shakapacker 9.2.0 → 9.3.0.beta.0

data/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "shakapacker",
-  "version": "9.2.0",
+  "version": "9.3.0-beta.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "shakapacker",
-      "version": "9.2.0",
+      "version": "9.3.0-beta.0",
       "license": "MIT",
       "dependencies": {
         "js-yaml": "^4.1.0",

data/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shakapacker",
-  "version": "9.2.0",
+  "version": "9.3.0-beta.0",
   "description": "Use webpack to manage app-like JavaScript modules in Rails",
   "homepage": "https://github.com/shakacode/shakapacker",
   "bugs": {
@@ -32,10 +32,12 @@
   ],
   "scripts": {
     "clean:ts": "find package -name '*.ts' -not -name '*.d.ts' | sed 's/\\.ts$//' | xargs -I {} rm -f {}.js {}.d.ts {}.d.ts.map {}.js.map",
-    "build": "tsc && node scripts/remove-use-strict.js && yarn prettier --write 'package/**/*.js'",
+    "build": "tsc && cp package/index.d.ts.template package/index.d.ts && node scripts/remove-use-strict.js && yarn prettier --write 'package/**/*.js'",
     "build:types": "tsc",
-    "lint": "eslint .",
-    "lint:fast": "eslint . --ext .js,.jsx,.ts,.tsx --config .eslintrc.fast.js",
+    "knip": "knip",
+    "knip:production": "knip --production",
+    "lint": "eslint . --cache",
+    "lint:fast": "eslint . --config eslint.config.fast.js --cache",
     "test": "jest",
     "type-check": "tsc --noEmit",
     "prepublishOnly": "yarn build && yarn type-check"
@@ -43,12 +45,27 @@
   "dependencies": {
     "js-yaml": "^4.1.0",
     "path-complete-extname": "^1.0.0",
-    "webpack-merge": "^5.8.0"
+    "webpack-merge": "^5.8.0",
+    "yargs": "^17.7.2"
   },
   "devDependencies": {
-    "@rspack/cli": "^1.4.11",
-    "@rspack/core": "^1.4.11",
+    "@rspack/cli": "^1.5.8",
+    "@rspack/core": "^1.5.8",
     "@swc/core": "^1.3.0",
+    "babel-loader": "^8.2.4",
+    "compression-webpack-plugin": "^9.0.0",
+    "css-loader": "^7.1.2",
+    "esbuild-loader": "^2.18.0",
+    "mini-css-extract-plugin": "^2.9.4",
+    "rspack-manifest-plugin": "^5.0.3",
+    "sass-loader": "^16.0.5",
+    "swc-loader": "^0.1.15",
+    "webpack": "5.93.0",
+    "webpack-assets-manifest": "^5.0.6",
+    "webpack-cli": "^6.0.0",
+    "webpack-subresource-integrity": "^5.1.0",
+    "@eslint/eslintrc": "^3.2.0",
+    "@eslint/js": "^9.37.0",
     "@types/babel__core": "^7.20.5",
     "@types/js-yaml": "^4.0.9",
     "@types/node": "^24.5.2",
@@ -56,35 +73,26 @@
     "@types/webpack": "^5.28.5",
     "@types/webpack-dev-server": "^4.7.2",
     "@types/webpack-merge": "^5.0.0",
-    "@typescript-eslint/eslint-plugin": "^8.45.0",
-    "@typescript-eslint/parser": "^8.45.0",
-    "babel-loader": "^8.2.4",
-    "compression-webpack-plugin": "^9.0.0",
-    "css-loader": "^7.1.2",
-    "esbuild-loader": "^2.18.0",
-    "eslint": "^8.0.0",
+    "@types/yargs": "^17.0.33",
+    "@typescript-eslint/eslint-plugin": "^8.46.0",
+    "@typescript-eslint/parser": "^8.46.0",
+    "eslint": "^9.37.0",
     "eslint-config-airbnb": "^19.0.4",
-    "eslint-config-prettier": "^9.0.0",
-    "eslint-plugin-import": "^2.31.0",
-    "eslint-plugin-jest": "^27.9.0",
+    "eslint-config-prettier": "^10.1.8",
+    "eslint-plugin-import": "^2.32.0",
+    "eslint-plugin-jest": "^29.0.1",
     "eslint-plugin-jsx-a11y": "^6.10.2",
-    "eslint-plugin-prettier": "^5.2.6",
+    "eslint-plugin-prettier": "^5.5.4",
     "eslint-plugin-react": "^7.37.5",
-    "eslint-plugin-react-hooks": "^4.6.0",
+    "eslint-plugin-react-hooks": "^7.0.0",
     "husky": "^9.1.7",
     "jest": "^29.7.0",
+    "knip": "^5.64.2",
     "lint-staged": "^15.2.10",
     "memory-fs": "^0.5.0",
-    "mini-css-extract-plugin": "^2.9.4",
     "prettier": "^3.2.5",
-    "rspack-manifest-plugin": "^5.0.3",
-    "sass-loader": "^16.0.5",
-    "swc-loader": "^0.1.15",
     "thenify": "^3.3.1",
-    "typescript": "^5.9.2",
-    "webpack": "5.93.0",
-    "webpack-assets-manifest": "^5.0.6",
-    "webpack-subresource-integrity": "^5.1.0"
+    "typescript": "^5.9.2"
   },
   "peerDependencies": {
     "@babel/core": "^7.17.9",
@@ -210,7 +218,7 @@
     ]
   },
   "engines": {
-    "node": ">= 14",
+    "node": ">= 20",
     "yarn": ">=1 <5"
   },
   "publishConfig": {

data/scripts/type-check-no-emit.js

@@ -21,7 +21,7 @@ try {
     cwd: process.cwd()
   })
   process.exit(0)
-} catch (error) {
+} catch {
   // Type checking failed
   process.exit(1)
 }

data/test/configExporter/configFile.test.js

@@ -0,0 +1,392 @@
+/* eslint-disable no-template-curly-in-string */
+const {
+  writeFileSync,
+  mkdirSync,
+  rmSync,
+  existsSync,
+  symlinkSync
+} = require("fs")
+const { resolve, join } = require("path")
+const { tmpdir } = require("os")
+const {
+  ConfigFileLoader,
+  generateSampleConfigFile
+} = require("../../package/configExporter")
+
+describe("ConfigFileLoader", () => {
+  const testDir = resolve(__dirname, "../tmp/config-file-test")
+  let configPath
+
+  beforeEach(() => {
+    // Create test directory
+    if (!existsSync(testDir)) {
+      mkdirSync(testDir, { recursive: true })
+    }
+    configPath = join(testDir, ".bundler-config.yml")
+  })
+
+  afterEach(() => {
+    // Clean up test directory
+    if (existsSync(testDir)) {
+      rmSync(testDir, { recursive: true, force: true })
+    }
+  })
+
+  describe("validateConfigPath", () => {
+    it("should reject path traversal attempts with ..", () => {
+      // Use a path that's definitely outside the project
+      const maliciousPath = "/etc/passwd"
+      expect(() => {
+        // eslint-disable-next-line no-new
+        new ConfigFileLoader(maliciousPath)
+      }).toThrow(/Config file must be within project directory/)
+    })
+
+    it("should reject symlink traversal to files outside project", async () => {
+      const outsideFile = join(tmpdir(), `test-outside-${Date.now()}.yml`)
+      const symlinkPath = join(testDir, "symlink-config.yml")
+
+      const cleanup = () => {
+        try {
+          rmSync(symlinkPath, { force: true })
+          // eslint-disable-next-line no-empty
+        } catch {}
+        try {
+          rmSync(outsideFile, { force: true })
+          // eslint-disable-next-line no-empty
+        } catch {}
+      }
+
+      try {
+        // Create a real file outside the project (in system temp dir)
+        writeFileSync(
+          outsideFile,
+          "builds:\n  test:\n    outputs:\n      - client\n"
+        )
+
+        // Attempt to create symlink
+        try {
+          symlinkSync(outsideFile, symlinkPath)
+        } catch (error) {
+          // Skip test if symlinks aren't supported or require elevated permissions
+          const skipCodes = ["EPERM", "ENOSYS", "EACCES"]
+          cleanup()
+          // eslint-disable-next-line jest/no-conditional-expect
+          expect(skipCodes).toContain(error.code)
+          return
+        }
+
+        // Verify that loading via symlink is rejected
+        expect(() => {
+          // eslint-disable-next-line no-new
+          new ConfigFileLoader(symlinkPath)
+        }).toThrow(/Config file must be within project directory/)
+
+        cleanup()
+      } catch (error) {
+        cleanup()
+        throw error
+      }
+    })
+
+    it("should accept paths within the project directory", () => {
+      expect(() => {
+        // eslint-disable-next-line no-new
+        new ConfigFileLoader(configPath)
+      }).not.toThrow()
+    })
+  })
+
+  describe("exists", () => {
+    it("should return false when config file does not exist", () => {
+      const loader = new ConfigFileLoader(configPath)
+      expect(loader.exists()).toBe(false)
+    })
+
+    it("should return true when config file exists", () => {
+      writeFileSync(configPath, "default_bundler: webpack\nbuilds: {}")
+      const loader = new ConfigFileLoader(configPath)
+      expect(loader.exists()).toBe(true)
+    })
+  })
+
+  describe("load", () => {
+    it("should load valid YAML config", () => {
+      writeFileSync(
+        configPath,
+        `
+default_bundler: rspack
+builds:
+  dev:
+    description: Development build
+    environment:
+      NODE_ENV: development
+    outputs:
+      - client
+      - server
+`
+      )
+      const loader = new ConfigFileLoader(configPath)
+      const loaded = loader.load()
+      expect(loaded.default_bundler).toBe("rspack")
+      expect(loaded.builds.dev).toBeDefined()
+      expect(loaded.builds.dev.description).toBe("Development build")
+    })
+
+    it("should throw error for malformed YAML", () => {
+      writeFileSync(configPath, "invalid: yaml: content:\n  - broken")
+      const loader = new ConfigFileLoader(configPath)
+      expect(() => loader.load()).toThrow(Error)
+    })
+
+    it("should throw error if builds key is missing", () => {
+      writeFileSync(configPath, "default_bundler: webpack")
+      const loader = new ConfigFileLoader(configPath)
+      expect(() => loader.load()).toThrow(/must contain a 'builds'/)
+    })
+
+    it("should throw error if builds is not an object", () => {
+      writeFileSync(configPath, "builds: []")
+      const loader = new ConfigFileLoader(configPath)
+      expect(() => loader.load()).toThrow(/must contain at least one build/)
+    })
+  })
+
+  describe("resolveBuild", () => {
+    beforeEach(() => {
+      writeFileSync(
+        configPath,
+        `
+default_bundler: rspack
+builds:
+  dev:
+    description: Development build
+    environment:
+      NODE_ENV: development
+      RAILS_ENV: development
+    outputs:
+      - client
+      - server
+  prod:
+    description: Production build
+    bundler: webpack
+    environment:
+      NODE_ENV: production
+    outputs:
+      - client
+`
+      )
+    })
+
+    it("should throw error for non-existent build", () => {
+      const loader = new ConfigFileLoader(configPath)
+      expect(() => {
+        loader.resolveBuild("nonexistent", {}, "webpack")
+      }).toThrow(/Build 'nonexistent' not found/)
+    })
+
+    it("should resolve build with environment variables", () => {
+      const loader = new ConfigFileLoader(configPath)
+      const resolved = loader.resolveBuild("dev", {}, "webpack")
+      expect(resolved.name).toBe("dev")
+      expect(resolved.environment.NODE_ENV).toBe("development")
+      expect(resolved.environment.RAILS_ENV).toBe("development")
+      expect(resolved.outputs).toStrictEqual(["client", "server"])
+    })
+
+    it("should use build-specific bundler over default", () => {
+      const loader = new ConfigFileLoader(configPath)
+      const resolved = loader.resolveBuild("prod", {}, "rspack")
+      expect(resolved.bundler).toBe("webpack")
+    })
+
+    it("should use CLI bundler option over everything", () => {
+      const loader = new ConfigFileLoader(configPath)
+      const resolved = loader.resolveBuild(
+        "prod",
+        { bundler: "rspack" },
+        "webpack"
+      )
+      expect(resolved.bundler).toBe("rspack")
+    })
+  })
+
+  describe("edge case validation", () => {
+    it("should throw error for empty outputs array", () => {
+      writeFileSync(
+        configPath,
+        `
+builds:
+  bad:
+    environment:
+      NODE_ENV: development
+    outputs: []
+`
+      )
+      const loader = new ConfigFileLoader(configPath)
+      expect(() => {
+        loader.resolveBuild("bad", {}, "webpack")
+      }).toThrow(/empty outputs array/)
+    })
+
+    it("should throw error for duplicate outputs", () => {
+      writeFileSync(
+        configPath,
+        `
+builds:
+  bad:
+    environment:
+      NODE_ENV: development
+    outputs:
+      - client
+      - client
+      - server
+`
+      )
+      const loader = new ConfigFileLoader(configPath)
+      expect(() => {
+        loader.resolveBuild("bad", {}, "webpack")
+      }).toThrow(/duplicate output types/)
+    })
+
+    it("should throw error for invalid config file path with path traversal", () => {
+      writeFileSync(
+        configPath,
+        `
+builds:
+  bad:
+    environment:
+      NODE_ENV: development
+    config: ../../../malicious.js
+    outputs:
+      - client
+`
+      )
+      const loader = new ConfigFileLoader(configPath)
+      expect(() => {
+        loader.resolveBuild("bad", {}, "webpack")
+      }).toThrow(/Invalid config file path/)
+    })
+  })
+
+  describe("environment variable expansion", () => {
+    beforeEach(() => {
+      process.env.TEST_VAR = "test-value"
+      process.env.BUNDLER_VAR = "should-not-be-used"
+    })
+
+    afterEach(() => {
+      delete process.env.TEST_VAR
+      delete process.env.BUNDLER_VAR
+    })
+
+    it("should expand ${BUNDLER} variable", () => {
+      writeFileSync(
+        configPath,
+        "builds:\n  test:\n    environment:\n      CONFIG_PATH: config/${BUNDLER}/config.js\n    outputs:\n      - client\n"
+      )
+      const loader = new ConfigFileLoader(configPath)
+      const resolved = loader.resolveBuild("test", {}, "rspack")
+      expect(resolved.environment.CONFIG_PATH).toBe("config/rspack/config.js")
+    })
+
+    it("should expand ${VAR} from environment", () => {
+      writeFileSync(
+        configPath,
+        "builds:\n  test:\n    environment:\n      CUSTOM: ${TEST_VAR}\n    outputs:\n      - client\n"
+      )
+      const loader = new ConfigFileLoader(configPath)
+      const resolved = loader.resolveBuild("test", {}, "webpack")
+      expect(resolved.environment.CUSTOM).toBe("test-value")
+    })
+
+    it("should expand ${VAR:-default} with default value", () => {
+      writeFileSync(
+        configPath,
+        "builds:\n  test:\n    environment:\n      WITH_DEFAULT: ${NONEXISTENT:-fallback-value}\n    outputs:\n      - client\n"
+      )
+      const loader = new ConfigFileLoader(configPath)
+      const resolved = loader.resolveBuild("test", {}, "webpack")
+      expect(resolved.environment.WITH_DEFAULT).toBe("fallback-value")
+    })
+
+    it("should use environment value over default in ${VAR:-default}", () => {
+      writeFileSync(
+        configPath,
+        "builds:\n  test:\n    environment:\n      WITH_DEFAULT: ${TEST_VAR:-fallback-value}\n    outputs:\n      - client\n"
+      )
+      const loader = new ConfigFileLoader(configPath)
+      const resolved = loader.resolveBuild("test", {}, "webpack")
+      expect(resolved.environment.WITH_DEFAULT).toBe("test-value")
+    })
+
+    it("should reject invalid environment variable names", () => {
+      writeFileSync(
+        configPath,
+        "builds:\n  test:\n    environment:\n      BAD: ${Invalid-Var-Name}\n    outputs:\n      - client\n"
+      )
+      const loader = new ConfigFileLoader(configPath)
+      const resolved = loader.resolveBuild("test", {}, "webpack")
+      // Should not expand invalid var names (contains hyphen)
+      expect(resolved.environment.BAD).toBe("${Invalid-Var-Name}")
+    })
+  })
+
+  describe("bundler_env conversion", () => {
+    it("should convert bundler_env to CLI arguments", () => {
+      writeFileSync(
+        configPath,
+        `
+builds:
+  test:
+    environment:
+      NODE_ENV: production
+    bundler_env:
+      target: modern
+      instrumented: true
+      disabled: false
+    outputs:
+      - client
+`
+      )
+      const loader = new ConfigFileLoader(configPath)
+      const resolved = loader.resolveBuild("test", {}, "webpack")
+
+      // YAML parses booleans as true/false, or as strings "true"/"false"
+      // The code handles both cases: true or "true" becomes a flag, false/"false" is ignored
+      // Expected format: ['--env', 'target=modern', '--env', 'instrumented']
+      expect(resolved.bundlerEnvArgs).toContain("--env")
+      expect(resolved.bundlerEnvArgs).toContain("target=modern")
+
+      // Boolean true becomes a flag (--env key), false is ignored
+      const argsString = resolved.bundlerEnvArgs.join(" ")
+      expect(argsString).toContain("--env instrumented")
+      expect(argsString).not.toContain("disabled")
+    })
+  })
+})
+
+describe("generateSampleConfigFile", () => {
+  it("should generate valid YAML string", () => {
+    const content = generateSampleConfigFile()
+    expect(content).toContain("default_bundler:")
+    expect(content).toContain("builds:")
+    expect(content).toContain("dev-hmr:")
+    expect(content).toContain("dev:")
+    expect(content).toContain("prod:")
+  })
+
+  it("should include documentation comments", () => {
+    const content = generateSampleConfigFile()
+    expect(content).toContain("# Bundler Build Configurations")
+    expect(content).toContain("HMR")
+    expect(content).toContain("production")
+  })
+
+  it("should escape template literal variables correctly", () => {
+    const content = generateSampleConfigFile()
+    // Should have ${BUNDLER} not actual 'webpack' or 'rspack'
+    expect(content).toContain("${BUNDLER}")
+    expect(content).toContain("${RAILS_ENV:-staging}")
+  })
+})