor warning for Rspack React Refresh v2 configs that still use the v1 default-export constructor pattern. [PR #1207](shakacode/shakapacker#1207) by justin808. Existing configs with const ReactRefreshPlugin = require("@rspack/plugin-react-refresh") followed by new ReactRefreshPlugin() can fail after upgrading to @rspack/plugin-react-refresh v2 with ReactRefreshPlugin is not a constructor; Doctor now points to the affected JS/TS config file and suggests the named-export/default/module compatibility form. Fixes #1204.
• Fixed the missing-@babel/core failure to report an actionable install message. [PR #1212](shakacode/shakapacker#1212) by justin808. Babel-transpiled builds whose app lacks @babel/core previously surfaced a raw module-resolution error from the Babel 8 compatibility check; the rule now explains which package to install and how to switch javascript_transpiler instead. Refs #1163.

Documentation

• Documented the required css-loader@^7.1.4 in the v10 Rspack upgrade instructions. [PR #1211](shakacode/shakapacker#1211) by justin808. The v10 upgrade guide's copy-paste Rspack v2 commands omitted css-loader, so apps following them could upgrade into an unsatisfied peer dependency.

v10.3.0

Added

• Allowed webpack-dev-server v6. [PR #1102](shakacode/shakapacker#1102) by G-Rath.

Fixed

• Fixed implicit SWC defaults for existing webpack/Babel apps without swc-loader. [PR #1206](shakacode/shakapacker#1206) by justin808. Webpack apps that omit both javascript_transpiler and the deprecated webpack_loader now fall back to Babel with a warning when Shakapacker's bundled SWC default is active, swc-loader is missing, and Babel is present. Explicit transpiler settings, webpack apps with swc-loader, and Rspack's built-in SWC path keep their existing behavior. Closes #1203.
• Fixed JavaScript config loading for missing Rails environments to use the production fallback. [PR #1206](shakacode/shakapacker#1206) by justin808. When RAILS_ENV has no matching section in config/shakapacker.yml, the Node package config now merges the production section instead of only bundled defaults, matching Ruby configuration loading and honoring explicit production javascript_transpiler, source_path, dev_server, and related settings for custom environments such as staging.
• Fixed helper binstubs delegating Node resolution to Ruby exec in unset and empty PATH environments. [PR #1200](shakacode/shakapacker#1200) and [PR #1201](shakacode/shakapacker#1201) by justin808. Restores shell-compatible Node lookup for bin/shakapacker-config and bin/diff-bundler-config after the v10.2.0 Ruby-binstub regression, while keeping friendly missing-Node errors for ENOENT and EACCES.

Changelog

Sourced from shakapacker's changelog.

[v10.3.2] - August 28, 2026

Changed

• Bumped the development and CI pin for Rspack from 2.0.1 to 2.2.0. [PR #1258](shakacode/shakapacker#1258) by justin808. The @rspack/core, @rspack/cli, @rspack/dev-server, and @rspack/plugin-react-refresh peer ranges are unchanged at ^2.0.0, so applications may stay on any Rspack 2.x release; only this repository's own development pins and dummy-app lockfiles move, so CI now exercises Rspack 2.2 against the range it already advertises. Annotated config exports (bin/shakapacker-config --annotate) also now list the complete optimization.moduleIds and optimization.chunkIds value sets for both bundlers, including 'compat-hashed', which requires Rspack 2.2 or newer and is documented as opt-in rather than made a default.

Fixed

• Fixed shakapacker:doctor not telling Rspack apps that a .swcrc is ignored outright. [PR #1276](shakacode/shakapacker#1276) by justin808. Doctor previously told Rspack apps only that moving .swcrc settings into config/swc.config.js would not help, while deliberately making no claim about the .swcrc itself, because the behavior had never been verified. It has now been verified against @rspack/core 2.0.1 and 2.2.0: Rspack's builtin:swc-loader never reads .swcrc. A .swcrc setting jsc.target and injecting an optimizer global produced byte-identical output to no .swcrc at all, while the same options passed inline as loader options did change the output. A .swcrc enabling decorator syntax likewise failed to unblock a decorator source, including with empty loader options and with swcrc/configFile set, so this is not merely inline options taking precedence. Doctor now states that a .swcrc is not read on Rspack and that every setting in it is silently inert - the mirror image of the config/swc.config.js case in #1259 - and continues to point at overriding the built-in builtin:swc-loader rule. Webpack messaging is unchanged. Fixes #1263.
• Fixed shakapacker:doctor staying silent about SWC configuration on Rspack apps that do not set javascript_transpiler: swc. [PR #1269](shakacode/shakapacker#1269) by justin808. Shakapacker's Rspack rules always transpile with builtin:swc-loader and never consult javascript_transpiler, so config/swc.config.js goes unread on an Rspack app configured for Babel or esbuild exactly as it does on one configured for SWC. Doctor's Rspack SWC-configuration warnings were gated on javascript_transpiler: swc, so those apps got no warning at all. Those warnings now reach any Rspack app: that config/swc.config.js is not read, and, for a .swcrc, that moving its settings into config/swc.config.js would not affect the build. The webpack-only SWC content checks and the "merged with Shakapacker's defaults" messaging stay gated on javascript_transpiler: swc, and apps with javascript_transpiler: none remain opted out. Fixes #1265.
• Fixed shakapacker:doctor and rake shakapacker:migrate_to_swc telling Rspack apps that config/swc.config.js is merged into their build. [PR #1260](shakacode/shakapacker#1260) by justin808. Rspack builds never read config/swc.config.js, because Shakapacker's Rspack rules set their builtin:swc-loader options inline. Doctor now warns that the file is unread on Rspack instead of reporting it as merged (and skips its content checks there), and no longer tells Rspack users with a .swcrc to migrate those settings into config/swc.config.js. The migrator's post-migration guidance and the generated file header instead show how to override the built-in builtin:swc-loader rule: apply webpack-merge's mergeWithRules to the output of generateRspackConfig(), since that function merges with plain merge, which concatenates module.rules, so an override passed into it is appended alongside the built-in rule rather than replacing it. Webpack apps keep the existing messaging. Fixes #1259.
• Fixed post-publish GitHub release failures hiding successful package publication details. The release task now prints its normal publication summary and the exact sync_github_release recovery command before exiting nonzero. [PR #1250](shakacode/shakapacker#1250) by justin808.
• Fixed helper binstubs to fail closed when PATH is unset. [PR #1240](shakacode/shakapacker#1240) by justin808. bin/shakapacker-config and bin/diff-bundler-config now report the missing-Node error without executing an app-root node binary when PATH is unset, while explicit PATH values retain their existing Node-resolution behavior. Fixes #1234.
• Fixed the deprecation warning for the legacy bundler config key claiming the value was understood while it was ignored. [PR #1270](shakacode/shakapacker#1270) by justin808. An app whose config/shakapacker.yml set only bundler: was told the key was deprecated and then built with a different bundler, because assets_bundler always resolves from the bundled defaults and the legacy key was never read. The warning now states that the value is ignored, names the bundler actually in use, and tells you to set assets_bundler instead. One resolution change accompanies it: a config that leaves assets_bundler: blank while setting bundler: previously resolved the legacy value in Ruby and now resolves webpack, matching what package/config.ts already built for it. Fixes #1262.

[v10.3.1] - August 3, 2026

Fixed

• Fixed 502 responses for proxied dev server assets under rack-proxy v1. [PR #1222](shakacode/shakapacker#1222) by jcbpl. Fixes #1220.
• Fixed dev-server liveness checks treating refused macOS 27 connections as running. The Ruby probe now verifies the connected socket's SO_ERROR result before proxying asset requests, avoiding false-positive dev-server detection and resulting 502 responses. [PR #1225](shakacode/shakapacker#1225) by justin808. Fixes #1224.
• Fixed webpack Babel, SWC, and esbuild rules skipping explicitly included .cjs files. [PR #1219](shakacode/shakapacker#1219) by oiahoon. Fixes #1218.
• Added a shakapacker:doctor warning for Rspack React Refresh v2 configs that still use the v1 default-export constructor pattern. [PR #1207](shakacode/shakapacker#1207) by justin808. Existing configs with const ReactRefreshPlugin = require("@rspack/plugin-react-refresh") followed by new ReactRefreshPlugin() can fail after upgrading to @rspack/plugin-react-refresh v2 with ReactRefreshPlugin is not a constructor; Doctor now points to the affected JS/TS config file and suggests the named-export/default/module compatibility form. Fixes #1204.
• Fixed the missing-@babel/core failure to report an actionable install message. [PR #1212](shakacode/shakapacker#1212) by justin808. Babel-transpiled builds whose app lacks @babel/core previously surfaced a raw module-resolution error from the Babel 8 compatibility check; the rule now explains which package to install and how to switch javascript_transpiler instead. Refs #1163.

Documentation

• Documented the required css-loader@^7.1.4 in the v10 Rspack upgrade instructions. [PR #1211](shakacode/shakapacker#1211) by justin808. The v10 upgrade guide's copy-paste Rspack v2 commands omitted css-loader, so apps following them could upgrade into an unsatisfied peer dependency.

[v10.3.0] - July 5, 2026

Added

• Allowed webpack-dev-server v6. [PR #1102](shakacode/shakapacker#1102) by G-Rath.

Fixed

• Fixed implicit SWC defaults for existing webpack/Babel apps without swc-loader. [PR #1206](shakacode/shakapacker#1206) by justin808. Webpack apps that omit both javascript_transpiler and the deprecated webpack_loader now fall back to Babel with a warning when Shakapacker's bundled SWC default is active, swc-loader is missing, and Babel is present. Explicit transpiler settings, webpack apps with swc-loader, and Rspack's built-in SWC path keep their existing behavior. Closes #1203.
• Fixed JavaScript config loading for missing Rails environments to use the production fallback. [PR #1206](shakacode/shakapacker#1206) by justin808. When RAILS_ENV has no matching section in config/shakapacker.yml, the Node package config now merges the production section instead of only bundled defaults, matching Ruby configuration loading and honoring explicit production javascript_transpiler, source_path, dev_server, and related settings for custom environments such as staging.
• Fixed helper binstub Node resolution after the v10.2.0 Ruby-binstub regression. [PR #1200](shakacode/shakapacker#1200) and [PR #1201](shakacode/shakapacker#1201) by justin808. Restores shell-compatible Node lookup for bin/shakapacker-config and bin/diff-bundler-config when PATH is empty, while keeping friendly missing-Node errors for ENOENT and EACCES. For an unset PATH, PR #1200 deliberately delegates Node resolution to Ruby exec's default-path behavior; PR #1240 later changed that case to fail closed.

Commits

• f152fe6 Release 10.3.2
• 594a691 Update changelog for 10.3.2 (#1278)
• 843409a Tell Rspack apps that .swcrc is ignored outright, not just unmigratable (#1276)
• ee6bba9 Warn Rspack apps that SWC config files are unread for any javascript_transpil...
• ac81bcf Fix the misleading deprecation warning for the ignored legacy bundler key (#1...
• 7eddfe1 Document how to override builtin:swc-loader options on Rspack (#1267)
• 24f3c2e Trigger Node based checks on markdown-only pull requests (#1266)
• 8d6ed80 Make AGENTS.md canonical for shared agent guidance (#1244)
• 980c194 Document rspack 2.2 user-facing changes: SWC Wasm plugin break, rspackPublicP...
• d51c1a8 Bump rspack dev pin from 2.0.1 to 2.2.0 and correct moduleIds/chunkIds config...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and optionsDescription has been truncated

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.