react_on_rails 17.1.0 → 17.2.0.rc.0

data/lib/react_on_rails/helper.rb

@@ -737,8 +737,8 @@ module ReactOnRails
     end
 
     # Wraps console replay JavaScript code in a script tag with CSP nonce if available.
-    # The console_script_code is already sanitized by scriptSanitizedVal() in the JavaScript layer,
-    # so using html_safe here is secure.
+    # The console_script_code is already escaped by escapeScript() (applied inside
+    # consoleReplay() in the JavaScript layer), so using html_safe here is secure.
     def wrap_console_script_with_nonce(console_script_code)
       return "" if console_script_code.blank?
 
@@ -748,7 +748,7 @@ module ReactOnRails
       script_options = { id: "consoleReplayLog" }
       script_options[:nonce] = nonce if nonce.present?
 
-      # Safe to use html_safe because content is pre-sanitized via scriptSanitizedVal()
+      # Safe to use html_safe because content is pre-escaped via escapeScript()
       content_tag(:script, console_script_code.html_safe, script_options)
     end
 

data/lib/react_on_rails/react_component/render_options.rb

@@ -105,13 +105,11 @@ module ReactOnRails
       end
 
       def dom_id
-        @dom_id ||= options.fetch(:id) do
-          if random_dom_id
-            generate_unique_dom_id
-          else
-            base_dom_id
-          end
-        end
+        @dom_id ||= if options[:id].nil?
+                      random_dom_id ? generate_unique_dom_id : base_dom_id
+                    else
+                      options[:id]
+                    end
       end
 
       def random_dom_id?

data/lib/react_on_rails/server_rendering_pool/ruby_embedded_java_script.rb

@@ -149,8 +149,7 @@ module ReactOnRails
 
         def read_bundle_js_code
           server_js_file = ReactOnRails::Utils.server_bundle_js_file_path
-          server_bundle_path_is_http = ReactOnRails::Utils.server_bundle_path_is_http?
-          if server_bundle_path_is_http
+          if ReactOnRails::Utils.server_bundle_path_is_http?
             file_url_to_string(server_js_file)
           else
             File.read(server_js_file)
@@ -160,19 +159,12 @@ module ReactOnRails
           # (a supported config convenience, e.g. https://:password@host:3800). This is the
           # public entry point that file_url_to_string is called from, so without this the
           # sanitization inside file_url_to_string's own raise/rescue is moot for any real
-          # caller — the credential would still leak here regardless. Errors already wrapped by
-          # file_url_to_string have passed through the same message sanitizer; scanning that
-          # wrapper again would treat its diagnostic text as fresh untrusted input. Other errors
-          # are scrubbed here because URI::InvalidURIError embeds the raw URL in its message.
-          sanitized_url = sanitized_renderer_url(server_js_file)
-          sanitized_error = if server_bundle_path_is_http && e.is_a?(ReactOnRails::ServerBundleLoadError)
-                              e.message
-                            else
-                              sanitized_renderer_error_message(e.message, server_js_file, sanitized_url)
-                            end
-          msg = "You specified server rendering JS file: #{sanitized_url}, but it cannot " \
+          # caller — the credential would still leak here regardless. e.message is scrubbed too:
+          # a URL malformed enough that URI.parse raises embeds the raw, unsanitized URL verbatim
+          # in URI::InvalidURIError's own message.
+          msg = "You specified server rendering JS file: #{sanitized_renderer_url(server_js_file)}, but it cannot " \
                 "be read. You may set the server_bundle_js_file in your configuration to be \"\" to " \
-                "avoid this warning.\nError is: #{sanitized_error}\n\n" \
+                "avoid this warning.\nError is: #{strip_userinfo(e.message, configured_url: server_js_file)}\n\n" \
                 "#{Utils.default_troubleshooting_section}"
           raise ReactOnRails::ServerBundleLoadError, msg
         end
@@ -400,106 +392,27 @@ module ReactOnRails
           nil
         end
 
-        # Strips any embedded credentials from a configured renderer URL before it is
-        # interpolated into an error message, so a password in the URL (a supported config
-        # convenience, e.g. https://:password@host:3800) cannot leak into logs or error
-        # trackers. One configured value is not free-form prose: multiple schemes or line breaks
-        # after its first scheme make it structurally ambiguous, so that URL suffix fails closed
-        # through its final @. Any non-URL prefix is preserved for useful error context.
+        # Removes credentials from a renderer URL for safe display. See #5046.
         def sanitized_renderer_url(url)
-          return url if url.nil? || url.empty?
-
-          scheme = url.match(%r{https?://}i)
-          return url unless scheme
-
-          prefix = url[...scheme.begin(0)]
-          configured_url = url[scheme.begin(0)..]
-          sanitized_url = if configured_url.match?(/[\r\n]/) || configured_url.scan(%r{https?://}i).length > 1
-                            strip_malformed_url_userinfo(configured_url)
-                          else
-                            sanitized_valid_http_url(configured_url) || strip_malformed_url_userinfo(configured_url)
-                          end
-
-          "#{prefix}#{sanitized_url}"
-        end
-
-        def sanitized_renderer_error_message(message, raw_url, sanitized_url = sanitized_renderer_url(raw_url))
-          message = message.to_s
-          return strip_userinfo(message) if raw_url.nil? || raw_url.empty?
-
-          # URI::InvalidURIError embeds String#inspect, while other errors may embed the raw value.
-          message = message.gsub(raw_url.inspect) { sanitized_url.inspect }
-                           .gsub(raw_url) { sanitized_url }
-          strip_userinfo(message)
-        end
-
-        # Protects successfully parsed bare HTTP(S) tokens by assembling the result from spans,
-        # without collision-prone placeholder text. A candidate remains unprotected when any @
-        # follows it before the next scheme: punctuation, prose, and line breaks are not structural
-        # proof that the @ is unrelated to malformed userinfo. When an unresolved region precedes
-        # a credential-bearing candidate, that region is discarded and the candidate is sanitized
-        # independently rather than allowing one fallback match to consume through another scheme.
-        # Ambiguous text may be over-redacted for safety.
-        def strip_userinfo(text)
-          text = text.to_s
-          sanitized = text.dup.clear
-          unprotected_start = 0
-
-          text.to_enum(:scan, %r{https?://(?:(?!https?://)[^\s"'])+}i).each do
-            match = Regexp.last_match
-            protected_url = sanitized_valid_http_url(match[0])
-            next unless protected_url
-            next if userinfo_delimiter_before_next_scheme?(text, match)
-
-            unprotected = text[unprotected_start...match.begin(0)]
-            sanitized << sanitized_unprotected_prefix(unprotected, match[0], protected_url)
-            sanitized << protected_url
-            unprotected_start = match.end(0)
-          end
-
-          sanitized << strip_unprotected_userinfo(text[unprotected_start..])
-        end
-
-        def userinfo_delimiter_before_next_scheme?(text, match)
-          continuation = text[match.end(0)..]
-          boundary = continuation.match(%r{https?://}i)
-          continuation = continuation[...boundary.begin(0)] if boundary
-          continuation.include?("@")
-        end
-
-        def sanitized_unprotected_prefix(text, raw_url, sanitized_url)
-          unresolved_scheme = text.match(%r{https?://}i)
-          return strip_unprotected_userinfo(text) if raw_url == sanitized_url || unresolved_scheme.nil?
-
-          text[...unresolved_scheme.begin(0)]
-        end
-
-        # URI handles valid URLs structurally, so an @ in the path is never mistaken for userinfo.
-        # Returning nil for invalid input keeps that token unprotected for the fail-closed pass.
-        def sanitized_valid_http_url(url)
-          uri = URI.parse(url)
-          return url if uri.userinfo.nil?
-
-          # URI rejects a password without a user, so clear password first.
-          uri.password = nil
-          uri.user = nil
-          uri.to_s
-        rescue URI::Error
-          nil
+          Utils.sanitize_url_for_display(url)
         end
 
-        def strip_unprotected_userinfo(text)
-          text.gsub(%r{https?://(?:(?!https?://).)*@}im) { |span| strip_malformed_url_userinfo(span) }
+        # Scrubs credentials from error-message text. When the configured URL is
+        # known, replaces it exactly first (handles tricky passwords), then cleans
+        # any remaining URL-like patterns in the prose.
+        def strip_userinfo(text, configured_url: nil)
+          sanitized_text = if configured_url
+                             text.to_s.gsub(configured_url) { sanitized_renderer_url(configured_url) }
+                           else
+                             text.to_s
+                           end
+          Utils.sanitize_error_text(sanitized_text)
         end
 
-        # For malformed URLs or unprotected scheme-delimited spans, remove through the last @. The
-        # retained suffix is best-effort context; ambiguous malformed diagnostics may lose text.
-        def strip_malformed_url_userinfo(url)
-          scheme = url.match(%r{\Ahttps?://}i)
-          userinfo_delimiter = url.rindex("@")
-          return url unless scheme && userinfo_delimiter
+        def sanitized_url_error_message(error, configured_url:)
+          return strip_userinfo(error.message, configured_url:) unless error.is_a?(URI::InvalidURIError)
 
-          "#{url[...scheme.end(0)]}#{url[(userinfo_delimiter + 1)..]}"
+          "bad URI (sanitized): #{sanitized_renderer_url(configured_url).inspect}"
         end
 
         def file_url_to_string(url)
@@ -518,10 +431,10 @@ module ReactOnRails
           # equals the destination (UTF-8). charset_from_content_type returns UTF-8 for three of
           # the four cases this method exists to handle (no Content-Type header, no charset
           # parameter, and an explicit charset=utf-8), so `.encode(Encoding::UTF_8)` alone would
-          # silently let invalid bytes through unchanged on those three paths — only a genuine
-          # cross-encoding transcode (e.g. a declared ISO-8859-1 body) actually validates via
-          # `encode`. valid_encoding? is therefore checked explicitly afterward so every path
-          # fails fast, not just the cross-encoding one.
+          # silently let invalid bytes through unchanged on those three paths. A genuine
+          # cross-encoding transcode can reject malformed input only when the source encoding has
+          # invalid byte sequences of its own (such as Shift_JIS). valid_encoding? is therefore
+          # checked explicitly afterward so every path fails fast, not just the cross-encoding one.
           #
           # An undecodable byte sequence (a charset that doesn't actually match the bytes) is
           # deliberately raised here rather than silently replaced with U+FFFD: this is source
@@ -542,10 +455,8 @@ module ReactOnRails
           # message, which Rails.logger and error trackers can persist. e.message is scrubbed as
           # well as url itself: a URL malformed enough that URI.parse raises embeds the raw,
           # unsanitized URL verbatim in URI::InvalidURIError's own message.
-          sanitized_url = sanitized_renderer_url(url)
-          sanitized_error = sanitized_renderer_error_message(e.message, url, sanitized_url)
-          msg = "file_url_to_string #{sanitized_url} failed\nError is: " \
-                "#{sanitized_error}\n\n#{Utils.default_troubleshooting_section}"
+          msg = "file_url_to_string #{sanitized_renderer_url(url)} failed\nError is: " \
+                "#{sanitized_url_error_message(e, configured_url: url)}\n\n#{Utils.default_troubleshooting_section}"
           raise ReactOnRails::ServerBundleLoadError, msg
         end
 

data/lib/react_on_rails/utils.rb

@@ -3,6 +3,7 @@
 require "English"
 require "open3"
 require "rainbow"
+require "uri"
 require "active_support"
 require "active_support/core_ext/string"
 require "shellwords"
@@ -444,6 +445,70 @@ module ReactOnRails
       end
     end
 
+    # Removes credentials from a URL for safe display in logs and error messages.
+    # Uses URI.parse for all heavy lifting — no regex on the URL itself.
+    #
+    # URI::File silently drops userinfo during parsing, so uri.to_s is already
+    # clean for file:// URLs. Malformed URLs that fail URI.parse get a safe
+    # placeholder. See #5046.
+    def self.sanitize_url_for_display(url)
+      return url if url.nil? || url.empty?
+
+      # Prepend http:// if there's no scheme — bare "host:port" strings are
+      # valid targets but URI.parse misparses them (treats "host" as the scheme).
+      # The HTTP stack makes the same assumption.
+      added_scheme = false
+      unless url.include?("://") || url.start_with?("/")
+        url = "http://#{url}"
+        added_scheme = true
+      end
+
+      begin
+        uri = URI.parse(url)
+      rescue URI::InvalidURIError
+        return "[unparseable URL redacted]"
+      end
+
+      if uri.userinfo
+        uri.password = nil
+        uri.user = nil
+      end
+
+      result = redact_query_values(uri)
+      # Strip the scheme we added — output should match the input format
+      result = result.delete_prefix("http://") if added_scheme
+      result
+    end
+
+    # Scrubs credentials from error-message text that may contain URLs.
+    def self.sanitize_error_text(text)
+      return text if text.nil? || text.empty?
+
+      text.to_s
+          .gsub(%r{//[^/?#]*@}, "//")
+          .gsub(%r{https?://[^\s]+}) do |match|
+        trimmed = match.sub(/[).,;:'">\]]+\z/, "")
+        sanitize_url_for_display(trimmed) + match[trimmed.length..]
+      end
+    end
+
+    # Replaces query values with [REDACTED], keeping keys for diagnostics.
+    # Bare components without = (like ?eyJhbGciOi...) are treated as opaque
+    # tokens and fully redacted. Operates on a parsed URI object.
+    def self.redact_query_values(uri)
+      if uri.query && !uri.query.empty?
+        begin
+          pairs = URI.decode_www_form(uri.query)
+          uri.query = pairs.map { |k, v| v.empty? ? "[REDACTED]" : "#{k}=[REDACTED]" }.join("&")
+        rescue ArgumentError
+          uri.query = "[REDACTED]"
+        end
+      end
+
+      uri.to_s
+    end
+    private_class_method :redact_query_values
+
     def self.default_troubleshooting_section
       <<~DEFAULT
         📞 Get Help & Support:

data/lib/react_on_rails/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module ReactOnRails
-  VERSION = "17.1.0"
+  VERSION = "17.2.0.rc.0"
 end

data/lib/react_on_rails/version_checker/lockfile_resolution.rb

@@ -0,0 +1,170 @@
+# frozen_string_literal: true
+
+require "json"
+require "yaml"
+require "date"
+require "strscan"
+
+module ReactOnRails
+  class VersionChecker
+    # Parsers for the lockfile formats that NodePackageVersion#resolve_version consults beyond
+    # Yarn classic and package-lock.json: pnpm-lock.yaml, bun.lock, and Yarn Berry's YAML
+    # yarn.lock (issue #5049). Semantics deliberately mirror the pre-existing parsers: entries
+    # are found by package name, and any unreadable or unrecognized lockfile simply yields nil
+    # so resolution falls back to the package.json version.
+    #
+    # The binary bun.lockb is intentionally NOT parsed (undocumented format); projects still on
+    # it resolve from package.json until they migrate to bun's text lockfile
+    # (bun install --save-text-lockfile --frozen-lockfile --lockfile-only, bun >= 1.1.39).
+    module LockfileResolution
+      # Resolve the installed version from pnpm-lock.yaml or bun.lock in +dir+ (the directory
+      # containing the package.json being checked). Returns a version String or nil.
+      def self.version(dir, package_name)
+        pnpm_lock = File.join(dir, "pnpm-lock.yaml")
+        if File.exist?(pnpm_lock)
+          version = guard { PnpmLockfile.version(pnpm_lock, package_name) }
+          return version if version
+        end
+
+        bun_lock = File.join(dir, "bun.lock")
+        if File.exist?(bun_lock)
+          version = guard { BunLockfile.version(bun_lock, package_name) }
+          return version if version
+        end
+
+        nil
+      end
+
+      # Yarn Berry (yarn 2+) yarn.lock content, dispatched from version_from_yarn_lock when the
+      # __metadata marker is present. Returns a version String or nil.
+      def self.berry_yarn_version(content, package_name)
+        guard { BerryYarnLockfile.version(content, package_name) }
+      end
+
+      # A malformed, unreadable, or unexpectedly shaped lockfile must behave exactly like a
+      # missing one (package.json fallback), mirroring the JSON::ParserError rescue the
+      # package-lock.json parser has always had — never crash the Rails initializer.
+      def self.guard
+        yield
+      rescue Psych::Exception, JSON::ParserError, TypeError, NoMethodError,
+             SystemCallError, EncodingError, ArgumentError => e
+        # These classes are how bad lockfile CONTENT surfaces (shape surprises from dig chains,
+        # invalid encodings, parse errors) — but a bug inside a parser would raise the same
+        # classes. Leave a debug trace so a swallowed programming error stays discoverable.
+        log_ignored(e)
+        nil
+      end
+
+      def self.log_ignored(error)
+        return unless defined?(Rails) && Rails.logger
+
+        Rails.logger.debug { "React on Rails lockfile resolution ignored #{error.class}: #{error.message}" }
+      end
+
+      # pnpm-lock.yaml. Handles lockfileVersion 5.x (pnpm <= 7: bare version strings), 6.0
+      # (pnpm 8: {specifier, version} objects), and 9.0 (pnpm 9/10: importers section),
+      # including the pnpm 11 multi-document form where an env document precedes the project
+      # document.
+      module PnpmLockfile
+        def self.version(path, package_name)
+          doc = project_document(path)
+          return nil unless doc
+
+          entry = dependencies(doc)&.[](package_name)
+          case entry
+          when Hash then strip_peer_suffix(entry["version"])
+          when String then strip_peer_suffix(entry)
+          end
+        end
+
+        def self.dependencies(doc)
+          return doc.dig("importers", ".", "dependencies") if doc.key?("importers")
+
+          doc["dependencies"]
+        end
+
+        # YAML.safe_load would return only the FIRST document of a pnpm 11 multi-document
+        # lockfile — the env document, which itself carries an importers section (with
+        # configDependencies/packageManagerDependencies under ".", never dependencies), so a
+        # first-match scan would pick it and resolution would come up empty. pnpm always writes
+        # the project document last (writeEnvLockfile prepends the env doc on every write), so
+        # scan the stream from the end. permitted_classes: some pnpm versions write unquoted
+        # ISO timestamps (a time: map), which Psych types as Date/Time and safe parsing would
+        # otherwise reject.
+        def self.project_document(path)
+          docs = YAML.safe_load_stream(File.read(path), permitted_classes: [Date, Time])
+          docs.reverse_each.find { |d| d.is_a?(Hash) && (d.key?("importers") || d.key?("dependencies")) }
+        end
+
+        # lockfileVersion >= 6: "16.6.0(react-dom@19.3.0(react@19.3.0))(react@19.3.0)" -> "16.6.0"
+        # lockfileVersion 5.x:  "16.6.0_react@19.3.0" -> "16.6.0"
+        def self.strip_peer_suffix(version)
+          return nil if version.nil?
+
+          cut = [version.index("("), version.index("_")].compact.min
+          cut ? version[0...cut] : version
+        end
+      end
+
+      # bun.lock — bun's text lockfile (lockfileVersion 0 in bun 1.1.39, 1 in bun 1.2-1.3,
+      # 2 in bun 1.4+; same on-disk shape throughout). The file is JSONC: strict JSON.parse
+      # fails on its trailing commas, so comments and trailing commas are stripped first.
+      module BunLockfile
+        def self.version(path, package_name)
+          doc = JSON.parse(jsonc_to_json(File.read(path)))
+          resolution = doc.dig("packages", package_name, 0)
+          return nil unless resolution.is_a?(String)
+
+          # "react-on-rails@16.6.0" / "@scope/pkg@1.2.3" -> version after the last "@"
+          resolution.rpartition("@").last
+        end
+
+        # One complete JSON string literal (escape-aware), a // line comment, a /* */ block
+        # comment, and a trailing comma directly before } or ].
+        STRING_LITERAL = /"(?:[^"\\]|\\.)*"/
+        LINE_COMMENT = %r{//[^\n]*}
+        BLOCK_COMMENT = %r{/\*.*?\*/}m
+        TRAILING_COMMA = /,(?=\s*[}\]])/
+
+        # String-aware JSONC-to-JSON: comments and trailing commas are only stripped OUTSIDE
+        # string literals, so values like "x,]" or "https://..." can never be corrupted.
+        def self.jsonc_to_json(content)
+          scanner = StringScanner.new(content)
+          result = +""
+          until scanner.eos?
+            if (string = scanner.scan(STRING_LITERAL))
+              result << string
+            elsif scanner.scan(LINE_COMMENT) || scanner.scan(BLOCK_COMMENT) || scanner.scan(TRAILING_COMMA)
+              next
+            else
+              result << scanner.getch
+            end
+          end
+          result
+        end
+      end
+
+      # Yarn Berry yarn.lock (real YAML; entry shape is identical across __metadata versions
+      # 4-8, i.e. yarn 2 through yarn 4). Mirrors the Yarn classic parser's semantics: the
+      # first entry keyed by this package name wins.
+      module BerryYarnLockfile
+        def self.version(content, package_name)
+          # permitted_classes mirrors the pnpm parser: tolerate unquoted timestamp scalars.
+          doc = YAML.safe_load(content, permitted_classes: [Date, Time])
+          return nil unless doc.is_a?(Hash)
+
+          # Berry keys registry deps with the npm: protocol ("react-on-rails@npm:^16.1.1") and
+          # can merge several selectors into one key. Matching "#{name}@" cannot collide with
+          # longer names ("react-on-rails-pro@..." does not start with "react-on-rails@").
+          doc.each do |key, entry|
+            next if key == "__metadata"
+            next unless key.to_s.split(",").any? { |selector| selector.strip.start_with?("#{package_name}@") }
+
+            return entry["version"]&.to_s if entry.is_a?(Hash)
+          end
+          nil
+        end
+      end
+    end
+  end
+end

data/lib/react_on_rails/version_checker.rb

@@ -4,6 +4,7 @@ require "json"
 require_relative "version_syntax_converter"
 require_relative "shakapacker_config_helpers"
 require_relative "rsc_rspack_support"
+require_relative "version_checker/lockfile_resolution"
 
 module ReactOnRails
   # Responsible for checking versions of rubygem versus yarn node package
@@ -15,7 +16,10 @@ module ReactOnRails
     attr_reader :node_package_version
 
     # Semver uses - to separate pre-release, but RubyGems use .
-    VERSION_PARTS_REGEX = /(\d+)\.(\d+)\.(\d+)(?:[-.]([0-9A-Za-z.-]+))?/
+    # Possessive quantifiers (++) keep matching linear on adversarial inputs (e.g. a version
+    # string of thousands of digits): a digit run never needs to backtrack for the following
+    # "." to match, so the semantics are unchanged.
+    VERSION_PARTS_REGEX = /(\d++)\.(\d++)\.(\d++)(?:[-.]([0-9A-Za-z.-]++))?/
     def self.build
       new(NodePackageVersion.build)
     end
@@ -205,8 +209,10 @@ module ReactOnRails
         Detected: #{node_package_version.raw}
              Gem: #{gem_version}
 
-        React on Rails requires exact version matching between the gem and npm package.
-        Do not use ^, ~, >, <, *, or other semver ranges.
+        React on Rails checks the INSTALLED package version against the gem version, so semver
+        ranges like ^ or ~ in package.json are fine when a lockfile can resolve them. No lockfile
+        could resolve the installed version here, so the package.json version itself must be an
+        exact version matching the gem.
 
         Fix:
           Run: #{install_cmd}
@@ -579,24 +585,33 @@ module ReactOnRails
 
       # Resolve version from lockfiles if available, otherwise use package.json version
       def resolve_version(package_json_version, package_name)
-        # If package.json specifies a local path or URL, don't try to resolve from lockfiles
-        # Lockfiles may contain placeholder versions like "0.0.0" for local links
-        return package_json_version if local_path_or_url_version?(package_json_version)
+        # If package.json specifies a local path, URL, or workspace link, don't try to resolve
+        # from lockfiles. Lockfiles record placeholders for links (e.g. "0.0.0", the Yarn Berry
+        # "0.0.0-use.local"), and keeping the raw spec lets the validators apply their
+        # local/workspace exemptions. A JSON null dependency value stays nil (validators treat a
+        # nil raw as "not installed").
+        return package_json_version if package_json_version.nil? ||
+                                       local_path_or_url_version?(package_json_version) ||
+                                       package_json_version.start_with?("workspace:")
+
+        # Fall back to the package.json version when no lockfile resolves one.
+        lockfile_version(package_name) || package_json_version
+      end
 
-        # Try yarn.lock first
+      # Try yarn.lock first, then package-lock.json, then the other package managers'
+      # lockfiles (pnpm-lock.yaml, bun.lock), which live in the same directory as package.json.
+      def lockfile_version(package_name)
         if yarn_lock && File.exist?(yarn_lock)
-          lockfile_version = version_from_yarn_lock(package_name)
-          return lockfile_version if lockfile_version
+          version = version_from_yarn_lock(package_name)
+          return version if version
         end
 
-        # Try package-lock.json
         if package_lock && File.exist?(package_lock)
-          lockfile_version = version_from_package_lock(package_name)
-          return lockfile_version if lockfile_version
+          version = version_from_package_lock(package_name)
+          return version if version
         end
 
-        # Fall back to package.json version
-        package_json_version
+        LockfileResolution.version(File.dirname(package_json.to_s), package_name)
       end
 
       # Check if a version string represents a local path or URL
@@ -616,6 +631,13 @@ module ReactOnRails
       def version_from_yarn_lock(package_name)
         return nil unless yarn_lock && File.exist?(yarn_lock)
 
+        # Yarn Berry (yarn 2+) writes the same yarn.lock filename in a YAML format marked by an
+        # __metadata section near the top; the format is decided by content, not by the yarn
+        # version in use. Sniff only the file head so the classic path below keeps streaming.
+        if File.open(yarn_lock) { |f| f.read(1024) }.to_s.include?("__metadata:")
+          return LockfileResolution.berry_yarn_version(File.read(yarn_lock), package_name)
+        end
+
         in_package_block = false
         File.foreach(yarn_lock) do |line|
           # Check if we're starting the block for our package
@@ -627,15 +649,14 @@ module ReactOnRails
           end
 
           # If we're in the package block, look for the version line
-          if in_package_block
-            # Version line looks like:  version "16.1.1"
-            if (match = line.match(/^\s+version\s+"([^"]+)"/))
-              return match[1]
-            end
-
-            # If we hit a blank line or new package, we've left the block
-            break if line.strip.empty? || (line[0] != " " && line[0] != "\t")
+          next unless in_package_block
+          # Version line looks like:  version "16.1.1"
+          if (match = line.match(/^\s+version\s+"([^"]+)"/))
+            return match[1]
           end
+
+          # If we hit a blank line or new package, we've left the block
+          break if line.strip.empty? || (line[0] != " " && line[0] != "\t")
         end
 
         nil

data/rakelib/run_rspec.rake

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require "pathname"
+require "shellwords"
 require "yaml"
 
 require_relative "task_helpers"
@@ -42,7 +43,11 @@ namespace :run_rspec do
       # by appending RBS runtime hook instead of replacing
       existing_rubyopt = ENV.fetch("RUBYOPT", nil)
       rubyopt_parts = ["-rrbs/test/setup", existing_rubyopt].compact.reject(&:empty?)
-      "RBS_TEST_TARGET='ReactOnRails::*' RUBYOPT='#{rubyopt_parts.join(' ')}'"
+      # Configuration accepts Rails.root and documented locale directories as Pathname values.
+      # Load their standard-library signatures without dropping caller-supplied RBS options.
+      rbs_options = "#{ENV.fetch('RBS_TEST_OPT', '-I sig')} -r pathname"
+      "RBS_TEST_OPT=#{Shellwords.escape(rbs_options)} " \
+        "RBS_TEST_TARGET='ReactOnRails::*' RUBYOPT='#{rubyopt_parts.join(' ')}'"
     rescue LoadError
       # RBS not available - silently skip runtime checking
       # This is expected in environments without the rbs gem