shakapacker 9.0.0.beta.7 → 9.0.0.beta.9

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ca5207ce21d40303f0a0250d140763ca93000a318ba28a9ac8efff358ce59310
-  data.tar.gz: f494c9a43b2c9fc704ca6dc1e3110f0c7048759a13e3f8254c44735e91a58da0
+  metadata.gz: 5bcee4a9f167db64caa92dd26cc09d18b58a7bcd9e42df48d83a67ee588e4661
+  data.tar.gz: 70bee9a11ad197b10731b8f0870c52093fa64092ad470525679d32b44b64fcc2
 SHA512:
-  metadata.gz: a13fd3b73ffb91546e25c8226731efd4cdf6e8024893011795e32f379d2c3ffd14a4b5286b2a32499447405a01624b50805aafd6749112538e560ab21bc58e7e
-  data.tar.gz: d9911ec4c3a53a6baf3598e48b29e74684113a6514e979c73b69479905399e94abc67c0792a51c1cf12c5961a771c9de1f19e1800991f9a638dfab5ebcd1e606
+  metadata.gz: 7c3be887fa8da2e9ef41aaf1753556da768002c7fcb0a765d348dac99c49d092caf2fe652008b86059a98c4b62d78326ff5f14cf4e39ed30696aebcd83560bc0
+  data.tar.gz: 2f4e2c8a069381191daed7fa8dbe6a38c93731c31399234d78621448d9a48a9d0759d9f84e29a94e8e87a88e4174e7a52d951470c56779fca673ebdc907fdda9

data/.eslintrc.fast.js

@@ -0,0 +1,40 @@
+// Fast ESLint config for quick development feedback
+// Skips type-aware rules that require TypeScript compilation
+
+const baseConfig = require("./.eslintrc.js")
+
+module.exports = {
+  ...baseConfig,
+  overrides: [
+    ...baseConfig.overrides.filter((o) => !o.files.includes("**/*.{ts,tsx}")),
+    {
+      files: ["**/*.{ts,tsx}"],
+      parser: "@typescript-eslint/parser",
+      parserOptions: {
+        // No project specified - disables type-aware linting
+        ecmaVersion: 2020,
+        sourceType: "module"
+      },
+      extends: [
+        "plugin:@typescript-eslint/recommended",
+        // Skip the "recommended-requiring-type-checking" preset
+        "plugin:prettier/recommended"
+      ],
+      plugins: ["@typescript-eslint"],
+      rules: {
+        // Same rules as main config minus type-aware ones
+        "import/no-unresolved": "off",
+        "import/no-extraneous-dependencies": "off",
+        "import/extensions": "off",
+        "no-use-before-define": "off",
+        "@typescript-eslint/no-use-before-define": ["error"],
+        "@typescript-eslint/no-unused-vars": [
+          "error",
+          { argsIgnorePattern: "^_" }
+        ],
+        "@typescript-eslint/no-explicit-any": "error",
+        "@typescript-eslint/explicit-module-boundary-types": "off"
+      }
+    }
+  ]
+}

data/.eslintrc.js

@@ -1,11 +1,22 @@
 module.exports = {
+  root: true, // Prevent ESLint from looking in parent directories
   extends: ["airbnb", "plugin:prettier/recommended"],
   rules: {
+    // Webpack handles module resolution, not ESLint
     "import/no-unresolved": "off",
+    // Allow importing devDependencies in config/test files
     "import/no-extraneous-dependencies": "off",
+    // TypeScript handles extensions, not needed for JS imports
     "import/extensions": "off",
     indent: ["error", 2]
   },
+  settings: {
+    react: {
+      // Suppress "react package not installed" warning
+      // This project doesn't use React but airbnb config requires react-plugin
+      version: "999.999.999"
+    }
+  },
   env: {
     browser: true,
     node: true
@@ -31,6 +42,43 @@ module.exports = {
         "jest/prefer-strict-equal": "error",
         "jest/prefer-todo": "error"
       }
+    },
+    {
+      files: ["**/*.{ts,tsx}"],
+      parser: "@typescript-eslint/parser",
+      parserOptions: {
+        // Enables type-aware linting for better type safety
+        // Note: This can slow down linting on large codebases
+        // Consider using --cache flag with ESLint if performance degrades
+        project: "./tsconfig.eslint.json",
+        tsconfigRootDir: __dirname
+      },
+      extends: [
+        "plugin:@typescript-eslint/recommended",
+        "plugin:@typescript-eslint/recommended-requiring-type-checking",
+        "plugin:prettier/recommended"
+      ],
+      plugins: ["@typescript-eslint"],
+      rules: {
+        // TypeScript compiler handles module resolution
+        "import/no-unresolved": "off",
+        // Allow importing devDependencies in TypeScript files
+        "import/no-extraneous-dependencies": "off",
+        // TypeScript handles file extensions via moduleResolution
+        "import/extensions": "off",
+        // Disable base rule in favor of TypeScript version
+        "no-use-before-define": "off",
+        "@typescript-eslint/no-use-before-define": ["error"],
+        // Allow unused vars if they start with underscore (convention for ignored params)
+        "@typescript-eslint/no-unused-vars": [
+          "error",
+          { argsIgnorePattern: "^_" }
+        ],
+        // Strict: no 'any' types allowed - use 'unknown' or specific types instead
+        "@typescript-eslint/no-explicit-any": "error",
+        // Allow implicit return types - TypeScript can infer them
+        "@typescript-eslint/explicit-module-boundary-types": "off"
+      }
     }
   ]
 }

data/.gitignore

@@ -11,6 +11,7 @@ yarn-error.log*
 /log
 gemfiles/*.lock
 .DS_Store
+.eslintcache
 
 .yalc
 yalc.lock
@@ -25,11 +26,8 @@ package/**/*.js
 !package/index.d.ts
 !package/loaders.d.ts
 !package/webpack-types.d.ts
-!package/babel/preset.js
 !package/babel/preset-react.js
-!package/rules/*.js
 !package/loaders/*.js
-!package/plugins/*.js
 !package/__mocks__/*.js
 !package/utils/get_style_rule.js
 !package/utils/node_modules.js

data/.husky/pre-commit

@@ -0,0 +1,2 @@
+#!/usr/bin/env sh
+npx lint-staged

data/.npmignore

@@ -10,6 +10,7 @@
 /gemfiles
 /.github
 /.circleci
+/.husky
 /.byebug_history
 .DS_Store
 yarn-debug.log*

data/CHANGELOG.md

@@ -9,7 +9,9 @@
 ## [Unreleased]
 Changes since the last non-beta release.
 
-## [v9.0.0-beta.4] - Unreleased
+## [v9.0.0-beta.8] - October 3, 2025
+
+See the [v9 Upgrade Guide](https://github.com/shakacode/shakapacker/blob/main/docs/v9_upgrade.md) for detailed migration instructions.
 
 ### ⚠️ Breaking Changes
 
@@ -17,7 +19,7 @@ Changes since the last non-beta release.
    - Babel dependencies are no longer included as peer dependencies
    - Improves compilation speed by 20x
    - **Migration for existing projects:**
-     - **Option 1 (Recommended):** Switch to SWC:
+     - **Option 1 (Recommended):** Switch to SWC - Run `rake shakapacker:migrate:to_swc` or manually:
        ```yaml
        # config/shakapacker.yml
        javascript_transpiler: 'swc'
@@ -30,11 +32,9 @@ Changes since the last non-beta release.
        ```
 
 2. **CSS Modules now use named exports by default**
-   - Configured with `namedExport: true` and `exportLocalsConvention: 'camelCase'`
    - **JavaScript:** Use named imports: `import { className } from './styles.module.css'`
    - **TypeScript:** Use namespace imports: `import * as styles from './styles.module.css'`
-   - Default imports (`import styles from '...'`) no longer work
-   - See [CSS Modules Export Mode documentation](./docs/css-modules-export-mode.md) for migration details
+   - To keep the old behavior with default imports, see [CSS Modules Export Mode documentation](./docs/css-modules-export-mode.md) for configuration instructions
 
 3. **Configuration option renamed from `webpack_loader` to `javascript_transpiler`**
    - Better reflects its purpose of configuring JavaScript transpilation
@@ -46,23 +46,26 @@ Changes since the last non-beta release.
   - Faster Rust-based bundling with webpack-compatible APIs
   - Built-in SWC loader and CSS extraction
   - Automatic bundler detection in `bin/shakapacker`
-- **Private output path** for server-side rendering bundles ([PR 592](https://github.com/shakacode/shakapacker/pull/592) by [justin808](https://github.com/justin808))
-  - Configure `private_output_path` for private server bundles
-- **Enhanced TypeScript definitions** ([PR 602](https://github.com/shakacode/shakapacker/pull/602) by [justin808](https://github.com/justin808))
-  - Better IDE support and type safety
-- **`rake shakapacker:doctor` diagnostic command** ([PR 609](https://github.com/shakacode/shakapacker/pull/609) by [justin808](https://github.com/justin808))
-  - Check for configuration issues and missing dependencies
-  - Identify missing loaders that cause build errors
-  - Particularly useful when migrating to v9 where peer dependencies are removed
-  - Detects transpiler-specific issues based on v9 changes
-
-### Changed
-- Configuration option renamed from `bundler` to `assets_bundler` (deprecated but supported)
-- **Babel dependencies are now optional** instead of peer dependencies ([PR 603](https://github.com/shakacode/shakapacker/pull/603) by [justin808](https://github.com/justin808))
-  - Installed automatically only when `javascript_transpiler` is set to 'babel'
+- **TypeScript type definitions** for improved IDE support and autocomplete
+  - Types available via `import type { WebpackConfig, RspackConfig, EnvironmentConfig } from "shakapacker/types"`
+  - See [TypeScript Documentation](./docs/typescript.md) for migration and usage instructions
+- **Optional peer dependencies** - All peer dependencies now marked as optional, preventing installation warnings while maintaining version compatibility tracking
+- **Private output path** for server-side rendering bundles ([PR 592](https://github.com/shakacode/shakapacker/pull/592))
+  - Configure `private_output_path` for private server bundles separate from public assets
+- **`rake shakapacker:doctor` diagnostic command** to check for configuration issues and missing dependencies
+- **`rake shakapacker:migrate:to_swc`** migration helper to assist with switching from Babel to SWC
+
+### Security
+- **Path Validation Utilities** ([PR 614](https://github.com/shakacode/shakapacker/pull/614) by [justin808](https://github.com/justin808))
+  - Added validation to prevent directory traversal attacks
+  - Implemented environment variable sanitization to prevent injection
+  - Enforced strict port validation (reject strings with non-digits)
+  - Added SHAKAPACKER_NPM_PACKAGE path validation (only .tgz/.tar.gz allowed)
+  - Path traversal security checks now run regardless of validation mode
 
 ### Fixed
-- Update webpack-dev-server to secure versions (^4.15.2 || ^5.2.2) ([PR 585](https://github.com/shakacode/shakapacker/pull/585) by [justin808](https://github.com/justin808))
+- Fixed private_output_path configuration edge cases ([PR 604](https://github.com/shakacode/shakapacker/pull/604))
+- Updated webpack-dev-server to secure versions (^4.15.2 || ^5.2.2) ([PR 585](https://github.com/shakacode/shakapacker/pull/585))
 
 ## [v8.4.0] - September 8, 2024
 
@@ -484,8 +487,8 @@ Note: [Rubygem is 6.3.0.pre.rc.1](https://rubygems.org/gems/shakapacker/versions
 ## v5.4.3 and prior changes from rails/webpacker
 See [CHANGELOG.md in rails/webpacker (up to v5.4.3)](https://github.com/rails/webpacker/blob/master/CHANGELOG.md)
 
-[Unreleased]: https://github.com/shakacode/shakapacker/compare/v9.0.0-beta.4...main
-[v9.0.0-beta.4]: https://github.com/shakacode/shakapacker/compare/v8.4.0...v9.0.0-beta.4
+[Unreleased]: https://github.com/shakacode/shakapacker/compare/v9.0.0-beta.8...main
+[v9.0.0-beta.8]: https://github.com/shakacode/shakapacker/compare/v8.4.0...v9.0.0-beta.8
 [v8.4.0]: https://github.com/shakacode/shakapacker/compare/v8.3.0...v8.4.0
 [v8.3.0]: https://github.com/shakacode/shakapacker/compare/v8.2.0...v8.3.0
 [v8.2.0]: https://github.com/shakacode/shakapacker/compare/v8.1.0...v8.2.0

data/CONTRIBUTING.md

@@ -3,6 +3,7 @@
 Thank you for your interest in contributing to Shakapacker! We welcome all contributions that align with our project goals and values. To ensure a smooth and productive collaboration, please follow these guidelines.
 
 ## Contents
+
 - [Reporting Issues](#reporting-issues)
 - [Submitting Pull Requests](#submitting-pull-requests)
 - [Setting Up a Development Environment](#setting-up-a-development-environment)
@@ -10,44 +11,89 @@ Thank you for your interest in contributing to Shakapacker! We welcome all contr
 - [Testing the generator](#testing-the-generator)
 
 ## Reporting Issues
+
 If you encounter any issues with the project, please first check the existing issues (including closed ones). If the issues is not reported before, please opening an issue on our GitHub repository. Please provide a clear and detailed description of the issue, including steps to reproduce it. Creating a demo repository to demonstrate the issue would be ideal (and in some cases necessary).
 
 If looking to contribute to the project by fixing existing issues, we recommend looking at issues, particularly with the "[help wanted](https://github.com/shakacode/shakapacker/issues?q=is%3Aissue+label%3A%22help+wanted%22)" label.
 
 ## Submitting Pull Requests
+
 We welcome pull requests that fix bugs, add new features, or improve existing ones. Before submitting a pull request, please make sure to:
 
-  - Open an issue about what you want to propose before start working on.
-  - Fork the repository and create a new branch for your changes.
-  - Write clear and concise commit messages.
-  - Follow our code style guidelines.
-  - Write tests for your changes and [make sure all tests pass](#making-sure-your-changes-pass-all-tests).
-  - Update the documentation as needed.
-  - Update CHANGELOG.md if the changes affect public behavior of the project.
+- Open an issue about what you want to propose before start working on.
+- Fork the repository and create a new branch for your changes.
+- Write clear and concise commit messages.
+- Follow our code style guidelines.
+- Write tests for your changes and [make sure all tests pass](#making-sure-your-changes-pass-all-tests).
+- Update the documentation as needed.
+- Update CHANGELOG.md if the changes affect public behavior of the project.
 
 ---
+
+## Git Hooks (Optional)
+
+This project includes configuration for git hooks via `husky` and `lint-staged`, but they are **opt-in for contributors**.
+
+**Why are hooks optional?** As a library project, we don't enforce git hooks because:
+
+- Different contributors may have different workflows
+- Forcing hooks can interfere with contributor tooling
+- CI/CD handles the final validation
+
+To enable pre-commit hooks locally:
+
+```bash
+npx husky install
+npx husky add .husky/pre-commit "npx lint-staged"
+```
+
+---
+
+## Linting and Code Quality
+
+### Running Linters
+
+```bash
+# Full linting with type checking (slower but thorough)
+yarn lint
+
+# Fast linting without type checking (for quick feedback)
+yarn lint:fast
+
+# With caching for better performance
+yarn lint --cache
+```
+
+**Performance Note:** TypeScript ESLint uses type-aware linting for better type safety, which can be slower on large codebases. Use `yarn lint:fast` during development for quick feedback.
+
+---
+
 ## Setting Up a Development Environment
 
 1. Install [Yarn](https://classic.yarnpkg.com/)
 2. To test your changes on a Rails test project do the following steps:
+
    - For Ruby gem, update `Gemfile` and point the `shakapacker` to the locally developing Shakapacker project:
-      ```ruby
-      gem 'shakapacker', path: "relative_or_absolute_path_to_local_shakapacker"
-      ```
+     ```ruby
+     gem 'shakapacker', path: "relative_or_absolute_path_to_local_shakapacker"
+     ```
    - For npm package, use `yalc` with following steps:
-      ```bash
-      # In Shakapacker root directory
-      yalc publish
-      # In Rails app for testing
-      yalc link shakapacker
-
-      # After every change in shakapacker, run the following in Shakapacker directory
-      yalc push # or yalc publish --push
-      ```
+
+     ```bash
+     # In Shakapacker root directory
+     yalc publish
+     # In Rails app for testing
+     yalc link shakapacker
+
+     # After every change in shakapacker, run the following in Shakapacker directory
+     yalc push # or yalc publish --push
+     ```
+
 3. Run the following commands to set up the development environment.
    ```
    bundle install
    yarn install
+   yarn prepare:husky  # Set up pre-commit hooks for linting
    ```
 
 ## Understanding Optional Peer Dependencies
@@ -59,11 +105,13 @@ Shakapacker uses optional peer dependencies (via `peerDependenciesMeta`) for max
 - **Version constraints still apply** - When a package is installed, version compatibility is enforced
 
 ### When modifying dependencies:
+
 1. Add new peer dependencies to both `peerDependencies` and `peerDependenciesMeta` (marking as optional)
 2. Keep version ranges synchronized between `devDependencies` and `peerDependencies`
 3. Test with multiple package managers: `npm`, `yarn`, and `pnpm`
 
 ### Testing peer dependency changes:
+
 ```bash
 # Test with npm (no warnings expected)
 cd /tmp && mkdir test-npm && cd test-npm
@@ -129,6 +177,7 @@ bundle exec rake run_spec:gem
 ```
 
 #### 4.4 Run only Shakapacker gem specs for backward compatibility
+
 These specs are to check Shakapacker v7 backward compatibility with v6.x
 
 ```
@@ -136,6 +185,7 @@ bundle exec rake run_spec:gem_bc
 ```
 
 #### 4.5 Run dummy app test
+
 For this, you need `yalc` to be installed on your local machine
 
 ```
@@ -143,6 +193,7 @@ bundle exec rake run_spec:dummy
 ```
 
 #### 4.6 Testing the installer
+
 To ensure that your installer works as expected, either you can run `bundle exec rake run_spec:install`, or take the following manual testing steps:
 
 1. Update the `Gemfile` so that gem `shakapacker` has a line like this, pointing to your developing Shakapacker:
@@ -152,7 +203,7 @@ To ensure that your installer works as expected, either you can run `bundle exec
 2. Run `bundle install` to install the updated gem.
 3. Run `bundle exec rails shakapacker:install` to confirm that you got the right changes.
 
- **Note:** Ensure that you use bundle exec otherwise the installed shakapacker gem will run and not the one you are working on.
+**Note:** Ensure that you use bundle exec otherwise the installed shakapacker gem will run and not the one you are working on.
 
 ## CI Workflows
 
@@ -161,6 +212,7 @@ Shakapacker uses GitHub Actions for continuous integration. The CI workflows use
 ### Package Manager Choice
 
 The project uses Yarn in CI workflows for the following reasons:
+
 - Deterministic dependency resolution with `yarn.lock`
 - Faster installation with offline mirror support
 - Better workspace support for monorepo-style testing
@@ -174,14 +226,16 @@ The project uses Yarn in CI workflows for the following reasons:
 - `.github/workflows/generator.yml` - Generator installation tests
 
 All workflows use:
+
 ```yaml
 - uses: actions/setup-node@v4
   with:
-    cache: 'yarn'
+    cache: "yarn"
     cache-dependency-path: spec/dummy/yarn.lock
 ```
 
 And install dependencies with:
+
 ```bash
 yarn install
 ```

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    shakapacker (9.0.0.beta.7)
+    shakapacker (9.0.0.beta.9)
       activesupport (>= 5.2)
       package_json
       rack-proxy (>= 0.6.1)

data/README.md

@@ -1,13 +1,14 @@
-# Shakapacker (v8)
+# Shakapacker (v9)
 ---
 
-_🚀 Shakapacker 9.0.0.beta.2 supports [Rspack](https://rspack.rs/)! 10x faster than webpack!_
+_🚀 Shakapacker 9 supports [Rspack](https://rspack.rs/)! 10x faster than webpack!_
 
 ---
 
 _Official, actively maintained successor to [rails/webpacker](https://github.com/rails/webpacker). ShakaCode stands behind the long-term maintenance and development of this project for the Rails community._
 
 * ⚠️ See the [6-stable](https://github.com/shakacode/shakapacker/tree/6-stable) branch for Shakapacker v6.x code and documentation. :warning:
+* **See [V9 Upgrade](./docs/v9_upgrade.md) for upgrading from the v8 release.**
 * See [V8 Upgrade](./docs/v8_upgrade.md) for upgrading from the v7 release.
 * See [V7 Upgrade](./docs/v7_upgrade.md) for upgrading from the v6 release.
 * See [V6 Upgrade](./docs/v6_upgrade.md) for upgrading from v5 or prior v6 releases.

data/TODO.md

@@ -22,22 +22,21 @@
 - [ ] Convert dev_server.js
 - [ ] Convert webpackDevServerConfig.js
 
-### Phase 4: Rules & Loaders
-- [ ] Convert all files in `package/rules/`
-- [ ] Convert all files in `package/plugins/`
-- [ ] Convert all files in `package/optimization/`
-
-### Phase 5: Framework-Specific Modules
-- [ ] Convert rspack support files
-- [ ] Convert swc support files
-- [ ] Convert esbuild support files
-- [ ] Convert babel preset
-
-### Phase 6: Final Cleanup
-- [ ] Convert remaining utilities
-- [ ] Add TypeScript linting
-- [ ] Enable strict mode
-- [ ] Update documentation
+### Phase 4: Rules & Loaders (PR #620) ✅
+- [x] Convert all files in `package/rules/`
+- [x] Convert all files in `package/plugins/`
+- [x] Convert all files in `package/optimization/`
+
+### Phase 5: Framework-Specific Modules ✅
+- [x] Convert rspack support files
+- [x] Convert swc support files
+- [x] Convert esbuild support files
+- [x] Convert babel preset
+
+### Phase 6: Final Cleanup ✅
+- [x] Add TypeScript linting with @typescript-eslint
+- [x] Verify strict mode is enabled (already configured)
+- [x] Update documentation
 
 ## Why Gradual Migration?
 - **Lower risk**: Each phase can be tested independently

data/TODO_v9.md

@@ -20,12 +20,15 @@ Align with Next.js and modern tooling by using named exports:
   options: {
     modules: {
       namedExport: true,
-      exportLocalsConvention: 'camelCase'
+      exportLocalsConvention: 'camelCaseOnly'  // Must be 'camelCaseOnly' or 'dashesOnly' with namedExport: true
     }
   }
 }
 ```
 
+**Note:** Using `exportLocalsConvention: 'camelCase'` with `namedExport: true` will cause a build error.
+css-loader only allows `'camelCaseOnly'` or `'dashesOnly'` when named exports are enabled.
+
 2. **Update TypeScript types:**
 - Ensure proper typing for CSS modules with named exports
 - May need to update or generate `.d.ts` files for CSS modules
@@ -81,4 +84,4 @@ Align with Next.js and modern tooling by using named exports:
 ### Test Infrastructure
 - Successfully implemented dual bundler support (webpack/rspack)
 - test-bundler script working well with status command
-- Consider adding more comprehensive tests for both bundlers
+- Consider adding more comprehensive tests for both bundlers

data/conductor-setup.sh

@@ -35,6 +35,18 @@ $BUNDLE_CMD install
 echo "📦 Installing JavaScript dependencies..."
 yarn install
 
+# Set up Husky git hooks
+echo "🪝 Setting up Husky git hooks..."
+npx husky
+if [ ! -f .husky/pre-commit ]; then
+    echo "Creating pre-commit hook..."
+    cat > .husky/pre-commit << 'EOF'
+#!/usr/bin/env sh
+npx lint-staged
+EOF
+    chmod +x .husky/pre-commit
+fi
+
 # Copy environment files if they exist in root
 if [ -n "${CONDUCTOR_ROOT_PATH:-}" ]; then
     if [ -f "$CONDUCTOR_ROOT_PATH/.env" ]; then