shakacode/react_on_rails v17.2.1

on GitHub

Fixed

• pnpm lockfiles are read on Psych older than 5.2.5: The version check and doctor read pnpm-lock.yaml with
  YAML.safe_load_stream, which Psych added in 5.2.5 (Ruby 3.4 ships 5.2.2). On older Psych every pnpm lockfile
  read failed silently, so the version check fell back to package.json and doctor's react-server-dom-webpack
  check reported "could not check". Older Psych now parses the stream and safe-loads each document. Fixes
  #5300.
  #5301 by justin808.

• Rspack server bundles no longer write a stray ssr-generated/manifest.json: The generated
  serverWebpackConfig.js removed client-only plugins by webpack class names only, so Rspack apps kept
  rspack-manifest-plugin and CssExtractRspackPlugin in the server compilation and in the RSC compilations
  derived from it. Each of those builds wrote its own ssr-generated/manifest.json, which ended up listing only
  the bundle that finished last. The generated config now removes both Rspack plugins. Existing Rspack apps can
  apply the same change to the plugin filter in config/rspack/serverWebpackConfig.js. Fixes
  #5184.
  #5185 by justin808.

• [Pro] unstable_cache no longer crashes on RSC payload-endpoint requests: BUILD_ID was initialized only
  on page-render requests, so any /rsc_payload/* request (e.g. RSCRoute.refetch()) that landed on a renderer
  worker which had not yet served a full page render threw BUILD_ID not set. The RSC bundle hash is now published
  on both paths, and the renderer VM context carries the bundle identity as a structural fallback so future RSC
  entrypoints are safe by default. Fixes #5076.
  #5141,
  #5142 by
  AbanoubGhadban.

• [Pro] Fix CSP nonce handling in fragment-cached components: The cached_* helpers now refresh executable inline script nonces on cache hits, preventing CSP from blocking hydration, console replay, and streaming scripts.
  Only nonces the framework emitted are refreshed. A cached render gives framework scripts a random placeholder nonce, and every response swaps it for its own nonce. App markup that carries the request's nonce, such as stored HTML injected while the nonce generator is session-derived, keeps its stale nonce for CSP to block on cache hits.
  Upgrade notes: App code that needs a nonce inside a cached component should read railsContext.cspNonce; a nonce passed in through props or Rails helpers is not refreshed. Overrides of these private Pro helpers must accept and forward their new parameters: normalize_cached_pro_attribution and normalize_cached_pro_attribution_html (cached_csp_nonce), append_cached_csp_nonce_marker (placeholder), consumer_stream_async (live_chunk_rewriter: keyword), and process_stream_chunks (live_chunk_rewriter); fetch_cache_entry now returns a fourth value. Framework emitters read the nonce through ReactOnRails::Helper#csp_nonce, which returns the placeholder during cached renders; code that overrides or stubs it should use the new request_csp_nonce for the request's own nonce. Component cache keys use a new csp-nonce-placeholder partition segment, so nonce-rendered entries written before upgrading are not reused. See CSP caching caveats for details.
  Fixes #5021 and #5267. #5025 by AbanoubGhadban and #5270 by justin808.

• [Pro] Inline RSC payloads now suppress console replay outside development and test whenever
  renderingError is present, including null, empty, and malformed values. This matches fetched RSC payloads
  and prevents console replay from exposing server diagnostics that error metadata omits. Ruby diagnostics
  now use JavaScript trim whitespace rules: NUL/NEL-only errors count as nonblank, while BOM-only errors do not.
  Clean-chunk replay is unchanged. Backports #5210
  by justin808.

• [Pro] Concurrent SSR keeps hydrated Redux stores separate: Async rendering, streaming,
  and RSC Client Component providers now read only their request's stores in a shared Node Renderer
  worker. Action required for upgraders: Upgrade the Node Renderer and React on Rails JavaScript packages together. Move module-scope setStore calls into per-render hydration. Browser store
  APIs and page lifecycle behavior are unchanged. Set isolateHydratedStores: false or
  RENDERER_ISOLATE_HYDRATED_STORES=false to restore the shared registry temporarily. Fixes #5124.
  #5133 by justin808.

Security

• [Pro] Doctor warns when the lockfile resolves a vulnerable react-server-dom-webpack: With RSC enabled,
  rake react_on_rails:doctor now reads every react-server-dom-webpack copy in yarn.lock, package-lock.json,
  pnpm-lock.yaml, or bun.lock, including copies installed through react-on-rails-rsc and npm aliases. It warns
  when a copy is affected by React's 2026-10-14 advisories (critical RCE
  GHSA-xqc2-xf4c-x3h3 and DoS
  GHSA-h3gv-c5rc-p453): any 19.0 through 19.3
  version below its line's patched release (19.0.9, 19.1.10, 19.2.9, 19.3.1), prereleases included. The fix updates
  react, react-dom, and react-server-dom-webpack together to 19.3.1 (19.2.9 on the 19.2 line) and commits the
  refreshed lockfile. Doctor also warns when no lockfile in the package root lists the package, or when a copy, such
  as an experimental build, falls outside the advisories' version rules.
  #5247 by justin808.

• [Pro] The RSC generator declares React 19.3.1 as the floor: New RSC apps now install react and react-dom
  from ~19.3.1 instead of ~19.3.0, so they cannot resolve React 19.3.0. React's 2026-10-14 advisories (critical RCE
  GHSA-xqc2-xf4c-x3h3 and DoS
  GHSA-h3gv-c5rc-p453) affect
  react-server-dom-webpack 19.3.0, and the patched react-server-dom-webpack 19.3.1 peers on React 19.3.1.
  react-on-rails-rsc 19.3.1 still accepts React 19.3.0, so this floor is stricter than the package requires. When an
  existing app has React 19.3.0, the generator now warns and gives one command that upgrades react, react-dom, and
  react-server-dom-webpack together, so a retained lockfile cannot keep the vulnerable copy.
  #5252 by justin808.

• [Pro] Doctor's react-server-dom-webpack check no longer skips pnpm tarball, git, or file: copies:
  pnpm-lock.yaml copies installed from a tarball URL, a git repository, or a local file, and pnpm 5 and 6 copies
  from a non-default registry, are now read too. Doctor warns that it cannot tell whether a non-registry copy includes the
  fixes, instead of reporting the lockfile as not affected.
  #5275 by justin808.

• [Pro] The Node Renderer requires fastify 5.12.6 or later: The react-on-rails-pro-node-renderer package
  now depends on fastify ^5.12.6 instead of ^5.8.5, so an app upgrading with an existing lockfile cannot keep a
  fastify release affected by the 5.12.x security fixes, including authentication bypass through malformed URLs
  (GHSA-p68q-wchp-6fh7), request-validation bypasses
  (GHSA-hwr6-493r-vm6h), and a header-validation bypass fixed
  in 5.12.6 (GHSA-389g-gv7q-r4x8). Fresh 17.2.0 installs
  already pick up a fixed fastify. If your app pins a fastify 5 release below 5.12.6 through pnpm overrides,
  npm overrides, or Yarn resolutions, raise or remove that pin. Node 18.19 apps that use the documented Fastify 4
  override keep it, but no Fastify 4 release fixes the authentication and request-validation bypasses, so
  move to Node 20 or later to get the fixed Fastify 5.
  #5274 by justin808.

• [Pro] Refresh react-server-dom-webpack for React's October 14 RSC advisories: React published
  GHSA-xqc2-xf4c-x3h3 (critical, remote
  code execution) and GHSA-h3gv-c5rc-p453
  (high, denial of service) against react-server-dom-webpack 19.0.0 through 19.3.0. React on Rails does not pin that
  package, so fresh installs already resolve a fixed version, but existing lockfiles keep the old one. Action
  required for upgraders: RSC apps should update react, react-dom, and react-server-dom-webpack together to
  19.3.1 (or all three to 19.2.9 on the 19.2 line) and commit the refreshed lockfile. If a copy nested under
  react-on-rails-rsc stays behind, pin it with npm overrides, pnpm pnpm.overrides, or Yarn resolutions. Check with
  pnpm why react-server-dom-webpack (or the npm or Yarn equivalent).
  #5276 by justin808.