react_on_rails 16.6.0.rc.1 → 16.6.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5c525aa58afae47bf65f4118b11472b00b06649b2b3eba698fa6f7b82a6a6050
-  data.tar.gz: 2fe64e5d5ce2306b56408b26ffef471177ed33319732336f2f4d203b4917b742
+  metadata.gz: bd57c5ba417fed762b468a17579ea7bdf04bb314730eb62e9b2ae210fd873c9c
+  data.tar.gz: a860a8fafb5f17aaf1bb9f07d519a3d73bbc6f3b997b44d7398c7fce7e4c45ab
 SHA512:
-  metadata.gz: 8e580e7e342ed62b643a5d89a8b8b9f145a3edb2e51089c240575445824b1b7c5b8d82286e477a6a8457d54ed26d64fb4a05f6a42a9cbca229e3512bfdbeddc8
-  data.tar.gz: 95539a4061db5f32a57c0e0d0e4665ba2fea563de45686ff0fecc10d94ce28f5f043348d29af748acee96f078c9337fd805677f388c903b34b1562c90571c22d
+  metadata.gz: 36ac38e9d74615e2970df360ce082bbfc625624347deaf0ddddf4756c21c112a76572795652ccd94f8f0cc05e8bbf51b6499a68a36c61a0e32eac06b17268721
+  data.tar.gz: 6a084e79ce8b4b8b5f9328d3243d71d740a2f34291f07c57fc56e33985d75242015171fc7c15b74a36545dc40263e603ece9cb0d4d722e4d624060fb56c14726

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    react_on_rails (16.6.0.rc.1)
+    react_on_rails (16.6.0)
       addressable
       connection_pool
       execjs (~> 2.5)

data/lib/generators/react_on_rails/js_dependency_manager.rb

@@ -52,29 +52,39 @@ module ReactOnRails
     # Include this module in generator classes and call setup_js_dependencies
     # to handle all JS dependency installation via package_json gem.
     module JsDependencyManager
+      # Third-party dependencies are pinned to ^major.0.0 ranges to prevent breaking
+      # changes from uncontrolled major version bumps (e.g., peer dependency conflicts)
+      # while still allowing minor/patch updates. Pre-1.0 packages are left bare since
+      # ^0.x ranges pin to the minor version, which is too narrow.
+      # Exception: SWC deps are pinned to match Shakapacker's own version constraints
+      # (swc-loader@^0.2.0 is pre-1.0 but deliberately pinned for Shakapacker compat).
+      #
+      # Update these pins deliberately when adopting a new major version.
+
       # Core React dependencies required for React on Rails
       # Note: @babel/preset-react is handled separately in BABEL_REACT_DEPENDENCIES
       # and is added only when SWC is not the active transpiler.
       REACT_DEPENDENCIES = %w[
-        react
-        react-dom
-        prop-types
+        react@^19.0.0
+        react-dom@^19.0.0
+        prop-types@^15.0.0
       ].freeze
 
       # Babel preset needed by the generated babel.config.js for non-SWC setups.
       BABEL_REACT_DEPENDENCIES = %w[
-        @babel/preset-react
+        @babel/preset-react@^7.0.0
       ].freeze
 
       # CSS processing dependencies for webpack
       CSS_DEPENDENCIES = %w[
-        css-loader
-        css-minimizer-webpack-plugin
-        mini-css-extract-plugin
-        style-loader
+        css-loader@^7.0.0
+        css-minimizer-webpack-plugin@^8.0.0
+        mini-css-extract-plugin@^2.0.0
+        style-loader@^4.0.0
       ].freeze
 
       # Development-only dependencies for hot reloading (Webpack)
+      # Both packages are pre-1.0, so left bare (see pinning note above).
       DEV_DEPENDENCIES = %w[
         @pmmmwh/react-refresh-webpack-plugin
         react-refresh
@@ -82,14 +92,15 @@ module ReactOnRails
 
       # Rspack core dependencies (only installed when --rspack flag is used)
       RSPACK_DEPENDENCIES = %w[
-        @rspack/core
-        rspack-manifest-plugin
+        @rspack/core@^1.0.0
+        rspack-manifest-plugin@^5.0.0
       ].freeze
 
       # Rspack development dependencies for hot reloading
+      # react-refresh is pre-1.0, so left bare (see pinning note above).
       RSPACK_DEV_DEPENDENCIES = %w[
-        @rspack/cli
-        @rspack/plugin-react-refresh
+        @rspack/cli@^1.0.0
+        @rspack/plugin-react-refresh@^1.0.0
         react-refresh
       ].freeze
 
@@ -100,16 +111,17 @@ module ReactOnRails
       # - If users choose javascript_transpiler: 'babel', they should manually add @babel/preset-typescript
       #   and configure it in their babel.config.js
       TYPESCRIPT_DEPENDENCIES = %w[
-        typescript
-        @types/react
-        @types/react-dom
+        typescript@^6.0.0
+        @types/react@^19.0.0
+        @types/react-dom@^19.0.0
       ].freeze
 
       # SWC transpiler dependencies (for Shakapacker 9.3.0+ default transpiler)
       # SWC is ~20x faster than Babel and is the default for new Shakapacker installations
+      # Version ranges match Shakapacker's own constraints.
       SWC_DEPENDENCIES = %w[
-        @swc/core
-        swc-loader
+        @swc/core@^1.3.0
+        swc-loader@^0.2.0
       ].freeze
 
       # React on Rails Pro dependencies (only installed when --pro or --rsc flag is used)
@@ -222,7 +234,8 @@ module ReactOnRails
         # RSC requires React 19.0.x specifically (not 19.1.x or later)
         # Pin to ~19.0.4 to allow patch updates while staying within 19.0.x
         react_deps = if respond_to?(:use_rsc?) && use_rsc?
-                       ["react@#{RSC_REACT_VERSION_RANGE}", "react-dom@#{RSC_REACT_VERSION_RANGE}", "prop-types"]
+                       ["react@#{RSC_REACT_VERSION_RANGE}", "react-dom@#{RSC_REACT_VERSION_RANGE}",
+                        "prop-types@^15.0.0"]
                      else
                        REACT_DEPENDENCIES
                      end

data/lib/generators/react_on_rails/templates/base/base/bin/switch-bundler

@@ -6,14 +6,17 @@ require "json"
 
 # Script to switch between webpack and rspack bundlers
 class BundlerSwitcher
+  # Pinned to ^major.0.0 to prevent peer dependency conflicts from major version bumps.
+  # Pre-1.0 packages are left bare since ^0.x pins to the minor version.
+  # webpack-cli pinned to ^6 (not ^7) to stay within Shakapacker's supported peer range.
   WEBPACK_DEPS = {
-    dependencies: %w[webpack webpack-assets-manifest webpack-merge],
-    dev_dependencies: %w[webpack-cli webpack-dev-server @pmmmwh/react-refresh-webpack-plugin]
+    dependencies: %w[webpack@^5.0.0 webpack-assets-manifest@^6.0.0 webpack-merge@^6.0.0],
+    dev_dependencies: %w[webpack-cli@^6.0.0 webpack-dev-server@^5.0.0 @pmmmwh/react-refresh-webpack-plugin]
   }.freeze
 
   RSPACK_DEPS = {
-    dependencies: %w[@rspack/core rspack-manifest-plugin],
-    dev_dependencies: %w[@rspack/cli @rspack/plugin-react-refresh]
+    dependencies: %w[@rspack/core@^1.0.0 rspack-manifest-plugin@^5.0.0],
+    dev_dependencies: %w[@rspack/cli@^1.0.0 @rspack/plugin-react-refresh@^1.0.0]
   }.freeze
 
   def initialize(target_bundler)
@@ -83,11 +86,14 @@ class BundlerSwitcher
     remove_deps = @target_bundler == "rspack" ? WEBPACK_DEPS : RSPACK_DEPS
 
     # Remove old bundler dependencies
+    # Strip version suffix (e.g., "webpack@^5.0.0" -> "webpack") since package.json keys are bare names.
+    # The regex handles scoped (@scope/name@ver) and unscoped (name@ver) packages, and is a no-op for
+    # bare names without a version suffix (e.g., "@pmmmwh/react-refresh-webpack-plugin" stays unchanged).
     remove_deps[:dependencies].each do |dep|
-      package_json["dependencies"]&.delete(dep)
+      package_json["dependencies"]&.delete(dep[%r{\A(@[^/]+/[^@]+|[^@]+)}])
     end
     remove_deps[:dev_dependencies].each do |dep|
-      package_json["devDependencies"]&.delete(dep)
+      package_json["devDependencies"]&.delete(dep[%r{\A(@[^/]+/[^@]+|[^@]+)}])
     end
 
     puts "✅ Removed #{@target_bundler == 'rspack' ? 'webpack' : 'rspack'} dependencies"

data/lib/react_on_rails/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module ReactOnRails
-  VERSION = "16.6.0.rc.1"
+  VERSION = "16.6.0"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: react_on_rails
 version: !ruby/object:Gem::Version
-  version: 16.6.0.rc.1
+  version: 16.6.0
 platform: ruby
 authors:
 - Justin Gordon
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-04-08 00:00:00.000000000 Z
+date: 2026-04-09 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: addressable