chore(deps): bump react_on_rails and react_on_rails_pro

[dependabot]

Bumps react_on_rails and react_on_rails_pro. These dependencies needed to be updated together.
Updates react_on_rails from 17.0.0.rc.3 to 17.0.0.rc.5

Release notes

Sourced from react_on_rails's releases.

v17.0.0.rc.5

Fixed

• [Pro] RSC and client-only FOUC reveal gating: Pro now waits for auto-loaded generated component stylesheets before mounting client-only roots and promotes streamed RSC client chunk stylesheet preloads to real stylesheet links before reveal, including when stream chunks split <link> tags. Shared generated CSS is matched through manifest-derived stylesheet href metadata, while app-authored preload links remain untouched. Fixes Issue 4031, Issue 4032. PR 4047 by justin808.

v17.0.0.rc.4

Added

• [Pro] Tag-based cache revalidation (a Next.js revalidateTag analog): The fragment-caching helpers (cached_react_component, cached_react_component_hash, cached_stream_react_component, cached_async_react_component) now accept an optional cache_tags: option (String, Proc, any object responding to cache_key such as an ActiveRecord model, or an Array of any mix), and the new ReactOnRailsPro.revalidate_tag(tag) / revalidate_tags(*tags) API deletes every cached entry registered under a tag via a Rails.cache-backed tag->key index. A new ReactOnRailsPro::Cache::Revalidates ActiveRecord concern (revalidates_react_cache) drives revalidation from after_commit, so the model that owns the data also owns cache invalidation (and composes with touch:). Revalidation is best-effort with correctness bounded by expires_in (a development-mode warning fires when cache_tags: is used without it); index growth is bounded by the new config.cache_tag_index_expires_in (default 7 days) and config.cache_tag_index_max_keys (default 5,000) settings. Existing cache_key:-only behavior is unchanged. Closes Issue 3871. PR 3964 by justin808.
• React 19 root error callbacks: ReactOnRails.setOptions({ rootErrorHandlers: { onRecoverableError, onCaughtError, onUncaughtError } }) registers React's root error callbacks globally; React on Rails applies them to every hydrateRoot/createRoot call it makes and invokes them with an extra context argument whose componentName and domNodeId fields are optional. In development, recoverable hydration errors now log an actionable React on Rails message (component name, dom id, component stack, and a link to the new Debugging Hydration Mismatches guide) alongside React's default error reporting, which stays intact so window-'error'-based tooling keeps working. Partial rootErrorHandlers updates merge per key, so registering one callback later does not drop the others. On React <19 (and <18 for onRecoverableError), React on Rails retains registrations for future upgrades, but the current runtime cannot invoke unsupported callbacks and logs a one-time console warning. On React on Rails Pro RSC/streaming hydration paths, user callbacks chain with (never replace) Pro's internal recoverable-error handler. Addresses Issue 3892. PR 3933 by justin808.
• useRailsForm hook + render_model_errors controller concern (an Inertia useForm-style bridge to Rails controllers): New React hook useRailsForm (importable from react-on-rails/useRailsForm) makes posting a React form to a plain Rails controller turnkey: data/setData, per-field errors, processing, wasSuccessful, submit verbs (post/put/patch/delete/submit), reset/clearErrors/setError, automatic CSRF attachment from the Rails csrf-token meta tag, JSON request/response handling, and mapping of 422 + { errors: { field: ["message"] } } responses onto per-field error state. Success results surface a redirectTo target (followed-redirect URL or JSON redirect_to hint) without navigating, forward-compatible with the client-routing work in Issue 3873. The gem side adds the opt-in ReactOnRails::Controller::FormResponders concern whose render_model_errors(record) renders ActiveModel errors in exactly that shape, so validations stay in the model with no API layer and no client-side duplication. Includes a new Forms and Mutations docs page (with an Inertia useForm mapping table and a Server Functions Issue 3867 cross-link) and a runnable dummy-app example (/rails_form). v1 is fetch-only; transform, recentlySuccessful, and file-upload progress are deferred. Closes Issue 3872. PR 3942 by justin808.
• [Pro] Built-in node renderer /health and /ready probe endpoints: The node renderer can now register first-class liveness (https://github.com/shakacode/react_on_rails/blob/HEAD/`GET /health->200 with a status-only body) and readiness (GET /ready->503until the answering worker is online and has at least one server bundle compiled, then200) endpoints, replacing the hand-rolled configureFastifyhealth-check recipe for the common case. The endpoints are off by default and enabled with the newenableHealthEndpointsconfig option (orRENDERER_ENABLE_HEALTH_ENDPOINTS=true, TRUE, yes, YES, or 1); they are unauthenticated like /infobut expose no runtime version or path details. The1alias is scoped toRENDERER_ENABLE_HEALTH_ENDPOINTS so existing node-renderer boolean environment flags keep their previous parsing behavior. Includes a new [Health and Readiness Endpoints](docs/oss/building-features/node-renderer/health-checks.md) docs page with working Kubernetes (tcpSocket+execwithcurl --http2-prior-knowledge-- the h2c listener cannot be probed with HTTP/1.1httpGet`), ECS, and Docker Compose probe examples. Closes Issue 3880. PR 3939 by justin808.
• [Pro] Source-mapped stack traces in the Node renderer: SSR errors now point at the original TypeScript/JavaScript file:line:column instead of bundled positions. When the server bundle carries an inline source map (or a .map file is available next to the uploaded bundle), the renderer captures the map text for the VM's bundle generation and lazily parses it on the first error before remapping stack frames — both for exceptions returned to Rails as renderer errors and for stacks captured inside the bundle that surface through ReactOnRails::PrerenderError. Bundles are also now evaluated with their real file path, so even unmapped stacks name the bundle file rather than evalmachine.<anonymous>. No per-request overhead: map parsing and frame remapping happen only when an error's stack is accessed, and parsed maps are cached per bundle generation. Uses Node's built-in module.SourceMap (no new dependencies). Part of Issue 3893. PR 3940 by justin808.

Changed

• [Pro] RSC peer compatibility accepts the coordinated React 19.2 floor: The Pro node renderer now allows React and React DOM 19.2.x starting at 19.2.7, matching the floor required by the react-on-rails-rsc 19.2 package line while preserving the existing React 19.0.x support window. Refs Issue 3865. PR 4026 by justin808.

Fixed

• Rspack generated apps start in HMR mode: Fresh rails generate react_on_rails:install --rspack and create-react-on-rails-app projects now install @rspack/dev-server, use the ReactRefreshRspackPlugin export, and keep bin/switch-bundler rspack's dev dependencies complete so bin/dev can launch Rspack serve instead of crashing during dev-server startup. Fixes Issue 3925. PR 3926 by AbanoubGhadban and ihabadham.

Changelog

Sourced from react_on_rails's changelog.

[17.0.0.rc.5] - 2026-06-16

Fixed

• [Pro] RSC and client-only FOUC reveal gating: Pro now waits for auto-loaded generated component stylesheets before mounting client-only roots and promotes streamed RSC client chunk stylesheet preloads to real stylesheet links before reveal, including when stream chunks split <link> tags. Shared generated CSS is matched through manifest-derived stylesheet href metadata, while app-authored preload links remain untouched. Fixes Issue 4031, Issue 4032. PR 4047 by justin808.

[17.0.0.rc.4] - 2026-06-14

Added

• [Pro] Tag-based cache revalidation (a Next.js revalidateTag analog): The fragment-caching helpers (cached_react_component, cached_react_component_hash, cached_stream_react_component, cached_async_react_component) now accept an optional cache_tags: option (String, Proc, any object responding to cache_key such as an ActiveRecord model, or an Array of any mix), and the new ReactOnRailsPro.revalidate_tag(tag) / revalidate_tags(*tags) API deletes every cached entry registered under a tag via a Rails.cache-backed tag->key index. A new ReactOnRailsPro::Cache::Revalidates ActiveRecord concern (revalidates_react_cache) drives revalidation from after_commit, so the model that owns the data also owns cache invalidation (and composes with touch:). Revalidation is best-effort with correctness bounded by expires_in (a development-mode warning fires when cache_tags: is used without it); index growth is bounded by the new config.cache_tag_index_expires_in (default 7 days) and config.cache_tag_index_max_keys (default 5,000) settings. Existing cache_key:-only behavior is unchanged. Closes Issue 3871. PR 3964 by justin808.
• React 19 root error callbacks: ReactOnRails.setOptions({ rootErrorHandlers: { onRecoverableError, onCaughtError, onUncaughtError } }) registers React's root error callbacks globally; React on Rails applies them to every hydrateRoot/createRoot call it makes and invokes them with an extra context argument whose componentName and domNodeId fields are optional. In development, recoverable hydration errors now log an actionable React on Rails message (component name, dom id, component stack, and a link to the new Debugging Hydration Mismatches guide) alongside React's default error reporting, which stays intact so window-'error'-based tooling keeps working. Partial rootErrorHandlers updates merge per key, so registering one callback later does not drop the others. On React <19 (and <18 for onRecoverableError), React on Rails retains registrations for future upgrades, but the current runtime cannot invoke unsupported callbacks and logs a one-time console warning. On React on Rails Pro RSC/streaming hydration paths, user callbacks chain with (never replace) Pro's internal recoverable-error handler. Addresses Issue 3892. PR 3933 by justin808.
• useRailsForm hook + render_model_errors controller concern (an Inertia useForm-style bridge to Rails controllers): New React hook useRailsForm (importable from react-on-rails/useRailsForm) makes posting a React form to a plain Rails controller turnkey: data/setData, per-field errors, processing, wasSuccessful, submit verbs (post/put/patch/delete/submit), reset/clearErrors/setError, automatic CSRF attachment from the Rails csrf-token meta tag, JSON request/response handling, and mapping of 422 + { errors: { field: ["message"] } } responses onto per-field error state. Success results surface a redirectTo target (followed-redirect URL or JSON redirect_to hint) without navigating, forward-compatible with the client-routing work in Issue 3873. The gem side adds the opt-in ReactOnRails::Controller::FormResponders concern whose render_model_errors(record) renders ActiveModel errors in exactly that shape, so validations stay in the model with no API layer and no client-side duplication. Includes a new Forms and Mutations docs page (with an Inertia useForm mapping table and a Server Functions Issue 3867 cross-link) and a runnable dummy-app example (/rails_form). v1 is fetch-only; transform, recentlySuccessful, and file-upload progress are deferred. Closes Issue 3872. PR 3942 by justin808.
• [Pro] Built-in node renderer /health and /ready probe endpoints: The node renderer can now register first-class liveness (https://github.com/shakacode/react_on_rails/blob/main/`GET /health->200 with a status-only body) and readiness (GET /ready->503until the answering worker is online and has at least one server bundle compiled, then200) endpoints, replacing the hand-rolled configureFastifyhealth-check recipe for the common case. The endpoints are off by default and enabled with the newenableHealthEndpointsconfig option (orRENDERER_ENABLE_HEALTH_ENDPOINTS=true, TRUE, yes, YES, or 1); they are unauthenticated like /infobut expose no runtime version or path details. The1alias is scoped toRENDERER_ENABLE_HEALTH_ENDPOINTS so existing node-renderer boolean environment flags keep their previous parsing behavior. Includes a new [Health and Readiness Endpoints](docs/oss/building-features/node-renderer/health-checks.md) docs page with working Kubernetes (tcpSocket+execwithcurl --http2-prior-knowledge-- the h2c listener cannot be probed with HTTP/1.1httpGet`), ECS, and Docker Compose probe examples. Closes Issue 3880. PR 3939 by justin808.
• [Pro] Source-mapped stack traces in the Node renderer: SSR errors now point at the original TypeScript/JavaScript file:line:column instead of bundled positions. When the server bundle carries an inline source map (or a .map file is available next to the uploaded bundle), the renderer captures the map text for the VM's bundle generation and lazily parses it on the first error before remapping stack frames — both for exceptions returned to Rails as renderer errors and for stacks captured inside the bundle that surface through ReactOnRails::PrerenderError. Bundles are also now evaluated with their real file path, so even unmapped stacks name the bundle file rather than evalmachine.<anonymous>. No per-request overhead: map parsing and frame remapping happen only when an error's stack is accessed, and parsed maps are cached per bundle generation. Uses Node's built-in module.SourceMap (no new dependencies). Part of Issue 3893. PR 3940 by justin808.

Changed

• [Pro] RSC peer compatibility accepts the coordinated React 19.2 floor: The Pro node renderer now allows React and React DOM 19.2.x starting at 19.2.7, matching the floor required by the react-on-rails-rsc 19.2 package line while preserving the existing React 19.0.x support window. Refs Issue 3865. PR 4026 by justin808.

Fixed

• Rspack generated apps start in HMR mode: Fresh rails generate react_on_rails:install --rspack and create-react-on-rails-app projects now install @rspack/dev-server, use the ReactRefreshRspackPlugin export, and keep bin/switch-bundler rspack's dev dependencies complete so bin/dev can launch Rspack serve instead of crashing during dev-server startup. Fixes Issue 3925. PR 3926 by AbanoubGhadban and ihabadham.

Commits

• 476a044 Bump version to 17.0.0.rc.5
• 7be6149 Update CHANGELOG.md for 17.0.0.rc.5 (#4075)
• 02d9bcb Add pr-ci-readiness helper to dedupe PR CI gating (#4067)
• d88a517 Add changelog-merged-prs helper to simplify update-changelog (#4066)
• cb8f8db Add pr-file-touch-map helper to simplify plan-pr-batch (#4065)
• ce88f54 Add fetch-pr-review-data helper to simplify address-review (#4064)
• bb24272 Exclude changelog from llms-full to end the recurring drift cascade (#4068)
• 1ba7386 Fix invalid CI command help response (#4058)
• 9fa782c Document GitHub Actions follow-up verification rule (#4054)
• 731ee9d Fix CI command reply permissions (#4057)
• Additional commits viewable in compare view

Updates react_on_rails_pro from 17.0.0.rc.3 to 17.0.0.rc.5

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

🚀 Quick Review App Commands

Welcome! Here are the commands you can use in this PR:
They require the repository to have cpflow review apps configured, including the CPLN_TOKEN_STAGING secret.

+review-app-deploy

Deploy your PR branch for testing.

+review-app-delete

Remove the review app when done.

+review-app-help

Show detailed instructions, environment setup, and configuration options.

Comment +review-app-help for full setup details.

[dependabot]

Looks like these dependencies are up-to-date now, so this is no longer needed.

[github-actions]

✅ Review App Deleted

Review app for PR #166 is deleted

🎮 Control Plane Console
📋 View Workflow Logs