Skip to content

Bump Rspack dependencies to v2 (^2.0.0-0)#3084

Open
justin808 wants to merge 2 commits intomainfrom
jg/3082-bump-rspack-v2
Open

Bump Rspack dependencies to v2 (^2.0.0-0)#3084
justin808 wants to merge 2 commits intomainfrom
jg/3082-bump-rspack-v2

Conversation

@justin808
Copy link
Copy Markdown
Member

@justin808 justin808 commented Apr 9, 2026

Summary

  • Updates generator and bin/switch-bundler Rspack dependencies from v1 to v2
  • @rspack/core@^2.0.0-0 and @rspack/cli@^2.0.0-0 — the -0 prerelease suffix ensures RC builds (currently 2.0.0-rc.1) are included until stable 2.0.0 lands
  • @rspack/plugin-react-refresh@^2.0.0 — already stable at 2.0.0
  • rspack-manifest-plugin@^5.0.0 — unchanged, already compatible with Rspack v2

Closes #3082

Test plan

  • js_dependency_manager_spec.rb passes
  • RuboCop passes on all changed files
  • CI passes

🤖 Generated with Claude Code

Summary by CodeRabbit

  • Changed
    • Upgraded Rspack bundler support from version 1 to version 2. Updated dependency configurations in the installation generator and bundler switching utility to use Rspack v2 packages, enabling support for prerelease and release candidate builds.

@coderabbitai
Copy link
Copy Markdown
Contributor

coderabbitai bot commented Apr 9, 2026

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

  • @coderabbitai resume to resume automatic reviews.
  • @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

  • ▶️ Resume reviews
  • 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: dec31ef2-4cbe-4570-9e19-58ec839ad10d

📥 Commits

Reviewing files that changed from the base of the PR and between b6ddb7d and 5081242.

📒 Files selected for processing (5)
  • CHANGELOG.md
  • react_on_rails/lib/generators/react_on_rails/js_dependency_manager.rb
  • react_on_rails/lib/generators/react_on_rails/templates/base/base/bin/switch-bundler
  • react_on_rails/spec/react_on_rails/generators/install_generator_spec.rb
  • react_on_rails/spec/react_on_rails/generators/js_dependency_manager_spec.rb
✅ Files skipped from review due to trivial changes (2)
  • react_on_rails/spec/react_on_rails/generators/js_dependency_manager_spec.rb
  • CHANGELOG.md
🚧 Files skipped from review as they are similar to previous changes (2)
  • react_on_rails/lib/generators/react_on_rails/js_dependency_manager.rb
  • react_on_rails/spec/react_on_rails/generators/install_generator_spec.rb

Walkthrough

Updated Rspack package version pins from v1 to v2 prerelease ranges across the generator, bundler switcher, tests, and changelog: @rspack/core and @rspack/cli^2.0.0-0, @rspack/plugin-react-refresh^2.0.0; rspack-manifest-plugin remains ^5.0.0.

Changes

Cohort / File(s) Summary
Changelog
CHANGELOG.md
Added Unreleased entry documenting Rspack dependency updates and references to Issue 3082 / PR 3084.
Generator constants
react_on_rails/lib/generators/react_on_rails/js_dependency_manager.rb
Bumped RSPACK_DEPENDENCIES / RSPACK_DEV_DEPENDENCIES to ^2.0.0-0 / ^2.0.0 and added comments about -0 prerelease inclusion.
Bundler switcher template
react_on_rails/lib/generators/react_on_rails/templates/.../bin/switch-bundler
Updated BundlerSwitcher::RSPACK_DEPS entries to match the v2 prerelease version constraints; rspack-manifest-plugin left at ^5.0.0.
Tests
react_on_rails/spec/.../install_generator_spec.rb, react_on_rails/spec/.../js_dependency_manager_spec.rb
Adjusted expectations to assert the new v2 prerelease version strings for rspack packages in generated outputs and pinned lists.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related PRs

Suggested reviewers

  • alexeyr-ci
  • justin808

Poem

🐰 A tiny hop from one to two, I hop and hum,
I pin the packages so installs won’t glum,
With caret and -0 I catch RC light,
Tests updated, changelog bright — hooray, delight! 🌿🎉

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 20.00% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly and concisely describes the main change: bumping Rspack dependencies from v1 to v2 with the specific version range.
Linked Issues check ✅ Passed All code changes align with the primary objective from issue #3082: updating Rspack dependency versions from v1 to v2 in the generator, js_dependency_manager.rb, switch-bundler, and corresponding tests.
Out of Scope Changes check ✅ Passed All changes are within scope and directly address the linked issue #3082; no unrelated modifications to other parts of the codebase were introduced.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch jg/3082-bump-rspack-v2

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@greptile-apps
Copy link
Copy Markdown

greptile-apps bot commented Apr 9, 2026

Greptile Summary

This PR upgrades Rspack dependencies from v1 to v2 across the generator (js_dependency_manager.rb) and the bin/switch-bundler template, using ^2.0.0-0 for @rspack/core and @rspack/cli to capture current RC builds (2.0.0-rc.1) and ^2.0.0 for @rspack/plugin-react-refresh which is already at stable 2.0.0. Spec fixtures and the changelog entry are updated to match.

One minor observation: both the new "Changed" entry in the changelog (this PR) and the existing "Fixed" entry from PR 3083 both state they close Issue 3082, which is a slight duplication since an issue can only be closed once on GitHub.

Confidence Score: 5/5

Safe to merge — all changes are targeted version string updates with matching spec and changelog coverage.

No P0 or P1 findings. All remaining observations are P2: the duplicate "Closes Issue 3082" reference in the changelog is cosmetic and does not affect runtime behavior. The version bump logic, constant definitions, and test assertions are consistent across all changed files.

No files require special attention.

Vulnerabilities

No security concerns identified.

Important Files Changed

Filename Overview
react_on_rails/lib/generators/react_on_rails/js_dependency_manager.rb Version strings bumped from ^1.0.0 to ^2.0.0-0 for @rspack/core and @rspack/cli, and to ^2.0.0 for @rspack/plugin-react-refresh; explanatory comments added inline.
react_on_rails/lib/generators/react_on_rails/templates/base/base/bin/switch-bundler RSPACK_DEPS constants updated to match the same v2 version strings as js_dependency_manager.rb.
react_on_rails/spec/react_on_rails/generators/js_dependency_manager_spec.rb Spec constant assertions updated to expect new v2 version strings; no logic changes.
react_on_rails/spec/react_on_rails/generators/install_generator_spec.rb Single string assertion updated from @rspack/core@^1.0.0 to @rspack/core@^2.0.0-0 to match the new switch-bundler template content.
CHANGELOG.md New "Changed" entry added; both this entry and the existing "Fixed" entry from PR 3083 reference closing Issue 3082, creating a slight duplication.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Generator / bin/switch-bundler invoked with --rspack] --> B{Rspack flag set?}
    B -- Yes --> C[Install RSPACK_DEPENDENCIES\n@rspack/core@^2.0.0-0\nrspack-manifest-plugin@^5.0.0]
    B -- Yes --> D[Install RSPACK_DEV_DEPENDENCIES\n@rspack/cli@^2.0.0-0\n@rspack/plugin-react-refresh@^2.0.0\nreact-refresh]
    B -- No --> E[Install Webpack dependencies]
    C --> F[Run package manager install]
    D --> F
    E --> F
Loading

Reviews (1): Last reviewed commit: "feat: bump rspack dependencies to v2 (^2..." | Re-trigger Greptile

@claude
Copy link
Copy Markdown
Contributor

claude bot commented Apr 9, 2026

Review

The changes are minimal, targeted, and correct. The version bumps in both js_dependency_manager.rb and bin/switch-bundler are consistent with each other, the test updates accurately reflect the new constants, and the code comments in js_dependency_manager.rb clearly explain the -0 prerelease suffix rationale.

Two items to address:

  1. CHANGELOG: duplicate "Closes Issue 3082" — Both the new Changed entry (this PR) and the existing Fixed entry from PR 3083 say Closes [Issue 3082]. Since PR 3083 was a workaround and this PR is the real fix, the PR 3083 entry should not be the one "closing" the issue. Suggest removing Closes [Issue 3082] from the PR 3083 entry (or changing it to See Issue 3082). See inline comment.

  2. CHANGELOG: missing PR/author attribution — Every other entry in the file includes [PR XXXX](...) by [author](...). The new entry for this PR is missing that. See inline comment.

Minor observation (not a blocker):

switch-bundler's RSPACK_DEPS constant lacks the explanatory comment that js_dependency_manager.rb has about the -0 prerelease suffix and why @rspack/plugin-react-refresh intentionally omits it. Since this template ships into user projects, the comment would help future readers. Suggestion in the inline comment.

Copy link
Copy Markdown
Contributor

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@CHANGELOG.md`:
- Around line 29-30: Update the CHANGELOG entry titled "Bump Rspack dependencies
to v2" to include the required PR attribution footer in the exact format: [PR
NUMBER](url) by [username](url) (no leading #), appended to the end of that
entry; ensure you use the actual PR number and contributor GitHub username/URLs
and preserve any existing inline **[Pro]** prefix if applicable.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 7c9e6b23-e039-4c2b-8394-e66c0cc2b523

📥 Commits

Reviewing files that changed from the base of the PR and between 16ac897 and 9e8ebac.

📒 Files selected for processing (5)
  • CHANGELOG.md
  • react_on_rails/lib/generators/react_on_rails/js_dependency_manager.rb
  • react_on_rails/lib/generators/react_on_rails/templates/base/base/bin/switch-bundler
  • react_on_rails/spec/react_on_rails/generators/install_generator_spec.rb
  • react_on_rails/spec/react_on_rails/generators/js_dependency_manager_spec.rb

@justin808
Copy link
Copy Markdown
Member Author

Review Address Summary

Addressed review feedback in 16e3c56:

Fixed (2):

  • CHANGELOG attribution: Added [PR 3084](...) by [justin808](...) to the new entry, matching the format used by all other entries
  • Duplicate "Closes Issue 3082": Changed PR 3083's entry from "Closes" to "See" since that PR was a workaround — this PR is the actual fix

Skipped with rationale (1):

  • switch-bundler comment suggestion: Declined — the explanatory comment already exists in js_dependency_manager.rb (the canonical source); duplicating it in the template creates a second maintenance point

All 3 review threads replied to and resolved.

@claude
Copy link
Copy Markdown
Contributor

claude bot commented Apr 9, 2026

Review: Bump Rspack dependencies to v2

Overall this PR is clean, well-scoped, and correctly addresses the Rspack v2 upgrade. The use of the `-0` prerelease suffix is the right technique to pull in `2.0.0-rc.1` builds of `@rspack/core` and `@rspack/cli` until stable 2.0.0 ships.

Asymmetric version specs — looks intentional, worth a comment

The three packages are treated differently:

Package Range Reason
`@rspack/core` `^2.0.0-0` Stable 2.0.0 not yet released (currently rc.1)
`@rspack/cli` `^2.0.0-0` Same — needs to track core's RC
`@rspack/plugin-react-refresh` `^2.0.0` Stable 2.0.0 already released (was the root cause per PR 3083)

This is correct, but the asymmetry isn't explained in the code. A future contributor could see `@rspack/cli@^2.0.0-0` and `@rspack/plugin-react-refresh@^2.0.0` side-by-side and wonder if the missing `-0` is a bug. The inline comments on `js_dependency_manager.rb` partly address this, but `switch-bundler` has no explanation at all.

Suggestion: add a brief comment (see inline) so the intent is preserved when someone revisits this after 2.0.0 stable ships.

Minor: CHANGELOG — dual "Closes" cleanup

The change from "Closes" to "See" on the PR 3083 CHANGELOG entry is the right call — only one PR should own the close. Looks good.

No behaviour or security concerns

All changes are version strings in frozen constants; no runtime logic or security surface is touched. Tests are updated in lockstep.

Approachable change — just the one documentation nit noted inline.

@claude
Copy link
Copy Markdown
Contributor

claude bot commented Apr 9, 2026

Code Review

Overall this is a clean and well-scoped change. Three items worth addressing before merge:

Issues found

1. CHANGELOG attribution (must fix)
Line 33 credits [I (Claude Code)](https://claude.ai/code) as the author, which will read strangely in the public changelog. See inline suggestion to change it to [justin808](https://github.com/justin808).

2. devtool: 'cheap-module-source-map' performance trade-off (consider)
The devtool change is a valid defensive workaround for the webpack 5.106.0 eval regression, but it silently downgrades rebuild performance for all generated apps. The original code explicitly rejected cheap-module-source-map for being slow. The inline comment only mentions the regression — it should also acknowledge the performance cost so developers who copy/maintain this config know what they're trading away. See the inline comment for detail on alternatives (false, cheap-source-map).

3. Other anonymous default exports (quick audit)
The scriptSanitizedVal named-export fix is the right root-cause remedy. I checked the rest of packages/react-on-rails/src/ and found no other export default ( patterns — looks clean.

What looks good

  • Rspack version ranges are correct: ^2.0.0-0 for @rspack/core and @rspack/cli (prerelease-inclusive, matching the current RC state), and ^2.0.0 for @rspack/plugin-react-refresh (already stable). The asymmetry is intentional and correct.
  • rspack-manifest-plugin@^5.0.0 left unchanged — v5 is already Rspack v2 compatible.
  • All test expectations and spec helper snapshots are updated consistently.
  • The devtool change is applied to all four affected config files (generator template, OSS dummy, Pro dummy, Pro execjs-compatible dummy).
  • The CHANGELOG structure (Changed for the version bump, Fixed for the devtool/export fix) is correct.

@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Apr 9, 2026

size-limit report 📦

Path Size
react-on-rails/client bundled (gzip) 62.63 KB (0%)
react-on-rails/client bundled (gzip) (time) 62.63 KB (0%)
react-on-rails/client bundled (brotli) 53.7 KB (0%)
react-on-rails/client bundled (brotli) (time) 53.7 KB (0%)
react-on-rails-pro/client bundled (gzip) 63.56 KB (-0.01% 🔽)
react-on-rails-pro/client bundled (gzip) (time) 63.56 KB (-0.01% 🔽)
react-on-rails-pro/client bundled (brotli) 54.58 KB (-0.04% 🔽)
react-on-rails-pro/client bundled (brotli) (time) 54.58 KB (-0.04% 🔽)
registerServerComponent/client bundled (gzip) 127.39 KB (+0.01% 🔺)
registerServerComponent/client bundled (gzip) (time) 127.39 KB (0%)
registerServerComponent/client bundled (brotli) 61.52 KB (0%)
registerServerComponent/client bundled (brotli) (time) 61.52 KB (0%)
wrapServerComponentRenderer/client bundled (gzip) 122.02 KB (0%)
wrapServerComponentRenderer/client bundled (gzip) (time) 122.02 KB (0%)
wrapServerComponentRenderer/client bundled (brotli) 56.77 KB (0%)
wrapServerComponentRenderer/client bundled (brotli) (time) 56.77 KB (0%)

Copy link
Copy Markdown
Contributor

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

♻️ Duplicate comments (1)
CHANGELOG.md (1)

33-33: ⚠️ Potential issue | 🟡 Minor

Correct the PR 3084 contributor attribution in this entry.

Line 33 attributes PR 3084 to I (Claude Code), but this PR is authored by justin808. Please update the byline to the actual contributor.

✏️ Suggested fix
-- **Fix SSR crash with webpack 5.106.0**: Changed server webpack config devtool from `eval` to `cheap-module-source-map` to work around a webpack 5.106.0 regression where anonymous default exports from ESM packages cause `ReferenceError: __WEBPACK_DEFAULT_EXPORT__ is not defined` during server-side rendering. Also converted `scriptSanitizedVal` from anonymous to named default export to prevent the issue in the npm package. [PR 3084](https://github.com/shakacode/react_on_rails/pull/3084) by [I (Claude Code)](https://claude.ai/code).
+- **Fix SSR crash with webpack 5.106.0**: Changed server webpack config devtool from `eval` to `cheap-module-source-map` to work around a webpack 5.106.0 regression where anonymous default exports from ESM packages cause `ReferenceError: __WEBPACK_DEFAULT_EXPORT__ is not defined` during server-side rendering. Also converted `scriptSanitizedVal` from anonymous to named default export to prevent the issue in the npm package. [PR 3084](https://github.com/shakacode/react_on_rails/pull/3084) by [justin808](https://github.com/justin808).
As per coding guidelines: “Format CHANGELOG entries as `[PR NUMBER](url) by [username](url)` without hash before PR number.”
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@CHANGELOG.md` at line 33, Update the CHANGELOG entry for PR 3084 to correct
the contributor attribution: replace the current byline "I (Claude Code)" with
the actual GitHub username "justin808" and ensure the entry follows the required
format `[PR 3084](https://github.com/shakacode/react_on_rails/pull/3084) by
[justin808](https://github.com/justin808)`, keeping the rest of the text (the
change description and links) unchanged.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Duplicate comments:
In `@CHANGELOG.md`:
- Line 33: Update the CHANGELOG entry for PR 3084 to correct the contributor
attribution: replace the current byline "I (Claude Code)" with the actual GitHub
username "justin808" and ensure the entry follows the required format `[PR
3084](https://github.com/shakacode/react_on_rails/pull/3084) by
[justin808](https://github.com/justin808)`, keeping the rest of the text (the
change description and links) unchanged.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: e38fadab-65b8-4980-9d4e-0261160a6fd7

📥 Commits

Reviewing files that changed from the base of the PR and between 16e3c56 and f59cd18.

📒 Files selected for processing (7)
  • CHANGELOG.md
  • packages/react-on-rails/src/scriptSanitizedVal.ts
  • react_on_rails/lib/generators/react_on_rails/templates/base/base/config/webpack/serverWebpackConfig.js.tt
  • react_on_rails/spec/dummy/config/webpack/serverWebpackConfig.js
  • react_on_rails/spec/react_on_rails/support/generator_spec_helper.rb
  • react_on_rails_pro/spec/dummy/config/webpack/serverWebpackConfig.js
  • react_on_rails_pro/spec/execjs-compatible-dummy/config/webpack/serverWebpackConfig.js
✅ Files skipped from review due to trivial changes (2)
  • react_on_rails/spec/react_on_rails/support/generator_spec_helper.rb
  • packages/react-on-rails/src/scriptSanitizedVal.ts

Copy link
Copy Markdown

@cursor cursor bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Fix All in Cursor

Bugbot Autofix is ON, but it could not run because on-demand usage is turned off. To enable Bugbot Autofix, turn on on-demand usage and set a spend limit in the Cursor dashboard.

Reviewed by Cursor Bugbot for commit b6ddb7d. Configure here.

@claude
Copy link
Copy Markdown
Contributor

claude bot commented Apr 9, 2026

Review

Overall this is a clean, well-commented PR. Two issues and one observation:

Bug: bin/switch-bundler misses the webpack version pin workaround

The generator now installs webpack@~5.105.0 to dodge the 5.106.0 SSR regression, but bin/switch-bundler's WEBPACK_DEPS constant still has webpack@^5.0.0:

# react_on_rails/lib/generators/react_on_rails/templates/base/base/bin/switch-bundler
WEBPACK_DEPS = {
  dependencies: %w[webpack@^5.0.0 webpack-assets-manifest@^6.0.0 webpack-merge@^6.0.0],

A user who starts with rspack and later runs bin/switch-bundler webpack will get webpack@5.106.0+ installed — the workaround in the generator won't help them. The tilde pin should be applied here too, and both should be updated together once webpack/webpack#20773 ships a fix.

Suggestion: Add a tracking issue for removing the temporary webpack pin

The comment in js_dependency_manager.rb correctly says "Remove this pin once webpack ships a fix", but there's no GitHub issue to track that. A short-lived issue or TODO linking to the upstream PR would prevent the pin from being forgotten indefinitely.

Minor: CHANGELOG author attribution on the SSR fix entry

See inline comment on CHANGELOG.md line 33 — the by [I (Claude Code)](...) attribution won't read well in a published changelog. Suggest using justin808 (or whichever human owns this PR) to match the style of every other entry.

@ihabadham
Copy link
Copy Markdown
Collaborator

WIP — picking this up.

Update generator and bin/switch-bundler Rspack dependencies from v1 to v2:
- @rspack/core@^2.0.0-0 (prerelease suffix includes RC builds)
- @rspack/cli@^2.0.0-0
- @rspack/plugin-react-refresh@^2.0.0 (already stable at 2.0.0)
- rspack-manifest-plugin@^5.0.0 (unchanged, already compatible)

The -0 prerelease suffix ensures that RC builds (currently 2.0.0-rc.1)
are resolved by npm until stable 2.0.0 ships.

Closes #3082

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@ihabadham ihabadham force-pushed the jg/3082-bump-rspack-v2 branch from b6ddb7d to acad445 Compare April 10, 2026 21:34
@claude
Copy link
Copy Markdown
Contributor

claude bot commented Apr 10, 2026

Review: Bump Rspack dependencies to v2

The change itself is clean and correct. A few notes:

What looks good

  • All three places that hardcode Rspack versions are updated consistently: RSPACK_DEPENDENCIES / RSPACK_DEV_DEPENDENCIES in js_dependency_manager.rb, RSPACK_DEPS in the bin/switch-bundler template, and the corresponding spec fixtures.
  • The ^2.0.0-0 prerelease range is the right semver trick here, and the inline comments explaining the -0 suffix are a helpful addition for future maintainers.
  • @rspack/plugin-react-refresh correctly uses ^2.0.0 (no -0) since it is already at stable 2.0.0 — good consistency with the comment that only the core/cli packages need the prerelease gate.

Minor observation: stale PR description

The PR description (and CodeRabbit walkthrough) mentions changes that are not in the actual diff — specifically:

  • SSR webpack devtool switch from evalcheap-module-source-map
  • A new webpack@~5.105.0 generator pin for non-rspack installs
  • scriptSanitizedVal renamed to a named export

Those look like they were part of an earlier iteration and were either moved to a separate PR or reverted before this was pushed. The description should be trimmed to match the actual five-file diff to avoid reviewer confusion (especially for someone landing on this PR without git context).

One inline suggestion

Left a comment on install_generator_spec.rb about adding the two missing dev-dep assertions to the switch-bundler test block.

Overall: LGTM once the description is cleaned up. The version bump is safe, well-documented, and the changed lines are exactly what you'd expect.

Copy link
Copy Markdown

@chatgpt-codex-connector chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: acad445b92

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

The bin/switch-bundler version-pin test only spot-checked @rspack/core
and webpack. A drift in @rspack/cli or @rspack/plugin-react-refresh within
the RSPACK_DEPS constant would silently pass the existing assertions.

Add assertions for the remaining two rspack pins so future version
changes to bin/switch-bundler cannot regress without a test failure.

The sibling test "installs rspack dependencies in package.json" already
checks all four rspack packages (for the generated package.json), so this
also brings the switch-bundler test into consistency with the adjacent
pattern.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@claude
Copy link
Copy Markdown
Contributor

claude bot commented Apr 11, 2026

Review: Bump Rspack dependencies to v2

Overall: Clean, focused, well-documented PR. The version bump approach and test updates look correct.

What's good

  • ^2.0.0-0 prerelease suffix is the right npm semver trick to include 2.0.0-rc.x builds without accidentally pulling in 2.1.0-rc.x. The inline comments explaining this are appreciated.
  • Consistency between js_dependency_manager.rb and switch-bundler is maintained — both updated in lockstep.
  • Improved test coverage in install_generator_spec.rb: the previous spec only asserted @rspack/core's version pin; now all three Rspack packages are verified. Good catch.
  • Correct version asymmetry: @rspack/plugin-react-refresh uses ^2.0.0 (no -0) since stable 2.0.0 already exists, while the other two use ^2.0.0-0. Intentional and consistent with the PR description.

Pre-existing gap worth addressing

js_dependency_manager.rb's RSPACK_DEV_DEPENDENCIES explicitly includes react-refresh:

RSPACK_DEV_DEPENDENCIES = %w[
  @rspack/cli@^2.0.0-0
  @rspack/plugin-react-refresh@^2.0.0
  react-refresh          #  explicit
].freeze

But switch-bundler's RSPACK_DEPS omits it:

RSPACK_DEPS = {
  dev_dependencies: %w[@rspack/cli@^2.0.0-0 @rspack/plugin-react-refresh@^2.0.0]
  #                                                                               ^ no react-refresh
}

This inconsistency predates this PR, but since the file is being touched it's a good moment to align them. react-refresh is a peer dep of @rspack/plugin-react-refresh — some package managers (npm ≥ 7, pnpm) install peers automatically, others don't. The generator installs it explicitly; the switcher script does not. Not a blocker, but worth a follow-up issue or fixing here.

Minor nit

The PR is still labelled work-in-progress — if CI is green and the change is ready, consider removing the label before merge.

@ihabadham
Copy link
Copy Markdown
Collaborator

Address-review summary

Scan scope: full PR history. The user directed me to investigate every review comment (including outdated ones marked as such by the force-push squash), so this run scanned all reviews regardless of cutoff timestamp — equivalent to check all reviews override.

PR head at triage: 5081242e (on top of squash commit acad445b)

Mattered

  • install_generator_spec.rb:673 (@claude[bot]) — Added assertions for @rspack/cli@^2.0.0-0 and @rspack/plugin-react-refresh@^2.0.0 to the switch-bundler version-pin test block. Brings the test into consistency with the sibling test that already checks all four rspack packages for a related concern. Fixed in 5081242eb. Thread resolved.

  • js_dependency_manager.rb:97 (@chatgpt-codex-connector[bot], P1) — "Keep Rspack pins compatible with current Shakapacker peers." Replied with context: shakapacker 10.0.0 already widened @rspack/core and @rspack/cli peers via Add rspack v2 support shakapacker#975; opened fix: align rspack v2 peer deps and installer defaults shakapacker#1091 to widen the remaining @rspack/plugin-react-refresh peer. All three peers are optional: true in peerDependenciesMeta, so the mismatch produces a warning (not a failure) under default npm/pnpm — CI on this PR (rspec-package-tests, examples) passed cleanly with @rspack/core@2.0.0-rc.1 alongside shakapacker 9.6.1. Replied with context. Thread resolved.

  • PR description (@claude[bot], post-squash general review) — The description still referenced changes that aren't in the actual 5-file diff (devtool switch, webpack@~5.105.0 pin, scriptSanitizedVal rename), due to earlier bot-appended CURSOR_SUMMARY and CodeRabbit walkthrough sections. Rewrote the description to match the actual diff.

Skipped

Pre-squash comments obsolete after the squash (5 threads, all received short rationale replies and were resolved):

  • CHANGELOG.md "I (Claude Code)" attribution (×2 duplicates, @claude[bot]) — entry was removed in the squash.
  • serverWebpackConfig.js.tt cheap-module-source-map perf (@claude[bot]) — devtool reverted to eval; webpack 5.106.1 ships the upstream fix.
  • scriptSanitizedVal.ts "good fix" positive ack (@claude[bot]) — rename reverted; no-op now.
  • bin/switch-bundler:18 missing webpack pin (@cursor[bot]) — generator-side pin reverted + webpack 5.106.1 makes original concern moot.

Pre-squash comments declined as minor nits (2 threads, replied and resolved):

  • js_dependency_manager.rb:107 asymmetric -0 suffix clarity (@claude[bot]) — existing inline comments at 103-104 and 112 are sufficient; adding a third comment for the exception is style preference.
  • bin/switch-bundler:19 template comment duplication (@claude[bot]) — equivalent concern was already declined by @justin808 pre-squash with the rationale that js_dependency_manager.rb is the canonical source. Same rationale applies.

Post-push new comment (1 thread, replied and resolved):

  • bin/switch-bundler:19 react-refresh explicit listing (@claude[bot], posted after my test-assertion commit) — pre-existing inconsistency between bin/switch-bundler and js_dependency_manager.rb. Declined as out of scope: both sides of bin/switch-bundler omit react-refresh (internally consistent), and adding it to only the rspack side would break that internal consistency while partially matching js_dependency_manager.rb. A proper fix requires deciding which design philosophy bin/switch-bundler should follow — out of scope for this PR.

Already resolved before this pass (3 threads, no action needed):

  • CHANGELOG.md two "Closes Issue 3082" (@claude[bot] + @justin808) — resolved pre-squash.
  • bin/switch-bundler:19 inline explanation decline (@claude[bot] + @justin808) — resolved pre-squash.
  • CHANGELOG.md missing PR attribution (@coderabbitai[bot] + @justin808) — resolved pre-squash.

Bulk-skipped as status noise or historical pre-squash summaries (13 items):

  • 9 general PR issue comments: @coderabbitai "reviews paused" notice, @greptile-apps pre-squash summary, 5 @claude[bot] pre-squash general reviews (all Fix B findings, obsolete), @github-actions size-limit report, @ihabadham "WIP — picking this up" marker.
  • 4 review summary bodies: 2 @coderabbitai (pre-squash), 1 @cursor[bot] (pre-squash), 1 @chatgpt-codex-connector[bot] post-squash boilerplate (its actionable content was captured as inline comment above).

Outcome

Next default scan starts after this comment. Say check all reviews to rescan the full PR.

@chatgpt-codex-connector
Copy link
Copy Markdown

To use Codex here, create a Codex account and connect to github.

@coderabbitai
Copy link
Copy Markdown
Contributor

coderabbitai bot commented Apr 11, 2026

@ihabadham: Thank you for the thorough triage — the structured breakdown across all 13 threads is clear and easy to follow. A few quick notes on the items that touched my prior comment:

  • The CHANGELOG attribution thread is correctly marked as already resolved pre-squash. ✅
  • The install_generator_spec.rb test coverage fix (adding assertions for @rspack/cli@^2.0.0-0 and @rspack/plugin-react-refresh@^2.0.0) is a solid consistency improvement.
  • The shakapacker peer-compat context and the follow-up PR fix: align rspack v2 peer deps and installer defaults shakapacker#1091 for @rspack/plugin-react-refresh is the right approach given that the peers are optional: true.

The react-refresh omission from bin/switch-bundler being deferred as out-of-scope is reasonable — that's an existing structural inconsistency that warrants a dedicated decision rather than a one-sided patch here.

I'll kick off a fresh review of the current state (post-squash + 5081242eb).


🧠 Learnings used
Learnt from: CR
Repo: shakacode/react_on_rails PR: 0
File: AGENTS.md:0-0
Timestamp: 2026-03-21T08:53:17.309Z
Learning: For small, focused PRs (roughly 5 files or fewer with one clear purpose): use at most one AI reviewer for inline comments, batch review fixes into one follow-up push, and verify language/runtime/library claims locally before making code changes in response to AI review
✅ Actions performed

Review triggered.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

@greptile-apps
Copy link
Copy Markdown

greptile-apps bot commented Apr 11, 2026

Thanks for the comprehensive summary. All the key points are addressed:

  • Test coverage for @rspack/cli and @rspack/plugin-react-refresh added in 5081242e
  • Shakapacker peer dependency context clarified with upstream follow-up PR ✓
  • PR description cleaned up to match actual changes ✓
  • Out-of-scope items appropriately deferred ✓

The PR is in good shape. No outstanding issues from my side.

@ihabadham
Copy link
Copy Markdown
Collaborator

I dug this through to the canonical fix and verified it in real fresh Rails apps.

Bottom line

This PR's Rspack v2 changes work cleanly once Shakapacker is fixed upstream.

The canonical fix is now in progress at:

That PR now does both required upstream changes:

  1. widens Shakapacker's @rspack/plugin-react-refresh peer range to allow v2
  2. widens shakapacker:install defaults in lib/install/package.json so fresh Rspack installs start on @rspack/core / @rspack/cli v2 instead of v1

What I verified locally

Using:

  • this PR branch for react_on_rails
  • the patched Shakapacker branch as a local path gem
  • a locally packed npm tarball from the patched Shakapacker branch

I ran a full fresh-app flow:

  • bundle exec rails generate react_on_rails:install --rspack --ignore-warnings
  • clean later npm install
  • bundle exec rails shakapacker:compile

All of it succeeded.

Final generated dependency state was:

  • @rspack/core: ^2.0.0-0
  • @rspack/cli: ^2.0.0-0
  • @rspack/plugin-react-refresh: 2.0.0
  • shakapacker: /tmp/.../shakapacker-10.0.0.tgz (local patched tarball for verification)

Conclusion

So the clean path here is:

  • merge/release the upstream Shakapacker fix
  • then merge this PR without a React on Rails-side workaround

I do not think this PR should grow a legacy-peer-deps workaround or a plugin-v1 fallback if we can land the upstream release first.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

CI: rspack generator specs fail due to @rspack/plugin-react-refresh 2.0.0 peer dep conflict

2 participants