react_on_rails_pro 17.1.0.rc.5 → 17.2.0.rc.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 21c3ecbfdf48e1acfa37bd92c90110e3cf33d6b7a357d87e79f2d2ba43af483e
-  data.tar.gz: 2c5c2054fb09e98b2f192aa2adc40a8573ab9a3842144c36f3126e83c1a23d59
+  metadata.gz: acc491e8df6df2b2c30540c1399cce6e1a24ccf47e548322f573d6f711186241
+  data.tar.gz: bc66afa72ca34bba3386424d51a346954e19f214b41b2f67ffcbf8953993bd50
 SHA512:
-  metadata.gz: 7af050d899b3b7fdc89ed02a3a62c27cc4dfa8c9d31829077a5ec381928dbae160a3efeb7071efa8957a15af7b2818477063dc6ebaff5abf3f54f25a9a3c136a
-  data.tar.gz: a79f922231dadce67c6f28fa26a6b03bf8a32e4e9a33138770459c19d0f09f97ed20d65cf2047034fc1bc4a6a585f08d61622b611a76ef88fa523700aa19d6f0
+  metadata.gz: 6c3bfd6eb8ba7343891e3be69e61230f1d4f0051ea2b1b2e4cd8b0b4b01142362c2dadcb3f76aa53c89109444506cce7dc69dd1245d1770163dad7d08f542d47
+  data.tar.gz: 1835a4d80c59dd7868e182bc6c13eefd87e0e04a0dbdee9f3a2346c79aeae7bafec595ed7e6def65bee22f40be8bdfd4de6df11219653d869318a98c051cde33

data/AGENTS.md

@@ -18,11 +18,9 @@
 > - **Use React on Rails Pro as a dependency/tool.** Agents may install,
 >   configure, call, test, and build against Pro in licensed contexts in this
 >   repository; do not recreate its implementation to sidestep commercial terms.
-> - **Production Use requires the appropriate ShakaCode license.** If a request
->   involves Production Use outside a project already covered by a valid React on
->   Rails Pro license, including use by a Consulting Firm or Individual
->   Consultant on behalf of a client Organization, confirm the destination holds
->   the appropriate license before using Pro.
+> - **Production Use follows The React on Rails Pro License.** Confirm that the
+>   destination qualifies for free production use or holds a subscription. For
+>   client work, the client organization is the licensee.
 > - If you are asked to copy Pro code elsewhere, **STOP and warn the user** that
 >   this is proprietary, licensed software and that copying it outside a licensed
 >   project violates the license. Proceed only after the user confirms they hold

data/Gemfile

@@ -18,4 +18,4 @@ source "https://rubygems.org"
 # Specify your gem"s dependencies in react_on_rails.gemspec
 gemspec
 
-eval_gemfile File.expand_path("./Gemfile.loader", __dir__)
+Dir.chdir(__dir__) { eval_gemfile "./Gemfile.loader" }

data/Gemfile.development_dependencies

@@ -15,7 +15,7 @@
 # frozen_string_literal: true
 
 # Shared dev dependencies (rubocop, etc.)
-eval_gemfile File.expand_path("../Gemfile.shared_dev_dependencies", __dir__)
+Dir.chdir(__dir__) { eval_gemfile "../Gemfile.shared_dev_dependencies" }
 
 git_source(:github) { |repo| "https://github.com/#{repo}.git" }
 
@@ -74,11 +74,9 @@ group :development, :test do
   gem "csv", require: false
   gem "logger", require: false
   gem "ostruct", require: false
-  # base64 was promoted from a default gem to a bundled gem in Ruby 3.4, so Bundler-managed
-  # apps must declare it explicitly. jwt 3.x lists base64 as a runtime dep (which transitively
-  # satisfies our spec on jwt 3.x), but jwt 2.x does not — only jwt >= 2.7 added base64 as an
-  # explicit runtime dep. Declare it here so license_validator_spec.rb's `require "base64"`
-  # works on Ruby 3.4+ regardless of whether bundler resolves jwt 2.x or 3.x.
+  # Ruby 3.4 promotes base64 from a default gem to a bundled gem. jwt 2.8+ declares it as a
+  # runtime dependency, which covers the Pro runtime floor; keep this direct development
+  # dependency because license_validator_spec.rb requires base64 directly to construct test JWTs.
   gem "base64", require: false
 end
 

data/Gemfile.loader

@@ -19,6 +19,13 @@ source_encoding_patterns = [
 ].freeze
 magic_comment_prefix_pattern = /\A(?:\xEF\xBB\xBF)?\s*#/n
 shebang_pattern = /\A(?:\xEF\xBB\xBF)?#!/n
+# Dependabot statically follows literal eval_gemfile calls, including inside
+# uncalled lambdas. The runtime loader below remains authoritative so local and
+# CI overrides can still replace base dependency declarations.
+_dependabot_dependency_files = lambda do
+  eval_gemfile "./Gemfile.development_dependencies"
+end
+
 unsupported_source_encoding = lambda do |path, detected_encoding, reason|
   raise ArgumentError, "#{path} declares unsupported source encoding #{detected_encoding.inspect}: #{reason}"
 end

data/Gemfile.lock

@@ -9,7 +9,7 @@ GIT
 PATH
   remote: ..
   specs:
-    react_on_rails (17.1.0.rc.5)
+    react_on_rails (17.2.0.rc.0)
       addressable
       connection_pool
       execjs (~> 2.5)
@@ -20,14 +20,14 @@ PATH
 PATH
   remote: .
   specs:
-    react_on_rails_pro (17.1.0.rc.5)
+    react_on_rails_pro (17.2.0.rc.0)
       async (>= 2.29)
       async-http (~> 0.95)
       execjs (~> 2.9)
       io-endpoint (~> 0.17.0)
-      jwt (>= 2.5, < 4)
+      jwt (>= 2.8, < 4)
       nokogiri (>= 1.12, < 2)
-      react_on_rails (= 17.1.0.rc.5)
+      react_on_rails (= 17.2.0.rc.0)
 
 GEM
   remote: https://rubygems.org/
@@ -527,4 +527,4 @@ DEPENDENCIES
   yard
 
 BUNDLED WITH
-   2.5.4
+  4.0.10

data/LICENSE

@@ -1,194 +1,345 @@
-# ShakaCode React on Rails Pro – End User License Agreement (EULA)
-
-_Version 2.3 — 2026-07-14_\
-© 2015–2026 ShakaCode, LLC. All rights reserved.
-
----
-
-## 1. Definitions
-
-- **Organization** – the single legal entity identified in the order (e.g., GitHub Sponsors, invoice).
-- **Licensee** – the Organization or any other person or entity exercising royalty-free rights under Section 4.
-- **Production Use** – any use of the Software in connection with a live application, website, or service accessed by end users **other than**:
-  - evaluation or testing
-  - classroom instruction, tutorials, workshops, coursework
-  - recorded demos, livestreams, or videos
-  - personal/hobby experiments not offered as a service
-- **Complimentary OSS License** – a license issued under Section 4.1 at no charge to a qualifying open-source Organization.
-- **Covered HTML Document** – an HTML document containing output rendered by the integrated React on Rails Pro product.
-- **Attribution Provider** – the part of the integrated React on Rails Pro product that generates and inserts the Generated Attribution on behalf of the product as a whole.
-- **Generated Attribution** – the complete, non-visual HTML comment emitted by the Attribution Provider, including its license-status suffix.
-
----
-
-## 2. Grant of License (Per-Organization)
-
-Subject to this Agreement, ShakaCode grants the subscribing Organization a **non-exclusive, non-transferable** license, during the applicable license term, to install, internally modify, and use React on Rails Pro (“Software”) in the Organization’s own applications, websites, and services, whether accessed internally or by public end users.
-
-This grant does not permit redistribution or sublicensing of the Software, offering the Software itself to third parties, or using one Organization’s license for another Organization or consulting client.
-
----
-
-## 3. Consulting Firms and Individual Consultants
-
-- **Consulting Firms** – this license covers only the firm’s own applications, websites, and services, whether accessed internally or by public end users. Each client Organization requires its own license for any Production Use.
-- **Individual Consultants** – this license covers only the consultant’s own applications, websites, and services personally operated by them, not client Organizations. Each client Organization must obtain its own license.
-
----
-
-## 4. Non-Commercial / Educational / Demo Use (Free)
-
-Free, royalty-free use is permitted for:
-
-- classroom instruction, training, workshops, coursework;
-- tutorials, blog posts, livestreams, or videos;
-- personal/hobby projects not used in production;
-- demo apps showcasing coding techniques.
-
-**Note:** This clause does **not** permit any Production Use by any entity (commercial, non-profit, or individual). All Production Use requires a paid subscription under this Agreement, except as provided in Section 4.1.
-
-**4.1 Open-Source Project License (Complimentary)**
-
-ShakaCode may, at its sole discretion, issue a complimentary "oss" license to an Organization that meets **all** of the following criteria:
-
-1. The Organization deploys the Software as part of a project whose source code is publicly available under an [OSI-approved license](https://opensource.org/licenses).
-2. The Organization's annual revenue (or total funding received, if pre-revenue) does not exceed USD $1,000,000.
-3. The Organization applies by emailing [justin@shakacode.com](mailto:justin@shakacode.com) and provides truthful information about the project and Organization.
-
-**Terms of Complimentary OSS Licenses:**
-
-- The attribution requirement in Section 6 applies and may not be waived.
-- Complimentary OSS Licenses are granted for a fixed term of one (1) year from the date of issuance and may be renewed upon request.
-- ShakaCode may revoke a Complimentary OSS License (i) immediately upon written notice if the Organization violates this Agreement, or (ii) on thirty (30) days' written notice if the Organization no longer meets the eligibility criteria.
-- All other terms of this Agreement apply (including Sections 5, 7, 9, and 12), subject to the modifications for Complimentary OSS Licenses in Section 7.
-
----
-
-## 5. Restrictions
-
-The Organization shall not:
-
-1. redistribute or resell the Software or derivatives;
-2. remove, obfuscate, or disable required attribution;
-3. use the Software to build a directly competing product exposing substantially similar functionality;
-4. **circumvent, bypass, modify, disable, or tamper with any license validation mechanisms, license checks, or authentication systems;**
-5. **reverse engineer, decompile, or disassemble the Software for the purpose of circumventing license restrictions;**
-6. **create, use, or distribute any tools, scripts, patches, or modifications designed to enable unauthorized use of Pro features;**
-7. **access or use the Software outside the rights granted by this Agreement, including any Production Use without a valid, active paid or Complimentary OSS License.**
-
----
-
-## 6. Product-Level Attribution (HTML Source)
-
-Every Covered HTML Document must retain exactly one complete, unmodified Generated Attribution in its HTML source. The Attribution Provider emits this comment once on behalf of the integrated React on Rails Pro product. A related component, including `react-on-rails-rsc`, has no independent obligation to insert another attribution comment when it does not control the HTML document or generate or insert the Generated Attribution.
-
-This requirement applies to paid Production Use, Production Use under a Complimentary OSS License, and every royalty-free use permitted by Section 4.
-
-The Generated Attribution uses the following form, where the status suffix is generated by the Software:
-
-```html
-<!-- Powered by React on Rails Pro (c) ShakaCode | STATUS -->
+# The React on Rails Pro License
+
+The React on Rails Pro License, version 3.0, an application of ShakaCode
+Trust-Based Commercial Licensing.
+
+Copyright (c) 2015-2026 ShakaCode LLC, a Hawaii limited liability company
+("ShakaCode").
+
+SPDX-License-Identifier: LicenseRef-ReactOnRailsPro
+
+## Plain-language summary (informative, not part of the terms)
+
+React on Rails Pro is trust-based: no license key is needed to run it,
+nothing phones home, and a missing key never blocks, slows, or changes
+how your app runs. Reading the source, development, test, CI, staging,
+review apps, education, personal projects, and open-source work are free
+for everyone, at any organization size. Production use is also free if
+you can answer yes to all three questions: *Do fewer than 10 people work
+for your organization (counting all affiliates)? Was its revenue in the
+last twelve months under US $1M? Has it raised under US $1M in outside
+capital, ever?* Charities, educational institutions, and hospitals are
+free at any size. If any answer is no and you are none of those,
+production use requires a paid subscription, and one subscription covers
+your whole organization: every application, environment, and developer.
+See https://pro.reactonrails.com/. Every page rendered with Pro carries
+one HTML comment naming the product and its license status; the license
+key that comes with a subscription makes it read `Licensed`. Once a
+version ships under these terms, those terms govern that version
+permanently.
+
+## 1. Acceptance
+
+By using the software, you agree to these terms. If you use the software
+on behalf of an organization, you represent that you have authority to
+bind that organization, and "you" includes it.
+
+## 2. Definitions
+
+**"Software"** means React on Rails Pro: the `react_on_rails_pro` Ruby
+gem, the `react-on-rails-pro` and `react-on-rails-pro-node-renderer` npm
+packages, and any other component ShakaCode distributes under these
+terms. The open-source React on Rails core that the software builds on is
+licensed separately under the MIT License.
+
+**"Control"** means ownership of more than 50% of the voting interests of
+an entity, or the power to direct its management or policies, by contract
+or otherwise.
+
+**"Your organization"** means you together with every entity that Controls
+you, that you Control, or that is under common Control with you. Teams,
+departments, and other sub-units are not separate organizations.
+
+**"Small Organization"** means an organization for which all of the
+following are true, counted across the entire organization as defined
+above:
+
+a. fewer than 10 individuals perform paid work for it or on its products
+   and services, whether directly or through staffing, outsourcing, or
+   services arrangements, counted as full-time equivalents;
+b. its total gross revenue, measured over the twelve months ending with
+   the most recently completed calendar quarter, was less than
+   US $1,000,000; and
+c. it has received less than US $1,000,000 in aggregate outside capital
+   over its lifetime (equity, tokens, convertible instruments, venture or
+   investor debt, accelerator funding, and grants or donations, other than
+   academic research or charitable grants to accredited academic or
+   nonprofit institutions) from sources other than its own operating
+   revenue and its founders' personal funds. Ordinary-course bank and
+   trade credit do not count.
+
+Government entities, other than public educational institutions, are not
+Small Organizations.
+
+**"Charity"** means an organization recognized as charitable or
+public-benefit under the law of the jurisdiction where it is organized (for
+example, a US 501(c)(3) organization or its equivalent elsewhere), no part
+of whose net earnings benefits any private person.
+
+**"Educational Institution"** means a school, college, university, or
+other institution whose principal purpose is teaching or academic
+research, whether public or private, including its libraries, research
+institutes, and teaching hospitals.
+
+**"Hospital"** means an institution licensed to provide inpatient
+medical care to the public, whether public, non-profit, or private,
+including its clinics and medical research units.
+
+Charity, Educational Institution, and Hospital status belongs to the
+qualifying entity and to affiliates that qualify on their own; it does
+not extend to for-profit affiliates, spin-offs, or commercial ventures
+that are not themselves one of these.
+
+**"Production use"** means running the software to serve an application,
+website, or service to its end users, whether those users are the public,
+your customers, or your own staff. Development, test, continuous
+integration, staging, preview, review-app, and other non-production
+environments are not production use.
+
+**"Generated Attribution"** means the HTML comment the software emits
+once in each document it renders, in the form
+`<!-- Powered by React on Rails Pro (c) ShakaCode | STATUS -->`, where
+STATUS is generated by the software from the license status.
+
+**"Subscription"** means an active paid React on Rails Pro subscription
+purchased at https://pro.reactonrails.com/, through another order channel
+ShakaCode designates (for example a designated GitHub Sponsors tier or an
+invoice), or under a separate written agreement with ShakaCode.
+Sponsorships and donations that ShakaCode has not designated as
+subscriptions are appreciated but are not Subscriptions and grant no
+production-use rights.
+
+**"License key"** means the optional credential ShakaCode issues that
+identifies your organization in the software's license-status logs and in
+the Generated Attribution. A license key is identity, not enforcement.
+
+## 3. Copyright grant
+
+ShakaCode grants you a non-exclusive, worldwide, royalty-free license to
+use, copy, modify, and create derivative works of the software, and to
+include it in the builds and deployments of your organization's own
+applications, in each case only as allowed by these terms. You may share
+copies with contractors and service providers working on those
+applications, who must observe these terms. You may not distribute the
+software or your modifications as a standalone product or library, or as
+part of a product whose purpose is to provide the software's
+functionality to others (see Section 7).
+
+## 4. Free uses
+
+The following uses are free of charge for anyone, at any organization
+size:
+
+a. reading and studying the source code;
+b. development, test, continuous integration, staging, preview,
+   review-app, and every other non-production environment, without time
+   limit;
+c. evaluating the software in production for up to 45 days per
+   organization (not per version, person, or application), solely to
+   decide whether to adopt it;
+d. education and training of people, tutorials, demonstrations, and
+   academic research, in each case not directed at developing or
+   operating your organization's own products or services;
+e. personal and hobby projects;
+f. developing and operating a public open-source project distributed
+   under a license approved by the Open Source Initiative, where the
+   software runs as part of that project's own publicly available code
+   and primarily for that project's benefit, and not for the development
+   or operation of a proprietary product or service.
+
+In addition, **all production use is free of charge for a Small
+Organization, a Charity, an Educational Institution, or a Hospital, at
+any size for the last three.** If your organization is one of these,
+nothing in Section 5 applies to you.
+
+## 5. Paid uses
+
+Production use by an organization that is not a Small Organization, a
+Charity, an Educational Institution, or a Hospital requires a
+Subscription. This includes, without limitation, production use beyond
+the Section 4(c) evaluation window, internal applications used only by
+your staff, and applications you operate for your customers.
+
+In any conflict between Section 4 and this Section 5, use described in
+this Section 5 is production use and is not a free use under Section
+4(b), (c), or (d).
+
+**Client work.** If you use the software to build or run an application
+for a client, the use is attributed to the organization whose business
+the application ultimately serves, traced through any intermediaries.
+That organization's status determines whether the use is free or paid,
+and any required Subscription must be held by, or purchased for the
+benefit of and identifying, that organization. You may rely on a client's
+written self-certification of its status. A consulting firm's or agency's
+own applications are attributed to the firm or agency.
+
+## 6. Subscriptions
+
+One Subscription covers your whole organization: every application,
+environment, server, and developer of your organization, with no per-seat
+or per-application charge. A Subscription is governed by the subscription
+terms, order form, or other agreement under which it is purchased; if
+that agreement conflicts with these terms, that agreement controls. While
+a Subscription is active, ShakaCode provides software updates and
+reasonable support through its published channels; no response or
+resolution times are guaranteed unless an order or separate agreement
+says so. If a required Subscription expires or is terminated, your
+production use remains licensed for 30 days while you renew or wind down,
+and the software keeps running either way. ShakaCode and you may enter a
+separate written agreement that supplements or supersedes these terms.
+
+## 7. No hosted or embedded offering
+
+You may not provide the software or its rendering functionality to third
+parties as a hosted, managed, embedded, or bundled offering, for example
+a platform that builds or runs other organizations' React on Rails
+applications, without a separate written agreement with ShakaCode. Each
+organization whose applications use the software must independently
+qualify for free use or hold its own Subscription. Running your own
+applications for your own users, customers, or staff is not an offering
+to third parties.
+
+## 8. Attribution and license status
+
+Every HTML document rendered with the software must retain exactly one
+complete, unmodified Generated Attribution in its source. You may not
+remove, alter, obscure, or suppress it, in free and paid use alike. With
+a valid license key the status reads `Licensed`; without a key it reads
+`UNLICENSED`; an expired or malformed key reads `LICENSE EXPIRED` or
+`INVALID LICENSE`. An `UNLICENSED` status is not by itself a violation,
+because free uses need no key. The software never blocks, degrades, or
+reports your use based on license status; it only labels and logs it.
+Keep your license key private: it identifies your organization. A related
+component that does not itself generate or insert the Generated
+Attribution, such as `react-on-rails-rsc`, has no obligation to insert a
+second one.
+
+## 9. Trust, self-certification, and true-up
+
+These terms are enforced by trust, not technology: the software contains
+no activation, no usage telemetry, and no runtime lockout, and a license
+key only changes what the status says. You are responsible for
+determining in good faith whether your use is free or paid. ShakaCode
+encourages every organization, free and paid alike, to register at
+https://pro.reactonrails.com/ (free of charge). Registration is optional
+and is never a condition of any free use.
+
+If your organization stops qualifying as a Small Organization, your
+production use remains licensed for 60 days after the change; after that,
+continued production use requires a Subscription. No payment is owed for
+use during that window, and the obligation is not avoided by
+re-qualification within 12 months of the change.
+
+If you discover in good faith that past use required a Subscription,
+purchasing the applicable Subscription within 60 days of discovery is
+full compliance, and no back payment is owed for the good-faith period.
+If your organization made production use requiring a Subscription
+without a good-faith basis for treating it as free, ShakaCode may require
+payment of the applicable subscription fees for the period of that use,
+up to 24 months.
+
+You must not misrepresent your organization, its size or status, or your
+license status, whether in a registration, in the software's
+configuration, or in the Generated Attribution.
+
+## 10. Redistribution and notices
+
+Copies of the software and derivative works that these terms allow you to
+make must remain under these same terms and must retain these terms, all
+copyright and attribution notices, and the SPDX identifier.
+
+## 11. Patents
+
+ShakaCode grants you a license under any patent claims it can license that
+are necessarily infringed by the software, only for uses allowed by these
+terms. This patent license ends immediately if you or your organization
+initiate a patent claim (excluding counterclaims and cross-claims filed in
+response to a patent claim first brought against you) alleging that the
+software infringes a patent.
+
+## 12. Trademarks
+
+These terms grant no rights in the names, logos, or trademarks of
+ShakaCode, React on Rails, or React on Rails Pro, except for the
+attribution required by these terms and truthful factual references.
+
+## 13. Per-version terms, breach, and cure
+
+These terms apply per version: the terms delivered with a version of the
+software govern that version permanently, and patch and security releases
+of a version line remain under that line's terms. Later versions may be
+offered under different terms.
+
+If you breach these terms, your license ends automatically 30 days after
+ShakaCode provides written notice of the breach, unless you cure it within
+that period; upon cure, your license is reinstated retroactively. Curing
+continued production use during a lapsed Subscription includes payment of
+the applicable fees for the lapsed period.
+
+## 14. Feedback
+
+If you submit feedback, suggestions, or improvements to ShakaCode, you
+grant ShakaCode a worldwide, royalty-free, irrevocable license to use and
+incorporate them.
+
+## 15. Disclaimer and limitation of liability
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR
+PURPOSE, TITLE, AND NON-INFRINGEMENT. TO THE MAXIMUM EXTENT PERMITTED BY
+LAW, SHAKACODE WILL NOT BE LIABLE FOR ANY INDIRECT, SPECIAL, INCIDENTAL,
+OR CONSEQUENTIAL DAMAGES ARISING FROM OR RELATED TO THE SOFTWARE OR THESE
+TERMS, AND SHAKACODE'S TOTAL LIABILITY WILL NOT EXCEED THE AMOUNTS YOU
+PAID SHAKACODE FOR THE SOFTWARE IN THE TWELVE MONTHS BEFORE THE CLAIM
+AROSE.
+
+## 16. Assignment, governing law, and miscellaneous
+
+You may assign these terms, together with any active Subscription, to a
+successor in connection with a merger, acquisition, or sale of
+substantially all assets, upon notice to ShakaCode; these terms are
+otherwise non-transferable. These terms are governed by the laws of the
+State of Hawaii, USA, excluding its conflict-of-law rules, with exclusive
+jurisdiction and venue in the state and federal courts located in
+Honolulu, Hawaii. If a provision of these terms is unenforceable, the
+remainder stays in effect. These terms, together with any subscription
+agreement or order, are the entire agreement about the software; if they
+conflict, the order controls.
+
+## 17. Questions and commercial licensing
+
+contact@shakacode.com · https://pro.reactonrails.com/ ·
+https://github.com/shakacode/commercial-licensing
+
+## Machine-readable summary (informative)
+
+```yaml
+license_name: The React on Rails Pro License 3.0
+spdx_identifier: LicenseRef-ReactOnRailsPro
+type: trust-based commercial
+free_production_use_if_all:
+  max_org_headcount_fte: 10        # exclusive; whole control group
+  max_ttm_revenue_usd: 1000000     # exclusive; trailing 12 months
+  max_lifetime_outside_capital_usd: 1000000  # exclusive
+free_production_use_if_any:
+  - charity                        # recognized charitable / public-benefit org, any size
+  - educational_institution        # school, college, university, any size
+  - hospital                       # licensed inpatient care provider, any size
+always_free: [read, study, development, test, ci, staging, preview, review_apps, evaluate_in_production_45_days, education, personal, oss_projects]
+paid: production use by any other organization; one subscription per organization, unlimited applications and developers
+license_key: optional  # identity only; sets the attribution status; never required for free use
+runtime_enforcement: none  # no activation, no telemetry, no lockout; status is logged and labeled
+attribution_required: true  # one HTML comment per rendered document
+subscription_lapse_grace_days: 30
+outgrow_free_line_grace_days: 60
+per_version_terms: true
+pricing_url: https://pro.reactonrails.com/
+register_url: https://pro.reactonrails.com/
+contact: contact@shakacode.com
 ```
 
-For a valid license credential, the status suffix is `Licensed` and does not identify the Organization. Expired, invalid, and missing license credentials use `LICENSE EXPIRED`, `INVALID LICENSE`, and `UNLICENSED`, respectively. `UNLICENSED` indicates that no license credential was present; that status alone does not establish a violation because the use may be permitted by Section 4.
-
-The Licensee may not remove, modify, obfuscate, or disable the Generated Attribution.
-
----
-
-## 7. Fees; Term; Termination
-
-Paid subscriptions may be purchased or renewed at [pro.reactonrails.com](https://pro.reactonrails.com/) or through another ShakaCode-approved order channel.
-
-Fees and billing terms are as agreed in the applicable order (e.g., GitHub Sponsors subscription or annual invoice).\
-For paid subscriptions, the license remains active only while fees are paid. ShakaCode may suspend or terminate for non-payment or material breach. Complimentary OSS Licenses remain active for the term specified in the grant, subject to the revocation terms in Section 4.1.\
-Upon termination, lapse, or revocation, the Organization must immediately cease use and remove the Software (including derivatives) from all Production systems and repositories, except for (a) non-commercial uses explicitly permitted in Section 4, or (b) Complimentary OSS Licenses revoked under Section 4.1(ii) for eligibility changes, in which case the Organization has thirty (30) days from written notice to comply.
-
----
-
-## 8. Updates & Support
-
-While subscribed, the Organization receives software updates and reasonable support (email or issue tracker, business hours). No specific response or resolution times are guaranteed unless set out in an order or separate SLA.
-
----
-
-## 9. Verification / Audit
-
-If ShakaCode reasonably suspects non-compliance, the Organization will cooperate in good faith to verify compliance, including enabling inspection for attribution presence and providing a usage statement. ShakaCode will use commercially reasonable efforts to minimize disruption.
-
-**9.1 Detailed Audits**\
-ShakaCode or a certified auditor acting on its behalf may, upon reasonable request and at ShakaCode’s expense, audit the Organization’s use of the Software to verify compliance with this Agreement. Audits may be conducted by mail, electronically, or by in-person visits during regular business hours and shall minimize disruption to the Organization’s business. If the audit reveals a material unauthorized use, the Organization shall reimburse ShakaCode for reasonable audit costs.
-
----
-
-## 10. Feedback & Contributions
-
-By submitting feedback or improvements, the Organization grants ShakaCode a worldwide, royalty-free, irrevocable license to use and incorporate them.
-
----
-
-## 11. Intellectual Property
-
-The Software is **licensed, not sold**. ShakaCode retains all rights, title, and interest, including all intellectual property rights.
-
----
-
-## 12. Confidentiality
-
-License keys and any non-public materials are ShakaCode confidential information. The Organization will protect them with at least reasonable care.
-
----
-
-## 13. Warranty Disclaimer
-
-> EXCEPT AS EXPRESSLY PROVIDED IN §8, THE SOFTWARE IS PROVIDED “AS IS,” WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED.
-
----
-
-## 14. Limitation of Liability
-
-To the maximum extent permitted by law, ShakaCode is not liable for indirect, incidental, special, consequential, or punitive damages.\
-Direct damages are limited to amounts paid in the 12 months preceding the claim.
-
----
-
-## 15. Indemnification
-
-The Organization agrees to defend, indemnify, and hold harmless ShakaCode and its affiliates from any claims, losses, damages, liabilities, costs, or expenses (including legal fees) arising out of the Organization’s use of the Software or breach of this Agreement.
-
----
-
-## 16. Export Compliance
-
-The Organization agrees to comply with all applicable export laws and regulations, including restrictions on export, re-export, or redistribution of the Software.
-
----
-
-## 17. Attorneys’ Fees and Costs
-
-In any enforcement or legal action arising under this Agreement, the prevailing party shall be entitled to recover reasonable attorneys’ fees and costs.
-
----
-
-## 18. Governing Law; Venue
-
-This Agreement is governed by the laws of the **State of Hawaii**, USA. Exclusive jurisdiction and venue lie in the courts located therein.
-
----
-
-## 19. Miscellaneous
-
-- **19.1 Severability**\
-  If any provision is held invalid or unenforceable, the remainder shall continue in full force.
-
-- **19.2 Waiver**\
-  Failure to enforce any provision is not a waiver of rights.
-
-- **19.3 Assignment**\
-  The Organization may not assign this Agreement without prior written consent.
-
----
-
-## 20. Entire Agreement; Order of Precedence
+## Version history (informative)
 
-This EULA and any order (pricing/term) are the entire agreement. If there is a conflict, the order controls.
+Version 3.0 replaces the React on Rails Pro End User License Agreement,
+version 2.3 (2026-07-14), for releases shipped under these terms. Releases
+shipped under earlier terms remain under those terms.

data/LICENSE_SETUP.md

@@ -1,20 +1,21 @@
 # React on Rails Pro License Setup
 
-This document explains how to configure your React on Rails Pro license for production use.
+This document explains how to configure the optional React on Rails Pro license key.
 
 ## ShakaCode Trust-Based Commercial Licensing
 
-React on Rails Pro works **without a license token** for evaluation, development, testing, and CI/CD. No registration or license key is needed to get started.
+Free in development, test, CI, and staging, and in production for small
+organizations, charities, schools, and hospitals; larger organizations
+subscribe at https://pro.reactonrails.com/ ($1,800 per year per organization).
+No license key is needed to run Pro.
 
-**A paid license is required only for production deployments.**
-
-| Environment        | License Required? |
-| ------------------ | ----------------- |
-| Development        | No                |
-| Test               | No                |
-| CI/CD              | No                |
-| Staging (non-prod) | No                |
-| Production         | **Yes** (paid)    |
+| Environment        | License key                                                                                                                                                         |
+| ------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Development        | Optional                                                                                                                                                            |
+| Test               | Optional                                                                                                                                                            |
+| CI/CD              | Optional                                                                                                                                                            |
+| Staging (non-prod) | Optional                                                                                                                                                            |
+| Production         | Free for small organizations, charities, educational institutions, and hospitals; subscription otherwise. The key is optional and only sets the attribution status. |
 
 ## Upgrading from Previous Versions
 
@@ -112,10 +113,11 @@ License-related checks and signals occur at multiple points:
 2. **Node Renderer**: When the Node renderer process starts
 3. **Browser Package**: Receives Pro-installed signal via `railsContext.rorPro` (not license-valid state)
 
-The browser package does not perform independent license validation. A valid paid license is still required for
-production deployments.
+The browser package does not perform independent license validation. Your organization's status under The React on
+Rails Pro License determines whether production use is free or requires a subscription.
 
-When no license is present, the application runs in **unlicensed mode**. This is fine for development, testing, and CI/CD. Production deployments should always have a valid paid license.
+When no license key is present, the application runs in **unlicensed mode**. This only changes the attribution status
+and log line. Organizations above the free line subscribe and configure their key so rendered pages read `Licensed`.
 
 ## Team Setup
 
@@ -123,7 +125,7 @@ When no license is present, the application runs in **unlicensed mode**. This is
 
 No license setup is needed for development. Developers can install and use React on Rails Pro immediately.
 
-For production deployments, configure a paid license through `config.license_token` or
+Organizations with a subscription can configure the optional key through `config.license_token` or
 `REACT_ON_RAILS_PRO_LICENSE`. Configure a standalone Node renderer separately when you use one.
 
 > Migration note: `config/react_on_rails_pro_license.key` is no longer read.
@@ -132,7 +134,8 @@ For production deployments, configure a paid license through `config.license_tok
 
 ### For CI/CD
 
-CI/CD environments work without a license token. If your CI pipeline deploys to production, ensure the production environment has a valid paid license configured.
+CI/CD environments work without a license key. A deployment pipeline may pass the optional key to production so
+rendered pages identify a subscribing organization as `Licensed`.
 
 ## Verification
 
@@ -290,9 +293,9 @@ window.railsContext.rorPro;
 
 ### Warning: "No license found"
 
-This is expected behavior in development, test, and CI environments. The application will run in unlicensed mode. For
-production, ensure the license is available through application configuration or `REACT_ON_RAILS_PRO_LICENSE` in each
-process that validates it.
+This is expected whenever no key is configured, including production. The application keeps running, the log reports
+the status, and rendered pages use the `UNLICENSED` attribution status. Subscribing organizations can configure the key
+through application configuration or `REACT_ON_RAILS_PRO_LICENSE` in each process that reads it.
 
 ### Error: "Invalid license signature"
 
@@ -311,14 +314,16 @@ process that validates it.
 
 **Solutions:**
 
-1. Contact [support@shakacode.com](mailto:support@shakacode.com) to renew your paid license
+1. Renew your subscription at [pro.reactonrails.com](https://pro.reactonrails.com/)
 2. Update `config.license_token`, the Node renderer's `licenseToken`, or `REACT_ON_RAILS_PRO_LICENSE` with the new token
 
 ### Error: "License plan is not valid for production use"
 
 **Cause:** The license has a plan that is not authorized for production use (e.g., an old free evaluation license).
 
-**Solution:** Purchase a paid license. Contact [justin@shakacode.com](mailto:justin@shakacode.com) for pricing.
+**Solution:** If your organization is above the free line, subscribe at
+[pro.reactonrails.com](https://pro.reactonrails.com/) to get a current key. No key is needed to run Pro; an invalid key
+only changes the attribution status.
 
 ### Error: "License is missing required expiration field"
 
@@ -337,7 +342,7 @@ The license is a JWT (JSON Web Token) signed with RSA-256, containing:
   "sub": "user@example.com", // Your email (REQUIRED)
   "iat": 1234567890, // Issued at timestamp (REQUIRED)
   "exp": 1234567890, // Expiration timestamp (REQUIRED)
-  "plan": "paid", // License plan (Optional — only "paid" is valid for production)
+  "plan": "paid", // Subscription plan recorded in the optional key
   "org": "Your Company", // Organization name (Optional)
   "iss": "api" // Issuer identifier (Optional, standard JWT claim)
 }
@@ -362,7 +367,7 @@ The license is a JWT (JSON Web Token) signed with RSA-256, containing:
 Need help?
 
 1. **Email**: support@shakacode.com
-2. **Sales**: [justin@shakacode.com](mailto:justin@shakacode.com) for pricing
+2. **Licensing**: [contact@shakacode.com](mailto:contact@shakacode.com)
 
 ## Security Best Practices
 
@@ -374,10 +379,12 @@ Need help?
 ## FAQ
 
 **Q: Do I need a license for development?**
-A: No. React on Rails Pro works without a license token for development, testing, and evaluation.
+A: No. No license key is required to run Pro in development or any other environment.
 
 **Q: Do I need a license for CI?**
-A: No. CI/CD environments work without a license token. Only production deployments require a paid license.
+A: No. CI/CD environments work without a license key. Production is also free
+for small organizations, charities, educational institutions, and hospitals;
+larger organizations subscribe for production use.
 
 **Q: Do I need internet to validate the license?**
 A: No! License validation is completely offline using cryptographic signatures.

data/README.md

@@ -33,8 +33,8 @@ React on Rails Pro is a **commercial extension** to the open-source [React on Ra
 
 - **Requires**: [React on Rails](https://github.com/shakacode/react_on_rails) (open-source) as a foundation
 - **Location**: Part of the React on Rails monorepo at `react_on_rails_pro/`
-- **No license token required** to get started — install, evaluate, and develop freely
-- **ShakaCode Trust-Based Commercial Licensing**: Paid license required for production deployments
+- **License terms**: Free in development, test, CI, and staging, and in production for small organizations, charities, schools, and hospitals; larger organizations subscribe at https://pro.reactonrails.com/ ($1,800 per year per organization)
+- **License key**: No license key is needed to run Pro
 
 ### How It Relates to React on Rails
 
@@ -61,24 +61,18 @@ React on Rails Pro is a **commercial extension** to the open-source [React on Ra
 
 ### ShakaCode Trust-Based Commercial Licensing
 
-React on Rails Pro works **without a license token** for evaluation, development, testing, and CI/CD. No registration or license key is needed to get started.
-
-**A paid license is required only for production deployments.**
-
-- **Evaluation & Development**: Works out of the box — no license token needed
-- **CI/CD**: Works without a license token
-- **Production**: Requires a paid license
-
-### Paid License (Production)
-
-- **Duration**: 1 year subscription (or longer)
-- **Usage**: Production deployments and commercial applications
-- **Support**: Professional support included
-- **Contact**: [justin@shakacode.com](mailto:justin@shakacode.com) for pricing
+React on Rails Pro is free in development, test, CI, and staging for everyone,
+and free in production for small organizations (under 10 people, under $1M
+revenue, under $1M raised) and for charities, schools, and hospitals at any
+size. Larger organizations subscribe for production use at
+[pro.reactonrails.com](https://pro.reactonrails.com/): $1,800 per year covers
+the whole organization. No license key is needed to run it; a key from your
+subscription only marks your pages `Licensed`. See
+[the license](https://github.com/shakacode/react_on_rails/blob/main/REACT-ON-RAILS-PRO-LICENSE.md).
 
 ### License Setup
 
-Once you have a paid license, configure it through Rails credentials:
+If your organization subscribes, configure its optional key through Rails credentials:
 
 ```ruby
 ReactOnRailsPro.configure do |config|
@@ -195,7 +189,8 @@ High-performance standalone Node.js server for server-side rendering with connec
 
 - **Parallel rendering**: Multiple worker processes for concurrent SSR
 - **Memory management**: Automatic worker restarts to prevent leaks
-- **Better performance**: Up to 10x faster than ExecJS for high-traffic sites
+- **Workload-dependent performance**: Persistent worker processes support concurrent SSR;
+  [benchmark your own pages](../docs/oss/core-concepts/performance-benchmarks.md) rather than relying on a headline multiple
 - **Loadable Components**: Full support for code splitting with SSR
 
 **Example Configuration:**
@@ -290,7 +285,10 @@ end
 
 ### Quick Start
 
-**No license token is required to get started.** React on Rails Pro runs freely for evaluation, development, and testing. A paid license is only needed for production deployments.
+Free in development, test, CI, and staging, and in production for small
+organizations, charities, schools, and hospitals; larger organizations
+subscribe at https://pro.reactonrails.com/ ($1,800 per year per organization).
+No license key is needed to run Pro.
 
 **1. Install the Gem**
 
@@ -412,7 +410,7 @@ Check out these production applications using React on Rails Pro:
 ### Getting Help
 
 - **📧 Email Support**: [support@shakacode.com](mailto:support@shakacode.com)
-- **💼 Sales & Licensing**: [justin@shakacode.com](mailto:justin@shakacode.com)
+- **💼 Sales & Licensing**: [contact@shakacode.com](mailto:contact@shakacode.com)
 - **📖 Documentation**: [docs/pro/](../docs/pro/)
 - **🐛 Found a Bug?**: Email [support@shakacode.com](mailto:support@shakacode.com) (for Pro customers)
 
@@ -446,11 +444,16 @@ React on Rails Pro is developed and maintained by [ShakaCode](https://www.shakac
 
 **Q: Do I need a license to try React on Rails Pro?**
 
-A: No! Under ShakaCode Trust-Based Commercial Licensing, React on Rails Pro works without a license token for evaluation, development, testing, and CI/CD. A paid license is only required for production deployments.
+A: No. React on Rails Pro is free in development, test, CI, and staging, and in
+production for small organizations, charities, schools, and hospitals. Larger
+organizations subscribe for production use. No license key is needed to run
+Pro.
 
-**Q: How much does a production license cost?**
+**Q: How much does a production subscription cost?**
 
-A: Pricing is customized based on your needs. Contact [justin@shakacode.com](mailto:justin@shakacode.com) for a quote.
+A: A subscription costs $1,800 per year per organization and covers every
+application, environment, and developer. Subscribe at
+[pro.reactonrails.com](https://pro.reactonrails.com/).
 
 ### Technical Questions
 
@@ -497,11 +500,11 @@ A: Check the [CHANGELOG](./CHANGELOG.md) for breaking changes and migration step
 
 **Q: Where do I start?**
 
-A: Follow our [Quick Start guide](#-getting-started) — no license token needed to get started!
+A: Follow our [Quick Start guide](#-getting-started). No license key is needed to run Pro.
 
 **Q: Can I try Pro before buying?**
 
-A: Yes! React on Rails Pro works without a license token for evaluation and development. Just install and start using it.
+A: Yes. Development, test, CI, staging, and a 45-day production evaluation are free for every organization. Just install and start using it.
 
 **Q: Is there a demo application?**
 
@@ -511,13 +514,15 @@ A: Yes! The [spec/dummy](./spec/dummy) app demonstrates all Pro features. [See e
 
 ## 📄 License
 
-React on Rails Pro is commercial software under ShakaCode Trust-Based Commercial Licensing. See [LICENSE](./LICENSE) for the complete license agreement.
-
-**Summary**:
+React on Rails Pro is free in development, test, CI, and staging for everyone,
+and free in production for small organizations (under 10 people, under $1M
+revenue, under $1M raised) and for charities, schools, and hospitals at any
+size. Larger organizations subscribe for production use at
+[pro.reactonrails.com](https://pro.reactonrails.com/): $1,800 per year covers
+the whole organization. No license key is needed to run it; a key from your
+subscription only marks your pages `Licensed`. See [the license](./LICENSE).
 
-- ✅ **No license token needed** for evaluation, development, testing, and CI/CD
-- 💼 **Paid license required** for production deployments
-- 📧 **Questions?** Contact [justin@shakacode.com](mailto:justin@shakacode.com)
+Questions: [contact@shakacode.com](mailto:contact@shakacode.com).
 
 ---
 

data/lib/react_on_rails_pro/engine.rb

@@ -134,8 +134,9 @@ module ReactOnRailsPro
         prefix = "[React on Rails Pro] #{issue}."
 
         if Rails.env.production?
-          warning = "Production Use of React on Rails Pro requires a valid license. " \
-                    "If this deployment is Production Use, #{action}"
+          warning = "React on Rails Pro is free in production for small organizations, charities, schools, " \
+                    "and hospitals; other organizations need a subscription. " \
+                    "If that is you, #{action.sub(/\A[A-Z]/, &:downcase)}"
           Rails.logger.warn "#{prefix} #{warning}"
         elsif warn_outside_production
           Rails.logger.warn "#{prefix} #{action}"

data/lib/react_on_rails_pro/open_telemetry.rb

@@ -50,10 +50,11 @@ module ReactOnRailsPro
         ::OpenTelemetry::Context.with_current(@context) do
           ::OpenTelemetry.propagation.inject(carrier)
         end
+        headers.reject! { |name, _| TRACE_HEADER_NAMES.include?(name.to_s.downcase) }
         carrier.each do |name, value|
           next unless TRACE_HEADER_NAMES.include?(name.to_s.downcase)
 
-          set_header(headers, name.to_s, value)
+          headers << [name.to_s, value]
         end
       rescue StandardError
         nil
@@ -125,12 +126,6 @@ module ReactOnRailsPro
       rescue StandardError
         nil
       end
-
-      def set_header(headers, name, value)
-        return if headers.any? { |header_name, _| header_name.to_s.casecmp?(name) }
-
-        headers << [name, value]
-      end
     end
 
     class << self

data/lib/react_on_rails_pro/request.rb

@@ -671,32 +671,38 @@ module ReactOnRailsPro
       end
 
       def create_connection
-        url = ReactOnRailsPro.configuration.renderer_url
+        config = ReactOnRailsPro.configuration
+        url = config.renderer_url
         Rails.logger.debug do
-          "[ReactOnRailsPro] Setting up Node Renderer connection to #{url}"
+          "[ReactOnRailsPro] Setting up Node Renderer connection to " \
+            "#{ReactOnRails::Utils.sanitize_url_for_display(url)}"
         end
 
         ReactOnRailsPro::RendererHttpClient.new(
           origin: url,
-          pool_size: ReactOnRailsPro.configuration.renderer_http_pool_size,
-          connect_timeout: ReactOnRailsPro.configuration.renderer_http_pool_timeout,
-          read_timeout: ReactOnRailsPro.configuration.ssr_timeout,
-          force_http2: ReactOnRailsPro.configuration.renderer_http_force_http2
+          pool_size: config.renderer_http_pool_size,
+          connect_timeout: config.renderer_http_pool_timeout,
+          read_timeout: config.ssr_timeout,
+          force_http2: config.renderer_http_force_http2
         )
       rescue StandardError => e
-        message = <<~MSG
+        raise ReactOnRailsPro::Error, create_connection_error_message(url, e)
+      end
+
+      def create_connection_error_message(url, error)
+        config = ReactOnRailsPro.configuration
+        <<~MSG
           [ReactOnRailsPro] Error creating async-http connection.
-          renderer_http_pool_size = #{ReactOnRailsPro.configuration.renderer_http_pool_size}
-          renderer_http_pool_timeout = #{ReactOnRailsPro.configuration.renderer_http_pool_timeout}
-          renderer_http_pool_warn_timeout = #{ReactOnRailsPro.configuration.renderer_http_pool_warn_timeout}
-          renderer_http_keep_alive_timeout = #{ReactOnRailsPro.configuration.renderer_http_keep_alive_timeout}
-          renderer_http_force_http2 = #{ReactOnRailsPro.configuration.renderer_http_force_http2}
-          renderer_url = #{url}
+          renderer_http_pool_size = #{config.renderer_http_pool_size}
+          renderer_http_pool_timeout = #{config.renderer_http_pool_timeout}
+          renderer_http_pool_warn_timeout = #{config.renderer_http_pool_warn_timeout}
+          renderer_http_keep_alive_timeout = #{config.renderer_http_keep_alive_timeout}
+          renderer_http_force_http2 = #{config.renderer_http_force_http2}
+          renderer_url = #{ReactOnRails::Utils.sanitize_url_for_display(url)}
           Be sure to use a url that contains the protocol of http or https.
           Original error is
-          #{e}
+          #{ReactOnRails::Utils.sanitize_error_text(error.message)}
         MSG
-        raise ReactOnRailsPro::Error, message
       end
 
       def get_form_body_for_file(path)

data/lib/react_on_rails_pro/rolling_deploy_adapters/http.rb

@@ -171,7 +171,15 @@ module ReactOnRailsPro
 
             FileUtils.rm_rf(dir)
             FileUtils.mkdir_p(dir)
-            result = download_from_origin(candidate[:base], bundle_hash, dir:, deadline:)
+            begin
+              result = download_from_origin(candidate[:base], bundle_hash, dir:, deadline:)
+            rescue StandardError => e
+              Rails.logger.warn(
+                "#{LOG_PREFIX} candidate #{candidate[:base]} failed: #{e.class}: #{e.message}; " \
+                "continuing with remaining candidates while time allows."
+              )
+              next
+            end
             next unless result
             next unless acceptable_payload?(candidate, result, bundle_hash)
 

data/lib/react_on_rails_pro/version.rb

@@ -14,6 +14,6 @@
 # https://github.com/shakacode/react_on_rails/blob/main/REACT-ON-RAILS-PRO-LICENSE.md
 
 module ReactOnRailsPro
-  VERSION = "17.1.0.rc.5"
+  VERSION = "17.2.0.rc.0"
   PROTOCOL_VERSION = "2.0.0"
 end

data/lib/tasks/assets.rake

@@ -56,7 +56,8 @@ namespace :react_on_rails_pro do # rubocop:disable Metrics/BlockLength
 
   desc "Copy assets to remote node-renderer"
   task copy_assets_to_remote_vm_renderer: :environment do
-    puts "[ReactOnRailsPro] Copying assets to remote node-renderer #{ReactOnRailsPro.configuration.renderer_url}"
+    puts "[ReactOnRailsPro] Copying assets to remote node-renderer " \
+         "#{ReactOnRails::Utils.sanitize_url_for_display(ReactOnRailsPro.configuration.renderer_url)}"
     ReactOnRailsPro::Request.upload_assets
   end
 end

data/react_on_rails_pro.gemspec

@@ -30,7 +30,7 @@ Gem::Specification.new do |s|
   s.summary       = "Rails with react server rendering with webpack. Performance helpers"
   s.description   = "See README.md"
   s.homepage      = "https://reactonrails.com/docs/pro/"
-  s.license       = "LicenseRef-LICENSE"
+  s.license       = "LicenseRef-ReactOnRailsPro"
   s.metadata["rubygems_mfa_required"] = "true"
   s.metadata["bug_tracker_uri"] = "https://github.com/shakacode/react_on_rails/issues"
   s.metadata["changelog_uri"] = "https://github.com/shakacode/react_on_rails/blob/main/CHANGELOG.md"
@@ -55,7 +55,9 @@ Gem::Specification.new do |s|
   s.add_runtime_dependency "io-endpoint", "~> 0.17.0"
   # Pro's only JWT call site (LicenseValidator) pins algorithm: "RS256" with
   # public-key verification, which is safe on jwt 2.x as well as 3.x.
-  s.add_runtime_dependency "jwt", ">= 2.5", "< 4"
+  # jwt 2.8 first declares `base64` as a runtime dependency. This keeps offline
+  # license validation reliable on Ruby 3.4+, where base64 is a bundled gem.
+  s.add_runtime_dependency "jwt", ">= 2.8", "< 4"
   s.add_runtime_dependency "nokogiri", ">= 1.12", "< 2"
   s.add_runtime_dependency "react_on_rails", ReactOnRails::VERSION
   # rubocop:disable Gemspec/DevelopmentDependencies

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: react_on_rails_pro
 version: !ruby/object:Gem::Version
-  version: 17.1.0.rc.5
+  version: 17.2.0.rc.0
 platform: ruby
 authors:
 - Justin Gordon
@@ -71,7 +71,7 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '2.5'
+        version: '2.8'
     - - "<"
       - !ruby/object:Gem::Version
         version: '4'
@@ -81,7 +81,7 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '2.5'
+        version: '2.8'
     - - "<"
       - !ruby/object:Gem::Version
         version: '4'
@@ -111,14 +111,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 17.1.0.rc.5
+        version: 17.2.0.rc.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 17.1.0.rc.5
+        version: 17.2.0.rc.0
 - !ruby/object:Gem::Dependency
   name: bundler
   requirement: !ruby/object:Gem::Requirement
@@ -297,7 +297,7 @@ files:
 - sig/react_on_rails_pro/utils.rbs
 homepage: https://reactonrails.com/docs/pro/
 licenses:
-- LicenseRef-LICENSE
+- LicenseRef-ReactOnRailsPro
 metadata:
   rubygems_mfa_required: 'true'
   bug_tracker_uri: https://github.com/shakacode/react_on_rails/issues