|
| 1 | +# React on Rails 16.1.x Release Notes |
| 2 | + |
| 3 | +## Upgrading from 16.0.x to 16.1.x |
| 4 | + |
| 5 | +Update your gem and npm package versions: |
| 6 | + |
| 7 | +```ruby |
| 8 | +# Gemfile |
| 9 | +gem "react_on_rails", "16.1.1" |
| 10 | +gem "shakapacker", "8.2.0" |
| 11 | +``` |
| 12 | + |
| 13 | +```json |
| 14 | +// package.json |
| 15 | +{ |
| 16 | + "dependencies": { |
| 17 | + "react-on-rails": "16.1.1", |
| 18 | + "shakapacker": "8.2.0" |
| 19 | + } |
| 20 | +} |
| 21 | +``` |
| 22 | + |
| 23 | +Then run `bundle install` and your package manager's install command. |
| 24 | + |
| 25 | +**Important:** The shakapacker gem and npm package versions must match exactly. |
| 26 | + |
| 27 | +## Version Compatibility |
| 28 | + |
| 29 | +| Component | Minimum | Recommended | |
| 30 | +| ----------- | ------- | ----------- | |
| 31 | +| Ruby | 3.0 | 3.3+ | |
| 32 | +| Node.js | 18 | 22+ | |
| 33 | +| Shakapacker | 6.0 | 8.2.0+ | |
| 34 | +| React | 18 | 18+ | |
| 35 | +| Rails | 5.2 | 7.0+ | |
| 36 | + |
| 37 | +**Note:** CI tests against Ruby 3.2+ and Node.js 20+, but the gem supports lower versions as shown above. |
| 38 | + |
| 39 | +## New Features in v16.1.0 |
| 40 | + |
| 41 | +### Doctor Rake Task |
| 42 | + |
| 43 | +New diagnostic command for troubleshooting setup issues: |
| 44 | + |
| 45 | +```bash |
| 46 | +rake react_on_rails:doctor |
| 47 | +VERBOSE=true rake react_on_rails:doctor # For detailed output |
| 48 | +``` |
| 49 | + |
| 50 | +### Server Bundle Security |
| 51 | + |
| 52 | +New configuration options for enhanced server bundle security: |
| 53 | + |
| 54 | +```ruby |
| 55 | +# config/initializers/react_on_rails.rb |
| 56 | +ReactOnRails.configure do |config| |
| 57 | + # Directory for server bundle output (default: "ssr-generated") |
| 58 | + config.server_bundle_output_path = "ssr-generated" |
| 59 | + |
| 60 | + # When enabled, server bundles only load from private directories |
| 61 | + config.enforce_private_server_bundles = true |
| 62 | +end |
| 63 | +``` |
| 64 | + |
| 65 | +### Enhanced bin/dev Script |
| 66 | + |
| 67 | +The updated `bin/dev` script provides better development server management with support for multiple modes: |
| 68 | + |
| 69 | +- `bin/dev` - Default HMR mode with webpack-dev-server |
| 70 | +- `bin/dev static` - Watch mode without HMR |
| 71 | +- `bin/dev prod` - Development with production-optimized assets |
| 72 | + |
| 73 | +### Multiple Procfile Support |
| 74 | + |
| 75 | +Three Procfile configurations for different development scenarios: |
| 76 | + |
| 77 | +1. **Procfile.dev** (HMR mode) - Rails server + webpack dev server for client + webpack watch for server bundle |
| 78 | +2. **Procfile.dev-static-assets** (Static watch mode) - Rails server + webpack watch mode |
| 79 | +3. **Procfile.dev-prod-assets** (Production assets in development) - Rails server with production-optimized assets |
| 80 | + |
| 81 | +### Webpack Configuration Updates |
| 82 | + |
| 83 | +- New `generateWebpackConfigs.js` helper for better configuration management |
| 84 | +- Improved babel.config.js setup |
| 85 | + |
| 86 | +### Generator Improvements |
| 87 | + |
| 88 | +**Note:** These improvements only affect newly generated code from `rails g react_on_rails:install` or component generators. Existing applications are unaffected. |
| 89 | + |
| 90 | +- Modern TypeScript patterns with better type inference |
| 91 | +- Optimized tsconfig.json with `"moduleResolution": "bundler"` |
| 92 | +- Enhanced Redux TypeScript integration |
| 93 | +- Smart `bin/dev` defaults that auto-navigate to `/hello_world` route |
| 94 | + |
| 95 | +## Security Enhancements |
| 96 | + |
| 97 | +v16.1.0 includes important security improvements: |
| 98 | + |
| 99 | +- **Command injection protection**: Fixed command injection vulnerabilities in generator package installation commands by replacing unsafe string interpolation with secure array-based system calls ([PR 1786](https://github.com/shakacode/react_on_rails/pull/1786)) by [justin808](https://github.com/justin808) |
| 100 | +- **Improved input validation**: Enhanced package manager validation and argument sanitization across all generators ([PR 1786](https://github.com/shakacode/react_on_rails/pull/1786)) by [justin808](https://github.com/justin808) |
| 101 | +- **Hardened DOM selectors**: Using `CSS.escape()` and proper JavaScript escaping for XSS protection ([PR 1791](https://github.com/shakacode/react_on_rails/pull/1791)) by [AbanoubGhadban](https://github.com/AbanoubGhadban) |
| 102 | + |
| 103 | +## Bug Fixes |
| 104 | + |
| 105 | +### v16.1.1 |
| 106 | + |
| 107 | +- Fixed RSC manifest file path resolution ([PR 1818](https://github.com/shakacode/react_on_rails/pull/1818)) by [AbanoubGhadban](https://github.com/AbanoubGhadban) |
| 108 | + |
| 109 | +### v16.1.0 |
| 110 | + |
| 111 | +- Fixed LoadError in `rake react_on_rails:doctor` when using packaged gem ([PR 1795](https://github.com/shakacode/react_on_rails/pull/1795)) by [justin808](https://github.com/justin808) |
| 112 | +- Fixed packs generator error when `server_bundle_js_file` is empty ([PR 1802](https://github.com/shakacode/react_on_rails/pull/1802)) by [justin808](https://github.com/justin808) |
| 113 | +- Fixed NoMethodError in environments without Shakapacker ([PR 1806](https://github.com/shakacode/react_on_rails/pull/1806)) by [justin808](https://github.com/justin808) |
| 114 | +- Fixed inconsistent Shakapacker version requirements ([PR 1806](https://github.com/shakacode/react_on_rails/pull/1806)) by [justin808](https://github.com/justin808) |
| 115 | + |
| 116 | +## Deprecations |
| 117 | + |
| 118 | +Remove `config.generated_assets_dirs` from your configuration - asset paths are now automatically determined from `shakapacker.yml`. |
| 119 | + |
| 120 | +## Common Upgrade Issues |
| 121 | + |
| 122 | +### Shakapacker Version Mismatch |
| 123 | + |
| 124 | +**Symptom:** Assets fail to compile or inconsistent behavior between development and production. |
| 125 | + |
| 126 | +**Solution:** Ensure your Shakapacker gem and npm package versions match exactly: |
| 127 | + |
| 128 | +```bash |
| 129 | +# Check gem version |
| 130 | +bundle show shakapacker |
| 131 | + |
| 132 | +# Check npm version |
| 133 | +npm list shakapacker |
| 134 | +# or |
| 135 | +yarn list shakapacker |
| 136 | +``` |
| 137 | + |
| 138 | +Both should show the same version (e.g., 8.2.0). |
| 139 | + |
| 140 | +### Missing Server Bundle After Upgrade |
| 141 | + |
| 142 | +**Symptom:** Server-side rendering fails with "bundle not found" errors. |
| 143 | + |
| 144 | +**Solution:** If you're using `server_bundle_output_path`, ensure the directory exists and your build process outputs to that location. Run `rake react_on_rails:doctor` to diagnose configuration issues. |
| 145 | + |
| 146 | +## Pro License Features |
| 147 | + |
| 148 | +v16.1.0 introduced foundational changes for React on Rails Pro, including: |
| 149 | + |
| 150 | +- Core/Pro separation with clear licensing boundaries |
| 151 | +- Runtime license validation with graceful fallback |
| 152 | +- Enhanced immediate hydration (Pro-only feature) |
| 153 | + |
| 154 | +These changes are internal and do not affect open-source users. For information about Pro features like streaming SSR, React Server Components, and enhanced performance optimizations, see [React on Rails Pro](https://www.shakacode.com/react-on-rails-pro/). |
| 155 | + |
| 156 | +## Related Resources |
| 157 | + |
| 158 | +- [Changelog](https://github.com/shakacode/react_on_rails/blob/master/CHANGELOG.md) |
| 159 | +- [Configuration Reference](../../api-reference/configuration.md) |
0 commit comments