react_on_rails_pro 16.2.0.beta.13 → 16.2.0.beta.16

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6ea28d8199e9609b3233cd147a173c48936d4400fe618bd609c972bff2fe22a9
-  data.tar.gz: ab4e291db072282321c49648c0ea4e247f1c69160e6d3bdade1c650ab221d057
+  metadata.gz: 3ebc6173ce60ead470a454c30308e09f0341130ed0af5a2e06e2c403005cffb6
+  data.tar.gz: 8482e11aaeb534457939143614cc969a52bb96fe7ac1db7ed435847bbdc6f716
 SHA512:
-  metadata.gz: 86872a77f2b473f5e5e4c36aa7b0809e0e6f26907adfbe6e98b5701e0cfea85c826ab84de90d753c18a03c2b9812672ad9999d418a5abb34995ddaefd2c4b97e
-  data.tar.gz: 5edffa8cafd674020d4e441b10bb90e2098f1074eadeb2555202e64af238babe8c6ca0d6b55e9ae6c9bda797e7106a28b286416c1b97b691ea28c063e9762126
+  metadata.gz: 5c1c2519d7d340ce8bb74619d8e11c4df8d546c58c5b8e9787ad77cb3a4ea80c0ff7c02f476427f72fbf1ea4f6d09d5fb7524ff55aae1621be7d6272c40386fd
+  data.tar.gz: 68c652b7250fb5a298c3bfaa8f258ab8bc88e9f71f1393311abedc17b1513714a14e02c4249d6176a9f2a25c49dd153c9f6a25913eea8d577ba471fe6aee3039

data/CHANGELOG.md

@@ -17,7 +17,9 @@ You can find the **package** version numbers from this repo's tags and below in
 
 ## [Unreleased]
 
-_Add changes in master not yet tagged._
+### [v16.2.0.beta.13] - 2025-12-07
+
+Changes since the last non-beta release.
 
 ### Improved
 
@@ -48,8 +50,12 @@ _Add changes in master not yet tagged._
 
 ### Fixed
 
+- **SECURITY: CVE-2025-55182 - React Server Components RCE Vulnerability**: by updating `react-on-rails-rsc` peer dependency to `v19.0.3` which mitigates that vulnerability. Also, users should update `react` and `react-dom` package versions to `v19.0.1` to ensure complete mitigation. [PR 2175](https://github.com/shakacode/react_on_rails/pull/2175) by [AbanoubGhadban](https://github.com/AbanoubGhadban).
+
 - Fixed compatibility issue with httpx 1.6.x by explicitly requiring http-2 >= 1.1.1. [PR 2141](https://github.com/shakacode/react_on_rails/pull/2141) by [AbanoubGhadban](https://github.com/AbanoubGhadban).
 
+- **Client Disconnect Handling for Streaming**: Added error handling for client disconnects during streaming. When a client disconnects mid-stream (browser closed, network drop), the system now catches `IOError`/`Errno::EPIPE`, sets a `client_disconnected` flag, stops the barrier to cancel producer tasks, and logs the disconnect for debugging. Prevents wasted CPU from producers continuing after the writer fails. [PR 2137](https://github.com/shakacode/react_on_rails/pull/2137) by [justin808](https://github.com/justin808).
+
 - **Node Renderer Worker Restart**: Fixed "descriptor closed" error that occurred when the node renderer restarts while handling an in-progress request (especially streaming requests). Workers now perform graceful shutdowns: they disconnect from the cluster to stop receiving new requests, wait for active requests to complete, then shut down cleanly. A configurable `gracefulWorkerRestartTimeout` ensures workers are forcibly killed if they don't shut down in time. [PR 1970](https://github.com/shakacode/react_on_rails/pull/1970) by [AbanoubGhadban](https://github.com/AbanoubGhadban).
 
 - **Body Duplication Bug On Streaming**: Fixed a bug that happens while streaming if the node renderer connection closed after streaming some chunks to the client. [PR 1995](https://github.com/shakacode/react_on_rails/pull/1995) by [AbanoubGhadban](https://github.com/AbanoubGhadban).
@@ -536,7 +542,8 @@ Above changes in [PR 52](https://github.com/shakacode/react_on_rails_pro/pull/52
 - advanced error handling
 
 [HEAD compared to 3.2.1]: https://github.com/shakacode/react_on_rails_pro/compare/3.3.1...HEAD
-[Unreleased]: https://github.com/shakacode/react_on_rails_pro/compare/4.0.0-rc-15...HEAD
+[Unreleased]: https://github.com/shakacode/react_on_rails/compare/v16.2.0.beta.13...master
+[v16.2.0.beta.13]: https://github.com/shakacode/react_on_rails/compare/16.1.1...v16.2.0.beta.13
 [4.0.0-rc.15]: https://github.com/shakacode/react_on_rails_pro/compare/4.0.0-rc.14...4.0.0-rc.15
 [4.0.0.rc.11]: https://github.com/shakacode/react_on_rails_pro/compare/4.0.0-rc.9...4.0.0-rc.11
 [4.0.0.rc.9]: https://github.com/shakacode/react_on_rails_pro/compare/4.0.0-rc.6...4.0.0-rc.9

data/Gemfile.development_dependencies

@@ -7,7 +7,7 @@ ruby '3.3.7'
 
 gem "react_on_rails", path: "../"
 
-gem "shakapacker", "9.3.0"
+gem "shakapacker", "9.4.0"
 gem "bootsnap", require: false
 gem "rails", "~> 7.1"
 gem "puma", "~> 6"

data/Gemfile.lock

@@ -9,7 +9,7 @@ GIT
 PATH
   remote: ..
   specs:
-    react_on_rails (16.2.0.beta.13)
+    react_on_rails (16.2.0.beta.16)
       addressable
       connection_pool
       execjs (~> 2.5)
@@ -20,7 +20,7 @@ PATH
 PATH
   remote: .
   specs:
-    react_on_rails_pro (16.2.0.beta.13)
+    react_on_rails_pro (16.2.0.beta.16)
       addressable
       async (>= 2.6)
       connection_pool
@@ -29,7 +29,7 @@ PATH
       httpx (~> 1.5)
       jwt (~> 2.7)
       rainbow
-      react_on_rails (= 16.2.0.beta.13)
+      react_on_rails (= 16.2.0.beta.16)
 
 GEM
   remote: https://rubygems.org/
@@ -402,7 +402,7 @@ GEM
       websocket (~> 1.0)
     semantic_range (3.1.0)
     sexp_processor (4.17.1)
-    shakapacker (9.3.0)
+    shakapacker (9.4.0)
       activesupport (>= 5.2)
       package_json
       rack-proxy (>= 0.6.1)
@@ -519,7 +519,7 @@ DEPENDENCIES
   sass-rails
   scss_lint
   selenium-webdriver (= 4.9.0)
-  shakapacker (= 9.3.0)
+  shakapacker (= 9.4.0)
   spring
   spring-watcher-listen
   sprockets

data/docs/code-splitting-loadable-components.md

@@ -1,12 +1,14 @@
 # Server-side rendering with code-splitting using Loadable/Components
+
 by ShakaCode
 
-*Last updated September 19, 2022*
+_Last updated September 19, 2022_
 
 ## Introduction
+
 The [React library recommends](https://loadable-components.com/docs/getting-started/) the use of React.lazy for code splitting with dynamic imports except
 when using server-side rendering. In that case, as of February 2020, they recommend [Loadable Components](https://loadable-components.com)
-for server-side rendering with dynamic imports. 
+for server-side rendering with dynamic imports.
 
 Note, in 2019 and prior, the code-splitting feature was implemented using `react-loadable`. The React
 team no longer recommends that library. The new way is far preferable.
@@ -18,7 +20,8 @@ yarn add  @loadable/babel-plugin @loadable/component @loadable/server @loadable/
 ```
 
 ### Summary
-- [`@loadable/babel-plugin`](https://loadable-components.com/docs/getting-started/) - The plugin transforms your code to be ready for Server Side Rendering. 
+
+- [`@loadable/babel-plugin`](https://loadable-components.com/docs/getting-started/) - The plugin transforms your code to be ready for Server Side Rendering.
 - `@loadable/component` - Main library for creating loadable components.
 - `@loadable/server` - Has functions for collecting chunks and provide style, script, link tags for the server.
 - `@loadable/webpack-plugin` - The plugin to create a stats file with all chunks, assets information.
@@ -35,15 +38,16 @@ See example of server configuration differences in the loadable-components [exam
 for server-side rendering](https://github.com/gregberge/loadable-components/blob/master/examples/server-side-rendering/webpack.config.babel.js)
 
 You need to configure 3 things:
-1. `target` 
-  a. client-side: `web`
-  b. server-side: `node`
+
+1. `target`
+   a. client-side: `web`
+   b. server-side: `node`
 2. `output.libraryTarget`
-  a. client-side: `undefined`
-  b. server-side: `commonjs2`
-3. babel-loader options.caller = 'node' or 'web'   
-3. `plugins`
-  a. server-side:  `new webpack.optimize.LimitChunkCountPlugin({ maxChunks: 1 })`
+   a. client-side: `undefined`
+   b. server-side: `commonjs2`
+3. babel-loader options.caller = 'node' or 'web'
+4. `plugins`
+   a. server-side: `new webpack.optimize.LimitChunkCountPlugin({ maxChunks: 1 })`
 
 ```js
 {
@@ -58,14 +62,15 @@ You need to configure 3 things:
 Explanation:
 
 - `target: 'node'` is required to be able to run the server bundle with the dynamic import logic on nodejs.
-If that is not done, webpack will add and invoke browser-specific functions to fetch the chunks into the bundle, which throws an error on server-rendering.
+  If that is not done, webpack will add and invoke browser-specific functions to fetch the chunks into the bundle, which throws an error on server-rendering.
 
 - `new webpack.optimize.LimitChunkCountPlugin({ maxChunks: 1 })`
-The react_on_rails_pro node-renderer expects only one single server-bundle. In other words, we cannot and do not want to split the server bundle.
+  The react_on_rails_pro node-renderer expects only one single server-bundle. In other words, we cannot and do not want to split the server bundle.
 
 #### Client config
 
 For the client config we only need to add the plugin:
+
 ```js
 {
   plugins: [
@@ -74,30 +79,33 @@ For the client config we only need to add the plugin:
   ]
 }
 ```
+
 This plugin collects all the information about entrypoints, chunks, and files, that have these chunks and creates a stats file during client bundle build.
 This stats file is used later to map rendered components to file assets. While you can use any filename, our documentation will use the default name.
 
 ### Babel
 
 Per [the docs](https://loadable-components.com/docs/babel-plugin/#transformation):
+
 > The plugin transforms your code to be ready for Server Side Rendering
 
 Add this to `babel.config.js`:
+
 ```js
 {
   "plugins": ["@loadable/babel-plugin"]
 }
 ```
-https://loadable-components.com/docs/babel-plugin/
 
+https://loadable-components.com/docs/babel-plugin/
 
 ### Convert components into loadable components
 
 Instead of importing the component directly, use a dynamic import:
 
 ```js
-import load from '@loadable/component'
-const MyComponent = load(() => import('./MyComponent'))
+import load from '@loadable/component';
+const MyComponent = load(() => import('./MyComponent'));
 ```
 
 ### Resolving issue with ChunkLoadError
@@ -118,22 +126,25 @@ const consoleDebug = (fn) => {
     console.debug(fn());
   }
 };
-const retry = (fn, retryMessage = '', retriesLeft = 3, interval = 500) => new Promise((resolve, reject) => {
-  fn()
-    .then(resolve)
-    .catch(() => {
-      setTimeout(() => {
-        if (retriesLeft === 1) {
-          console.warn(`Maximum retries exceeded, retryMessage: ${retryMessage}. Reloading page...`);
-          window.location.reload();
-          return;
-        }
-        // Passing on "reject" is the important part
-        consoleDebug(() => `Trying request, retryMessage: ${retryMessage}, retriesLeft: ${retriesLeft - 1}`);
-        retry(fn, retryMessage, retriesLeft - 1, interval).then(resolve, reject);
-      }, interval);
-    });
-});
+const retry = (fn, retryMessage = '', retriesLeft = 3, interval = 500) =>
+  new Promise((resolve, reject) => {
+    fn()
+      .then(resolve)
+      .catch(() => {
+        setTimeout(() => {
+          if (retriesLeft === 1) {
+            console.warn(`Maximum retries exceeded, retryMessage: ${retryMessage}. Reloading page...`);
+            window.location.reload();
+            return;
+          }
+          // Passing on "reject" is the important part
+          consoleDebug(
+            () => `Trying request, retryMessage: ${retryMessage}, retriesLeft: ${retriesLeft - 1}`,
+          );
+          retry(fn, retryMessage, retriesLeft - 1, interval).then(resolve, reject);
+        }, interval);
+      });
+  });
 export default retry;
 ```
 
@@ -152,21 +163,21 @@ const HomePage = loadable(() => retry(() => import('./HomePage')));
 
 In the client bundle, we need to wrap the `hydrateRoot` call into a `loadableReady` function.
 So, hydration will be fired only after all necessary chunks preloads. In this example below,
-`ClientApp` is registering as `App`. 
+`ClientApp` is registering as `App`.
 
 ```js
 import React from 'react';
 import ReactOnRails from 'react-on-rails';
-import { hydrateRoot } from 'react-dom/client'
-import { loadableReady } from '@loadable/component'
+import { hydrateRoot } from 'react-dom/client';
+import { loadableReady } from '@loadable/component';
 import App from './App';
 
 const ClientApp = (props, railsContext, domId) => {
   loadableReady(() => {
-    const root = document.getElementById(domId)
+    const root = document.getElementById(domId);
     hydrateRoot(root, <App {...props} />);
-  })
-}
+  });
+};
 
 ReactOnRails.register({
   App: ClientApp,
@@ -175,20 +186,20 @@ ReactOnRails.register({
 
 #### Server
 
-The purpose of the server function is to collect all rendered chunks and pass them as script, link, 
-style tags to the Rails view. In this example below, `ServerApp` is registering as `App`. 
+The purpose of the server function is to collect all rendered chunks and pass them as script, link,
+style tags to the Rails view. In this example below, `ServerApp` is registering as `App`.
 
 ```js
 import React from 'react';
 import ReactOnRails from 'react-on-rails';
-import { ChunkExtractor } from '@loadable/server'
-import App from './App'
-import path from 'path'
+import { ChunkExtractor } from '@loadable/server';
+import App from './App';
+import path from 'path';
 
 const ServerApp = (props, railsContext) => {
   // This loadable-stats file was generated by `LoadablePlugin` in client webpack config.
   // You must configure the path to resolve per your setup. If you are copying the file to
-  // a remote server, the file should be a sibling of this file. 
+  // a remote server, the file should be a sibling of this file.
   // __dirname is going to be the directory where the server-bundle.js exists
   // Note, React on Rails Pro automatically copies the loadable-stats.json to the same place as the
   // server-bundle.js. Thus, the __dirname of this code is where we can find loadable-stats.json.
@@ -198,10 +209,10 @@ const ServerApp = (props, railsContext) => {
   // This object is used to search filenames by corresponding chunk names.
   // See https://loadable-components.com/docs/api-loadable-server/#chunkextractor
   // for the entryPoints, pass an array of all your entryPoints using dynamic imports
-  const extractor = new ChunkExtractor({ statsFile, entrypoints: ['client-bundle'] })
+  const extractor = new ChunkExtractor({ statsFile, entrypoints: ['client-bundle'] });
 
   // It creates the wrapper `ChunkExtractorManager` around `App` to collect chunk names of rendered components.
-  const jsx = extractor.collectChunks(<App {...props} railsContext={railsContext} />)
+  const jsx = extractor.collectChunks(<App {...props} railsContext={railsContext} />);
 
   const componentHtml = renderToString(jsx);
 
@@ -211,8 +222,8 @@ const ServerApp = (props, railsContext) => {
       // Returns all the files with rendered chunks for furture insert into rails view.
       linkTags: extractor.getLinkTags(),
       styleTags: extractor.getStyleTags(),
-      scriptTags: extractor.getScriptTags()
-    }
+      scriptTags: extractor.getScriptTags(),
+    },
   };
 };
 
@@ -224,6 +235,7 @@ ReactOnRails.register({
 ## Configure react_on_rails_pro
 
 ### React on Rails Pro
+
 You must set `config.assets_top_copy` so that the node-renderer will have access to the loadable-stats.json.
 
 ```ruby
@@ -233,15 +245,16 @@ You must set `config.assets_top_copy` so that the node-renderer will have access
 Your server rendering code, per the above, will find this file like this:
 
 ```js
-  const statsFile = path.resolve(__dirname, 'loadable-stats.json');
-``` 
+const statsFile = path.resolve(__dirname, 'loadable-stats.json');
+```
 
 Note, if `__dirname` is not working in your webpack build, that's because you didn't set `node: false`
 in your webpack configuration. That turns off the polyfills for things like `__dirname`.
 
-
 ### Node Renderer
+
 In your `node-renderer.js` file which runs node renderer, you need to specify `supportModules` options as follows:
+
 ```js
 const path = require('path');
 const env = process.env;
@@ -261,7 +274,7 @@ reactOnRailsProNodeRenderer(config);
 ```erb
 <% res = react_component_hash("App", props: {}, prerender: true) %>
 <%= content_for :link_tags, res['linkTags'] %>
-<%= content_for :style_tags, res['styleTags'] %> 
+<%= content_for :style_tags, res['styleTags'] %>
 
 <%= res['componentHtml'].html_safe %>
 
@@ -269,6 +282,7 @@ reactOnRailsProNodeRenderer(config);
 ```
 
 ## Making HMR Work
+
 To make HMR work, it's best to disable loadable-components when using the Dev Server.
 Note: you will need access to our **private** React on Rails Pro repository to open the following links.
 
@@ -277,9 +291,11 @@ Take a look at the code searches for ['imports-loadable'](https://github.com/sha
 The general concept is that we have a non-loadable, HMR-ready, file that substitutes for the loadable-enabled one, with the suffixes `imports-hmr.js` instead of `imports-loadable.js`
 
 ### Webpack configuration
+
 Use the [NormalModuleReplacement plugin](https://webpack.js.org/plugins/normal-module-replacement-plugin/):
 
 [code](https://github.com/shakacode/react_on_rails_pro/blob/a361f4e163b9170f180ae07ee312fb9b4c719fc3/spec/dummy/config/webpack/environment.js#L81-L91)
+
 ```js
 if (isWebpackDevServer) {
   environment.plugins.append(
@@ -305,7 +321,7 @@ Note: you will need access to our **private** React on Rails Pro repository to o
 ### Client-Side Startup
 
 - [spec/dummy/client/app/loadable/loadable-client.imports-hmr.js](https://github.com/shakacode/react_on_rails_pro/blob/master/spec/dummy/client/app/loadable/loadable-client.imports-hmr.js)
-- [spec/dummy/client/app/loadable/loadable-client.imports-loadable.js](https://github.com/shakacode/react_on_rails_pro/blob/master/spec/dummy/client/app/loadable/loadable-client.imports-loadable.js)
+- [spec/dummy/client/app/loadable/loadable-client.imports-loadable.jsx](https://github.com/shakacode/react_on_rails_pro/blob/master/spec/dummy/client/app/loadable/loadable-client.imports-loadable.jsx)
 
 ### Server-Side Startup
 

data/lib/react_on_rails_pro/version.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
 module ReactOnRailsPro
-  VERSION = "16.2.0.beta.13"
+  VERSION = "16.2.0.beta.16"
   PROTOCOL_VERSION = "2.0.0"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: react_on_rails_pro
 version: !ruby/object:Gem::Version
-  version: 16.2.0.beta.13
+  version: 16.2.0.beta.16
 platform: ruby
 authors:
 - Justin Gordon
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2025-12-07 00:00:00.000000000 Z
+date: 2025-12-10 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: addressable
@@ -128,14 +128,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 16.2.0.beta.13
+        version: 16.2.0.beta.16
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 16.2.0.beta.13
+        version: 16.2.0.beta.16
 - !ruby/object:Gem::Dependency
   name: bundler
   requirement: !ruby/object:Gem::Requirement