react_on_rails 17.2.1.rc.0 → 17.2.1.rc.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: edfd94f0a53c71af11853ebd7d941792638456c4825ad4d81c5f9654a2aceab5
-  data.tar.gz: 9f6795ffd2ff8fdb3af046f2bb5978bd1a773e860a67e4c6fd852ef582f29830
+  metadata.gz: 873030bfb660d497c78ad7f6b1d829afc2ea47f0e9af5eef17d32ecfcbb8eab0
+  data.tar.gz: 06fb62c87edb38282098cff52958084a52337589924caabe98e38ff9ee840180
 SHA512:
-  metadata.gz: c093dc91758e7b2b7877a5ddcee62633bb69fc04ab85cc77157e9a4e2140eda3fa1b3da05954c59b17a7f855601d71a72fb596e8658a7c029804b854b90ee3e5
-  data.tar.gz: beee84a4d4b7bcbd92eabfcee2595057683847c02e088420ad31d9e26639a3149ca1eba9c9c44629cb1c835102b5042218b6c125667aa86e4e70868b05e82e1f
+  metadata.gz: 07302dd91bb841ea7cd9e0f8ea66670c79bebb3bee67556a88836b6d37e8343a6718c419db6828f32981156ec7c7928cbaa1d20fe66ce527183b449329fc0083
+  data.tar.gz: 40a186a2d6db7331315ec50a85c3cf5a6a7e61fe1da14cecb60d6b4e6b05ce4c13955de07043c38e9d10a6c11fcca6ee090db812efd1a3581e0c6961860703ae

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    react_on_rails (17.2.1.rc.0)
+    react_on_rails (17.2.1.rc.2)
       addressable
       connection_pool
       execjs (~> 2.5)

data/lib/generators/react_on_rails/js_dependency_manager.rb

@@ -156,10 +156,15 @@ module ReactOnRails
       # this to later minors just because those releases are current on npm; React's RSC runtime and
       # bundler integration can change between minors. Move it together with RSC_PACKAGE_VERSION_PIN.
       #
+      # The floor is 19.3.1, stricter than the ^19.3.0 that react-on-rails-rsc 19.3.1 accepts: React's
+      # 2026-10-14 RSC advisories (GHSA-xqc2-xf4c-x3h3, GHSA-h3gv-c5rc-p453) affect
+      # react-server-dom-webpack 19.3.0, and the patched react-server-dom-webpack 19.3.1 peers on React
+      # ^19.3.1. A ~19.3.0 range would let a lockfile keep the vulnerable set.
+      #
       # This is intentionally distinct from RSC_PACKAGE_VERSION_PIN below, which pins
-      # `react-on-rails-rsc`. Coordination note for #3609: Pro package metadata and generated apps
-      # use the tested React range with the exact stable RSC package pin.
-      RSC_REACT_VERSION_RANGE = "~19.3.0"
+      # `react-on-rails-rsc`. Coordination note for #3609: generated apps use this React range with
+      # the exact stable RSC package pin; the Pro packages' dev pins track the tested React release.
+      RSC_REACT_VERSION_RANGE = "~19.3.1"
       # Pinned to the stable 19.3.1 package, the current React 19.3 line. Apps generated by earlier
       # versions keep their own pins (19.2.x with React 19.2.7+, or 19.3.0 with React 19.2.8+), which
       # the React on Rails Pro 17 runtime check still supports.

data/lib/generators/react_on_rails/rsc_setup.rb

@@ -42,6 +42,16 @@ module ReactOnRails
       RSC_SUPPORTED_REACT_MINOR = RSC_MINIMUM_REACT_VERSION_TUPLE.fetch(1)
       RSC_MINIMUM_REACT_PATCH = RSC_MINIMUM_REACT_VERSION_TUPLE.fetch(2)
       RSC_SUPPORTED_REACT_LINE = "#{RSC_SUPPORTED_REACT_MAJOR}.#{RSC_SUPPORTED_REACT_MINOR}.x".freeze
+      # Historical fact, not the generator floor: React's 2026-10-14 advisories patched
+      # react-server-dom-webpack at 19.3.1 on the 19.3 line (doctor's RSC_FLIGHT_PATCHED_VERSIONS).
+      # Never bump it with the floor; drop the advisory sentence once the supported line leaves 19.3.
+      RSC_ADVISORY_PATCHED_REACT_VERSION = "19.3.1"
+      RSC_ADVISORY_REACT_LINE = RSC_ADVISORY_PATCHED_REACT_VERSION.sub(/\.\d+\z/, ".x").freeze
+      # Keep in sync with doctor's report_vulnerable_rsc_flight_versions fallback.
+      RSC_NESTED_FLIGHT_OVERRIDE_HINT = <<~HINT.strip
+        If a react-server-dom-webpack copy nested under react-on-rails-rsc stays behind,
+        pin it with npm `overrides`, pnpm `pnpm.overrides`, or Yarn `resolutions`.
+      HINT
       MAX_LAYOUT_NAME_ATTEMPTS = 99
 
       # Main entry point for RSC setup.
@@ -89,30 +99,42 @@ module ReactOnRails
           GeneratorMessages.add_warning(<<~MSG.strip)
             ⚠️  RSC requires React #{RSC_SUPPORTED_REACT_LINE} (detected: #{react_version})
 
-            This generator installs react-on-rails-rsc@#{RSC_PACKAGE_VERSION_PIN}, which requires
-            React #{RSC_SUPPORTED_REACT_LINE} with patch >= #{RSC_MINIMUM_REACT_VERSION}. The React on Rails Pro node renderer refuses
-            to start when React and react-on-rails-rsc are on different lines.
+            This generator installs react-on-rails-rsc@#{RSC_PACKAGE_VERSION_PIN}, which requires React #{RSC_SUPPORTED_REACT_LINE}.
+            The React on Rails Pro node renderer refuses to start when React and react-on-rails-rsc are on
+            different lines. New apps get React #{RSC_MINIMUM_REACT_VERSION} or later. React's 2026-10-14 security
+            advisories affect react-server-dom-webpack below #{RSC_ADVISORY_PATCHED_REACT_VERSION} on the #{RSC_ADVISORY_REACT_LINE} line.
 
-            To install a compatible React version:
-              #{manual_add_packages_command(["react@#{RSC_REACT_VERSION_RANGE}", "react-dom@#{RSC_REACT_VERSION_RANGE}"])}
+            To install a compatible set:
+              #{manual_add_packages_command(rsc_flight_upgrade_packages(RSC_REACT_VERSION_RANGE))}
 
-            Run `bundle exec rake react_on_rails:doctor` afterwards to confirm the pairing.
+            #{RSC_NESTED_FLIGHT_OVERRIDE_HINT}
+
+            Then commit the refreshed lockfile and run `bundle exec rake react_on_rails:doctor` to confirm the pairing.
           MSG
         elsif patch < RSC_MINIMUM_REACT_PATCH
           GeneratorMessages.add_warning(<<~MSG.strip)
             ⚠️  React #{react_version} is below the recommended minimum for RSC.
 
-            Please upgrade to at least React #{RSC_MINIMUM_REACT_VERSION}:
-              #{manual_add_packages_command(["react@#{RSC_MINIMUM_REACT_VERSION}", "react-dom@#{RSC_MINIMUM_REACT_VERSION}"])}
+            React's 2026-10-14 security advisories affect react-server-dom-webpack below #{RSC_ADVISORY_PATCHED_REACT_VERSION} on the
+            #{RSC_ADVISORY_REACT_LINE} line, and each patched react-server-dom-webpack requires the matching React release.
+            Upgrade all three together to #{RSC_MINIMUM_REACT_VERSION} so a retained lockfile does not keep a vulnerable copy:
+              #{manual_add_packages_command(rsc_flight_upgrade_packages(RSC_MINIMUM_REACT_VERSION))}
+
+            #{RSC_NESTED_FLIGHT_OVERRIDE_HINT}
 
-            react-on-rails-rsc@#{RSC_PACKAGE_VERSION_PIN} is coordinated with
-            React/React DOM #{RSC_MINIMUM_REACT_VERSION}+ for the React on Rails Pro 17 RSC runtime.
+            Then commit the refreshed lockfile and run `bundle exec rake react_on_rails:doctor` to confirm the pairing.
           MSG
         end
       end
 
       private
 
+      # react-server-dom-webpack arrives through react-on-rails-rsc, so naming it upgrades the copy a
+      # retained lockfile would otherwise keep; the patched release shares React's version number.
+      def rsc_flight_upgrade_packages(version)
+        %w[react react-dom react-server-dom-webpack].map { |package| "#{package}@#{version}" }
+      end
+
       def add_rsc_config_to_pro_initializer
         initializer_path = "config/initializers/react_on_rails_pro.rb"
         full_path = File.join(destination_root, initializer_path)

data/lib/generators/react_on_rails/templates/base/base/config/webpack/serverWebpackConfig.js.tt

@@ -136,9 +136,18 @@ const configureServer = () => {
 
 
   // Don't hash the server bundle b/c would conflict with the client manifest
-  // And no need for the MiniCssExtractPlugin
+  // And no need for the CSS extraction plugin (MiniCssExtractPlugin or CssExtractRspackPlugin)
+  // Rspack's plugins are matched by class because rspack-manifest-plugin names its
+  // class WebpackManifestPlugin (exported as RspackManifestPlugin).
+  const { RspackManifestPlugin } = config.assets_bundler === 'rspack'
+    ? require('rspack-manifest-plugin')
+    : {};
+  const isRspackClientOnlyPlugin = (plugin) =>
+    (RspackManifestPlugin && plugin instanceof RspackManifestPlugin) ||
+    (bundler.CssExtractRspackPlugin && plugin instanceof bundler.CssExtractRspackPlugin);
   serverWebpackConfig.plugins = serverWebpackConfig.plugins.filter(
     (plugin) =>
+      !isRspackClientOnlyPlugin(plugin) &&
       plugin.constructor.name !== 'WebpackAssetsManifest' &&
       plugin.constructor.name !== 'MiniCssExtractPlugin' &&
       plugin.constructor.name !== 'ForkTsCheckerWebpackPlugin',

data/lib/react_on_rails/doctor.rb

@@ -21,6 +21,7 @@ require_relative "system_checker"
 require_relative "doctor_schema"
 require_relative "pro_migration"
 require_relative "node_renderer_procfile"
+require_relative "version_checker/lockfile_resolution"
 require_relative "../generators/react_on_rails/js_dependency_manager"
 
 begin
@@ -5084,6 +5085,19 @@ module ReactOnRails
       min_patch.positive? ? "#{line} starting at #{RSC_SUPPORTED_PACKAGE_MAJOR}.#{minor}.#{min_patch}" : line
     end.join(" or ")
     RSC_PACKAGE_INSTALL_VERSION = ReactOnRails::Generators::JsDependencyManager::RSC_PACKAGE_VERSION_PIN
+    # React's 2026-10-14 RSC advisories (critical RCE GHSA-xqc2-xf4c-x3h3, DoS GHSA-h3gv-c5rc-p453)
+    # affect react-server-dom-webpack 19.0.0 through 19.3.0. Each entry is the first patched release
+    # on its minor line. This is a security floor, separate from the React pairing in
+    # RSC_REACT_SUPPORT_RANGES, so it has no node-renderer counterpart to keep in sync.
+    RSC_FLIGHT_PACKAGE_NAME = "react-server-dom-webpack"
+    RSC_FLIGHT_ADVISORIES = "GHSA-xqc2-xf4c-x3h3 (critical remote code execution) and " \
+                            "GHSA-h3gv-c5rc-p453 (denial of service)"
+    RSC_FLIGHT_PATCHED_VERSIONS = {
+      [19, 0] => "19.0.9",
+      [19, 1] => "19.1.10",
+      [19, 2] => "19.2.9",
+      [19, 3] => "19.3.1"
+    }.freeze
     # Rejected prerelease lines with a known published stable successor: the 19.3.0-rc.4 pin that
     # React on Rails 17.1.0 generated, and the 19.3.1-rc.x soak that 17.2.0.rc.0 and rc.1 admitted.
     # Mirrors prereleaseLinesWithStableSuccessor in rscPeerSupport.ts.
@@ -5143,7 +5157,7 @@ module ReactOnRails
       check_rsc_bundler_config
       check_rsc_rspack_version
       check_rsc_rspack_lazy_compilation
-      check_rsc_react_version
+      check_rsc_package_versions
       check_rsc_procfile_watcher
       check_rsc_client_manifest
       check_rsc_artifacts
@@ -5334,6 +5348,99 @@ module ReactOnRails
       check_legacy_rsc_react_version(react_version)
     end
 
+    def check_rsc_package_versions
+      check_rsc_react_version
+      check_rsc_flight_advisories
+    end
+
+    # Reads every react-server-dom-webpack copy the lockfile resolves, not node_modules, so the
+    # warning matches what a fresh install or deploy would get from the committed lockfile.
+    def check_rsc_flight_advisories
+      package_root = resolved_package_root
+      return if package_root_missing?(package_root)
+
+      versions = ReactOnRails::VersionChecker::LockfileResolution.all_versions(package_root, RSC_FLIGHT_PACKAGE_NAME)
+      if versions.empty?
+        report_unchecked_rsc_flight_advisories(package_root)
+        return
+      end
+
+      by_status = versions.group_by { |version| rsc_flight_version_status(version) }
+      report_vulnerable_rsc_flight_versions(by_status[:vulnerable]) if by_status[:vulnerable]
+      report_unjudged_rsc_flight_versions(by_status[:unknown]) if by_status[:unknown]
+      return unless by_status.keys == [:patched]
+
+      verb = versions.size == 1 ? "is" : "are"
+      checker.add_success("✅ #{RSC_FLIGHT_PACKAGE_NAME} #{versions.join(', ')} #{verb} not affected by " \
+                          "#{RSC_FLIGHT_ADVISORIES}")
+    end
+
+    # Copies rsc_flight_version_status cannot judge (see there) get this instead of a success.
+    def report_unjudged_rsc_flight_versions(versions)
+      checker.add_warning(<<~MSG.strip)
+        ⚠️  Could not tell whether #{RSC_FLIGHT_PACKAGE_NAME} #{versions.join(', ')} includes the fixes for React's RSC
+        security advisories #{RSC_FLIGHT_ADVISORIES}.
+
+        The advisories cover 19.0.0 through 19.3.0, fixed in #{RSC_FLIGHT_PATCHED_VERSIONS.values.join(', ')}.
+        Prefer a stable patched release, or confirm this build was published after 2026-10-14.
+      MSG
+    end
+
+    def report_vulnerable_rsc_flight_versions(vulnerable)
+      # React on Rails Pro 17 RSC supports the 19.2 and 19.3 lines, so older lines move to 19.3.
+      on_19_2_line = vulnerable.map { |version| npm_version_tuple(version)[1] == 2 }.uniq
+      target_text = case on_19_2_line
+                    when [true] then RSC_FLIGHT_PATCHED_VERSIONS.fetch([19, 2])
+                    when [false] then RSC_FLIGHT_PATCHED_VERSIONS.fetch([19, 3])
+                    else "#{RSC_FLIGHT_PATCHED_VERSIONS.fetch([19, 3])} " \
+                         "(or #{RSC_FLIGHT_PATCHED_VERSIONS.fetch([19, 2])} for copies on the 19.2 line)"
+                    end
+      checker.add_warning(<<~MSG.strip)
+        ⚠️  Your lockfile resolves #{RSC_FLIGHT_PACKAGE_NAME} #{vulnerable.join(', ')}, which React's RSC security
+        advisories #{RSC_FLIGHT_ADVISORIES} affect.
+
+        Fix: update react, react-dom, and #{RSC_FLIGHT_PACKAGE_NAME} together to #{target_text}
+        (each patched #{RSC_FLIGHT_PACKAGE_NAME} requires the matching React release), then commit the
+        refreshed lockfile. If a copy nested under #{RSC_PACKAGE_NAME} stays behind, pin it with npm
+        `overrides`, pnpm `pnpm.overrides`, or Yarn `resolutions`.
+        Confirm with `npm ls #{RSC_FLIGHT_PACKAGE_NAME}`, `pnpm why #{RSC_FLIGHT_PACKAGE_NAME}`,
+        or `yarn why #{RSC_FLIGHT_PACKAGE_NAME}`.
+      MSG
+    end
+
+    # RSC always installs react-server-dom-webpack, so finding no copy means the check did not run:
+    # the lockfile is missing, unreadable, or at a workspace root above the package root.
+    def report_unchecked_rsc_flight_advisories(package_root)
+      checker.add_warning(<<~MSG.strip)
+        ⚠️  Could not check #{RSC_FLIGHT_PACKAGE_NAME} against React's RSC security advisories
+        #{RSC_FLIGHT_ADVISORIES}.
+
+        No readable yarn.lock, package-lock.json, pnpm-lock.yaml, or bun.lock in #{package_root} lists it.
+        If your lockfile lives at a workspace root, confirm every copy is #{RSC_FLIGHT_PATCHED_VERSIONS.values.join(', ')}
+        or later on its line with `npm ls #{RSC_FLIGHT_PACKAGE_NAME}`, `pnpm why #{RSC_FLIGHT_PACKAGE_NAME}`,
+        or `yarn why #{RSC_FLIGHT_PACKAGE_NAME}`.
+      MSG
+    end
+
+    # :vulnerable below its line's patched release, whatever the prerelease tag: even a canary built
+    # after the fix is answered by moving to the stable patched release. :patched for a stable release
+    # at or above it or on a later line. :unknown for what the advisories give no rule for: a
+    # prerelease above the patched release, experimental builds, earlier lines, unparseable versions.
+    def rsc_flight_version_status(version)
+      return :unknown unless Gem::Version.correct?(version)
+
+      major, minor, = npm_version_tuple(version)
+      patched = RSC_FLIGHT_PATCHED_VERSIONS[[major, minor]]
+      stable = npm_prerelease(version).blank?
+      if patched
+        return :vulnerable if Gem::Version.new(version) < Gem::Version.new(patched)
+
+        return stable ? :patched : :unknown
+      end
+
+      stable && ([major, minor] <=> RSC_FLIGHT_PATCHED_VERSIONS.keys.max).positive? ? :patched : :unknown
+    end
+
     def check_legacy_rsc_react_version(react_version)
       if supported_rsc_react_version?(react_version)
         checker.add_success("✅ React #{react_version} is compatible with RSC")

data/lib/react_on_rails/helper.rb

@@ -23,6 +23,7 @@ module ReactOnRails
     include ReactOnRails::FontHelper
 
     COMPONENT_HTML_KEY = "componentHtml"
+    CSP_NONCE_OVERRIDE_FIBER_KEY = :react_on_rails_csp_nonce_override
     IMMEDIATE_HYDRATION_WARNING_MUTEX = Mutex.new
 
     class << self
@@ -371,8 +372,6 @@ module ReactOnRails
           end
         end
 
-        add_csp_nonce_to_context(result)
-
         if defined?(request) && request.present?
           # Check for encoding of the request's original_url and try to force-encoding the
           # URLs as UTF-8. This situation can occur in browsers that do not encode the
@@ -408,6 +407,10 @@ module ReactOnRails
       end
 
       context = @rails_context.merge(serverSide: server_side)
+      # Added per call rather than memoized: a component rendered for the Pro component
+      # cache sees a placeholder nonce (see csp_nonce), and that must not leak into the
+      # context later renders of the same request use.
+      add_csp_nonce_to_context(context)
       add_rsc_stream_observability_to_context(context)
       context
     end
@@ -722,10 +725,21 @@ module ReactOnRails
       )
     end
 
+    # Returns the CSP script nonce that framework-emitted scripts carry. React on Rails Pro
+    # sets CSP_NONCE_OVERRIDE_FIBER_KEY while it renders a component whose HTML it will
+    # cache, so every framework script in that HTML carries a random placeholder only the
+    # framework knows. Pro then swaps the placeholder for the serving request's nonce on
+    # every response, which leaves app markup carrying the request nonce unpromoted
+    # (issue #5267). Fiber storage scopes the override to that render and the async tasks
+    # it starts, so concurrent renders of other components keep the request nonce.
+    def csp_nonce
+      Fiber[CSP_NONCE_OVERRIDE_FIBER_KEY] || request_csp_nonce
+    end
+
     # Returns the CSP script nonce for the current request, or nil if CSP is not enabled.
     # Rails 5.2-6.0 use content_security_policy_nonce with no arguments.
     # Rails 6.1+ accept an optional directive argument.
-    def csp_nonce
+    def request_csp_nonce
       return unless respond_to?(:content_security_policy_nonce)
 
       begin

data/lib/react_on_rails/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module ReactOnRails
-  VERSION = "17.2.1.rc.0"
+  VERSION = "17.2.1.rc.2"
 end

data/lib/react_on_rails/version_checker/lockfile_resolution.rb

@@ -35,6 +35,20 @@ module ReactOnRails
         nil
       end
 
+      # Every version of +package_name+ that the lockfiles in +dir+ resolve, transitive copies
+      # included. .version answers "what did package.json's direct dependency resolve to"; this
+      # answers "which copies get installed", so a security check sees a vulnerable nested copy
+      # (react-server-dom-webpack arrives through react-on-rails-rsc, not package.json).
+      # Unreadable lockfiles contribute nothing. Returns a unique Array of version Strings.
+      def self.all_versions(dir, package_name)
+        ALL_VERSION_READERS.flat_map do |filename, reader|
+          path = File.join(dir, filename)
+          next [] unless File.exist?(path)
+
+          guard { reader.call(path, package_name) } || []
+        end.uniq
+      end
+
       # Yarn Berry (yarn 2+) yarn.lock content, dispatched from version_from_yarn_lock when the
       # __metadata marker is present. Returns a version String or nil.
       def self.berry_yarn_version(content, package_name)
@@ -77,6 +91,43 @@ module ReactOnRails
           end
         end
 
+        # Keys under packages/snapshots name every installed copy:
+        #   9.0: "name@1.2.3" or "name@1.2.3(peer@4.5.6)"; 6.0: "/name@1.2.3(...)"; 5.x: "/name/1.2.3_peer@4.5.6"
+        #   5.x and 6.0 from a non-default registry: "registry.example.com/name/1.2.3",
+        #   "localhost+4873/name/1.2.3", or "registry.example.com/name@1.2.3"
+        # Tarball, git, and file: copies are returned as their whole key, so callers report them as unknown
+        # instead of skipping them or misreading a tarball name such as "19.3.1.tgz" as a version. 9.0 keys
+        # them as "name@https://...tgz(peer@4.5.6)"; 5.x and 6.0 key them by source ("github.com/org/repo/sha",
+        # "file:vendor/pkg.tgz") and record the package only in the entry's name.
+        PLAIN_VERSION = /\A\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?\z/
+
+        def self.all_versions(path, package_name)
+          doc = project_document(path)
+          return [] unless doc
+
+          key_pattern = %r{\A/?(?:[^/@]+/)?#{Regexp.escape(package_name)}[@/](.+)\z}
+          versions = []
+          %w[packages snapshots].each do |section|
+            entries = doc[section]
+            next unless entries.is_a?(Hash)
+
+            entries.each do |key, entry|
+              version = copy_version(key.to_s, entry, key_pattern, package_name)
+              versions << version if version
+            end
+          end
+          versions.uniq
+        end
+
+        def self.copy_version(key, entry, key_pattern, package_name)
+          rest = key[key_pattern, 1]
+          resolution = key[0, key.index("(") || key.length]
+          return (resolution if entry.is_a?(Hash) && entry["name"] == package_name) unless rest
+
+          version = strip_peer_suffix(rest)
+          version&.match?(PLAIN_VERSION) ? version : resolution
+        end
+
         def self.dependencies(doc)
           return doc.dig("importers", ".", "dependencies") if doc.key?("importers")
 
@@ -119,6 +170,19 @@ module ReactOnRails
           resolution.rpartition("@").last
         end
 
+        # packages is keyed by install path ("name", "parent/name"); entry[0] is "name@version".
+        def self.all_versions(path, package_name)
+          packages = JSON.parse(jsonc_to_json(File.read(path)))["packages"]
+          return [] unless packages.is_a?(Hash)
+
+          packages.values.filter_map do |entry|
+            resolution = entry.is_a?(Array) ? entry[0] : nil
+            next unless resolution.is_a?(String) && resolution.start_with?("#{package_name}@")
+
+            resolution.delete_prefix("#{package_name}@")
+          end
+        end
+
         # One complete JSON string literal (escape-aware), a // line comment, a /* */ block
         # comment, and a trailing comma directly before } or ].
         STRING_LITERAL = /"(?:[^"\\]|\\.)*"/
@@ -157,14 +221,99 @@ module ReactOnRails
           # can merge several selectors into one key. Matching "#{name}@" cannot collide with
           # longer names ("react-on-rails-pro@..." does not start with "react-on-rails@").
           doc.each do |key, entry|
-            next if key == "__metadata"
-            next unless key.to_s.split(",").any? { |selector| selector.strip.start_with?("#{package_name}@") }
+            next unless entry_for?(key, package_name)
 
             return entry["version"]&.to_s if entry.is_a?(Hash)
           end
           nil
         end
+
+        def self.all_versions(content, package_name)
+          doc = YAML.safe_load(content, permitted_classes: [Date, Time])
+          return [] unless doc.is_a?(Hash)
+
+          # An alias ("flight@npm:react-server-dom-webpack@19.3.0") is keyed by the alias name, but
+          # its resolution still names the real package.
+          doc.filter_map do |key, entry|
+            next unless entry.is_a?(Hash)
+            next unless entry_for?(key, package_name) || entry["resolution"].to_s.start_with?("#{package_name}@")
+
+            entry["version"]&.to_s
+          end
+        end
+
+        def self.entry_for?(key, package_name)
+          return false if key == "__metadata"
+
+          key.to_s.split(",").any? { |selector| selector.strip.start_with?("#{package_name}@") }
+        end
+      end
+
+      # Yarn classic yarn.lock: one block per resolved copy, keyed by its selectors
+      # ("name@^1.0.0", "name@~1.0.2":) with an indented version "1.0.3" line. An npm alias
+      # selector ("flight@npm:name@19.3.0") names the real package after "npm:".
+      module ClassicYarnLockfile
+        def self.all_versions(path, package_name)
+          content = File.read(path)
+          return BerryYarnLockfile.all_versions(content, package_name) if content[0, 1024].include?("__metadata:")
+
+          selector = /\A"?(?:[^\s"]+@npm:)?#{Regexp.escape(package_name)}@/
+          versions = []
+          in_block = false
+          content.each_line do |line|
+            if line.match?(/\A\S/)
+              in_block = line.match?(selector)
+            elsif in_block && (match = line.match(/\A\s+version\s+"?([^"\s]+)"?/))
+              versions << match[1]
+              in_block = false
+            end
+          end
+          versions
+        end
       end
+
+      # package-lock.json v2/v3 keys every copy by install path ("node_modules/name",
+      # "node_modules/parent/node_modules/name"); an npm alias installs under the alias path and
+      # records the real package in "name". v1 nests copies under dependencies, and records an
+      # alias's real package in its version ("flight": { "version": "npm:name@1.2.3" }).
+      module NpmLockfile
+        def self.all_versions(path, package_name)
+          doc = JSON.parse(File.read(path))
+          return [] unless doc.is_a?(Hash)
+
+          install_path = %r{(?:\A|/)node_modules/#{Regexp.escape(package_name)}\z}
+          from_packages = (doc["packages"].is_a?(Hash) ? doc["packages"] : {}).filter_map do |key, entry|
+            next unless entry.is_a?(Hash)
+
+            entry["version"] if key.match?(install_path) || (key != "" && entry["name"] == package_name)
+          end
+          from_packages + v1_versions(doc["dependencies"], package_name)
+        end
+
+        def self.v1_versions(dependencies, package_name)
+          return [] unless dependencies.is_a?(Hash)
+
+          alias_prefix = "npm:#{package_name}@"
+          dependencies.flat_map do |name, entry|
+            next [] unless entry.is_a?(Hash)
+
+            version = entry["version"].to_s
+            own = if version.start_with?(alias_prefix) then [version.delete_prefix(alias_prefix)]
+                  elsif name == package_name && !version.empty? then [version]
+                  else
+                    []
+                  end
+            own + v1_versions(entry["dependencies"], package_name)
+          end
+        end
+      end
+
+      ALL_VERSION_READERS = {
+        "yarn.lock" => ClassicYarnLockfile.method(:all_versions),
+        "package-lock.json" => NpmLockfile.method(:all_versions),
+        "pnpm-lock.yaml" => PnpmLockfile.method(:all_versions),
+        "bun.lock" => BunLockfile.method(:all_versions)
+      }.freeze
     end
   end
 end

data/sig/react_on_rails/version_checker/lockfile_resolution.rbs

@@ -1,13 +1,20 @@
 module ReactOnRails
   class VersionChecker
     module LockfileResolution
+      ALL_VERSION_READERS: Hash[String, Method]
+
       def self.version: (String dir, String package_name) -> String?
+      def self.all_versions: (String dir, String package_name) -> Array[String]
       def self.berry_yarn_version: (String content, String package_name) -> String?
       def self.guard: [T] () { () -> T } -> T?
       def self.log_ignored: (Exception error) -> void
 
       module PnpmLockfile
+        PLAIN_VERSION: Regexp
+
         def self.version: (String path, String package_name) -> String?
+        def self.all_versions: (String path, String package_name) -> Array[String]
+        def self.copy_version: (String key, untyped entry, Regexp key_pattern, String package_name) -> String?
         def self.dependencies: (Hash[String, untyped] doc) -> Hash[String, untyped]?
         def self.project_document: (String path) -> Hash[String, untyped]?
         def self.strip_peer_suffix: (String? version) -> String?
@@ -20,11 +27,23 @@ module ReactOnRails
         TRAILING_COMMA: Regexp
 
         def self.version: (String path, String package_name) -> String?
+        def self.all_versions: (String path, String package_name) -> Array[String]
         def self.jsonc_to_json: (String content) -> String
       end
 
       module BerryYarnLockfile
         def self.version: (String content, String package_name) -> String?
+        def self.all_versions: (String content, String package_name) -> Array[String]
+        def self.entry_for?: (untyped key, String package_name) -> bool
+      end
+
+      module ClassicYarnLockfile
+        def self.all_versions: (String path, String package_name) -> Array[String]
+      end
+
+      module NpmLockfile
+        def self.all_versions: (String path, String package_name) -> Array[String]
+        def self.v1_versions: (untyped dependencies, String package_name) -> Array[String]
       end
     end
   end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: react_on_rails
 version: !ruby/object:Gem::Version
-  version: 17.2.1.rc.0
+  version: 17.2.1.rc.2
 platform: ruby
 authors:
 - Justin Gordon