react_on_rails 16.4.0.rc.0 → 16.4.0.rc.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e73e8a4df085484ab44226919e7e642d67b609b03375b34845ea43f896e2ca43
-  data.tar.gz: c94d4c27cd4ae57c9b382b80327686d918ad2906f561879c04cc90817f89d195
+  metadata.gz: 9598839cf6698d283c5549d221dd23a2b67903cbc8620fb037012b74bc0d0a61
+  data.tar.gz: 7b89e0d293d6aa02af9b404732adf5376a4c9411e180a880a538db48e8fa337c
 SHA512:
-  metadata.gz: 5eac27c292bd94ffbdb2c61a3d64d0021b39320c7b82778df631c4e231cfafa190a943101a41d57cf053a0b52f948b3dd0f8c0db5d48cc4a7f9e12177043c770
-  data.tar.gz: ab3b3beeda1c9ae9d5bf21b2e6ba946d1ead835ed9e0b6fc7b3017e3cdfdb8c101aab5f25a3fd35f6486c0f2dfdd4e68927f9b0a9d0a9020e709f9e33d0a29bb
+  metadata.gz: 78464cfa9ffbaae7606fbb68cafb3189dba19a0aa731af101d6eae85ed8ce66fb9d44e5f5bf6444377d011621b599a63a742b25621213b744d711950c9ca123a
+  data.tar.gz: 51b18f716f5d6cadcc777c14fee9430f3c40375932be3f9576e355564365995768f635a45ecd29c2605ad9eac146ee85a0a2190acdd700b10cd71aa58046fa59

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    react_on_rails (16.4.0.rc.0)
+    react_on_rails (16.4.0.rc.1)
       addressable
       connection_pool
       execjs (~> 2.5)

data/lib/react_on_rails/helper.rb

@@ -480,23 +480,27 @@ module ReactOnRails
       )
     end
 
+    # Returns the CSP script nonce for the current request, or nil if CSP is not enabled.
+    # Rails 5.2-6.0 use content_security_policy_nonce with no arguments.
+    # Rails 6.1+ accept an optional directive argument.
+    def csp_nonce
+      return unless respond_to?(:content_security_policy_nonce)
+
+      begin
+        content_security_policy_nonce(:script)
+      rescue ArgumentError
+        # Fallback for Rails versions that don't accept arguments
+        content_security_policy_nonce
+      end
+    end
+
     # Wraps console replay JavaScript code in a script tag with CSP nonce if available.
     # The console_script_code is already sanitized by scriptSanitizedVal() in the JavaScript layer,
     # so using html_safe here is secure.
     def wrap_console_script_with_nonce(console_script_code)
       return "" if console_script_code.blank?
 
-      # Get the CSP nonce if available (Rails 5.2+)
-      # Rails 5.2-6.0 use content_security_policy_nonce with no arguments
-      # Rails 6.1+ accept an optional directive argument
-      nonce = if respond_to?(:content_security_policy_nonce)
-                begin
-                  content_security_policy_nonce(:script)
-                rescue ArgumentError
-                  # Fallback for Rails versions that don't accept arguments
-                  content_security_policy_nonce
-                end
-              end
+      nonce = csp_nonce
 
       # Build the script tag with nonce if available
       script_options = { id: "consoleReplayLog" }

data/lib/react_on_rails/pro_helper.rb

@@ -24,9 +24,11 @@ module ReactOnRails
       spec_tag = if render_options.immediate_hydration
                    # Escape dom_id for JavaScript context
                    escaped_dom_id = escape_javascript(render_options.dom_id)
+                   nonce = csp_nonce
+                   script_options = nonce.present? ? { nonce: nonce } : {}
                    immediate_script = content_tag(:script, %(
           typeof ReactOnRails === 'object' && ReactOnRails.reactOnRailsComponentLoaded('#{escaped_dom_id}');
-        ).html_safe)
+        ).html_safe, script_options)
                    "#{component_specification_tag}\n#{immediate_script}"
                  else
                    component_specification_tag
@@ -49,9 +51,14 @@ module ReactOnRails
       store_hydration_scripts = if redux_store_data[:immediate_hydration]
                                   # Escape store_name for JavaScript context
                                   escaped_store_name = escape_javascript(redux_store_data[:store_name])
-                                  immediate_script = content_tag(:script, <<~JS.strip_heredoc.html_safe
-                                    typeof ReactOnRails === 'object' && ReactOnRails.reactOnRailsStoreLoaded('#{escaped_store_name}');
-                                  JS
+                                  nonce = csp_nonce
+                                  script_options = nonce.present? ? { nonce: nonce } : {}
+                                  immediate_script = content_tag(
+                                    :script,
+                                    <<~JS.strip_heredoc.html_safe,
+                                      typeof ReactOnRails === 'object' && ReactOnRails.reactOnRailsStoreLoaded('#{escaped_store_name}');
+                                    JS
+                                    script_options
                                   )
                                   "#{store_hydration_data}\n#{immediate_script}"
                                 else

data/lib/react_on_rails/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module ReactOnRails
-  VERSION = "16.4.0.rc.0"
+  VERSION = "16.4.0.rc.1"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: react_on_rails
 version: !ruby/object:Gem::Version
-  version: 16.4.0.rc.0
+  version: 16.4.0.rc.1
 platform: ruby
 authors:
 - Justin Gordon
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-02-11 00:00:00.000000000 Z
+date: 2026-02-13 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: addressable