Validate RSC RC4 with React on Rails RC3

[justin808]

Summary

• Upgrade React on Rails and React on Rails Pro to 17.1.0.rc.3.
• Upgrade React on Rails Pro's node renderer to 17.1.0-rc.3.
• Validate the registry-published react-on-rails-rsc@19.3.0-rc.4 with React, React DOM, and React Server DOM Webpack 19.2.8.
• Refresh the Ruby and Yarn lockfiles from the public registries.

This is the downstream tutorial validation candidate for the empty "use client" module fix from react-on-rails-rsc issue #823 / PR #230.

Manual verification

Regression control

With the same dependency set except react-on-rails-rsc@19.3.0-rc.3, yarn build:dev reproduced the expected failure:

react-on-rails-rsc: the "use client" module .../client/app/packs/stores-registration.js has no runtime exports, so no server component can reference it
webpack compiled with 1 error

After restoring the registry-published react-on-rails-rsc@19.3.0-rc.4, the identical build passed. The RSC bundle included stores-registration.js as a one-byte module without treating it as an error.

Passing gates

• yarn install --frozen-lockfile --non-interactive (using an isolated Yarn cache)
• yarn build:dev (client, server, and RSC bundles all compiled successfully)
• Required artifact assertions: nonempty client manifest, RSC client manifest, server bundle, RSC bundle, and server/client manifest
• bundle exec rake ci:js: 4 suites, 16 tests, 0 failures
• Live Rails + node-renderer smoke:
  • /: HTTP 200
  • /server-components: HTTP 200 with the RSC demo, server environment, and live activity content
  • /rsc_payload/ServerComponentsPage?props=%7B%7D: HTTP 200, application/x-ndjson, nonempty payload
• spec/requests/server_components_spec.rb: 5 examples, 0 failures
• spec/system/server_components_demo_spec.rb: 5 examples, 0 failures
• bundle exec rake ci:rspec: 80 examples, 0 failures
• RuboCop: 59 files, 0 offenses
• ESLint: 0 errors (one existing react/no-danger warning)

The machine had a stale chromedriver 150 earlier in PATH while Chrome was 153. The first browser-only attempt failed before opening a session. Re-running with that stale executable excluded let Selenium Manager select the compatible driver, after which both targeted system specs and the full RSpec suite passed.

Package provenance

The Yarn lockfile resolves react-on-rails-rsc@19.3.0-rc.4 from the public npm registry with integrity:

sha512-+oJbP947a1e8Pg8GzhsWJxXmtiEyNJCGlX9oxmOGFonVxS9znet8sPpq8imaSi5ak6heNd4SlY6cX4cbgAbVhw==

The published package reports git head 78f78ce878dd7f84098d3128a453a2fb3bc7e258.

---

Note

Medium Risk
Release-candidate upgrades across SSR, node renderer, and RSC bundling affect all client/server/RSC builds; risk is mitigated by lockfile-only changes and reported CI/smoke validation, but runtime behavior can still shift with RC bits.

Overview
Bumps the React on Rails stack to 17.1.0.rc.3 (Ruby react_on_rails_pro / npm react-on-rails-pro and node renderer) and pins React 19.2.8 with react-on-rails-rsc@19.3.0-rc.4 and matching react-server-dom-webpack, replacing the prior 17.0.0 / ~19.2.7 / 19.2.1-rc.1 set.

Lockfiles (Gemfile.lock, yarn.lock) and README version targets are refreshed so Ruby and JS stay aligned; Ruby transitive deps (e.g. async, async-http) move with the Pro gem.

This is a downstream validation release for the RSC fix that allows empty "use client" modules (e.g. stores-registration.js) to build without webpack errors—no application source changes in the diff.

^{Reviewed by Cursor Bugbot for commit 318eb5d. Bugbot is set up for automated code reviews on this repo. Configure here.}

Summary by CodeRabbit

• Chores
  • Updated the application’s React and server-rendering components to newer release candidates.
  • Aligned React package versions for more consistent runtime behavior.
  • Updated the React on Rails Pro integration to the latest release candidate.

[github-actions]

No description provided.

[github-actions]

🚀 Quick Review App Commands

Welcome! Here are the commands you can use in this PR:
They require the repository to have cpflow review apps configured, including the CPLN_TOKEN_STAGING secret.

+review-app-deploy

Deploy your PR branch for testing.

+review-app-delete

Remove the review app when done.

+review-app-help

Show detailed instructions, environment setup, and configuration options.

Comment +review-app-help for full setup details.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-12T23:06:44.604697Z	1c3e0a7	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: a0b5a86d-baef-4ea0-82b6-f4e247b5b2b2

📥 Commits

Reviewing files that changed from the base of the PR and between f760670 and 1c3e0a7.

⛔ Files ignored due to path filters (2)

• Gemfile.lock is excluded by !**/*.lock
• yarn.lock is excluded by !**/yarn.lock, !**/*.lock

📒 Files selected for processing (2)

• Gemfile
• package.json

Included review availability: Your plan provides up to 4 included reviews per hour; 3 remain after this review.

---

Walkthrough

The project updates React, React DOM, React Server Components, React on Rails Pro, and the Node renderer versions in package.json and Gemfile.

Changes

React on Rails dependency updates

Layer / File(s)	Summary
Dependency version alignment Gemfile, package.json	React and React DOM are pinned to 19.2.8. React on Rails Pro packages are upgraded to 17.1.0-rc.3. React Server Components is upgraded to 19.3.0-rc.4. The Ruby gem uses 17.1.0.rc.3.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to 1c3e0

The dependency upgrade is mergeable with no unresolved correctness or integration risk identified.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the primary change: validating RSC RC4 with React on Rails RC3. It is concise and specific.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch jg-codex/validate-ror17-rc3-rsc-rc4

Warning

Some tools did not complete. Review the errors below.

🔧 ESLint

If the error stems from missing dependencies, add them to the package.json file. For unrecoverable errors (e.g., due to private dependencies), disable the tool in the CodeRabbit configuration.

package.json

Parsing error: Missing semicolon. (2:8)

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[justin808]

Manual verification: registry-backed RC4

Environment: fresh clone of master at f760670c2097fe10382cee63d23cc28b41822a65, Ruby 3.4.6, Node 22.12.0, Yarn 1.22.22, PostgreSQL 11, registry-installed packages.

Before / regression control: changing only react-on-rails-rsc to 19.3.0-rc.3 made the RSC build reject client/app/packs/stores-registration.js because the "use client" module has no runtime exports. Build exited nonzero.

After: restoring public react-on-rails-rsc@19.3.0-rc.4 made the identical development build pass; the empty registration module was included without an error.

Additional evidence: frozen Yarn install passed; all required output artifacts were nonempty; JS tests passed 16/16; live /, /server-components, and the direct NDJSON RSC payload endpoint returned 200; targeted RSC request specs passed 5/5; targeted browser RSC specs passed 5/5; full RSpec passed 80/80; RuboCop had 0 offenses; ESLint had 0 errors.

Browser environment note: the first local system-spec attempt was blocked before page load by a stale ChromeDriver 150 in PATH against Chrome 153. Excluding that stale executable allowed Selenium Manager to select the compatible driver, after which targeted and full browser-bearing suites passed.

[greptile-apps]

Confidence Score: 4/5

The dependency upgrade appears safe to merge, with a non-blocking documentation update needed to keep the tutorial’s declared version targets accurate.

Findings

1.  Version Targets Are Stale ▶

Summary

• Upgrades the React on Rails Pro Ruby and npm packages, including the node renderer, to 17.1.0 RC3.
• Pins React, React DOM, and React Server DOM Webpack to 19.2.8.
• Upgrades react-on-rails-rsc to 19.3.0 RC4 and records its new parser dependencies.
• Refreshes the associated Ruby async HTTP stack.

_{Reviews (1) · Last reviewed commit: "Validate RSC RC4 with React on Rails RC3"}

[claude]

Review summary

This PR is a mechanical dependency bump touching only Gemfile, Gemfile.lock, package.json, and yarn.lock — no application code changed. Given the thorough manual verification already documented in the PR body (build, RSC bundle, live smoke tests, RSpec/ESLint/RuboCop all green), I focused on the dependency changes themselves.

Findings (left as inline comments):

• react-on-rails-rsc is bumped to a pre-release (19.3.0-rc.4), alongside RC builds of react-on-rails-pro/react-on-rails-pro-node-renderer/react_on_rails_pro (Ruby gem). This is clearly intentional — it's validating an upstream fix ahead of a stable cut — but since this repo doubles as the public tutorial/reference, it'd be good to track a follow-up to pin back to stable releases once 19.3.0/17.1.0 are officially released, so people copying from the tutorial don't inherit RC deps.
• react, react-dom, and react-server-dom-webpack moved from ~19.2.7-style patch ranges to exact pins (19.2.8, no ~). That's reasonable while validating this specific RC combo, but it's a slightly bigger scope change (loses automatic patch updates for React itself) than the RC version bumps the PR is otherwise about — worth confirming it's intentional rather than incidental.

No issues found in:

• Gemfile.lock transitive bumps (async, protocol-http*, io-event/io-stream, etc.) — version constraints are internally consistent (e.g. protocol-http2's ~> 0.62 and protocol-http1's ~> 0.68 both correctly permit the new protocol-http 0.71.0).
• yarn.lock — the duplicate @babel/parser/@babel/types/etc. entries are just the new @babel/parser ^7.28.5 dependency pulled in by react-on-rails-rsc@19.3.0-rc.4 coexisting with older ranges; normal yarn.lock behavior, not a bug.
• No stray references to the old pinned versions (17.0.0, 19.2.7, 19.2.1) were left elsewhere in the repo.

No security or correctness issues introduced by this diff itself beyond the general (acknowledged) risk of depending on pre-release packages.

[github-actions]

No description provided.

[justin808]

Address-review summary

Scan scope: full PR history through 2026-09-12T23:07:00Z (no earlier address-review checkpoint).

Mattered

• Fixed the stale README Version Targets in 318eb5d; they now match the exact RC combination tested by this PR.
• Confirmed that the exact React 19.2.8 trio is intentional for reproducible RC validation and documented that purpose in the README.
• Confirmed that moving the tutorial from RCs to stable releases is covered by the React on Rails 17.1.0 release tracker: Release gate: react_on_rails 17.1.0 react_on_rails#4842.

Skipped

• CodeRabbit reported no actionable findings. Its JSON-as-JavaScript ESLint parser warning is tool noise; repository ESLint passed with zero errors.
• Other bot summary/status comments required no action.

All three inline review threads were replied to and resolved. Next default scan starts after this comment. Say check all reviews to rescan the full PR.

[claude]

Reviewed. This is a clean, self-contained dependency/lockfile bump — no application source changes, and I verified there are no other stale version references left behind (checked .controlplane/templates/*.yml, .github/workflows/*.yml, renderer/node-renderer.js, spec/initializers/react_on_rails_pro_spec.rb). The manual verification in the description (regression control showing the old RSC RC3 failure, passing build/test gates, package provenance/integrity check) is thorough for a version-bump PR.

Two minor, non-blocking observations:

1. Exact pins replace range pins for React packages. react, react-dom, and react-server-dom-webpack move from ~19.2.7 to exact 19.2.8 in package.json (README calls these "exact RC validation pins"). That's reasonable while validating an RC combo, but worth a tracking note/issue to relax back to a ~/^ range once react-on-rails-rsc reaches GA, so the tutorial doesn't silently miss future patch releases.

2. Multiple RC dependencies stacked together (react_on_rails_pro@17.1.0.rc.3, react-on-rails-pro-node-renderer@17.1.0-rc.3, react-on-rails-rsc@19.3.0-rc.4). Since this repo is a public tutorial that people copy from, it may be worth a follow-up reminder/issue to swap these for stable releases once available, so newcomers don't end up pinned to RC builds long-term.

Nothing here blocks the merge — the lockfile changes look internally consistent (Gemfile.lock/yarn.lock resolve cleanly per the reported CI runs), and the version-target table in README.md was updated in sync with package.json/Gemfile.

[justin808]

Address-review summary

Scan scope: review activity after the previous summary at 2026-09-12T23:09:04Z.

Mattered

• None. The current head has no correctness, security, or integration findings.

Optional

• Claude's two non-blocking reminders (restore normal React patch-range policy and move the tutorial to stable React on Rails/RSC releases after GA) are covered by the existing React on Rails 17.1.0 release tracker: Release gate: react_on_rails 17.1.0 react_on_rails#4842. No additional issue is needed.

Skipped

• No new inline findings or status noise needing action.

All current-head checks are terminal and green, and all inline review threads are resolved. Next default scan starts after this comment. Say check all reviews to rescan the full PR.