shakacode/shakapacker v9.6.0 on GitHub

[v9.6.0] - March 7, 2026

Security

Removed default Access-Control-Allow-Origin: * header from dev server configuration. This header allowed any website to access dev server resources. If your setup runs webpack-dev-server on a different port from your Rails server, uncomment the headers section in config/shakapacker.yml to restore cross-origin asset loading. PR #936 by justin808. Fixes #935.

Added

Added SKIP=true installer mode to preserve existing files. PR #926 by justin808. Running rails shakapacker:install SKIP=true now skips conflicting files instead of overwriting them. This is useful for CI/CD pipelines and automated setups where you want to install only missing files without touching existing configuration.
Export bundler utility functions for Webpack/Rspack compatibility. PR #922 by justin808. New utility functions that make it easier to write bundler-agnostic configuration code: isRspack, isWebpack, getBundler(), getCssExtractPlugin(), getCssExtractPluginLoader(), getDefinePlugin(), getEnvironmentPlugin(), and getProvidePlugin(). Users no longer need to write conditional logic to handle differences between Webpack and Rspack.
```
// Before: manual conditional logic
const { config } = require("shakapacker")
const CssPlugin =
  config.assets_bundler === "rspack"
    ? require("@rspack/core").CssExtractRspackPlugin
    : require("mini-css-extract-plugin")

// After: use bundler utilities
const { getCssExtractPlugin } = require("shakapacker")
const CssPlugin = getCssExtractPlugin()
```

Changed

Changed default file rule type from asset/resource to asset. PR #901 by justin808. Static assets (images, fonts, SVGs) now use webpack/rspack's asset type instead of asset/resource, allowing the bundler to automatically inline small files as data URIs for better performance.
Allow compression-webpack-plugin v12. PR #937 by G-Rath.

BREAKING: sass-loader now defaults to modern Sass API. PR #879 by justin808. The sass-loader configuration now uses api: "modern" instead of the deprecated legacy API. This improves compatibility with plugins like sass-resources-loader that require the modern API. If you experience issues after upgrading, you can revert to the legacy API by customizing your webpack config:

// config/webpack/webpack.config.js
const { generateWebpackConfig } = require("shakapacker")
const config = generateWebpackConfig()

// Find and modify sass-loader options
config.module.rules.forEach((rule) => {
  if (rule.use) {
    rule.use.forEach((loader) => {
      if (loader.loader?.includes("sass-loader")) {
        loader.options.api = "legacy"
      }
    })
  }
})

module.exports = config

Fixed

Fixed hidden dotfiles and dot-directories being treated as entrypoints. PR #915 by justin808. Entry discovery now ignores files and directories whose names start with . when traversing source_entry_path, preventing unintended bundles from being created. Closes #853.
Fixed orphaned webpack/rspack processes when foreman receives SIGTERM. PR #888 by jordan-brough. When running under foreman, sending SIGTERM to foreman (e.g. kill <pid>) would kill the Ruby shakapacker process but leave the webpack/rspack child process running as an orphan. DevServerRunner now uses exec to replace the Ruby process entirely, and Runner uses spawn with SIGTERM forwarding to ensure the child process is properly terminated.
Fixed missing-environment fallback to use production instead of development. PR #894 by justin808. When a Rails environment (e.g., staging) is not defined in shakapacker.yml, Shakapacker now falls back to the production configuration instead of development. This ensures unknown environments get production-optimized webpack/rspack builds by default.
Fixed installer writing wrong shakapacker version in package.json. PR #899 by justin808. The shakapacker:install generator now keeps the package.json dependency value in sync with the exact version or path that was requested, instead of relying on the post-install value which could differ.
Fixed privateOutputPath not being computed in JavaScript config. PR #891 by ihabadham. The private_output_path setting from shakapacker.yml is now properly resolved to an absolute path and exposed as privateOutputPath in the JavaScript configuration, matching the behavior already present in the Ruby configuration.
Fixed installer not updating shakapacker.yml when selecting a non-default transpiler. PR #895 by codex-rs. Installing with JAVASCRIPT_TRANSPILER=babel (or esbuild) now correctly updates config/shakapacker.yml to match the selected transpiler instead of leaving it set to swc. Previously, a quote mismatch in the gsub_file call meant the config was never actually updated, and the condition also excluded JAVASCRIPT_TRANSPILER=babel from the update entirely. Additionally, JAVASCRIPT_TRANSPILER=babel no longer installs SWC packages.
Fixed ENOENT crash on clean builds when using webpack-assets-manifest v6 with merge: true. PR #931 by justin808. Seeds an empty {} manifest file before instantiating the plugin, so the merge read succeeds on first build rather than throwing an unhandled ENOENT.
Improved error message when manifest is empty or missing. PR #872 by justin808. When the bundler is still compiling (empty manifest) or hasn't run yet (missing manifest file), users now see clear, actionable error messages instead of the generic 7-point checklist.
Fixed NODE_ENV=test causing DefinePlugin warnings. PR #870 by justin808. When RAILS_ENV=test, Shakapacker now sets NODE_ENV=development instead of NODE_ENV=test. This prevents webpack/rspack DefinePlugin conflicts since these bundlers only recognize "development" and "production" as valid NODE_ENV values.
Fixed --json flag output being corrupted by log messages. PR #869 by justin808. When --json is in the command arguments, [Shakapacker] log messages are now written to stderr instead of stdout, keeping stdout clean for valid JSON output. This allows bin/shakapacker --profile --json to be piped to tools like webpack-bundle-analyzer. Normal (non-JSON) usage is unchanged. Resolves #868.
Require explicit truthy values for all installer env vars. PR #926, PR #943 by justin808. Previously, any set value (including "false" or "0") would activate these flags. Now only explicit truthy values (true, 1, yes, case-insensitive) are recognized for SKIP, FORCE, USE_BABEL_PACKAGES, SHAKAPACKER_USE_TYPESCRIPT, and SKIP_COMMON_LOADERS. This behavior change may require CI/scripts that relied on arbitrary non-empty values to switch to recognized truthy values like true.

Documentation

Added CDN limitation warnings for Early Hints feature. PR #878 by justin808. The early hints documentation now prominently notes that most CDNs (Cloudflare, AWS CloudFront, AWS ALB) strip HTTP 103 responses before they reach end users. Debug mode also includes CDN warnings in HTML comments.