Bump shakapacker from 9.5.0 to 10.2.0 in /ruby-gem/spec/dummy

[dependabot]

Bumps shakapacker from 9.5.0 to 10.2.0.

Release notes

Sourced from shakapacker's releases.

v10.2.0

Added

• Added webpack_compile_flags configuration. [PR #1180](shakacode/shakapacker#1180) by justin808. Allows Rails-driven Shakapacker compiles to pass extra webpack/rspack CLI flags, such as --fail-on-warnings or --progress, through bin/shakapacker. Fixes #1175.
• Added AI analysis prompt generation to the config exporter. [PR #695](shakacode/shakapacker#695), [PR #1184](shakacode/shakapacker#1184) by justin808. When running doctor mode (bin/shakapacker-config --doctor), the exporter now also writes an AI-ANALYSIS-PROMPT.md: a ready-to-paste prompt that guides an AI assistant (ChatGPT, Claude, Gemini, etc.) to review the configuration for migration issues (webpack ↔ rspack), build errors, client/server and development/production optimizations, and best practices. The React on Rails–specific guidance in the generated prompt is included only when React on Rails is detected in the app (via package.json, Gemfile, or Gemfile.lock). This is purely additive; existing exports are unchanged, and a failure to write the prompt file only warns without affecting the exported configs.
• Added support for sass-loader v17. [PR #1141](shakacode/shakapacker#1141) by fukayatsu. Widened the optional sass-loader peer range to ^13.0.0 || ^14.0.0 || ^15.0.0 || ^16.0.0 || ^17.0.0 in core shakapacker, shakapacker-webpack, and shakapacker-rspack. The Sass rule already selects loadPaths for v16+ and keeps api: "modern", both of which remain valid in v17. Note that sass-loader v17 requires Node.js 22.11.0+ and drops node-sass and the legacy Sass JS API, so apps that opt into v17 must already be on Node 22.12+ (the upper branch of Shakapacker's engines.node range).
• Added Babel 8 peer dependency support. [PR #1187](shakacode/shakapacker#1187) by justin808. Widened the Babel peer ranges in core shakapacker and the shakapacker-webpack supplemental package to allow Babel 8, and updated the Shakapacker Babel preset to omit options removed in Babel 8 while preserving existing Babel 7 behavior. Repository development pins stay on Babel 7, with added compatibility tests covering Babel 8. Refs #1163.

Changed

• New installs now default to Rspack instead of webpack. [PR #1150](shakacode/shakapacker#1150) by justin808. bundle exec rake shakapacker:install now scaffolds an Rspack project (config, dependencies, and config/shakapacker.yml) by default. This is a new-install default only: existing applications are unaffected. The Rspack default applies only to brand-new installs — re-running the installer on an app that already has a config/shakapacker.yml keeps that app's current bundler (and installs that bundler's dependencies), so the installer never silently switches an existing project's bundler. To install with webpack, run bundle exec rake shakapacker:install[webpack] or set SHAKAPACKER_ASSETS_BUNDLER=webpack; to change an existing app's bundler, use bundle exec rake shakapacker:switch_bundler.
• Changed Rspack support to target Rspack v2 only. [PR #1179](shakacode/shakapacker#1179) by justin808. Core, installer, switch-bundler defaults, supplemental package, dummy app, and docs now use @rspack/core, @rspack/cli, @rspack/dev-server, and @rspack/plugin-react-refresh v2 ranges. Rspack installs now also require rspack-manifest-plugin@^5.2.2, and shakapacker-rspack requires css-loader@^7.1.4 for Rspack v2 peer compatibility. The Rspack React Refresh loader now uses the v2 named ReactRefreshRspackPlugin export instead of retaining legacy v1 export-shape fallbacks.

Fixed

• Fixed helper binstubs and doctor checks for subdirectory JavaScript layouts. [PR #1192](shakacode/shakapacker#1192) by justin808. bin/shakapacker-config and bin/diff-bundler-config now resolve package scripts from a configured client package root before falling back to the Rails root, and shakapacker:doctor now searches package metadata, lockfiles, and installed packages across client/root layouts while reducing false SWC dependency issues for custom hybrid webpack/Rspack setups. Fixes #1170 and #1090.
• Fixed dev-server passthrough argument validation messages. [PR #1180](shakacode/shakapacker#1180) by justin808. bin/shakapacker-dev-server -- --host ... or --port ... now fails with a clearer Shakapacker message instead of forwarding the separator to the bundler; set dev_server.host and dev_server.port in config/shakapacker.yml instead.
• Fixed shakapacker:export_bundler_config regression on apps upgraded from older Shakapacker versions. [PR #1127](shakacode/shakapacker#1127) by justin808. The task previously invoked bin/shakapacker-config unconditionally via RbConfig.ruby, which crashed when the file was still the legacy JavaScript binstub (#!/usr/bin/env node) left over from earlier installs. The task now inspects the shebang and exec's the file directly when it points at Node, while keeping the Ruby+RbConfig.ruby path for the current Ruby binstub. Affected users are also nudged to run bundle exec rake shakapacker:binstubs to refresh their helper binstub. Refs #1123.
• Fixed shakapacker:doctor Sass implementation detection for sass-embedded apps. [PR #1178](shakacode/shakapacker#1178) by justin808. The doctor now accepts either modern Sass implementation package (sass or sass-embedded) when Sass files are present, matching Shakapacker's default modern Sass API instead of incorrectly requiring Dart Sass. New installs also include sass alongside sass-loader. Fixes #1172.
• Fixed Psych::DisallowedClass boot crash when pnpm-lock.yaml contains a time: section. [PR #1161](shakacode/shakapacker#1161) by justin808. pnpm >= 10.16 (default in pnpm 11) writes publish timestamps into pnpm-lock.yaml that Psych 4+ refuses to safe-load, so the shakapacker.version_checker boot initializer raised Psych::DisallowedClass: Tried to load unspecified class: Time and crashed every Rails boot — even when version checking was disabled. The lockfile is now parsed with YAML.safe_load(..., permitted_classes: [Time, Date]). Fixes #1160.
• Fixed Rspack dev-server lazy compilation defaults for Rails split dev-server topology. [PR #1179](shakacode/shakapacker#1179) by justin808. Generated Rspack development configs now set top-level lazyCompilation: false while the dev server is running, preventing Rspack CLI dev-server auto-lazy behavior from routing dynamic imports through lazy trigger URLs Rails does not serve. Apps that intentionally use lazy compilation can still set a safe top-level lazyCompilation value in their Rspack config.
• Fixed Rspack dev-server config loading during static watch builds. [PR #1142](shakacode/shakapacker#1142) by justin808. The Rspack devServer configuration is now gated behind WEBPACK_SERVE=true, matching the webpack development config, so static watch builds (bin/shakapacker --watch) no longer load the dev-server client. The devMiddleware.writeToDisk filter that skips hot-update files is preserved. Fixes #1137.
• Fixed compiler strategies ignoring the instance config of custom Shakapacker::Instance objects. [PR #1147](shakacode/shakapacker#1147) by justin808. Ports #976 by brunodccarvalho. Strategies now read the instance-specific config and watch both webpack and rspack config directories.

v10.1.0

Added

• Added supplemental npm packages shakapacker-webpack and shakapacker-rspack. [PR #1096](shakacode/shakapacker#1096), [PR #1133](shakacode/shakapacker#1133) by justin808. Optional packages that lockstep with core and declare the managed-build stack as required peer dependencies (so on npm 7+ a single yarn add shakapacker-webpack auto-installs shakapacker, webpack, webpack-cli, and webpack-assets-manifest; shakapacker-rspack declares shakapacker, @rspack/core, @rspack/cli, and rspack-manifest-plugin). Required peers eliminate the silent duplicate-bundler failure mode that direct dependencies could cause when an app or transitive dep pins a different bundler version. Optional features (transpilers, dev-server, CSS preprocessors, react-refresh) remain as opt-in peerDependencies so SCSS/native-binding bloat isn't forced on every install. The wrappers emit structured warnings (SHAKAPACKER_BUNDLER_MISMATCH, SHAKAPACKER_NO_TRANSPILER) when config.assets_bundler or javascript_transpiler doesn't match the installed peers. pnpm and Yarn PnP users should keep packages imported by app config files as explicit app dependencies (the Rails installer handles this automatically). See the v10.1 migration guide for adoption steps and https://github.com/shakacode/shakapacker/blob/HEAD/docs/dependency-strategy.md for the design rationale and v11 roadmap.
• Added shakapacker:doctor check for disabled Rspack cache. [PR #1100](shakacode/shakapacker#1100) by justin808. The doctor now inspects the Rspack config file for an explicit cache: false, warns when found (disabling cache causes significantly slower builds), and also flags Rspack v1 installs (where persistent cache is experimental) with a recommendation to upgrade to v2.
• Added a shakapacker:doctor hint to compiler output. [PR #1100](shakacode/shakapacker#1100) by justin808. The compiler now logs a one-time tip suggesting bundle exec rake shakapacker:doctor after a failed compilation, so healthy build loops stay quiet.

Migration Notes

• Simplify your package.json by adopting a supplemental package. On npm 7+ (or Yarn 2+ in nodeLinker: node-modules mode), existing apps can drop the explicit managed-build deps from devDependencies and let the supplemental package's required peers be auto-installed:

  • Rspack apps can replace shakapacker + @rspack/core + @rspack/cli + rspack-manifest-plugin with a single shakapacker-rspack. See packages/shakapacker-rspack/README.md §"Simplifying an existing rspack install" for the before/after.
  • Webpack apps can replace shakapacker + webpack + webpack-cli + webpack-assets-manifest with a single shakapacker-webpack. See packages/shakapacker-webpack/README.md §"Simplifying an existing webpack install" for the before/after.
  • Optional peers (transpilers, webpack-dev-server, CSS preprocessors, react-refresh) stay only if your app uses those features.
  • Adoption is opt-in: leaving your package.json untouched on v10.1 also continues to work.

• Adopting shakapacker-webpack requires webpack-assets-manifest@^6.0.0. Core shakapacker still accepts both v5 and v6 (^5.0.6 || ^6.0.0), but shakapacker-webpack pins ~6.5.1. Apps still on webpack-assets-manifest@5.x must upgrade when switching to the supplemental package; v6 fixed an ENOENT crash on clean builds with merge: true and dropped a Node 14 install path. See the v5→v6 release notes and packages/shakapacker-webpack/README.md for details.

⚠️ Breaking Changes

• Breaking: tightened package.json engines.node to ^20.19.0 || >=22.12.0. [PR #1099](shakacode/shakapacker#1099) by justin808. Raised from >= 20, dropping support for Node 20.0.0–20.18.x and Node 21.x to match @rspack/core@2.0.0-rc.0. Consumers on those versions will hit an engine error with --engine-strict or yarn workspaces and need to upgrade. The PR also bumps .node-version to 22.20.0 and updates conductor-setup.sh to enforce the same disjoint range up front, so contributors get a clear error before yarn install fails with a confusing engine mismatch.

Changed

• Changed shakapacker:install to default fresh Rspack installs to v2 (^2.0.0-0). [PR #1091](shakacode/shakapacker#1091) by ihabadham. lib/install/package.json now declares @rspack/core and @rspack/cli as ^1.0.0 || ^2.0.0-0; fresh installs pick the v2 range. Existing apps are unaffected. Note: Rspack v2 requires Node.js 20.19.0+.
• Slimmed the published gem from ~486K (294 files) to ~121K (75 files). [PR #1110](shakacode/shakapacker#1110), [PR #1120](shakacode/shakapacker#1120) by justin808. Replaced the broad git ls-files gem manifest with an explicit runtime/install allowlist (CHANGELOG.md, MIT-LICENSE, README.md, gemspec, lib, sig, package.json), excluding repo-only docs, tests, JavaScript package source, CI/tooling files, and test_files metadata from the published gem. Fixes #987.

... (truncated)

Changelog

Sourced from shakapacker's changelog.

[v10.2.0] - July 3, 2026

Added

• Added webpack_compile_flags configuration. [PR #1180](shakacode/shakapacker#1180) by justin808. Allows Rails-driven Shakapacker compiles to pass extra webpack/rspack CLI flags, such as --fail-on-warnings or --progress, through bin/shakapacker. Fixes #1175.
• Added AI analysis prompt generation to the config exporter. [PR #695](shakacode/shakapacker#695), [PR #1184](shakacode/shakapacker#1184) by justin808. When running doctor mode (bin/shakapacker-config --doctor), the exporter now also writes an AI-ANALYSIS-PROMPT.md: a ready-to-paste prompt that guides an AI assistant (ChatGPT, Claude, Gemini, etc.) to review the configuration for migration issues (webpack ↔ rspack), build errors, client/server and development/production optimizations, and best practices. The React on Rails–specific guidance in the generated prompt is included only when React on Rails is detected in the app (via package.json, Gemfile, or Gemfile.lock). This is purely additive; existing exports are unchanged, and a failure to write the prompt file only warns without affecting the exported configs.
• Added support for sass-loader v17. [PR #1141](shakacode/shakapacker#1141) by fukayatsu. Widened the optional sass-loader peer range to ^13.0.0 || ^14.0.0 || ^15.0.0 || ^16.0.0 || ^17.0.0 in core shakapacker, shakapacker-webpack, and shakapacker-rspack. The Sass rule already selects loadPaths for v16+ and keeps api: "modern", both of which remain valid in v17. Note that sass-loader v17 requires Node.js 22.11.0+ and drops node-sass and the legacy Sass JS API, so apps that opt into v17 must already be on Node 22.12+ (the upper branch of Shakapacker's engines.node range).
• Added Babel 8 peer dependency support. [PR #1187](shakacode/shakapacker#1187) by justin808. Widened the Babel peer ranges in core shakapacker and the shakapacker-webpack supplemental package to allow Babel 8, and updated the Shakapacker Babel preset to omit options removed in Babel 8 while preserving existing Babel 7 behavior. Repository development pins stay on Babel 7, with added compatibility tests covering Babel 8. Refs #1163.

Changed

• New installs now default to Rspack instead of webpack. [PR #1150](shakacode/shakapacker#1150) by justin808. bundle exec rake shakapacker:install now scaffolds an Rspack project (config, dependencies, and config/shakapacker.yml) by default. This is a new-install default only: existing applications are unaffected. The Rspack default applies only to brand-new installs — re-running the installer on an app that already has a config/shakapacker.yml keeps that app's current bundler (and installs that bundler's dependencies), so the installer never silently switches an existing project's bundler. To install with webpack, run bundle exec rake shakapacker:install[webpack] or set SHAKAPACKER_ASSETS_BUNDLER=webpack; to change an existing app's bundler, use bundle exec rake shakapacker:switch_bundler.
• Changed Rspack support to target Rspack v2 only. [PR #1179](shakacode/shakapacker#1179) by justin808. Core, installer, switch-bundler defaults, supplemental package, dummy app, and docs now use @rspack/core, @rspack/cli, @rspack/dev-server, and @rspack/plugin-react-refresh v2 ranges. Rspack installs now also require rspack-manifest-plugin@^5.2.2, and shakapacker-rspack requires css-loader@^7.1.4 for Rspack v2 peer compatibility. The Rspack React Refresh loader now uses the v2 named ReactRefreshRspackPlugin export instead of retaining legacy v1 export-shape fallbacks.

Fixed

• Fixed helper binstubs and doctor checks for subdirectory JavaScript layouts. [PR #1192](shakacode/shakapacker#1192) by justin808. bin/shakapacker-config and bin/diff-bundler-config now resolve package scripts from a configured client package root before falling back to the Rails root, and shakapacker:doctor now searches package metadata, lockfiles, and installed packages across client/root layouts while reducing false SWC dependency issues for custom hybrid webpack/Rspack setups. Fixes #1170 and #1090.
• Fixed dev-server passthrough argument validation messages. [PR #1180](shakacode/shakapacker#1180) by justin808. bin/shakapacker-dev-server -- --host ... or --port ... now fails with a clearer Shakapacker message instead of forwarding the separator to the bundler; set dev_server.host and dev_server.port in config/shakapacker.yml instead.
• Fixed shakapacker:export_bundler_config regression on apps upgraded from older Shakapacker versions. [PR #1127](shakacode/shakapacker#1127) by justin808. The task previously invoked bin/shakapacker-config unconditionally via RbConfig.ruby, which crashed when the file was still the legacy JavaScript binstub (#!/usr/bin/env node) left over from earlier installs. The task now inspects the shebang and exec's the file directly when it points at Node, while keeping the Ruby+RbConfig.ruby path for the current Ruby binstub. Affected users are also nudged to run bundle exec rake shakapacker:binstubs to refresh their helper binstub. Refs #1123.
• Fixed shakapacker:doctor Sass implementation detection for sass-embedded apps. [PR #1178](shakacode/shakapacker#1178) by justin808. The doctor now accepts either modern Sass implementation package (sass or sass-embedded) when Sass files are present, matching Shakapacker's default modern Sass API instead of incorrectly requiring Dart Sass. New installs also include sass alongside sass-loader. Fixes #1172.
• Fixed Psych::DisallowedClass boot crash when pnpm-lock.yaml contains a time: section. [PR #1161](shakacode/shakapacker#1161) by justin808. pnpm >= 10.16 (default in pnpm 11) writes publish timestamps into pnpm-lock.yaml that Psych 4+ refuses to safe-load, so the shakapacker.version_checker boot initializer raised Psych::DisallowedClass: Tried to load unspecified class: Time and crashed every Rails boot — even when version checking was disabled. The lockfile is now parsed with YAML.safe_load(..., permitted_classes: [Time, Date]). Fixes #1160.
• Fixed Rspack dev-server lazy compilation defaults for Rails split dev-server topology. [PR #1179](shakacode/shakapacker#1179) by justin808. Generated Rspack development configs now set top-level lazyCompilation: false while the dev server is running, preventing Rspack CLI dev-server auto-lazy behavior from routing dynamic imports through lazy trigger URLs Rails does not serve. Apps that intentionally use lazy compilation can still set a safe top-level lazyCompilation value in their Rspack config.
• Fixed Rspack dev-server config loading during static watch builds. [PR #1142](shakacode/shakapacker#1142) by justin808. The Rspack devServer configuration is now gated behind WEBPACK_SERVE=true, matching the webpack development config, so static watch builds (bin/shakapacker --watch) no longer load the dev-server client. The devMiddleware.writeToDisk filter that skips hot-update files is preserved. Fixes #1137.
• Fixed compiler strategies ignoring the instance config of custom Shakapacker::Instance objects. [PR #1147](shakacode/shakapacker#1147) by justin808. Ports #976 by brunodccarvalho. Strategies now read the instance-specific config and watch both webpack and rspack config directories.

[v10.1.0] - May 27, 2026

Added

• Added supplemental npm packages shakapacker-webpack and shakapacker-rspack. [PR #1096](shakacode/shakapacker#1096), [PR #1133](shakacode/shakapacker#1133) by justin808. Optional packages that lockstep with core and declare the managed-build stack as required peer dependencies (so on npm 7+ a single yarn add shakapacker-webpack auto-installs shakapacker, webpack, webpack-cli, and webpack-assets-manifest; shakapacker-rspack declares shakapacker, @rspack/core, @rspack/cli, and rspack-manifest-plugin). Required peers eliminate the silent duplicate-bundler failure mode that direct dependencies could cause when an app or transitive dep pins a different bundler version. Optional features (transpilers, dev-server, CSS preprocessors, react-refresh) remain as opt-in peerDependencies so SCSS/native-binding bloat isn't forced on every install. The wrappers emit structured warnings (SHAKAPACKER_BUNDLER_MISMATCH, SHAKAPACKER_NO_TRANSPILER) when config.assets_bundler or javascript_transpiler doesn't match the installed peers. pnpm and Yarn PnP users should keep packages imported by app config files as explicit app dependencies (the Rails installer handles this automatically). See the v10.1 migration guide for adoption steps and https://github.com/shakacode/shakapacker/blob/main/docs/dependency-strategy.md for the design rationale and v11 roadmap.
• Added shakapacker:doctor check for disabled Rspack cache. [PR #1100](shakacode/shakapacker#1100) by justin808. The doctor now inspects the Rspack config file for an explicit cache: false, warns when found (disabling cache causes significantly slower builds), and also flags Rspack v1 installs (where persistent cache is experimental) with a recommendation to upgrade to v2.
• Added a shakapacker:doctor hint to compiler output. [PR #1100](shakacode/shakapacker#1100) by justin808. The compiler now logs a one-time tip suggesting bundle exec rake shakapacker:doctor after a failed compilation, so healthy build loops stay quiet.

Migration Notes

• Simplify your package.json by adopting a supplemental package. On npm 7+ (or Yarn 2+ in nodeLinker: node-modules mode), existing apps can drop the explicit managed-build deps from devDependencies and let the supplemental package's required peers be auto-installed:

  • Rspack apps can replace shakapacker + @rspack/core + @rspack/cli + rspack-manifest-plugin with a single shakapacker-rspack. See packages/shakapacker-rspack/README.md §"Simplifying an existing rspack install" for the before/after.
  • Webpack apps can replace shakapacker + webpack + webpack-cli + webpack-assets-manifest with a single shakapacker-webpack. See packages/shakapacker-webpack/README.md §"Simplifying an existing webpack install" for the before/after.
  • Optional peers (transpilers, webpack-dev-server, CSS preprocessors, react-refresh) stay only if your app uses those features.
  • Adoption is opt-in: leaving your package.json untouched on v10.1 also continues to work.

• Adopting shakapacker-webpack requires webpack-assets-manifest@^6.0.0. Core shakapacker still accepts both v5 and v6 (^5.0.6 || ^6.0.0), but shakapacker-webpack pins ~6.5.1. Apps still on webpack-assets-manifest@5.x must upgrade when switching to the supplemental package; v6 fixed an ENOENT crash on clean builds with merge: true and dropped a Node 14 install path. See the v5→v6 release notes and packages/shakapacker-webpack/README.md for details.

⚠️ Breaking Changes

• Breaking: tightened package.json engines.node to ^20.19.0 || >=22.12.0. [PR #1099](shakacode/shakapacker#1099) by justin808. Raised from >= 20, dropping support for Node 20.0.0–20.18.x and Node 21.x to match @rspack/core@2.0.0-rc.0. Consumers on those versions will hit an engine error with --engine-strict or yarn workspaces and need to upgrade. The PR also bumps .node-version to 22.20.0 and updates conductor-setup.sh to enforce the same disjoint range up front, so contributors get a clear error before yarn install fails with a confusing engine mismatch.
• Breaking: native ESM named imports of lazy baseConfig and rules no longer work. [PR #1107](shakacode/shakapacker#1107) by justin808. The side-effect fix for #1095 reimplements baseConfig and rules as lazy getters, so Node no longer statically detects those two CommonJS properties as named exports. Native ESM consumers must access them via the default import (import shakapacker from 'shakapacker'; const { baseConfig, rules } = shakapacker, or the same pattern for shakapacker/rspack) rather than import { baseConfig, rules } ..., which now throws a SyntaxError at load time. Other named imports (config, generateWebpackConfig, env, merge, generateRspackConfig, etc.) are unaffected and explicitly preserved. CommonJS access (require('shakapacker').baseConfig, require('shakapacker/rspack').baseConfig) — including direct assignment to override the lazy value — continues to work.

Changed

... (truncated)

Commits

• 6fecdd3 Release 10.2.0
• 1d2cb92 Update changelog for v10.2.0 (#1199)
• 62fc5f8 Support subdirectory tooling and hybrid doctor hints (#1192)
• 31cd41e docs: clarify rspack wrapper peer deps (#1193)
• 57d3bf1 Add supplemental dummy install smoke coverage (#1186)
• 6583abd Support Babel 8 peer ranges (#1187)
• 0413266 Gate React on Rails AI prompt context (#1184)
• dcaac6b Document multi-target SSR watch workflow (#1189)
• e264b92 Clarify dependency strategy planning status (#1188)
• 1d7a12a Replace helper binstub sync note (#1183)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #3099.