Bump the javascript group across 1 directory with 12 updates

[dependabot]

Bumps the javascript group with 12 updates in the / directory:

Package	From	To
@swc/core	1.15.43	1.16.1
css-loader	7.1.4	7.1.5
esbuild	0.28.1	0.28.2
react	19.2.7	19.2.8
react-dom	19.2.7	19.2.8
react-on-rails	17.0.0-rc.6	17.0.1
shakapacker	10.2.0	10.3.2
webpack	5.108.3	5.110.1
webpack-cli	7.1.0	7.2.3
@pmmmwh/react-refresh-webpack-plugin	0.6.2	0.6.3
daisyui	5.6.7	5.7.22
webpack-dev-server	5.2.5	6.0.0

Updates @swc/core from 1.15.43 to 1.16.1

Changelog

Sourced from @​swc/core's changelog.

[1.16.1] - 2026-08-19

Bug Fixes

• (es/minifier) Preserve for init (#12121) (0a1d4de)

• (es/modules) Preserve destructuring assignment targets in SystemJS (#12122) (557060b)

• (es/react) Handle apos JSX entities (#12125) (d09547f)

[1.16.0] - 2026-08-14

Bug Fixes

• (encoding) Fix incorrect fields count (#11905) (6fb4ca1)

  • BREAKING: Fix incorrect fields count (#11905)

• (es/ast) Prevent mutable reference escape (#12088) (592f559)

• (es/ast) Fix panic on JSX surrogate entities (#11803) (d21de47)

  • BREAKING: fix panic on JSX surrogate entities (#11803)

• (es/es2015) Preserve this in static field parameters (#12085) (5b758ed)

• (es/minifier) Remove unused variable initializer cycles (#12106) (0421534)

• (es/minifier) Bound arguments parameter injection (#12053) (46d6f41)

• (es/preset-env) Lower unsupported async generators (#12086) (3a144b1)

• (hstr) Avoid references to uninitialized bytes (#12087) (68f0983)

• (plugin) Make raw byte reconstruction unsafe (#12089) (83ab4ed)

• (plugin/runner) Write Wasmer cache atomically (#12100) (3c4f404)

... (truncated)

Commits

• 490c7d8 chore: Publish 1.16.1 with swc_core v77.0.2
• 7e4d782 chore: Publish 1.16.1-nightly-20260819.1 with swc_core v77.0.2
• ae2117a chore: Publish 1.16.0 with swc_core v77.0.0
• 99671f1 chore: Publish 1.16.0-nightly-20260814.1 with swc_core v77.0.0
• 394c7c9 refactor(es/ast)!: introduce FunctionBody (#12096)
• 9ae902e refactor(es/ast)!: use Function for object accessors (#12077)
• 1687c0f refactor(es/ast)!: split TypeScript this parameters (#12075)
• 0febbba chore: Publish 1.15.47 with swc_core v75.0.0
• 68abe42 chore: Publish 1.15.47-nightly-20260729.1 with swc_core v75.0.0
• 9383162 chore: Publish 1.15.46 with swc_core v74.0.1
• Additional commits viewable in compare view

Updates css-loader from 7.1.4 to 7.1.5

Release notes

Sourced from css-loader's releases.

v7.1.5

7.1.5 (2026-08-28)

Bug Fixes

• strip BOM before processing with postcss (#1684) (bd20834)

Changelog

Sourced from css-loader's changelog.

7.1.5 (2026-08-28)

Bug Fixes

• strip BOM before processing with postcss (#1684) (bd20834)

Commits

• be04ec2 chore(release): 7.1.5
• 405bdde docs: deprecate css-loader in favor of webpack's built-in CSS support (#1683)
• bd20834 fix: strip BOM before processing with postcss (#1684)
• 488cdb1 chore(deps-dev): bump lodash from 4.17.23 to 4.18.1 (#1663)
• fd4cb47 chore(deps-dev): bump flatted from 3.3.3 to 3.4.2 (#1659)
• 4bf84fa docs: clarify style-loader usage in Getting Started (#1656)
• d7441e5 chore(deps): bump immutable from 5.1.3 to 5.1.5 (#1654)
• ca53a77 chore(deps): bump minimatch (#1653)
• See full diff in compare view

Updates esbuild from 0.28.1 to 0.28.2

Release notes

Sourced from esbuild's releases.

v0.28.2

• Fix tree shaking bug due to TypeScript import alias (#4507)

  This release fixes a bug that could cause esbuild to incorrectly tree-shake imports that are used in a TypeScript type alias under certain circumstances. Affected code uses a TypeScript-specific import assignment and looks something like this:

  import Base from './dep.js';
  import Alias = Base.SomeType;

• Fix CSS minification bug involving & (#4497)

  This release fixes a bug where esbuild's CSS minifier incorrectly removed a & when it was unsafe to do so. Here is an example:

  /* Original code */
  .a .b {
    & .b:not(& .c) {
      color: red;
    }
  }
  /* Old output (with --minify) */
  .a .b{.b:not(& .c){color:red}}
  /* New output (with --minify) */
  .a .b{& .b:not(& .c){color:red}}

  This should match <span class="a"><span class="b"><span class="b">yes</span></span></span> but not <span class="a"><span class="b">no</span></span>. The old output incorrectly matched both.

• Avoid overwriting input files without --allow-overwrite (#4484)

  For example: esbuild input.js --outfile=input.js tells esbuild to overwrite input.js with the output of running esbuild on it. This was supposed to already be prevented by default, but it accidentally regressed in version 0.17.0 and apparently didn't have any test coverage. The error message was being printed but the input file was still being overwritten. Oops.

  This release puts the original behavior back. With this release, esbuild should now actually avoid overwriting input files unless --allow-overwrite is explicitly present. This is done by not writing out any files when a build error is encountered.

• Fix incorrect code generated when using top-level await (#4498)

  Previously esbuild could generate code containing a syntax error in complex scenarios involving top-level await used in a dependency cycle. The problem was a missing async on one or more module wrapper closures. With this release, esbuild now uses a fixed-point iteration algorithm to correctly annotate all dependencies in the cycle as needing an async module wrapper.

• Fix a minification bug with lowered logical assignment operators (#4508)

  This release fixes a bug that could cause esbuild to generate incorrect code for logical assignment operators when lowering them to an older target environment. Specifically the lowering process requires duplicating the left-hand side, but esbuild incorrectly failed to count the duplicate as a new usage when the left-hand side is an identifier. That then caused the minifier to believe that the left-hand side was only used once and could attempt to incorrectly inline an initializer into the first usage. This bug has now been fixed:

  // Original code
  function foo() {
    let x
    bar(x ||= {})

... (truncated)

Changelog

Sourced from esbuild's changelog.

0.28.2

• Fix tree shaking bug due to TypeScript import alias (#4507)

  This release fixes a bug that could cause esbuild to incorrectly tree-shake imports that are used in a TypeScript type alias under certain circumstances. Affected code uses a TypeScript-specific import assignment and looks something like this:

  import Base from './dep.js';
  import Alias = Base.SomeType;

• Fix CSS minification bug involving & (#4497)

  This release fixes a bug where esbuild's CSS minifier incorrectly removed a & when it was unsafe to do so. Here is an example:

  /* Original code */
  .a .b {
    & .b:not(& .c) {
      color: red;
    }
  }
  /* Old output (with --minify) */
  .a .b{.b:not(& .c){color:red}}
  /* New output (with --minify) */
  .a .b{& .b:not(& .c){color:red}}

  This should match <span class="a"><span class="b"><span class="b">yes</span></span></span> but not <span class="a"><span class="b">no</span></span>. The old output incorrectly matched both.

• Avoid overwriting input files without --allow-overwrite (#4484)

  For example: esbuild input.js --outfile=input.js tells esbuild to overwrite input.js with the output of running esbuild on it. This was supposed to already be prevented by default, but it accidentally regressed in version 0.17.0 and apparently didn't have any test coverage. The error message was being printed but the input file was still being overwritten. Oops.

  This release puts the original behavior back. With this release, esbuild should now actually avoid overwriting input files unless --allow-overwrite is explicitly present. This is done by not writing out any files when a build error is encountered.

• Fix incorrect code generated when using top-level await (#4498)

  Previously esbuild could generate code containing a syntax error in complex scenarios involving top-level await used in a dependency cycle. The problem was a missing async on one or more module wrapper closures. With this release, esbuild now uses a fixed-point iteration algorithm to correctly annotate all dependencies in the cycle as needing an async module wrapper.

• Fix a minification bug with lowered logical assignment operators (#4508)

  This release fixes a bug that could cause esbuild to generate incorrect code for logical assignment operators when lowering them to an older target environment. Specifically the lowering process requires duplicating the left-hand side, but esbuild incorrectly failed to count the duplicate as a new usage when the left-hand side is an identifier. That then caused the minifier to believe that the left-hand side was only used once and could attempt to incorrectly inline an initializer into the first usage. This bug has now been fixed:

  // Original code
  function foo() {
    let x

... (truncated)

Commits

• 609683d publish 0.28.2 to npm
• 11b1fe4 add to release notes
• ab50d91 css: fix green/blue channel swap in oklch gamut mapping (#4488)
• 04627b6 fix #4498: async TLA checks need a worklist
• 5c15177 disable gopls in the go folder
• fc2ee9b css: adjust parser to allow --foo: {...}
• 209db54 release notes for css nesting bugfix
• c625d31 fix #4497: preserve nested ampersands during minification (#4500)
• 34474e2 better isolation of current part in js parser
• 07f6e8c fix #4507: import assignment tree-shaking bug
• Additional commits viewable in compare view

Updates react from 19.2.7 to 19.2.8

Release notes

Sourced from react's releases.

19.2.8 (July 21st, 2026)

React Server Components

• Performance improvements when decoding (#37087 by @​eps1lon)

Commits

• 1dd4ecb [FlightReply] Performance improvements when decoding (#37087)
• b0d2fdb [19.2.x] Update required references to GitHub repo (#36753)
• See full diff in compare view

Updates react-dom from 19.2.7 to 19.2.8

Release notes

Sourced from react-dom's releases.

19.2.8 (July 21st, 2026)

React Server Components

• Performance improvements when decoding (#37087 by @​eps1lon)

Commits

• 1dd4ecb [FlightReply] Performance improvements when decoding (#37087)
• b0d2fdb [19.2.x] Update required references to GitHub repo (#36753)
• See full diff in compare view

Updates react-on-rails from 17.0.0-rc.6 to 17.0.1

Release notes

Sourced from react-on-rails's releases.

v17.0.1

Fixed

• Corrected the OSS npm package license metadata and packed license: react-on-rails now declares MIT, includes a package-local MIT license in the published tarball, and verifies the packed artifact cannot inherit React on Rails Pro commercial terms. PR 4792 by justin808.

v17.0.1.rc.0

Fixed

• Corrected the OSS npm package license metadata and packed license: react-on-rails now declares MIT, includes a package-local MIT license in the published tarball, and verifies the packed artifact cannot inherit React on Rails Pro commercial terms. PR 4792 by justin808.

v17.0.0

Breaking Changes

• [Pro] Removed the undocumented ReactOnRailsPro::Cache.fetch_react_component class API: Pro apps should use the supported cached helper APIs (cached_react_component, cached_react_component_hash, and related helpers) instead of calling the low-level cache class directly. The helper cache path still preserves generated-pack loading on cache hits, tag registration, and expires_at handling internally. Fixes #4497. #4541 by justin808.
• [Pro] React Server Components now require the stable React 19.2.x RSC line: Pro RSC apps on React on Rails 17 require react-on-rails-rsc >= 19.2.1 < 19.3, React >= 19.2.7, and matching React DOM. Non-RSC Pro apps retain React 18 support. The Pro generator scaffolds that coordinated stable runtime and rejects all prerelease RSC packages while the stable floor is active. The adopted react-on-rails-rsc artifact uses the React on Rails Pro commercial terms rather than MIT and reports SEE LICENSE IN LICENSE.md in npm metadata. Set REACT_ON_RAILS_PRO_DISABLE_VERSION_CHECK=1 only as an emergency rollout escape hatch to downgrade startup errors to warnings. #4357. #4490 and #4670 by justin808.
• Removed the inert config.server_render_method option: The open-source configuration no longer accepts config.server_render_method. The option never selected a server render method — the open-source gem always renders with ExecJS — and its validator raised ReactOnRails::Error at boot for any value other than blank or "ExecJS". Setting it now raises NoMethodError at boot, so delete any config.server_render_method = ... line from config/initializers/react_on_rails.rb; rake react_on_rails:doctor also flags the stale line. For a standalone Node rendering process, use React on Rails Pro's Node renderer, configured via ReactOnRailsPro.configure. Fixes #4415. #4423 by justin808.
• Removed three deprecated configuration options (config.generated_assets_dirs, config.skip_display_none, config.defer_generated_component_packs): These were deprecated in v16 and are gone in v17. Setting any of them now raises NoMethodError at boot; delete the stale lines from config/initializers/react_on_rails.rb (rake react_on_rails:doctor flags them). Migration: delete config.generated_assets_dirs — public asset paths come from public_output_path in config/shakapacker.yml; delete config.skip_display_none — it had no runtime effect; replace config.defer_generated_component_packs = true with config.generated_component_packs_loading_strategy = :defer, and simply delete config.defer_generated_component_packs = false (the removed option was truthy-gated — only = true set :defer; = false was a no-op that fell through to the default strategy, so it did not mean :sync; set :sync explicitly only if you relied on synchronous loading). The default strategy is :async for Pro or :defer for non-Pro on Shakapacker 8.2.0+, and :sync on older Shakapacker. Fixes #4419. #4432 by justin808.
• Removed the never-wired RenderRequest / JsCodeBuilder / RenderingStrategy rendering layer: The internal strategy-pattern classes ReactOnRails::RenderRequest, ReactOnRails::JsCodeBuilder, ReactOnRails::RenderingStrategy (with ExecJsStrategy), and — in Pro — ReactOnRailsPro::JsCodeBuilder and ReactOnRailsPro::RenderingStrategy::NodeStrategy, plus the undocumented ReactOnRails.rendering_strategy and ReactOnRails.js_code_builder module accessors, are removed. This scaffolding was built for the strategy-pattern refactor in #2905 (closed without wiring it in) and was never invoked on any production server-rendering path — SSR runs through ServerRenderingJsCode and ServerRenderingPool, which never touched this layer. These constants and accessors were internal and undocumented; if you reference them in application code, remove the reference (the layer performed no work). Fixes #4414. #4437 by justin808.
• Removed undocumented ReactOnRails::Utils helpers: React on Rails 17 removes the unused ReactOnRails::Utils.server_rendering_is_enabled? and ReactOnRails::Utils.rails_version_less_than helper methods. Remove any application calls to those helpers; release-example generation now owns its private Rails-version check outside the public Utils surface. Fixes #4418. #4431 by justin808.
• Ruby 3.3+ is required for React on Rails v17: The open-source gem now requires Ruby >= 3.3.0, aligning it with React on Rails Pro, create-react-on-rails-app, and the CI minimum matrix. React on Rails v16 remains the upgrade path for applications that must stay on Ruby 3.2 or older. #3500 by justin808.
• [Pro] Node Renderer now requires Ruby 3.3+ for the async-http transport: The react-on-rails-pro gem now requires Ruby >= 3.3 (raised from >= 3.0) because async-http depends on Ruby 3.3 features. Upgrade Ruby before moving to this release. See docs/pro/updating.md for the full upgrade guide. #3320 by AbanoubGhadban.
• [Pro] config.renderer_http_pool_size now limits async-http connections per renderer client: Existing numeric values now cap concurrent async-http connections for each renderer client instead of sizing a persistent process-wide connection pool. HTTP/2 may multiplex request streams over those pooled connections. Setting nil keeps the default connection limit and does not make the async-http client unlimited. Persistent connection reuse is automatic when a long-lived Fiber.scheduler is present. See docs/pro/updating.md for the full upgrade guide. #3320 by AbanoubGhadban.

Added

• [Pro] React 18 support for non-RSC streaming SSR: stream_react_component with synchronous props is now explicitly supported on React 18 as well as React 19. Permanent packed-artifact coverage verifies a production Webpack build and progressive Suspense output on React 18 without installing or bundling react-on-rails-rsc; async props and React Server Components remain React 19-only. Fixes #4642. #4658 by justin808.
• Generated Rails response TypeScript contracts: Rails apps can now register explicit JSON response contracts with ReactOnRails::TypeScriptResponseTypes and run rake react_on_rails:generate_response_types to emit importable .d.ts declarations plus a

... (truncated)

Changelog

Sourced from react-on-rails's changelog.

[17.0.1] - 2026-07-26

Fixed

• Corrected the OSS npm package license metadata and packed license: react-on-rails now declares MIT, includes a package-local MIT license in the published tarball, and verifies the packed artifact cannot inherit React on Rails Pro commercial terms. PR 4792 by justin808.

[17.0.0] - 2026-07-16

Breaking Changes

• [Pro] Removed the undocumented ReactOnRailsPro::Cache.fetch_react_component class API: Pro apps should use the supported cached helper APIs (cached_react_component, cached_react_component_hash, and related helpers) instead of calling the low-level cache class directly. The helper cache path still preserves generated-pack loading on cache hits, tag registration, and expires_at handling internally. Fixes Issue 4497. PR 4541 by justin808.
• [Pro] React Server Components now require the stable React 19.2.x RSC line: Pro RSC apps on React on Rails 17 require react-on-rails-rsc >= 19.2.1 < 19.3, React >= 19.2.7, and matching React DOM. Non-RSC Pro apps retain React 18 support. The Pro generator scaffolds that coordinated stable runtime and rejects all prerelease RSC packages while the stable floor is active. The adopted react-on-rails-rsc artifact uses the React on Rails Pro commercial terms rather than MIT and reports SEE LICENSE IN LICENSE.md in npm metadata. Set REACT_ON_RAILS_PRO_DISABLE_VERSION_CHECK=1 only as an emergency rollout escape hatch to downgrade startup errors to warnings. Issue 4357. PR 4490 and PR 4670 by justin808.
• Removed the inert config.server_render_method option: The open-source configuration no longer accepts config.server_render_method. The option never selected a server render method — the open-source gem always renders with ExecJS — and its validator raised ReactOnRails::Error at boot for any value other than blank or "ExecJS". Setting it now raises NoMethodError at boot, so delete any config.server_render_method = ... line from config/initializers/react_on_rails.rb; rake react_on_rails:doctor also flags the stale line. For a standalone Node rendering process, use React on Rails Pro's Node renderer, configured via ReactOnRailsPro.configure. Fixes Issue 4415. PR 4423 by justin808.
• Removed three deprecated configuration options (config.generated_assets_dirs, config.skip_display_none, config.defer_generated_component_packs): These were deprecated in v16 and are gone in v17. Setting any of them now raises NoMethodError at boot; delete the stale lines from config/initializers/react_on_rails.rb (rake react_on_rails:doctor flags them). Migration: delete config.generated_assets_dirs — public asset paths come from public_output_path in config/shakapacker.yml; delete config.skip_display_none — it had no runtime effect; replace config.defer_generated_component_packs = true with config.generated_component_packs_loading_strategy = :defer, and simply delete config.defer_generated_component_packs = false (the removed option was truthy-gated — only = true set :defer; = false was a no-op that fell through to the default strategy, so it did not mean :sync; set :sync explicitly only if you relied on synchronous loading). The default strategy is :async for Pro or :defer for non-Pro on Shakapacker 8.2.0+, and :sync on older Shakapacker. Fixes Issue 4419. PR 4432 by justin808.
• Removed the never-wired RenderRequest / JsCodeBuilder / RenderingStrategy rendering layer: The internal strategy-pattern classes ReactOnRails::RenderRequest, ReactOnRails::JsCodeBuilder, ReactOnRails::RenderingStrategy (with ExecJsStrategy), and — in Pro — ReactOnRailsPro::JsCodeBuilder and ReactOnRailsPro::RenderingStrategy::NodeStrategy, plus the undocumented ReactOnRails.rendering_strategy and ReactOnRails.js_code_builder module accessors, are removed. This scaffolding was built for the strategy-pattern refactor in Issue 2905 (closed without wiring it in) and was never invoked on any production server-rendering path — SSR runs through ServerRenderingJsCode and ServerRenderingPool, which never touched this layer. These constants and accessors were internal and undocumented; if you reference them in application code, remove the reference (the layer performed no work). Fixes Issue 4414. PR 4437 by justin808.
• Removed undocumented ReactOnRails::Utils helpers: React on Rails 17 removes the unused ReactOnRails::Utils.server_rendering_is_enabled? and ReactOnRails::Utils.rails_version_less_than helper methods. Remove any application calls to those helpers; release-example generation now owns its private Rails-version check outside the public Utils surface. Fixes Issue 4418. PR 4431 by justin808.
• Ruby 3.3+ is required for React on Rails v17: The open-source gem now requires Ruby >= 3.3.0, aligning it with React on Rails Pro, create-react-on-rails-app, and the CI minimum matrix. React on Rails v16 remains the upgrade path for applications that must stay on Ruby 3.2 or older. PR 3500 by justin808.
• [Pro] Node Renderer now requires Ruby 3.3+ for the async-http transport: The react-on-rails-pro gem now requires Ruby >= 3.3 (raised from >= 3.0) because async-http depends on Ruby 3.3 features. Upgrade Ruby before moving to this release. See docs/pro/updating.md for the full upgrade guide. PR 3320 by AbanoubGhadban.
• [Pro] config.renderer_http_pool_size now limits async-http connections per renderer client: Existing numeric values now cap concurrent async-http connections for each renderer client instead of sizing a persistent process-wide connection pool. HTTP/2 may multiplex request streams over those pooled connections. Setting nil keeps the default connection limit and does not make the async-http client unlimited. Persistent connection reuse is automatic when a long-lived Fiber.scheduler is present. See docs/pro/updating.md for the full upgrade guide. PR 3320 by AbanoubGhadban.

Added

• [Pro] React 18 support for non-RSC streaming SSR: stream_react_component with synchronous props is now explicitly supported on React 18 as well as React 19. Permanent packed-artifact coverage verifies a production Webpack build and progressive Suspense output on React 18 without installing or bundling react-on-rails-rsc; async props and React Server Components remain React 19-only. Fixes Issue 4642. PR 4658 by justin808.

• Generated Rails response TypeScript contracts: Rails apps can now register explicit JSON response contracts with ReactOnRails::TypeScriptResponseTypes and run rake react_on_rails:generate_response_types to emit importable .d.ts declarations plus a RailsResponseTypes lookup map for TanStack Query clients. Fixes Issue 4247. PR 4259 by justin808.

• Typed Rails action callers for TanStack Query mutations: The react-on-rails/railsAction subpath now exports createRailsAction, a same-origin JSON caller that attaches Rails CSRF headers and lets mutation code type responses with the generated RailsResponseType<'controller.action'> lookup. Fixes Issue 4248. PR 4260 by justin808.

... (truncated)

Commits

• See full diff in compare view

Updates shakapacker from 10.2.0 to 10.3.2

Release notes

Sourced from shakapacker's releases.

v10.3.2

Changed

• Bumped the development and CI pin for Rspack from 2.0.1 to 2.2.0. [PR #1258](shakacode/shakapacker#1258) by justin808. The @rspack/core, @rspack/cli, @rspack/dev-server, and @rspack/plugin-react-refresh peer ranges are unchanged at ^2.0.0, so applications may stay on any Rspack 2.x release; only this repository's own development pins and dummy-app lockfiles move, so CI now exercises Rspack 2.2 against the range it already advertises. Annotated config exports (bin/shakapacker-config --annotate) also now list the complete optimization.moduleIds and optimization.chunkIds value sets for both bundlers, including 'compat-hashed', which requires Rspack 2.2 or newer and is documented as opt-in rather than made a default.

Fixed

• Fixed shakapacker:doctor not telling Rspack apps that a .swcrc is ignored outright. [PR #1276](shakacode/shakapacker#1276) by justin808. Doctor previously told Rspack apps only that moving .swcrc settings into config/swc.config.js would not help, while deliberately making no claim about the .swcrc itself, because the behavior had never been verified. It has now been verified against @rspack/core 2.0.1 and 2.2.0: Rspack's builtin:swc-loader never reads .swcrc. A .swcrc setting jsc.target and injecting an optimizer global produced byte-identical output to no .swcrc at all, while the same options passed inline as loader options did change the output. A .swcrc enabling decorator syntax likewise failed to unblock a decorator source, including with empty loader options and with swcrc/configFile set, so this is not merely inline options taking precedence. Doctor now states that a .swcrc is not read on Rspack and that every setting in it is silently inert - the mirror image of the config/swc.config.js case in #1259 - and continues to point at overriding the built-in builtin:swc-loader rule. Webpack messaging is unchanged. Fixes #1263.
• Fixed shakapacker:doctor staying silent about SWC configuration on Rspack apps that do not set javascript_transpiler: swc. [PR #1269](shakacode/shakapacker#1269) by justin808. Shakapacker's Rspack rules always transpile with builtin:swc-loader and never consult javascript_transpiler, so config/swc.config.js goes unread on an Rspack app configured for Babel or esbuild exactly as it does on one configured for SWC. Doctor's Rspack SWC-configuration warnings were gated on javascript_transpiler: swc, so those apps got no warning at all. Those warnings now reach any Rspack app: that config/swc.config.js is not read, and, for a .swcrc, that moving its settings into config/swc.config.js would not affect the build. The webpack-only SWC content checks and the "merged with Shakapacker's defaults" messaging stay gated on javascript_transpiler: swc, and apps with javascript_transpiler: none remain opted out. Fixes #1265.
• Fixed shakapacker:doctor and rake shakapacker:migrate_to_swc telling Rspack apps that config/swc.config.js is merged into their build. [PR #1260](shakacode/shakapacker#1260) by justin808. Rspack builds never read config/swc.config.js, because Shakapacker's Rspack rules set their builtin:swc-loader options inline. Doctor now warns that the file is unread on Rspack instead of reporting it as merged (and skips its content checks there), and no longer tells Rspack users with a .swcrc to migrate those settings into config/swc.config.js. The migrator's post-migration guidance and the generated file header instead show how to override the built-in builtin:swc-loader rule: apply webpack-merge's mergeWithRules to the output of generateRspackConfig(), since that function merges with plain merge, which concatenates module.rules, so an override passed into it is appended alongside the built-in rule rather than replacing it. Webpack apps keep the existing messaging. Fixes #1259.
• Fixed post-publish GitHub release failures hiding successful package publication details. The release task now prints its normal publication summary and the exact sync_github_release recovery command before exiting nonzero. [PR #1250](shakacode/shakapacker#1250) by justin808.
• Fixed helper binstubs to fail closed when PATH is unset. [PR #1240](shakacode/shakapacker#1240) by justin808. bin/shakapacker-config and bin/diff-bundler-config now report the missing-Node error without executing an app-root node binary when PATH is unset, while explicit PATH values retain their existing Node-resolution behavior. Fixes #1234.
• Fixed the deprecation warning for the legacy bundler config key claiming the value was understood while it was ignored. [PR #1270](shakacode/shakapacker#1270) by justin808. An app whose config/shakapacker.yml set only bundler: was told the key was deprecated and then built with a different bundler, because assets_bundler always resolves from the bundled defaults and the legacy key was never read. The warning now states that the value is ignored, names the bundler actually in use, and tells you to set assets_bundler instead. One resolution change accompanies it: a config that leaves assets_bundler: blank while setting bundler: previously resolved the legacy value in Ruby and now resolves webpack, matching what package/config.ts already built for it. Fixes #1262.

v10.3.1

Fixed

• Fixed 502 responses for proxied dev server assets under rack-proxy v1. [PR #1222](shakacode/shakapacker#1222) by jcbpl. Fixes #1220.
• Fixed dev-server liveness checks treating refused macOS 27 connections as running. The Ruby probe now verifies the connected socket's SO_ERROR result before proxying asset requests, avoiding false-positive dev-server detection and resulting 502 responses. [PR #1225](shakacode/shakapacker#1225) by justin808. Fixes #1224.
• Fixed webpack Babel, SWC, and esbuild rules skipping explicitly included .cjs files. [PR #1219](shakacode/shakapacker#1219) by oiahoon. Fixes #1218.
• Added a shakapacker:doctor warning for Rspack React Refresh v2 configs that still use the v1 default-export constructor pattern. [PR #1207](shakacode/shakapacker#1207) by justin808. Existing configs with const ReactRefreshPlugin = require("@rspack/plugin-react-refresh") followed by new ReactRefreshPlugin() can fail after upgrading to @rspack/plugin-react-refresh v2 with ReactRefreshPlugin is not a constructor; Doctor now points to the affected JS/TS config file and suggests the named-export/default/module compatibility form. Fixes #1204.
• Fixed the missing-@babel/core failure to report an actionable install message. [PR #1212](shakacode/shakapacker#1212) by justin808. Babel-transpiled builds whose app lacks @babel/core previously surfaced a raw module-resolution error from the Babel 8 compatibility check; the rule now explains which package to install and how to switch javascript_transpiler instead. Refs #1163.

Documentation

• Documented the required css-loader@^7.1.4 in the v10 Rspack upgrade instructions. [PR #1211](shakacode/shakapacker#1211) by justin808. The v10 upgrade guide's copy-paste Rspack v2 commands omitted css-loader, so apps following them could upgrade into an unsatisfied peer dependency.

v10.3.0

Added

• Allowed webpack-dev-server v6. [PR #1102](shakacode/shakapacker#1102) by G-Rath.

Fixed

• Fixed implicit SWC defaults for existing webpack/Babel apps without swc-loader. [PR #1206](shakacode/shakapacker#1206) by justin808. Webpack apps that omit both javascript_transpiler and the deprecated webpack_loader now fall back to Babel with a warning when Shakapacker's bundled SWC default is active, swc-loader is missing, and Babel is present. Explicit transpiler settings, webpack apps with swc-loader, and Rspack's built-in SWC path keep their existing behavior. Closes #1203.
• Fixed JavaScript config loading for missing Rails environments to use the production fallback. [PR #1206](shakacode/shakapacker#1206) by justin808. When RAILS_ENV has no matching section in config/shakapacker.yml, the Node package config now merges the production section instead of only bundled defaults, matching Ruby configuration loading and honoring explicit production javascript_transpiler, source_path, dev_server, and related settings for custom environments such as staging.
• Fixed helper binstubs delegating Node resolution to Ruby exec in unset and empty PATH environments. [PR #1200](shakacode/shakapacker#1200) and [PR #1201](shakacode/shakapacker#1201) by justin808. Restores shell-compatible Node lookup for bin/shakapacker-config and bin/diff-bundler-config after the v10.2.0 Ruby-binstub regression, while keeping friendly missing-Node errors for ENOENT and EACCES.

Changelog

Sourced from shakapacker's changelog.

[v10.3.2] - August 28, 2026

Changed

• Bumped the development and CI pin for Rspack from 2.0.1 to 2.2.0. [PR #1258](shakacode/shakapacker#1258) by justin808. The @rspack/core, @rspack/cli, @rspack/dev-server, and @rspack/plugin-react-refresh peer ranges are unchanged at ^2.0.0, so applications may stay on any Rspack 2.x release; only this repository's own development pins and dummy-app lockfiles move, so CI now exercises Rspack 2.2 against the range it already advertises. Annotated config exports (bin/shakapacker-config --annotate) also now list the complete optimization.moduleIds and optimization.chunkIds value sets for both bundlers, including 'compat-hashed', which requires Rspack 2.2 or newer and is documented as opt-in rather than made a default.

Fixed

• Fixed shakapacker:doctor not telling Rspack apps that a .swcrc is ignored outright. [PR #1276](shakacode/shakapacker#1276) by justin808. Doctor previously told Rspack apps only that moving .swcrc settings into config/swc.config.js would not help, while deliberately making no claim about the .swcrc itself, because the behavior had never been verified. It has now been verified against @rspack/core 2.0.1 and 2.2.0: Rspack's builtin:swc-loader never reads .swcrc. A .swcrc setting jsc.target and injecting an optimizer global produced byte-identical output to no .swcrc at all, while the same options passed inline as loader options did change the output. A .swcrc enabling decorator syntax likewise failed to unblock a decorator source, including with empty loader options and with swcrc/configFile set, so this is not merely inline options taking precedence. Doctor now states that a .swcrc is not read on Rspack and that every setting in it is silently inert - the mirror image of the config/swc.config.js case in #1259 - and continues to point at overriding the built-in builtin:swc-loader rule. Webpack messaging is unchanged. Fixes #1263.
• Fixed shakapacker:doctor staying silent about SWC configuration on Rspack apps that do not set javascript_transpiler: swc. [PR #1269](shakacode/shakapacker#1269) by justin808. Shakapacker's Rspack rules always...

  Description has been truncated

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.