shakapacker 8.3.0 → 8.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 85c3a527653e307cedc881f7879b245feaca4d79b47f7f7abac358f38a1e8305
-  data.tar.gz: eae6e26f151f0e6d346f9cef659854b91b7e0a4a3f388aa5cef016d6323f2c52
+  metadata.gz: 6ccbba3c39a550ae683e13c45e3ac4f79733ae6ffebabf2d6ab55f37b7427d99
+  data.tar.gz: 569998bb9475e8ed2b8ba786d1ccdf2b84d562d61ba8ef78d08ad195c3ea2230
 SHA512:
-  metadata.gz: b04c921e57bb1fe74f9811d5e7cc9ba137600f9da55b906db3d51cc754533c7ed62f69bf9800172e07a2c4676a61bb13e0b939e12f25322c3065060a8c46d015
-  data.tar.gz: 870d7895ec05e62183f8958bae438b417b490df5c22d30f656a818d3e9c2747b8a16adb2f973bb0a6a36ac497ce4e725a7d2b139ece7ef1e96ac4171285673da
+  metadata.gz: 2c529d5f970394ca40b79d7ac1ddb430c197cbd508bf533195f13d81937cca872232436bcb92c5a8f38eafc9968ef0d1a82c280120545e421d143dcf72d12f0c
+  data.tar.gz: b341f56e92124b2418b56483dab20374aee03fca5de1e946e5b09ce1f2ca7d0daa16c47ed365a90f51a8f5bdf55235dbe9107cf95dc0a3b9b00e19056f72f343

data/CHANGELOG.md

@@ -8,6 +8,19 @@
 ## [Unreleased]
 Changes since the last non-beta release.
 
+## [v8.4.0] - September 8, 2025
+
+### Added
+
+- Support for subresource integrity. [PR 570](https://github.com/shakacode/shakapacker/pull/570) by [panagiotisplytas](https://github.com/panagiotisplytas)
+
+### Fixed
+
+- Install the latest major version of peer dependencies [PR 576](https://github.com/shakacode/shakapacker/pull/576) by [G-Rath](https://github.com/g-rath).
+- Remove duplicate word in comment from generated `shakapacker.yml` config [PR 572](https://github.com/shakacode/shakapacker/pull/572) by [G-Rath](https://github.com/g-rath).
+- fix: update webpack-dev-server to secure versions (^4.15.2 || ^5.2.2) [PR 585](https://github.com/shakacode/shakapacker/pull/585) by [justin808](https://github.com/justin808)
+
+
 ## [v8.3.0] - April 25, 2025
 ### Added
 
@@ -419,7 +432,8 @@ Note: [Rubygem is 6.3.0.pre.rc.1](https://rubygems.org/gems/shakapacker/versions
 ## v5.4.3 and prior changes from rails/webpacker
 See [CHANGELOG.md in rails/webpacker (up to v5.4.3)](https://github.com/rails/webpacker/blob/master/CHANGELOG.md)
 
-[Unreleased]: https://github.com/shakacode/shakapacker/compare/v8.3.0...main
+[Unreleased]: https://github.com/shakacode/shakapacker/compare/v8.4.0...main
+[v8.4.0]: https://github.com/shakacode/shakapacker/compare/v8.3.0...v8.4.0
 [v8.3.0]: https://github.com/shakacode/shakapacker/compare/v8.2.0...v8.3.0
 [v8.2.0]: https://github.com/shakacode/shakapacker/compare/v8.1.0...v8.2.0
 [v8.1.0]: https://github.com/shakacode/shakapacker/compare/v8.0.2...v8.1.0

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    shakapacker (8.3.0)
+    shakapacker (8.4.0)
       activesupport (>= 5.2)
       package_json
       rack-proxy (>= 0.6.1)

data/README.md

@@ -625,7 +625,7 @@ By default, you will find the Shakapacker preset in your `package.json`. Note, y
   ]
 },
 ```
-Optionally, you can change your Babel configuration by removing these lines in your `package.json` and adding [a Babel](https://babeljs.io/docs/en/config-files) configuration file](https://babeljs.io/docs/en/config-files) to your project. For an example of customization based on the original, see [Customizing Babel Config](./docs/customizing_babel_config.md).
+Optionally, you can change your Babel configuration by removing these lines in your `package.json` and adding [a Babel configuration file](https://babeljs.io/docs/en/config-files) to your project. For an example of customization based on the original, see [Customizing Babel Config](./docs/customizing_babel_config.md).
 
 
 ### SWC configuration

data/docs/react.md

@@ -61,11 +61,7 @@ const webpackConfig = generateWebpackConfig();
 
 if (isDevelopment && inliningCss) {
   webpackConfig.plugins.push(
-    new ReactRefreshWebpackPlugin({
-      overlay: {
-        sockPort: webpackConfig.devServer.port,
-      },
-    })
+    new ReactRefreshWebpackPlugin()
   );
 }
 
@@ -201,11 +197,7 @@ const webpackConfig = generateWebpackConfig();
 
 if (isDevelopment && inliningCss) {
   webpackConfig.plugins.push(
-    new ReactRefreshWebpackPlugin({
-      overlay: {
-        sockPort: webpackConfig.devServer.port,
-      },
-    })
+    new ReactRefreshWebpackPlugin()
   );
 }
 

data/docs/subresource_integrity.md

@@ -0,0 +1,54 @@
+# Subresource integrity
+It's a cryptographic hash that helps browsers check that the served js or css file has not been tampered in any way.
+
+[MDN - Subresource Integrity](https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity)
+
+## Important notes
+- If you somehow modify the file after the hash was generated, it will automatically be considered as tampered, and the browser will not allow it to be executed.
+- Enabling subresource integrity generation, will change the structure of `manifest.json`. Keep that in mind if you utilize this file in any other custom implementation.
+
+Before:
+```json
+{
+  "application.js": "/path_to_asset"
+}
+```
+
+After:
+```json
+{
+  "application.js": {
+    "src": "/path_to_asset",
+    "integrity": "<sha256-hash> <sha384-hash> <sha512-hash>"
+  }
+}
+```
+
+## Possible CORS issues
+Enabling subresource integrity for an asset, actually enforces CORS checks on that resource too. Which means that
+if you haven't set that up properly beforehand, it will probably lead to CORS errors with cached assets.
+
+[MDN - How browsers handle Subresource Integrity](https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity#how_browsers_handle_subresource_integrity)
+
+## Configuration
+
+By default, this setting is disabled, to ensure backwards compatibility, and let developers adapt at their own pace.
+This may change in the future, as it is a very nice security feature, and it should be enabled by default.
+
+To enable it, just add this in `shakapacker.yml`
+```yml
+  integrity:
+    enabled: true    
+```
+
+For further customization, you can also utilize the options `hash_functions` that control the functions used to generate 
+integrity hashes. And `cross_origin` that sets the cross-origin loading attribute.
+
+```yml
+  integrity:
+    enabled: true
+    hash_functions: ["sha256", "sha384", "sha512"]
+    cross_origin: "anonymous" # or "use-credentials"
+```
+
+This will utilize under the hood webpack-subresource-integrity plugin and will modify `manifest.json` to include integrity hashes.

data/lib/install/config/shakapacker.yml

@@ -42,7 +42,7 @@ default: &default
   # Raises an error if there is a mismatch in the shakapacker gem and npm package being used
   ensure_consistent_versioning: true
 
-  # Select whether the compiler will use SHA digest ('digest' option) or most most recent modified timestamp ('mtime') to determine freshness
+  # Select whether the compiler will use SHA digest ('digest' option) or most recent modified timestamp ('mtime') to determine freshness
   compiler_strategy: digest
 
   # Select whether the compiler will always use a content hash and not just in production
@@ -55,6 +55,16 @@ default: &default
   # SHAKAPACKER_ASSET_HOST will override both configurations.
   # asset_host: custom-path
 
+  # Utilizing webpack-subresource-integrity plugin, will generate integrity hashes for all entries in manifest.json
+  # https://github.com/waysact/webpack-subresource-integrity/tree/main/webpack-subresource-integrity
+  integrity:
+    enabled: false
+    # Which cryptographic function(s) to use, for generating the integrity hash(es). Default sha-384. Other possible values sha256, sha512
+    hash_functions: ["sha384"]
+    # Default "anonymous". Other possible value "use-credentials"
+    # https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity#cross-origin_resource_sharing_and_subresource_integrity
+    cross_origin: "anonymous"
+
 development:
   <<: *default
   compile: true
@@ -71,7 +81,7 @@ development:
     # Hot Module Replacement updates modules while the application is running without a full reload
     # Used instead of the `hot` key in https://webpack.js.org/configuration/dev-server/#devserverhot
     hmr: false
-    # If HMR is on, CSS will by inlined by delivering it as part of the script payload via style-loader. Be sure
+    # If HMR is on, CSS will be inlined by delivering it as part of the script payload via style-loader. Be sure
     # that you add style-loader to your project dependencies.
     #
     # If you want to instead deliver CSS via <link> with the mini-css-extract-plugin, set inline_css to false.
@@ -114,7 +124,7 @@ production:
   # Production depends on precompilation of packs prior to booting for performance.
   compile: false
 
-  # Use content hash for naming assets. Cannot be overridden by for production.
+  # Use content hash for naming assets. Cannot be overridden in production.
   useContentHash: true
 
   # Cache manifest.json for performance

data/lib/install/template.rb

@@ -136,7 +136,7 @@ Dir.chdir(Rails.root) do
   dev_dependencies_to_add = []
 
   peers.each do |(package, version)|
-    major_version = version.match(/(\d+)/)[1]
+    major_version = version.split("||").last.match(/(\d+)/)[1]
     entry = "#{package}@#{major_version}"
 
     if dev_dependency_packages.include? package

data/lib/shakapacker/configuration.rb

@@ -99,6 +99,10 @@ class Shakapacker::Configuration
     )
   end
 
+  def integrity
+    fetch(:integrity)
+  end
+
   private
     def data
       @data ||= load

data/lib/shakapacker/helper.rb

@@ -109,11 +109,11 @@ module Shakapacker::Helper
     @javascript_pack_tag_loaded = true
 
     capture do
-      concat javascript_include_tag(*async, **options.dup.tap { |o| o[:async] = true })
+      render_tags(async, :javascript, **options.dup.tap { |o| o[:async] = true })
       concat "\n" if async.any? && deferred.any?
-      concat javascript_include_tag(*deferred, **options.dup.tap { |o| o[:defer] = true })
+      render_tags(deferred, :javascript, **options.dup.tap { |o| o[:defer] = true })
       concat "\n" if sync.any? && deferred.any?
-      concat javascript_include_tag(*sync, **options)
+      render_tags(sync, :javascript, options)
     end
   end
 
@@ -166,7 +166,9 @@ module Shakapacker::Helper
 
     @stylesheet_pack_tag_loaded = true
 
-    stylesheet_link_tag(*(requested_packs | appended_packs), **options)
+    capture do
+      render_tags(requested_packs | appended_packs, :stylesheet, options)
+    end
   end
 
   def append_stylesheet_pack_tag(*names)
@@ -238,4 +240,38 @@ module Shakapacker::Helper
     rescue
       path_to_asset(current_shakapacker_instance.manifest.lookup!(name), options)
     end
+
+    def lookup_integrity(source)
+      (source.respond_to?(:dig) && source.dig("integrity")) || nil
+    end
+
+    def lookup_source(source)
+      (source.respond_to?(:dig) && source.dig("src")) || source
+    end
+
+    # Handles rendering javascript and stylesheet tags with integrity, if that's enabled.
+    def render_tags(sources, type, options)
+      return unless sources.present? || type.present?
+
+      sources.each.with_index do |source, index|
+        tag_source = lookup_source(source)
+
+        if current_shakapacker_instance.config.integrity[:enabled]
+          integrity = lookup_integrity(source)
+
+          if integrity.present?
+            options[:integrity] = integrity
+            options[:crossorigin] = current_shakapacker_instance.config.integrity[:cross_origin]
+          end
+        end
+
+        if type == :javascript
+          concat javascript_include_tag(tag_source, **options)
+        else
+          concat stylesheet_link_tag(tag_source, **options)
+        end
+
+        concat "\n" unless index == sources.size - 1
+      end
+    end
 end

data/lib/shakapacker/manifest.rb

@@ -67,7 +67,12 @@ class Shakapacker::Manifest
     end
 
     def find(name)
-      data[name.to_s].presence
+      return nil unless data[name.to_s].present?
+
+      return data[name.to_s] unless data[name.to_s].respond_to?(:dig)
+
+      # Try to return src, if that fails, (ex. entrypoints object) return the whole object.
+      data[name.to_s].dig("src") || data[name.to_s]
     end
 
     def full_pack_name(name, pack_type)

data/lib/shakapacker/version.rb

@@ -1,4 +1,4 @@
 module Shakapacker
   # Change the version in package.json too, please!
-  VERSION = "8.3.0".freeze
+  VERSION = "8.4.0".freeze
 end

data/package/config.js

@@ -50,5 +50,7 @@ if (config.manifest_path) {
 } else {
   config.manifestPath = resolve(config.outputPath, "manifest.json")
 }
+// Ensure no duplicate hash functions exist in the returned config object
+config.integrity.hash_functions = [...new Set(config.integrity.hash_functions)]
 
 module.exports = config

data/package/environments/base.js

@@ -86,7 +86,9 @@ const getPlugins = () => {
       writeToDisk: true,
       output: config.manifestPath,
       entrypointsUseAssets: true,
-      publicPath: config.publicPathWithoutCDN
+      publicPath: config.publicPathWithoutCDN,
+      integrity: config.integrity.enabled,
+      integrityHashes: config.integrity.hash_functions
     })
   ]
 
@@ -105,6 +107,22 @@ const getPlugins = () => {
     )
   }
 
+  if (
+    moduleExists("webpack-subresource-integrity") &&
+    config.integrity.enabled
+  ) {
+    const {
+      SubresourceIntegrityPlugin
+    } = require("webpack-subresource-integrity")
+
+    plugins.push(
+      new SubresourceIntegrityPlugin({
+        hashFuncNames: config.integrity.hash_functions,
+        enabled: isProduction
+      })
+    )
+  }
+
   return plugins
 }
 
@@ -121,7 +139,12 @@ module.exports = {
     // https://webpack.js.org/configuration/output/#outputhotupdatechunkfilename
     hotUpdateChunkFilename: "js/[id].[fullhash].hot-update.js",
     path: config.outputPath,
-    publicPath: config.publicPath
+    publicPath: config.publicPath,
+
+    // This is required for SRI to work.
+    crossOriginLoading: config.integrity.enabled
+      ? config.integrity.cross_origin
+      : false
   },
   entry: getEntryObject(),
   resolve: {

data/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shakapacker",
-  "version": "8.3.0",
+  "version": "8.4.0",
   "description": "Use webpack to manage app-like JavaScript modules in Rails",
   "homepage": "https://github.com/shakacode/shakapacker",
   "bugs": {
@@ -46,6 +46,7 @@
     "thenify": "^3.3.1",
     "webpack": "5.93.0",
     "webpack-assets-manifest": "^5.0.6",
+    "webpack-subresource-integrity": "^5.1.0",
     "webpack-merge": "^5.8.0"
   },
   "peerDependencies": {
@@ -60,8 +61,9 @@
     "terser-webpack-plugin": "^5.3.1",
     "webpack": "^5.76.0",
     "webpack-assets-manifest": "^5.0.6 || ^6.0.0",
+    "webpack-subresource-integrity": "^5.1.0",
     "webpack-cli": "^4.9.2 || ^5.0.0 || ^6.0.0",
-    "webpack-dev-server": "^4.9.0 || ^5.0.0",
+    "webpack-dev-server": "^4.15.2 || ^5.2.2",
     "webpack-merge": "^5.8.0 || ^6.0.0"
   },
   "peerDependenciesMeta": {
@@ -70,6 +72,9 @@
     },
     "@types/webpack": {
       "optional": true
+    },
+    "webpack-subresource-integrity": {
+      "optional": true
     }
   },
   "packageManager": "yarn@1.22.22",

data/test/package/config.test.js

@@ -54,4 +54,44 @@ describe("Config", () => {
       resolve("app/javascript/manifest.json")
     )
   })
+
+  test("should have integrity disabled by default", () => {
+    const config = require("../../package/config")
+    expect(config.integrity.enabled).toBe(false)
+  })
+
+  test("should have sha384 as default hash function", () => {
+    const config = require("../../package/config")
+    expect(config.integrity.hash_functions).toStrictEqual(["sha384"])
+  })
+
+  test("should have anonymous as default crossorigin", () => {
+    const config = require("../../package/config")
+    expect(config.integrity.cross_origin).toBe("anonymous")
+  })
+
+  test("should allow enabling integrity", () => {
+    process.env.SHAKAPACKER_CONFIG = "config/shakapacker_integrity.yml"
+    const config = require("../../package/config")
+
+    expect(config.integrity.enabled).toBe(true)
+  })
+
+  test("should allow configuring hash functions", () => {
+    process.env.SHAKAPACKER_CONFIG = "config/shakapacker_integrity.yml"
+    const config = require("../../package/config")
+
+    expect(config.integrity.hash_functions).toStrictEqual([
+      "sha384",
+      "sha256",
+      "sha512"
+    ])
+  })
+
+  test("should allow configuring crossorigin", () => {
+    process.env.SHAKAPACKER_CONFIG = "config/shakapacker_integrity.yml"
+    const config = require("../../package/config")
+
+    expect(config.integrity.cross_origin).toBe("use-credentials")
+  })
 })

data/yarn.lock

@@ -4457,6 +4457,11 @@ typed-array-length@^1.0.7:
     possible-typed-array-names "^1.0.0"
     reflect.getprototypeof "^1.0.6"
 
+typed-assert@^1.0.8:
+  version "1.0.9"
+  resolved "https://registry.yarnpkg.com/typed-assert/-/typed-assert-1.0.9.tgz#8af9d4f93432c4970ec717e3006f33f135b06213"
+  integrity sha512-KNNZtayBCtmnNmbo5mG47p1XsCyrx6iVqomjcZnec/1Y5GGARaxPs6r49RnSPeUP3YjNYiU9sQHAtY4BBvnZwg==
+
 unbox-primitive@^1.1.0:
   version "1.1.0"
   resolved "https://registry.yarnpkg.com/unbox-primitive/-/unbox-primitive-1.1.0.tgz#8d9d2c9edeea8460c7f35033a88867944934d1e2"
@@ -4551,6 +4556,13 @@ webpack-sources@^3.2.3:
   resolved "https://registry.yarnpkg.com/webpack-sources/-/webpack-sources-3.2.3.tgz#2d4daab8451fd4b240cc27055ff6a0c2ccea0cde"
   integrity sha512-/DyMEOrDgLKKIG0fmvtz+4dUX/3Ghozwgm6iPp8KRhvn+eQf9+Q7GWxVNMk3+uCPWfdXYC4ExGBckIXdFEfH1w==
 
+webpack-subresource-integrity@^5.1.0:
+  version "5.1.0"
+  resolved "https://registry.yarnpkg.com/webpack-subresource-integrity/-/webpack-subresource-integrity-5.1.0.tgz#8b7606b033c6ccac14e684267cb7fb1f5c2a132a"
+  integrity sha512-sacXoX+xd8r4WKsy9MvH/q/vBtEHr86cpImXwyg74pFIpERKt6FmB8cXpeuh0ZLgclOlHI4Wcll7+R5L02xk9Q==
+  dependencies:
+    typed-assert "^1.0.8"
+
 webpack@5.93.0:
   version "5.93.0"
   resolved "https://registry.yarnpkg.com/webpack/-/webpack-5.93.0.tgz#2e89ec7035579bdfba9760d26c63ac5c3462a5e5"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: shakapacker
 version: !ruby/object:Gem::Version
-  version: 8.3.0
+  version: 8.4.0
 platform: ruby
 authors:
 - David Heinemeier Hansson
@@ -10,7 +10,7 @@ authors:
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2025-04-29 00:00:00.000000000 Z
+date: 2025-09-09 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -165,6 +165,7 @@ files:
 - docs/react.md
 - docs/sprockets.md
 - docs/style_loader_vs_mini_css.md
+- docs/subresource_integrity.md
 - docs/troubleshooting.md
 - docs/using_esbuild_loader.md
 - docs/using_swc_loader.md
@@ -284,7 +285,7 @@ homepage: https://github.com/shakacode/shakapacker
 licenses:
 - MIT
 metadata:
-  source_code_uri: https://github.com/shakacode/shakapacker/tree/v8.3.0
+  source_code_uri: https://github.com/shakacode/shakapacker/tree/v8.4.0
 post_install_message:
 rdoc_options: []
 require_paths:
@@ -300,7 +301,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.5.11
+rubygems_version: 3.5.22
 signing_key:
 specification_version: 4
 summary: Use webpack to manage app-like JavaScript modules in Rails