react-on-rails-rsc 19.3.0 → 19.3.1-rc.0

package/CHANGELOG.md

@@ -2,6 +2,16 @@
 
 All notable changes to this package will be documented in this file.
 
+## [19.3.1-rc.0] - 2026-09-19
+
+### Breaking Changes
+- Opened the React 19.3 Flight line by depending on stock `react-server-dom-webpack@~19.3.0` and raising the `react` and `react-dom` peer floors to `^19.3.0`. Published `19.3.0` remains the React 19.2.8 line; apps still on React 19.2.8 must pin exact `react-on-rails-rsc@19.3.0` instead of taking this patch. ([#235])
+
+  **Migration Guide:**
+
+  1. Upgrade application `react`, `react-dom`, and `react-server-dom-webpack` together to 19.3.0 so the nested Flight runtime matches React and a second Flight copy is not installed.
+  2. Keep exact `react-on-rails-rsc@19.3.0` while the app remains on React 19.2.8. Do not treat `19.3.1-rc.0` as a drop-in patch for that line. This candidate publishes to npm `next` only; `latest` stays on `19.3.0` until the downstream gate accepts the final.
+
 ## [19.3.0] - 2026-09-16
 
 ### Breaking Changes
@@ -85,12 +95,14 @@ All notable changes to this package will be documented in this file.
 ### Security
 - Updated the vendored `react-server-dom-webpack` runtime from React 19.0.3 to the React 19.0.7 security level, applying the React 19.0.4 fixes for CVE-2025-55183, CVE-2025-55184, and CVE-2025-67779 plus the React 19.0.7 reply-decoding denial-of-service fixes for CVE-2026-23869 (GHSA-479c-33wc-g2pg) and CVE-2026-23870 (GHSA-rv78-f8rc-xrxh). Note: the upstream CVE-2026-23869 fix changes the reply wire format for nested `FormData`, so client and server must both run the patched runtime shipped by this package. ([#48]) ([#86])
 
+[19.3.1-rc.0]: https://github.com/shakacode/react_on_rails_rsc/compare/19.3.0...19.3.1-rc.0
 [19.3.0]: https://github.com/shakacode/react_on_rails_rsc/compare/19.2.1...19.3.0
 [19.2.1]: https://github.com/shakacode/react_on_rails_rsc/compare/19.2.0...19.2.1
 [19.2.0]: https://github.com/shakacode/react_on_rails_rsc/compare/19.0.5...19.2.0
 [19.0.5]: https://github.com/shakacode/react_on_rails_rsc/compare/19.0.4...19.0.5
 
 [#203]: https://github.com/shakacode/react_on_rails_rsc/pull/203
+[#235]: https://github.com/shakacode/react_on_rails_rsc/pull/235
 [#207]: https://github.com/shakacode/react_on_rails_rsc/pull/207
 [#120]: https://github.com/shakacode/react_on_rails_rsc/pull/120
 [#140]: https://github.com/shakacode/react_on_rails_rsc/pull/140

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "react-on-rails-rsc",
-  "version": "19.3.0",
+  "version": "19.3.1-rc.0",
   "description": "React Server Components support for react_on_rails Ruby gem",
   "exports": {
     "./client": {
@@ -116,14 +116,14 @@
     "@rspack/core": "^2.1.2",
     "@tsconfig/node14": "^14.1.2",
     "@types/jest": "^30.0.0",
-    "@types/react": "^19.2.2",
-    "@types/react-dom": "^19.2.2",
+    "@types/react": "^19.3.0",
+    "@types/react-dom": "^19.3.0",
     "css-loader": "^7.1.4",
     "jest": "^30.4.2",
     "mini-css-extract-plugin": "^2.10.2",
     "publint": "0.3.24",
-    "react": "^19.2.8",
-    "react-dom": "^19.2.8",
+    "react": "^19.3.0",
+    "react-dom": "^19.3.0",
     "release-it": "21.0.2",
     "ts-jest": "^29.4.5",
     "typescript": "^5.4.3",
@@ -131,8 +131,8 @@
   },
   "peerDependencies": {
     "@rspack/core": "^1.0.0 || ^2.0.0",
-    "react": "^19.2.8",
-    "react-dom": "^19.2.8",
+    "react": "^19.3.0",
+    "react-dom": "^19.3.0",
     "webpack": "^5.59.0"
   },
   "peerDependenciesMeta": {
@@ -144,7 +144,7 @@
     "@babel/parser": "^7.28.5",
     "acorn-loose": "^8.3.0",
     "neo-async": "^2.6.1",
-    "react-server-dom-webpack": "~19.2.8",
+    "react-server-dom-webpack": "~19.3.0",
     "webpack-sources": "^3.2.0"
   },
   "repository": {