shakapacker 9.3.0.beta.7 → 9.3.1

data/package/environments/production.ts

@@ -3,19 +3,20 @@
  * @module environments/production
  */
 
-/* eslint global-require: 0 */
 /* eslint import/no-dynamic-require: 0 */
 
-const { resolve } = require("path")
-const { merge } = require("webpack-merge")
-const baseConfig = require("./base")
-const { moduleExists } = require("../utils/helpers")
-const config = require("../config")
 import type {
   Configuration as WebpackConfiguration,
   WebpackPluginInstance
 } from "webpack"
 import type { CompressionPluginConstructor } from "./types"
+import type { Config } from "../types"
+
+const { resolve } = require("path")
+const { merge } = require("webpack-merge")
+const baseConfig = require("./base")
+const { moduleExists } = require("../utils/helpers")
+const config = require("../config") as Config
 
 const optimizationPath = resolve(
   __dirname,
@@ -27,7 +28,6 @@ const { getOptimization } = require(optimizationPath)
 
 let CompressionPlugin: CompressionPluginConstructor | null = null
 if (moduleExists("compression-webpack-plugin")) {
-  // eslint-disable-next-line global-require
   CompressionPlugin = require("compression-webpack-plugin")
 }
 
@@ -73,7 +73,6 @@ const productionConfig: Partial<WebpackConfiguration> = {
 }
 
 if (config.useContentHash === false) {
-  // eslint-disable-next-line no-console
   console.warn(`⚠️ WARNING
 Setting 'useContentHash' to 'false' in the production environment (specified by NODE_ENV environment variable) is not allowed!
 Content hashes get added to the filenames regardless of setting useContentHash in 'shakapacker.yml' to false.

data/package/environments/test.ts

@@ -3,10 +3,12 @@
  * @module environments/test
  */
 
+import type { Configuration as WebpackConfiguration } from "webpack"
+import type { Config } from "../types"
+
 const { merge } = require("webpack-merge")
-const config = require("../config")
+const config = require("../config") as Config
 const baseConfig = require("./base")
-import type { Configuration as WebpackConfiguration } from "webpack"
 
 interface TestConfig {
   mode: "development" | "production" | "none"

data/package/esbuild/index.ts

@@ -1,4 +1,3 @@
-/* eslint global-require: 0 */
 /* eslint import/no-dynamic-require: 0 */
 
 import { resolve } from "path"
@@ -21,7 +20,6 @@ const getLoaderExtension = (filename: string): string => {
 const getCustomConfig = (): Partial<RuleSetRule> => {
   const path = resolve("config", "esbuild.config.js")
   if (existsSync(path)) {
-    // eslint-disable-next-line @typescript-eslint/no-require-imports
     return require(path)
   }
   return {}

data/package/index.d.ts

@@ -7,6 +7,7 @@
  * When adding/modifying exports in index.ts, update this file accordingly.
  */
 
+// @ts-expect-error: webpack is an optional peer dependency (using type-only import)
 import type { Configuration, RuleSetRule } from "webpack"
 import type { Config, DevServerConfig, Env } from "./types"
 

data/package/index.d.ts.template

@@ -7,6 +7,7 @@
  * When adding/modifying exports in index.ts, update this file accordingly.
  */
 
+// @ts-expect-error: webpack is an optional peer dependency (using type-only import)
 import type { Configuration, RuleSetRule } from "webpack"
 import type { Config, DevServerConfig, Env } from "./types"
 

data/package/index.ts

@@ -1,11 +1,9 @@
-/* eslint global-require: 0 */
 /* eslint import/no-dynamic-require: 0 */
 
 import * as webpackMerge from "webpack-merge"
 import { resolve } from "path"
 import { existsSync } from "fs"
-// @ts-ignore: webpack is an optional peer dependency (using type-only import)
-import type { Configuration } from "webpack"
+import type { Configuration, RuleSetRule } from "webpack"
 import config from "./config"
 import baseConfig from "./environments/base"
 import devServer from "./dev_server"
@@ -14,8 +12,16 @@ import { moduleExists, canProcess } from "./utils/helpers"
 import inliningCss from "./utils/inliningCss"
 
 const rulesPath = resolve(__dirname, "rules", `${config.assets_bundler}.js`)
-const rules = require(rulesPath)
+/** Array of webpack/rspack loader rules */
+const rules = require(rulesPath) as RuleSetRule[]
 
+/**
+ * Generate webpack configuration with optional custom config.
+ *
+ * @param extraConfig - Optional webpack configuration to merge with base config
+ * @returns Final webpack configuration
+ * @throws {Error} If more than one argument is provided
+ */
 const generateWebpackConfig = (
   extraConfig: Configuration = {},
   ...extraArgs: unknown[]
@@ -41,15 +47,32 @@ const generateWebpackConfig = (
   return webpackMerge.merge({}, environmentConfig, extraConfig)
 }
 
+/**
+ * The Shakapacker module exports.
+ * This object is exported via CommonJS `export =`.
+ *
+ * NOTE: This pattern is temporary and will be replaced with named exports
+ * once issue #641 is resolved.
+ */
 export = {
-  config, // shakapacker.yml
+  /** Shakapacker configuration from shakapacker.yml */
+  config,
+  /** Development server configuration */
   devServer,
+  /** Generate webpack configuration with optional custom config */
   generateWebpackConfig,
+  /** Base webpack/rspack configuration */
   baseConfig,
+  /** Environment configuration (railsEnv, nodeEnv, etc.) */
   env,
+  /** Array of webpack/rspack loader rules */
   rules,
+  /** Check if a module exists in node_modules */
   moduleExists,
+  /** Process a file if a specific loader is available */
   canProcess,
+  /** Whether CSS should be inlined (dev server with HMR) */
   inliningCss,
+  /** webpack-merge functions (merge, mergeWithCustomize, mergeWithRules, unique) */
   ...webpackMerge
 }

data/package/loaders.d.ts

@@ -1,8 +1,8 @@
-// @ts-ignore: webpack is an optional peer dependency (using type-only import)
+// @ts-expect-error: webpack is an optional peer dependency (using type-only import)
 import type { LoaderDefinitionFunction } from "webpack"
 
 export interface ShakapackerLoaderOptions {
-  [key: string]: any
+  [key: string]: unknown
 }
 
 export interface ShakapackerLoader {

data/package/optimization/webpack.ts

@@ -19,38 +19,36 @@ interface OptimizationConfig {
   minimizer: unknown[]
 }
 
-const getOptimization = (): OptimizationConfig => {
-  return {
-    minimizer: [
-      tryCssMinimizer(),
-      new TerserPlugin({
-        // SHAKAPACKER_PARALLEL env var: number of parallel workers, or true for auto (os.cpus().length - 1)
-        // If not set or invalid, defaults to true (automatic parallelization)
-        parallel: process.env.SHAKAPACKER_PARALLEL
-          ? Number.parseInt(process.env.SHAKAPACKER_PARALLEL, 10) || true
-          : true,
-        terserOptions: {
-          parse: {
-            // Let terser parse ecma 8 code but always output
-            // ES5 compliant code for older browsers
-            ecma: 8
-          },
-          compress: {
-            ecma: 5,
-            warnings: false,
-            comparisons: false
-          },
-          mangle: { safari10: true },
-          output: {
-            ecma: 5,
-            comments: false,
-            ascii_only: true
-          }
+const getOptimization = (): OptimizationConfig => ({
+  minimizer: [
+    tryCssMinimizer(),
+    new TerserPlugin({
+      // SHAKAPACKER_PARALLEL env var: number of parallel workers, or true for auto (os.cpus().length - 1)
+      // If not set or invalid, defaults to true (automatic parallelization)
+      parallel: process.env.SHAKAPACKER_PARALLEL
+        ? Number.parseInt(process.env.SHAKAPACKER_PARALLEL, 10) || true
+        : true,
+      terserOptions: {
+        parse: {
+          // Let terser parse ecma 8 code but always output
+          // ES5 compliant code for older browsers
+          ecma: 8
+        },
+        compress: {
+          ecma: 5,
+          warnings: false,
+          comparisons: false
+        },
+        mangle: { safari10: true },
+        output: {
+          ecma: 5,
+          comments: false,
+          ascii_only: true
         }
-      })
-    ].filter(Boolean)
-  }
-}
+      }
+    })
+  ].filter(Boolean)
+})
 
 export = {
   getOptimization

data/package/plugins/rspack.ts

@@ -1,8 +1,10 @@
+import type { Config } from "../types"
+
 const { requireOrError } = require("../utils/requireOrError")
 
 const { RspackManifestPlugin } = requireOrError("rspack-manifest-plugin")
 const rspack = requireOrError("@rspack/core")
-const config = require("../config")
+const config = require("../config") as Config
 const { isProduction } = require("../env")
 const { moduleExists } = require("../utils/helpers")
 

data/package/plugins/webpack.ts

@@ -1,9 +1,11 @@
+import type { Config } from "../types"
+
 const { requireOrError } = require("../utils/requireOrError")
 // TODO: Change to `const { WebpackAssetsManifest }` when dropping 'webpack-assets-manifest < 6.0.0' (Node >=20.10.0) support
 const WebpackAssetsManifest = requireOrError("webpack-assets-manifest")
 const webpack = requireOrError("webpack")
-const config = require("../config")
-const { isProduction, isDevelopment } = require("../env")
+const config = require("../config") as Config
+const { isProduction } = require("../env")
 const { moduleExists } = require("../utils/helpers")
 
 const getPlugins = (): unknown[] => {
@@ -15,7 +17,7 @@ const getPlugins = (): unknown[] => {
   const plugins = [
     new webpack.EnvironmentPlugin(process.env),
     new WebpackAssetsManifestConstructor({
-      merge: isDevelopment,
+      merge: true,
       entrypoints: true,
       writeToDisk: true,
       output: config.manifestPath,

data/package/rspack/index.ts

@@ -1,14 +1,15 @@
-/* eslint global-require: 0 */
 /* eslint import/no-dynamic-require: 0 */
 
 // Mixed require/import syntax:
 // - Using require() for compiled JS modules that may not have proper ES module exports
 // - Using import for type-only imports and Node.js built-in modules
-const webpackMerge = require("webpack-merge")
 import { resolve } from "path"
 import { existsSync } from "fs"
 import type { RspackConfigWithDevServer } from "../environments/types"
-const config = require("../config")
+import type { Config } from "../types"
+
+const webpackMerge = require("webpack-merge")
+const config = require("../config") as Config
 const baseConfig = require("../environments/base")
 const devServer = require("../dev_server")
 const env = require("../env")
@@ -35,7 +36,7 @@ const generateRspackConfig = (
 
   const { nodeEnv } = env
   const path = resolve(__dirname, "../environments", `${nodeEnv}.js`)
-  // eslint-disable-next-line @typescript-eslint/no-require-imports
+
   const environmentConfig = existsSync(path) ? require(path) : baseConfig
 
   // Create base rspack config

data/package/rules/file.ts

@@ -1,4 +1,5 @@
-import { dirname, sep, normalize } from "path"
+import { dirname, normalize } from "path"
+
 const {
   additional_paths: additionalPaths,
   source_path: sourcePath

data/package/rules/jscommon.ts

@@ -1,5 +1,6 @@
 import { resolve } from "path"
 import { realpathSync } from "fs"
+
 const {
   source_path: sourcePath,
   additional_paths: additionalPaths

data/package/rules/raw.ts

@@ -1,4 +1,6 @@
-const config = require("../config")
+import type { Config } from "../types"
+
+const config = require("../config") as Config
 
 const rspackRawConfig = () => ({
   resourceQuery: /raw/,

data/package/rules/rspack.ts

@@ -1,5 +1,3 @@
-/* eslint global-require: 0 */
-
 const { moduleExists } = require("../utils/helpers")
 const { debug, info, warn } = require("../utils/debug")
 

data/package/rules/sass.ts

@@ -1,5 +1,3 @@
-/* eslint global-require: 0 */
-
 const { getStyleRule } = require("../utils/getStyleRule")
 const { canProcess, packageMajorVersion } = require("../utils/helpers")
 const { additional_paths: extraPaths } = require("../config")

data/package/rules/webpack.ts

@@ -1,4 +1,3 @@
-/* eslint global-require: 0 */
 /* eslint import/no-dynamic-require: 0 */
 
 export = [

data/package/swc/index.ts

@@ -1,4 +1,3 @@
-/* eslint global-require: 0 */
 /* eslint import/no-dynamic-require: 0 */
 
 import { resolve } from "path"
@@ -18,7 +17,6 @@ const isTypescriptFile = (filename: string): boolean =>
 const getCustomConfig = (): Partial<RuleSetRule> => {
   const path = resolve("config", "swc.config.js")
   if (existsSync(path)) {
-    // eslint-disable-next-line @typescript-eslint/no-require-imports
     return require(path)
   }
   return {}

data/package/types.ts

@@ -15,6 +15,7 @@ export interface Config {
   source_entry_path: string
   nested_entries: boolean
   css_extract_ignore_order_warnings: boolean
+  css_modules_export_mode?: "named" | "default"
   public_root_path: string
   public_output_path: string
   private_output_path?: string
@@ -53,8 +54,6 @@ export interface Env {
 type Header =
   | Array<{ key: string; value: string }>
   | Record<string, string | string[]>
-type ServerType = "http" | "https" | "spdy"
-type WebSocketType = "sockjs" | "ws"
 
 /**
  * This has the same keys and behavior as https://webpack.js.org/configuration/dev-server/ except:
@@ -63,7 +62,7 @@ type WebSocketType = "sockjs" | "ws"
  * @see {import('webpack-dev-server').Configuration}
  */
 export interface DevServerConfig {
-  allowed_hosts?: "all" | "auto" | string | string[]
+  allowed_hosts?: string | string[]
   bonjour?: boolean | Record<string, unknown> // bonjour.BonjourOptions
   client?: Record<string, unknown> // Client
   compress?: boolean
@@ -71,7 +70,7 @@ export interface DevServerConfig {
   headers?: Header | (() => Header)
   history_api_fallback?: boolean | Record<string, unknown> // HistoryApiFallbackOptions
   hmr?: "only" | boolean
-  host?: "local-ip" | "local-ipv4" | "local-ipv6" | string
+  host?: string
   http2?: boolean
   https?: boolean | https.ServerOptions
   ipc?: boolean | string
@@ -85,23 +84,21 @@ export interface DevServerConfig {
     | string[]
     | Record<string, unknown>
     | Record<string, unknown>[]
-  port?: "auto" | string | number
+  port?: string | number
   proxy?: unknown // ProxyConfigMap | ProxyConfigArray
   setup_exit_signals?: boolean
-  static?: boolean | string | unknown // Static | Array<string | Static>
-  watch_files?: string | string[] | unknown // WatchFiles | Array<WatchFiles | string>
+  static?: unknown // Static | Array<string | Static>
+  watch_files?: unknown // WatchFiles | Array<WatchFiles | string>
   web_socket_server?:
     | string
     | boolean
-    | WebSocketType
     | {
-        type?: string | boolean | WebSocketType
+        type?: string | boolean
         options?: Record<string, unknown>
       }
   server?:
     | string
     | boolean
-    | ServerType
-    | { type?: string | boolean | ServerType; options?: https.ServerOptions }
+    | { type?: string | boolean; options?: https.ServerOptions }
   [otherWebpackDevServerConfigKey: string]: unknown
 }

data/package/utils/debug.ts

@@ -18,24 +18,20 @@ const isDebugMode = (): boolean => {
 
 const debug = (message: string, ...args: unknown[]): void => {
   if (isDebugMode()) {
-    // eslint-disable-next-line no-console
     console.log(`[Shakapacker] ${message}`, ...args)
   }
 }
 
 const warn = (message: string, ...args: unknown[]): void => {
-  // eslint-disable-next-line no-console
   console.warn(`[Shakapacker] WARNING: ${message}`, ...args)
 }
 
 const error = (message: string, ...args: unknown[]): void => {
-  // eslint-disable-next-line no-console
   console.error(`[Shakapacker] ERROR: ${message}`, ...args)
 }
 
 const info = (message: string, ...args: unknown[]): void => {
   if (isDebugMode()) {
-    // eslint-disable-next-line no-console
     console.info(`[Shakapacker] INFO: ${message}`, ...args)
   }
 }

data/package/utils/getStyleRule.ts

@@ -1,18 +1,19 @@
-/* eslint global-require: 0 */
+import type { Config } from "../types"
+
 const { canProcess, moduleExists } = require("./helpers")
 const { requireOrError } = require("./requireOrError")
-const config = require("../config")
+const config = require("../config") as Config
 const inliningCss = require("./inliningCss")
 
 interface StyleRule {
   test: RegExp
-  use: any[]
+  use: unknown[]
   type?: string
 }
 
 const getStyleRule = (
   test: RegExp,
-  preprocessors: any[] = []
+  preprocessors: unknown[] = []
 ): StyleRule | null => {
   if (moduleExists("css-loader")) {
     const tryPostcss = () =>
@@ -28,6 +29,11 @@ const getStyleRule = (
         ? requireOrError("@rspack/core").CssExtractRspackPlugin.loader
         : requireOrError("mini-css-extract-plugin").loader
 
+    // Determine CSS Modules export mode based on configuration
+    // 'named' (default): Use named exports with camelCaseOnly (v9 behavior)
+    // 'default': Use default exports with camelCase (v8 behavior)
+    const useNamedExports = config.css_modules_export_mode !== "default"
+
     const use = [
       inliningCss ? "style-loader" : extractionPlugin,
       {
@@ -37,11 +43,13 @@ const getStyleRule = (
           importLoaders: 2,
           modules: {
             auto: true,
-            // v9 defaults: Use named exports with camelCase conversion
-            // Note: css-loader requires 'camelCaseOnly' or 'dashesOnly' when namedExport is true
-            // Using 'camelCase' with namedExport: true causes a build error
-            namedExport: true,
-            exportLocalsConvention: "camelCaseOnly"
+            // Use named exports for v9 (default), or default exports for v8 compatibility
+            namedExport: useNamedExports,
+            // 'camelCaseOnly' with namedExport: true (v9 default)
+            // 'camelCase' with namedExport: false (v8 behavior - exports both original and camelCase)
+            exportLocalsConvention: useNamedExports
+              ? "camelCaseOnly"
+              : "camelCase"
           }
         }
       },

data/package/utils/helpers.ts

@@ -38,6 +38,11 @@ const loaderMatches = <T = unknown>(
   loaderToCheck: string,
   fn: () => T
 ): T | null => {
+  // If transpiler is set to 'none', skip all transpiler rules (for custom webpack configs)
+  if (configLoader === "none") {
+    return null
+  }
+
   if (configLoader !== loaderToCheck) {
     return null
   }
@@ -59,15 +64,14 @@ const loaderMatches = <T = unknown>(
 
 const packageFullVersion = (packageName: string): string => {
   try {
-    // eslint-disable-next-line import/no-dynamic-require
     const packageJsonPath = require.resolve(`${packageName}/package.json`)
-    // eslint-disable-next-line import/no-dynamic-require, global-require
+    // eslint-disable-next-line import/no-dynamic-require
     const packageJson = require(packageJsonPath) as { version: string }
     return packageJson.version
-  } catch (error: any) {
+  } catch (error: unknown) {
     // Re-throw the error with proper code to maintain compatibility with babel preset
     // The preset expects MODULE_NOT_FOUND errors to handle missing core-js gracefully
-    if (error.code === "MODULE_NOT_FOUND") {
+    if ((error as NodeJS.ErrnoException).code === "MODULE_NOT_FOUND") {
       throw error
     }
     // For other errors, warn and re-throw

data/package/utils/pathValidation.ts

@@ -28,26 +28,87 @@ export function isPathTraversalSafe(inputPath: string): boolean {
 /**
  * Resolves and validates a path within a base directory
  * Prevents directory traversal attacks by ensuring the resolved path
- * stays within the base directory
+ * stays within the base directory.
+ * Also resolves symlinks to prevent symlink-based path traversal attacks.
+ *
+ * @param basePath - The base directory to validate against
+ * @param userPath - The user-provided path to validate
+ * @param resolveSymlinks - Whether to resolve symlinks (default: true for security)
+ * @returns The validated absolute path
+ * @throws Error if path is outside base directory
  */
-export function safeResolvePath(basePath: string, userPath: string): string {
-  // Normalize the base path
-  const normalizedBase = path.resolve(basePath)
+export function safeResolvePath(
+  basePath: string,
+  userPath: string,
+  resolveSymlinks = true
+): string {
+  // Resolve the base path through symlinks if enabled
+  let normalizedBase: string
+  try {
+    normalizedBase = resolveSymlinks
+      ? fs.realpathSync(basePath)
+      : path.resolve(basePath)
+  } catch (error: unknown) {
+    // If basePath doesn't exist (ENOENT), fall back to path.resolve
+    // Rethrow other errors (e.g., permission issues) as they indicate real problems
+    const nodeError = error as NodeJS.ErrnoException
+    if (nodeError?.code === "ENOENT") {
+      normalizedBase = path.resolve(basePath)
+    } else {
+      throw error
+    }
+  }
+
+  // For paths that may not exist yet, validate the parent directory
+  const absolutePath = path.resolve(basePath, userPath)
+  const parentDir = path.dirname(absolutePath)
+  const fileName = path.basename(absolutePath)
+
+  // Resolve parent directory through symlinks if it exists and symlink resolution is enabled
+  let resolvedParent: string
+  try {
+    resolvedParent = resolveSymlinks
+      ? fs.realpathSync(parentDir)
+      : path.resolve(parentDir)
+  } catch (error: unknown) {
+    // If parent doesn't exist (ENOENT), validate the absolute path as-is
+    // Rethrow other errors (e.g., permission issues) as they indicate real problems
+    const nodeError = error as NodeJS.ErrnoException
+    if (nodeError?.code === "ENOENT") {
+      if (
+        !absolutePath.startsWith(normalizedBase + path.sep) &&
+        absolutePath !== normalizedBase
+      ) {
+        throw new Error(
+          `[SHAKAPACKER SECURITY] Path traversal attempt detected.\n` +
+            `Requested path would resolve outside of allowed directory.\n` +
+            `Base: ${normalizedBase}\n` +
+            `Attempted: ${userPath}\n` +
+            `Resolved to: ${absolutePath}`
+        )
+      }
+      return absolutePath
+    }
+    throw error
+  }
 
-  // Resolve the user path relative to base
-  const resolved = path.resolve(normalizedBase, userPath)
+  // Reconstruct the full path with the resolved (symlink-free) parent
+  const resolved = path.resolve(resolvedParent, fileName)
 
   // Ensure the resolved path is within the base directory
   if (
     !resolved.startsWith(normalizedBase + path.sep) &&
     resolved !== normalizedBase
   ) {
+    const symlinkNote = resolveSymlinks
+      ? ` (symlink-resolved from ${userPath})`
+      : ""
     throw new Error(
       `[SHAKAPACKER SECURITY] Path traversal attempt detected.\n` +
         `Requested path would resolve outside of allowed directory.\n` +
         `Base: ${normalizedBase}\n` +
         `Attempted: ${userPath}\n` +
-        `Resolved to: ${resolved}`
+        `Resolved to: ${resolved}${symlinkNote}`
     )
   }
 
@@ -77,17 +138,16 @@ export function validatePaths(paths: string[], basePath: string): string[] {
       console.warn(
         `[SHAKAPACKER WARNING] Skipping potentially unsafe path: ${userPath}`
       )
-      continue
-    }
-
-    try {
-      const safePath = safeResolvePath(basePath, userPath)
-      validatedPaths.push(safePath)
-    } catch (error) {
-      console.warn(
-        `[SHAKAPACKER WARNING] Invalid path configuration: ${userPath}\n` +
-          `Error: ${error instanceof Error ? error.message : String(error)}`
-      )
+    } else {
+      try {
+        const safePath = safeResolvePath(basePath, userPath)
+        validatedPaths.push(safePath)
+      } catch (error) {
+        console.warn(
+          `[SHAKAPACKER WARNING] Invalid path configuration: ${userPath}\n` +
+            `Error: ${error instanceof Error ? error.message : String(error)}`
+        )
+      }
     }
   }