[dependabot]

Bumps the ruby group with 7 updates in the / directory:

Package	From	To
rails	8.1.3	8.1.4
bigdecimal	4.1.2	4.1.3
sqlite3	2.9.5	2.9.6
mini_racer	0.21.4	0.22.1
terser	1.2.7	1.2.8
bootsnap	1.24.6	1.26.0
shakapacker	10.2.0	10.3.2

Updates rails from 8.1.3 to 8.1.4

Release notes

Sourced from rails's releases.

8.1.4

Active Support

• Fix the debug error page rendering for SyntaxErrors with multi-line messages.

  Marco Roth

• Make ActiveSupport::JSON.decode compatible with the upcoming json 3.0 gem.

  Earlopain

• Fix number_to_human_size crashing for sizes above a terabyte by supporting petabyte, exabyte, and zettabyte storage units.

  Kenta Ishizaki

• Fix Range#sole raising NoMethodError when the enumerable core extension isn't already loaded.

  Kenta Ishizaki

• Fix ActiveSupport::Cache::FileStore raising NameError for FileUtils when fileutils isn't already loaded.

  Kenta Ishizaki

• Fix Enumerable#in_order_of with filter: true dropping nil elements explicitly named in the series.

  Kenta Ishizaki

• Keep HashWithIndifferentAccess#filter returning a HashWithIndifferentAccess instead of a plain Hash.

  Kenta Ishizaki

• Fix number_to_human and number_to_human_size crashing when :precision is nil.

  Kenta Ishizaki

• Fix ActiveSupport::InheritableOptions#to_h to recursively flatten nested InheritableOptions parents.

  Andrew Novoselac

• Fix ActiveSupport::StructuredEventSubscriber.debug_only leaking debug-only methods across subscriber subclasses.

  Kenta Ishizaki

... (truncated)

Commits

• c3466ea Preparing for 8.1.4 release
• 334dc3e Merge pull request #58854 from carlosdanielpohlod/strict-locals-ascii-only-body
• 8df6693 Merge pull request #58827 from rails/backport-alias-fallback-8-1-stable
• 2ed2c88 Define read_attribute_for_validation instead of aliasing send
• 2616145 Merge pull request #56705 from p8/activemodel/fix-read-attr-for-serialization...
• 20abac3 Merge pull request #58817 from yahonda/fix-alias-fallback-to-object-in-attrib...
• 2670772 Merge pull request #58733 from kwestein/create-or-find-by-deadlock
• 8236300 Merge pull request #58806 from Shopify/hm-wnqzpryypymkrxtn
• e6288a8 Update CHANGELOGs for 8-1-stable backports
• 44a7fd4 Merge pull request #58799 from e-akashsaini/fix-tuple-where-key-corrupting-at...
• Additional commits viewable in compare view

Updates bigdecimal from 4.1.2 to 4.1.3

Release notes

Sourced from bigdecimal's releases.

v4.1.3

What's Changed

• Stop use RB_GC_GUARD on uninitialized value by @​tompng in ruby/bigdecimal#536
• Fix unused-but-set-global warnings in clang-23 by @​nobu in ruby/bigdecimal#540
• Declare TypedData with RUBY_TYPED_THREAD_SAFE_FREE by @​byroot in ruby/bigdecimal#541
• Bit-burst algorithm version of BigMath.erf and BigMath.erfc by @​tompng in ruby/bigdecimal#458
• Keep Newton division divisor alive by @​OskarEichler in ruby/bigdecimal#548
• Correct nullable BigDecimal conversion signature by @​OskarEichler in ruby/bigdecimal#551
• Fix out-of-bounds write in Newton-Raphson division, Improve normalize by @​tompng in ruby/bigdecimal#553
• Fix precision loss in Newton-Raphson inverse by @​tompng in ruby/bigdecimal#552
• Honor exception: false for complex conversion by @​OskarEichler in ruby/bigdecimal#549
• Honor exception: false for strings with null bytes by @​OskarEichler in ruby/bigdecimal#550
• Guard string VALUEs while parsing their C string by @​tompng in ruby/bigdecimal#556
• Make String#to_d accept embedded NUL bytes and reject ASCII-incompatible strings by @​tompng in ruby/bigdecimal#557
• Faster gamma calculation by @​tompng in ruby/bigdecimal#524
• Bump version to v4.1.3 by @​tompng in ruby/bigdecimal#558

New Contributors

• @​OskarEichler made their first contribution in ruby/bigdecimal#548

Full Changelog: ruby/bigdecimal@v4.1.2...v4.1.3

Changelog

Sourced from bigdecimal's changelog.

4.1.3

• Faster gamma and lgamma calculation using Lagrange interpolation GH-524

  @​tompng

• Bit-burst algorithm version of BigMath.erf and BigMath.erfc GH-458

  @​tompng

• Fix Newton-Raphson division bugs: precision loss, out-of-bounds write, and missing GC guard for the divisor GH-548 GH-552 GH-553

  @​OskarEichler @​tompng

• Fix GC safety issues around RB_GC_GUARD and string arguments GH-536 GH-556

  @​tompng

• Honor exception: false for Complex and strings with null bytes GH-549 GH-550

  @​OskarEichler

• Make String#to_d accept embedded NUL bytes and reject ASCII-incompatible strings GH-557

  @​tompng

• Correct nullable BigDecimal conversion RBS signature GH-551

  @​OskarEichler

• Declare TypedData with RUBY_TYPED_THREAD_SAFE_FREE GH-541

  @​byroot

• Fix unused-but-set-global warnings in clang-23 GH-540

  @​nobu

Commits

• 8ed99ea Bump version to v4.1.3 (#558)
• 60829da Faster gamma calculation (#524)
• 00d26a2 Make String#to_d accept embedded NUL bytes and reject ASCII-incompatible stri...
• 7471291 Guard string VALUEs while parsing their C string (#556)
• d2f2d20 Honor exception: false for strings with null bytes (#550)
• 0d5a486 Honor exception: false for complex conversion (#549)
• d345bb3 Merge pull request #555 from ruby/dependabot/github_actions/step-security/har...
• fc595d3 Bump step-security/harden-runner from 2.21.0 to 2.21.1
• 4799dd5 Fix precision loss in Newton-Raphson inverse (#552)
• 881af5c Bump step-security/harden-runner from 2.20.0 to 2.21.0 (#546)
• Additional commits viewable in compare view

Updates sqlite3 from 2.9.5 to 2.9.6

Release notes

Sourced from sqlite3's releases.

2.9.6 / 2026-08-11

Security / Stability

• Fix a garbage collection bug where the argument array passed to a custom aggregate function's step was not visible to the GC, so arguments could be collected mid-conversion when the aggregate takes two or more arguments, corrupting the values passed to step or crashing the process. See GHSA-mwm8-39rw-8826 for more information. #733 @​jeremy

Fixed

• Fix a leak where custom aggregate handler instances were never released, so a connection accumulated one instance per GROUP BY group per query for its lifetime. #722 @​djmb
• Fix GC compaction issues with custom functions, aggregates, collations, #trace and #authorizer=. These callbacks were registered with sqlite by passing a raw Ruby object pointer as user data; keeping the object reachable prevented collection but not relocation, after which sqlite held a stale address and the next call could raise NoMethodError, return a wrong result, or segfault. Affects applications that call GC.compact or run with GC.auto_compact = true. The equivalent issue in #busy_handler was fixed in #466. #723 @​djmb
• Fix the private methods Database#open_v2 and #open16 silently replacing a live connection and leaking the previous connection handle when invoked via send on an open database. They now raise SQLite3::Exception. #729 @​flavorjones
• Fix TEXT values containing an embedded NUL byte being truncated at the first NUL when passed as arguments to functions created with Database#define_function. #730 @​flavorjones
• Fix an exception raised inside a Database#define_function block leaving the connection's sqlite mutex held, which deadlocked any other thread that later used the connection. The exception now propagates to the caller and the connection remains usable. #731 @​flavorjones
• Database.new now raises ArgumentError when the filename or VFS name contains an embedded NUL byte (or an embedded 0x0000 code unit in a UTF-16 filename), instead of silently opening a path truncated at the NUL. #732 @​flavorjones

Improved

• When Database.new fails to open the database file, the underlying sqlite3 connection handle is now closed immediately instead of waiting for the garbage collector to clean it up. #719 @​katafrakt

d8b1f7d23efd7abac285775a9566562fc7debfef79d594e3a20354406fb7907c  gems/sqlite3-2.9.6-aarch64-linux-gnu.gem
3579e1c98cdc7ff5c3722847bb63ed4e1efb7ff675cb5e1e48ef2d4da5fb3bc9  gems/sqlite3-2.9.6-aarch64-linux-musl.gem
33541500e3615da02afe54a9cc38b17a6985d3cf9d8b76d6d0a83002f114e7ec  gems/sqlite3-2.9.6-arm-linux-gnu.gem
c5490af48bb228fefa54314e9541375c3907e70f8109f3881b5ff97e1c93ae33  gems/sqlite3-2.9.6-arm-linux-musl.gem
849b5d7f795e60fe25076d62c72dd722beb45b3850b516ad978d60ee848ec15b  gems/sqlite3-2.9.6-arm64-darwin.gem
1f2b88f417fd0a8c1d5ef19c7e817d8b9c61bee6e33b6b36255fb6e40148e6f8  gems/sqlite3-2.9.6-x64-mingw-ucrt.gem
fbaa9f46f9708f57dd8a459b37fc269f9613e0cacf1547df01aa439cc45c20c0  gems/sqlite3-2.9.6-x86-linux-gnu.gem
6715026fbb5530e810b28ef43b9c4f84cd3c991f67b9d808a31fcc32b847abbd  gems/sqlite3-2.9.6-x86-linux-musl.gem
b5842fea77781c14da03fa7bc0feb82db03a69e135affcb6f5399cbd2797a5f3  gems/sqlite3-2.9.6-x86_64-darwin.gem
613188ce02f614126ddbc38c5e217ccffd6306d0dcd9adca9764547aa890a634  gems/sqlite3-2.9.6-x86_64-linux-gnu.gem
d493b11818a3573387a1d56e1ee8fa00da23a683a7a1cc063e7a0feeed843abf  gems/sqlite3-2.9.6-x86_64-linux-musl.gem
956fe606956420d04ac7157d3ace620c8caba2135b2e05c76e483493da24d08e  gems/sqlite3-2.9.6.gem

Changelog

Sourced from sqlite3's changelog.

2.9.6 / 2026-08-11

Security / Stability

• Fix a garbage collection bug where the argument array passed to a custom aggregate function's step was not visible to the GC, so arguments could be collected mid-conversion when the aggregate takes two or more arguments, corrupting the values passed to step or crashing the process. See GHSA-mwm8-39rw-8826 for more information. #733 @​jeremy

Fixed

• Fix a leak where custom aggregate handler instances were never released, so a connection accumulated one instance per GROUP BY group per query for its lifetime. #722 @​djmb
• Fix GC compaction issues with custom functions, aggregates, collations, #trace and #authorizer=. These callbacks were registered with sqlite by passing a raw Ruby object pointer as user data; keeping the object reachable prevented collection but not relocation, after which sqlite held a stale address and the next call could raise NoMethodError, return a wrong result, or segfault. Affects applications that call GC.compact or run with GC.auto_compact = true. The equivalent issue in #busy_handler was fixed in #466. #723 @​djmb
• Fix the private methods Database#open_v2 and #open16 silently replacing a live connection and leaking the previous connection handle when invoked via send on an open database. They now raise SQLite3::Exception. #729 @​flavorjones
• Fix TEXT values containing an embedded NUL byte being truncated at the first NUL when passed as arguments to functions created with Database#define_function. #730 @​flavorjones
• Fix an exception raised inside a Database#define_function block leaving the connection's sqlite mutex held, which deadlocked any other thread that later used the connection. The exception now propagates to the caller and the connection remains usable. #731 @​flavorjones
• Database.new now raises ArgumentError when the filename or VFS name contains an embedded NUL byte (or an embedded 0x0000 code unit in a UTF-16 filename), instead of silently opening a path truncated at the NUL. #732 @​flavorjones

Improved

• When Database.new fails to open the database file, the underlying sqlite3 connection handle is now closed immediately instead of waiting for the garbage collector to clean it up. #719 @​katafrakt

Commits

• a52dc0d version bump to v2.9.6
• cc5ac0c Root the aggregate argument array so GC cannot free live values (GHSA-mwm8-39...
• abcb0f6 Reject database filenames and VFS names containing NUL (#732)
• 1d86b7a Raise when open_v2 or open16 is called on an open database (#729)
• 7230171 Stop a raise inside a UDF block from deadlocking other threads (#731)
• 2677f9a Pass TEXT values containing embedded NULs to UDFs intact (#730)
• 3de8f6e doc: update CHANGELOG.md
• ac6bd2f Release aggregate instances when sqlite finishes with them (#722)
• 32460e9 Stop sqlite calling into moved Ruby objects (#723)
• f600993 build(deps-dev): update rubocop-minitest requirement (#727)
• Additional commits viewable in compare view

Updates mini_racer from 0.21.4 to 0.22.1

Changelog

Sourced from mini_racer's changelog.

• 0.22.1 - 27-08-2026

  • Fix building with Clang 22+ and big-endian bigint serialization by making bigint serialization byte-oriented instead of relying on native uint64_t/unsigned long representations
  • Fix Ruby integers at or above 512 bits being silently truncated when passed to JavaScript, and large JavaScript bigints producing an invalid internal value when returned to Ruby
  • Support Ruby and JavaScript bigints up to a 16 MiB magnitude, using allocation-free conversion for common sizes and bounded dynamic storage for larger values

• 0.22.0 - 12-08-2026

  • Add Context#call_await and Context#eval_await: like call/eval but block until a returned Promise settles and return the settled value; rejections raise MiniRacer::RuntimeError
  • Fix a call or eval made from a Ruby callback taking the timeout or stop meant for the evaluation around it, which then kept running
  • Fix a timeout that fires just after its own evaluation ends, where it would stop the next evaluation instead
  • Fix a race introduced in 0.21.4 where a request sent right after a nested dispatch (e.g. perform_microtask_checkpoint or a nested call from an attached callback) could be dropped, deadlocking the context

Commits

• 413b119 version bump
• bfe3414 Add a community section (#439)
• 554923f FIX: support clang 22+ compilation (#434)
• 6ca86db deflake and agents.md
• 3ea3783 Bump actions/checkout from 7.0.0 to 7.0.1 (#437)
• 1491d72 FEATURE: add Context#call_await and Context#eval_await (#441)
• 14209e3 FIX: don't drop requests that arrive before v8_roundtrip is re-entered (#440)
• ff88d42 Bump ruby/setup-ruby from 1.314.0 to 1.319.0 (#436)
• 5bd2f7b Bump ruby/setup-ruby from 1.310.0 to 1.314.0 (#432)
• f32fde4 Bump actions/checkout from 6.0.3 to 7.0.0 (#431)
• Additional commits viewable in compare view

Updates terser from 1.2.7 to 1.2.8

Changelog

Sourced from terser's changelog.

1.2.8 (08 July 2026)

• update TerserJS to [5.49.0]

Commits

• 3b834aa Merge pull request #68 from ahorek/terser5490
• dbdc8a1 update ruby matrix
• a12a175 add new compress options
• 29c83c1 terser 5.49.0
• See full diff in compare view

Updates bootsnap from 1.24.6 to 1.26.0

Release notes

Sourced from bootsnap's releases.

v1.26.0

What's Changed

• Handle top level Coverage constant being defined, but without it being the true stdlib coverage module.
• Fix bootsnap precompile that could generate a corrupted cache entry if an already cached YAML file was modified without changing its size.
• Workaround a potential Ruby SEGV if Bootsnap.instrumentation raised an error.

v1.25.0

What's Changed

• Improve YAML parsing cache to more efficiently handle Time, Date and DateTime.

• Don't invalidate the compile cache when YJIT is toggled. YJIT is a runtime JIT and doesn't change the serialized instruction sequences that are cached, but enabling it (via --yjit, RUBYOPT, or RubyVM::YJIT.enable) adds a +YJIT marker to RUBY_DESCRIPTION ( +YJIT <token> on YJIT_SUPPORT builds), which is part of the cache key. This previously discarded the entire compile cache whenever YJIT was enabled at runtime but not at precompile time (or vice versa). The marker is now stripped before hashing.

• Fix CompileCache::Native.fetch and .precompile reading a non-String path argument (e.g. a Pathname) with RSTRING_PTR. Regression from 1.24.0.

Full Changelog: rails/bootsnap@v1.24.6...v1.25.0

Changelog

Sourced from bootsnap's changelog.

1.26.0

• Handle top level Coverage constant being defined, but without it being the true stdlib coverage module.
• Fix bootsnap precompile that could generate a corrupted cache entry if an already cached YAML file was modified without changing its size.
• Workaround a potential Ruby SEGV if Bootsnap.instrumentation raised an error.

1.25.0

• Improve YAML parsing cache to more efficiently handle Time, Date and DateTime.

• Don't invalidate the compile cache when YJIT is toggled. YJIT is a runtime JIT and doesn't change the serialized instruction sequences that are cached, but enabling it (via --yjit, RUBYOPT, or RubyVM::YJIT.enable) adds a +YJIT marker to RUBY_DESCRIPTION ( +YJIT <token> on YJIT_SUPPORT builds), which is part of the cache key. This previously discarded the entire compile cache whenever YJIT was enabled at runtime but not at precompile time (or vice versa). The marker is now stripped before hashing.

• Fix CompileCache::Native.fetch and .precompile reading a non-String path argument (e.g. a Pathname) with RSTRING_PTR. Regression from 1.24.0.

Commits

• 67a7290 Release 1.26.0
• 1881b9a Merge pull request #573 from byroot/same-size-miscompilation
• 605bbeb Fix precompilation when regenerating an existing cache entry of the same size
• 5fd59da Merge pull request #569 from OskarEichler/codex/accept-tempfile-fd-zero
• 70550c7 Merge pull request #568 from OskarEichler/codex/remove-umask-debug-output
• 8aed2ed Accept tempfile descriptor zero
• f7457ea Remove umask debug output
• 9ee62a2 Merge pull request #567 from byroot/rename-mod
• 7c8178e Handle write(2) being interrupted.
• 3e755ca atomic_write_cache_file: stop leaking FD on error
• Additional commits viewable in compare view

Updates shakapacker from 10.2.0 to 10.3.2

Release notes

Sourced from shakapacker's releases.

v10.3.2

Changed

• Bumped the development and CI pin for Rspack from 2.0.1 to 2.2.0. [PR #1258](shakacode/shakapacker#1258) by justin808. The @rspack/core, @rspack/cli, @rspack/dev-server, and @rspack/plugin-react-refresh peer ranges are unchanged at ^2.0.0, so applications may stay on any Rspack 2.x release; only this repository's own development pins and dummy-app lockfiles move, so CI now exercises Rspack 2.2 against the range it already advertises. Annotated config exports (bin/shakapacker-config --annotate) also now list the complete optimization.moduleIds and optimization.chunkIds value sets for both bundlers, including 'compat-hashed', which requires Rspack 2.2 or newer and is documented as opt-in rather than made a default.

Fixed

• Fixed shakapacker:doctor not telling Rspack apps that a .swcrc is ignored outright. [PR #1276](shakacode/shakapacker#1276) by justin808. Doctor previously told Rspack apps only that moving .swcrc settings into config/swc.config.js would not help, while deliberately making no claim about the .swcrc itself, because the behavior had never been verified. It has now been verified against @rspack/core 2.0.1 and 2.2.0: Rspack's builtin:swc-loader never reads .swcrc. A .swcrc setting jsc.target and injecting an optimizer global produced byte-identical output to no .swcrc at all, while the same options passed inline as loader options did change the output. A .swcrc enabling decorator syntax likewise failed to unblock a decorator source, including with empty loader options and with swcrc/configFile set, so this is not merely inline options taking precedence. Doctor now states that a .swcrc is not read on Rspack and that every setting in it is silently inert - the mirror image of the config/swc.config.js case in #1259 - and continues to point at overriding the built-in builtin:swc-loader rule. Webpack messaging is unchanged. Fixes #1263.
• Fixed shakapacker:doctor staying silent about SWC configuration on Rspack apps that do not set javascript_transpiler: swc. [PR #1269](shakacode/shakapacker#1269) by justin808. Shakapacker's Rspack rules always transpile with builtin:swc-loader and never consult javascript_transpiler, so config/swc.config.js goes unread on an Rspack app configured for Babel or esbuild exactly as it does on one configured for SWC. Doctor's Rspack SWC-configuration warnings were gated on javascript_transpiler: swc, so those apps got no warning at all. Those warnings now reach any Rspack app: that config/swc.config.js is not read, and, for a .swcrc, that moving its settings into config/swc.config.js would not affect the build. The webpack-only SWC content checks and the "merged with Shakapacker's defaults" messaging stay gated on javascript_transpiler: swc, and apps with javascript_transpiler: none remain opted out. Fixes #1265.
• Fixed shakapacker:doctor and rake shakapacker:migrate_to_swc telling Rspack apps that config/swc.config.js is merged into their build. [PR #1260](shakacode/shakapacker#1260) by justin808. Rspack builds never read config/swc.config.js, because Shakapacker's Rspack rules set their builtin:swc-loader options inline. Doctor now warns that the file is unread on Rspack instead of reporting it as merged (and skips its content checks there), and no longer tells Rspack users with a .swcrc to migrate those settings into config/swc.config.js. The migrator's post-migration guidance and the generated file header instead show how to override the built-in builtin:swc-loader rule: apply webpack-merge's mergeWithRules to the output of generateRspackConfig(), since that function merges with plain merge, which concatenates module.rules, so an override passed into it is appended alongside the built-in rule rather than replacing it. Webpack apps keep the existing messaging. Fixes #1259.
• Fixed post-publish GitHub release failures hiding successful package publication details. The release task now prints its normal publication summary and the exact sync_github_release recovery command before exiting nonzero. [PR #1250](shakacode/shakapacker#1250) by justin808.
• Fixed helper binstubs to fail closed when PATH is unset. [PR #1240](shakacode/shakapacker#1240) by justin808. bin/shakapacker-config and bin/diff-bundler-config now report the missing-Node error without executing an app-root node binary when PATH is unset, while explicit PATH values retain their existing Node-resolution behavior. Fixes #1234.
• Fixed the deprecation warning for the legacy bundler config key claiming the value was understood while it was ignored. [PR #1270](shakacode/shakapacker#1270) by justin808. An app whose config/shakapacker.yml set only bundler: was told the key was deprecated and then built with a different bundler, because assets_bundler always resolves from the bundled defaults and the legacy key was never read. The warning now states that the value is ignored, names the bundler actually in use, and tells you to set assets_bundler instead. One resolution change accompanies it: a config that leaves assets_bundler: blank while setting bundler: previously resolved the legacy value in Ruby and now resolves webpack, matching what package/config.ts already built for it. Fixes #1262.

v10.3.1

Fixed

• Fixed 502 responses for proxied dev server assets under rack-proxy v1. [PR #1222](shakacode/shakapacker#1222) by jcbpl. Fixes #1220.
• Fixed dev-server liveness checks treating refused macOS 27 connections as running. The Ruby probe now verifies the connected socket's SO_ERROR result before proxying asset requests, avoiding false-positive dev-server detection and resulting 502 responses. [PR #1225](shakacode/shakapacker#1225) by justin808. Fixes #1224.
• Fixed webpack Babel, SWC, and esbuild rules skipping explicitly included .cjs files. [PR #1219](shakacode/shakapacker#1219) by oiahoon. Fixes #1218.
• Added a shakapacker:doctor warning for Rspack React Refresh v2 configs that still use the v1 default-export constructor pattern. [PR #1207](shakacode/shakapacker#1207) by justin808. Existing configs with const ReactRefreshPlugin = require("@rspack/plugin-react-refresh") followed by new ReactRefreshPlugin() can fail after upgrading to @rspack/plugin-react-refresh v2 with ReactRefreshPlugin is not a constructor; Doctor now points to the affected JS/TS config file and suggests the named-export/default/module compatibility form. Fixes #1204.
• Fixed the missing-@babel/core failure to report an actionable install message. [PR #1212](shakacode/shakapacker#1212) by justin808. Babel-transpiled builds whose app lacks @babel/core previously surfaced a raw module-resolution error from the Babel 8 compatibility check; the rule now explains which package to install and how to switch javascript_transpiler instead. Refs #1163.

Documentation

• Documented the required css-loader@^7.1.4 in the v10 Rspack upgrade instructions. [PR #1211](shakacode/shakapacker#1211) by justin808. The v10 upgrade guide's copy-paste Rspack v2 commands omitted css-loader, so apps following them could upgrade into an unsatisfied peer dependency.

v10.3.0

Added

• Allowed webpack-dev-server v6. [PR #1102](shakacode/shakapacker#1102) by G-Rath.

Fixed

• Fixed implicit SWC defaults for existing webpack/Babel apps without swc-loader. [PR #1206](shakacode/shakapacker#1206) by justin808. Webpack apps that omit both javascript_transpiler and the deprecated webpack_loader now fall back to Babel with a warning when Shakapacker's bundled SWC default is active, swc-loader is missing, and Babel is present. Explicit transpiler settings, webpack apps with swc-loader, and Rspack's built-in SWC path keep their existing behavior. Closes #1203.
• Fixed JavaScript config loading for missing Rails environments to use the production fallback. [PR #1206](shakacode/shakapacker#1206) by justin808. When RAILS_ENV has no matching section in config/shakapacker.yml, the Node package config now merges the production section instead of only bundled defaults, matching Ruby configuration loading and honoring explicit production javascript_transpiler, source_path, dev_server, and related settings for custom environments such as staging.
• Fixed helper binstubs delegating Node resolution to Ruby exec in unset and empty PATH environments. [PR #1200](shakacode/shakapacker#1200) and [PR #1201](shakacode/shakapacker#1201) by justin808. Restores shell-compatible Node lookup for bin/shakapacker-config and bin/diff-bundler-config after the v10.2.0 Ruby-binstub regression, while keeping friendly missing-Node errors for ENOENT and EACCES.

Changelog

Sourced from shakapacker's changelog.

[v10.3.2] - August 28, 2026

Changed

• Bumped the development and CI pin for Rspack from 2.0.1 to 2.2.0. [PR #1258](shakacode/shakapacker#1258) by justin808. The @rspack/core, @rspack/cli, @rspack/dev-server, and @rspack/plugin-react-refresh peer ranges are unchanged at ^2.0.0, so applications may stay on any Rspack 2.x release; only this repository's own development pins and dummy-app lockfiles move, so CI now exercises Rspack 2.2 against the range it already advertises. Annotated config exports (bin/shakapacker-config --annotate) also now list the complete optimization.moduleIds and optimization.chunkIds value sets for both bundlers, including 'compat-hashed', which requires Rspack 2.2 or newer and is documented as opt-in rather than made a default.

Fixed

• Fixed shakapacker:doctor not telling Rspack apps that a .swcrc is ignored outright. [PR #1276](shakacode/shakapacker#1276) by justin808. Doctor previously told Rspack apps only that moving .swcrc settings into config/swc.config.js would not help, while deliberately making no claim about the .swcrc itself, because the behavior had never been verified. It has now been verified against @rspack/core 2.0.1 and 2.2.0: Rspack's builtin:swc-loader never reads .swcrc. A .swcrc setting jsc.target and injecting an optimizer global produced byte-identical output to no .swcrc at all, while the same options passed inline as loader options did change the output. A .swcrc enabling decorator syntax likewise failed to unblock a decorator source, including with empty loader options and with swcrc/configFile set, so this is not merely inline options taking precedence. Doctor now states that a .swcrc is not read on Rspack and that every setting in it is silently inert - the mirror image of the config/swc.config.js case in #1259 - and continues to point at overriding the built-in builtin:swc-loader rule. Webpack messaging is unchanged. Fixes #1263.
• Fixed shakapacker:doctor staying silent about SWC configuration on Rspack apps that do not set javascript_transpiler: swc. [PR #1269](shakacode/shakapacker#1269) by justin808. Shakapacker's Rspack rules always transpile with builtin:swc-loader and never consult javascript_transpiler, so config/swc.config.js goes unread on an Rspack app configured for Babel or esbuild exactly as it does on one configured for SWC. Doctor's Rspack SWC-configuration warnings were gated on javascript_transpiler: swc, so those apps got no warning at all. Those warnings now reach any Rspack app: that config/swc.config.js is not read, and, for a .swcrc, that moving its settings into config/swc.config.js would not affect the build. The webpack-only SWC content checks and the "merged with Shakapacker's defaults" messaging stay gated on javascript_transpiler: swc, and apps with javascript_transpiler: none remain opted out. Fixes #1265.
• Fixed shakapacker:doctor and rake shakapacker:migrate_to_swc telling Rspack apps that config/swc.config.js is merged into their build. [PR #1260](shakacode/shakapacker#1260) by justin808. Rspack builds never read config/swc.config.js, because Shakapacker's Rspack rules set their builtin:swc-loader options inline. Doctor now warns that the file is unread on Rspack instead of reporting it as merged (and skips its content checks there), and no longer tells Rspack users with a .swcrc to migrate those settings into config/swc.config.js. The migrator's post-migration guidance and the generated file header instead show how to override the built-in builtin:swc-loader rule: apply webpack-merge's mergeWithRules to the output of generateRspackConfig(), since that function merges with plain merge, which concatenates module.rules, so an override passed into it is appended alongside the built-in rule rather than replacing it. Webpack apps keep the existing messaging. Fixes #1259.
• Fixed post-publish GitHub release failures hiding successful package publication details. The release task now prints its normal publication summary and the exact sync_github_release recovery command before exiting nonzero. [PR #1250](shakacode/shakapacker#1250) by justin808.
• Fixed helper binstubs to fail closed when PATH is unset. [PR #1240](shakacode/shakapacker#1240) by justin808. bin/shakapacker-config and bin/diff-bundler-config now report the missing-Node error without executing an app-root node binary when PATH is unset, while explicit PATH values retain their existing Node-resolution behavior. Fixes #1234.
• Fixed the deprecation warning for the legacy bundler config key claiming the value was understood while it was ignored. [PR #1270](shakacode/shakapacker#1270) by justin808. An app whose config/shakapacker.yml set only bundler: was told the key was deprecated and then built with a different bundler, because assets_bundler always resolves from the bundled defaults and the legacy key was never read. The warning now states that the value is ignored, names the bundler actually in use, and tells you to set assets_bundler instead. One resolution change accompanies it: a config that leaves assets_bundler: blank while setting bundler: previously resolved the legacy value in Ruby and now resolves webpack, matching what package/config.ts already built for it. Fixes #1262.

[v10.3.1] - August 3, 2026

Fixed

• Fixed 502 responses for proxied dev server assets under rack-proxy v1. [PR #1222](shakacode/shakapacker#1222) by jcbpl. Fixes #1220.
• Fixed dev-server liveness checks treating refused macOS 27 connections as running. The Ruby probe now verifies the connected socket's SO_ERROR result before proxying asset requests, avoiding false-positive dev-server detection and resulting 502 responses. [PR #1225](shakacode/shakapacker#1225) by justin808. Fixes #1224.
• Fixed webpack Babel, SWC, and esbuild rules skipping explicitly included .cjs files. [PR #1219](shakacode/shakapacker#1219) by oiahoon. Fixes #1218.
• Added a shakapacker:doctor warning for Rspack React Refresh v2 configs that still use the v1 default-export constructor pattern. [PR #1207](shakacode/shakapacker#1207) by justin808. Existing configs with const ReactRefreshPlugin = require("@rspack/plugin-react-refresh") followed by new ReactRefreshPlugin() can fail after upgrading to @rspack/plugin-react-refresh v2 with ReactRefreshPlugin is not a constructor; Doctor now points to the affected JS/TS config file and suggests the named-export/default/module compatibility form. Fixes #1204.
• Fixed the missing-@babel/core failure to report an actionable install message. [PR #1212](shakacode/shakapacker#1212) by justin808. Babel-transpiled builds whose app lacks @babel/core previously surfaced a raw module-resolution error from the Babel 8 compatibility check; the rule now explains which package to install and how to switch javascript_transpiler instead. Refs #1163.

Documentation

• Documented the required css-loader@^7.1.4 in the v10 Rspack upgrade instructions. [PR #1211](shakacode/shakapacker#1211) by justin808. The v10 upgrade guide's copy-paste Rspack v2 commands omitted css-loader, so apps following them could upgrade into an unsatisfied peer dependency.

[v10.3.0] - July 5, 2026

Added

• Allowed webpack-dev-server v6. [PR #1102](shakacode/shakapacker#1102) by G-Rath.

Fixed

• Fixed implicit SWC defaults for existing webpack/Babel apps without swc-loader. [PR #1206Description has been truncated

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 6e681d1f-e5d6-4542-99c5-94d8f9d01d81

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}