Bump the major-updates group across 1 directory with 10 updates

[dependabot]

Bumps the major-updates group with 9 updates in the / directory:

Package	From	To
discard	1.4.0	2.0.0
haml	5.2.2	7.5.1
i18n-js	3.9.2	4.2.4
shakapacker	9.5.0	10.3.2
sentry-rails	6.7.0	7.0.0
rspec-rails	6.1.5	8.0.4
shoulda-matchers	7.0.1	8.0.1
simplecov	0.22.0	1.2.0
puma	7.2.1	8.0.2

Updates discard from 1.4.0 to 2.0.0

Changelog

Sourced from discard's changelog.

Version 2.0.0

Release date: 2026-05-27

• Require ActiveRecord >= 7.0; drop support for Rails 6.x and earlier
• Wrap #discard / #undiscard in a transaction so callback exceptions roll back the DB write (#84, #77)

Commits

• cdeb3d4 Version 2.0.0
• 94effaf Document current interaction with validations
• 7a0a61c Merge pull request #124 from jarednorman/pr-84
• 60fb990 Wrap discard methods in a transaction
• 0e68168 CI: drop Ruby 3.1, add Ruby 3.4
• c1d5888 Raise ActiveRecord floor to 7.0
• 7a9417d Merge pull request #116 from okuramasafumi/fix-ci
• f7dd775 Merge pull request #118 from SuperGoodSoft/fix-tests
• 26f3113 Update readme to have correct test command
• 4340d3f Fix tests
• Additional commits viewable in compare view

Updates haml from 5.2.2 to 7.5.1

Release notes

Sourced from haml's releases.

v7.5.1

What's Changed

• Improve frozen strings management by @​tagliala in haml/haml#1205

Full Changelog: haml/haml@v7.5.0...v7.5.1

v7.5.0

What's Changed

• Remove redundant require and use extend directly by @​tagliala in haml/haml#1204
• Compile a multi-line attribute hash statically by @​wilfison in haml/haml#1222

Full Changelog: haml/haml@v7.4.1...v7.5.0

v7.4.1

What's Changed

• Build the preserve regex once per tag list instead of per call by @​wilfison in haml/haml#1220

Full Changelog: haml/haml@v7.4.0...v7.4.1

v7.4.0

What's Changed

• Cut per-render overhead in AttributeBuilder by @​wilfison in haml/haml#1216
• Keep interpolated text in the source encoding by @​fukayatsu in haml/haml#1221
• Pick the html_safe escaper once at load instead of per value by @​wilfison in haml/haml#1217

Full Changelog: haml/haml@v7.3.1...v7.4.0

v7.3.1

What's Changed

• Keep Prism-derived fragments in the source encoding by @​fukayatsu in haml/haml#1219

New Contributors

• @​fukayatsu made their first contribution in haml/haml#1219

Full Changelog: haml/haml@v7.3.0...v7.3.1

v7.3.0

What's Changed

• Add info to metadata by @​Nymuxyzo in haml/haml#1213
• Replace Ripper with Prism by @​wilfison in haml/haml#1214

New Contributors

• @​Nymuxyzo made their first contribution in haml/haml#1213
• @​wilfison made their first contribution in haml/haml#1214

Full Changelog: haml/haml@v7.2.2...v7.3.0

... (truncated)

Changelog

Sourced from haml's changelog.

7.5.1

• Improve frozen strings management haml/haml#1205

7.5.0

• Compile a multi-line attribute hash statically haml/haml#1222
  • Errors from multi-line attributes will be reported on the tag's line instead of the expression that raised the error.

7.4.1

• Build the preserve regex once per tag list instead of per call haml/haml#1220

7.4.0

• Haml::BOOLEAN_ATTRIBUTES is changed from Array to Set haml/haml#1216
• A guard on respond_to?(:html_safe?) is removed from Haml::Util.escape_html_safe haml/haml#1217
• Keep interpolated text in the source encoding, fixing the Encoding::CompatibilityError remaining on an ASCII-8BIT template source that mixes plain text and interpolation with non-ASCII characters haml/haml#1218

7.3.1

• Keep Prism-derived fragments in the source encoding, fixing Encoding::CompatibilityError on an ASCII-8BIT template source with non-ASCII characters (regression in 7.3.0) haml/haml#1218

7.3.0

• Replace Ripper with Prism haml/haml#1214
  • Interpolate #@ivar, #$gvar and #@@cvar in string literals instead of dropping them
  • Keep an escaped delimiter of a percent literal, so = %q{a\}b} renders a}b
  • Deprecate Haml::AttributeParser.available?, which is now always true and will be removed in the future

7.2.2

• Remove obsolete TruffleRuby compatibility skips haml/haml#1210

7.2.1

• Do not rely on Ripper quirk in parsing old-style Haml attributes haml/haml#1212

7.2.0

• Do not require rails when haml is required haml/haml#1201
• Point changelog_uri to GitHub Releases haml/haml#1202

7.1.0

• Support xhtml format for boolean nested data attributes haml/haml#1200

7.0.2

... (truncated)

Commits

• c06aad5 Version 7.5.1
• 3e6dbb3 Improve frozen strings management (#1205)
• d1a4022 Version 7.5.0
• 281f030 Compile a multi-line attribute hash statically
• 0b503a3 Move the attribute newline count onto DynamicAttributes
• 234a855 Count lines through fescape and html attribute expressions
• f86c0cc Remove redundant require and use extend directly (#1204)
• 7f51ae7 Version 7.4.1
• fce2365 Move find_and_preserve into Haml::Preserver
• 26c36cd Drop the tag list from the emitted find_and_preserve call
• Additional commits viewable in compare view

Updates i18n-js from 3.9.2 to 4.2.4

Changelog

Sourced from i18n-js's changelog.

Changelog

v5.0.0.rc1 - Jun 02, 2026

• [Added] embed_fallback_translations plugin now supports I18n.fallbacks, and will switch to it automatically if you're using a backend that includes the I18n::Backend::Fallbacks module and have I18n.fallbacks configured.
• [Changed] i18n lint:translations and i18n lint:scripts now support globs in their ignore option.
• [Removed] Previous versions allowed bare keys in lint's :ignore rule. This is no longer supported; instead, use *.key.
• [Removed] Remove i18n check; use i18n lint:translations instead.
• [Fixed] Return the number of missing translations as the exit code when running i18n lint:scripts.
• [Changed] Plugin configuration moved from top-level keys to a pipeline: array in the config file. Each entry requires a plugin: key identifying the plugin and an enabled: key. Plugin-specific options are defined inline in the same stage object.
• [Changed] I18nJS::Plugin.key is now a class method returning a String. Previously it was an instance method called config_key that returned a Symbol.
• [Changed] I18nJS::Plugin#initialize now accepts plugin_config: and main_config: instead of a single config: argument.
• [Changed] I18nJS::Plugin#config now returns only the plugin's own configuration slice instead of the full main config.
• [Changed] I18nJS.initialize_plugins! now returns the list of active plugin instances. The I18nJS.plugins accessor has been removed.
• [Changed] I18nJS::Schema.root_keys is now a frozen Array. Plugins no longer need to register a root key in their setup method.
• [Changed] Schema validation paths in validate_schema are now relative to the plugin's own config root. Remove the leading config_key segment from all paths passed to schema.* helpers.
• [Removed] The check: root key is no longer recognised by the schema validator. Remove it from your config file.
• [Added] A single plugin class can now appear multiple times in the pipeline with different configurations, each running as an independent instance.
• [Changed] Export translations in parallel. To enable parallel mode, your output file definition must include the :locale placeholder.

... (truncated)

Commits

• f8fb0dc Bump up version (4.2.4).
• 2cbea21 Remove benchmark gem (#737)
• 9f99172 Update matrix.
• 9096c6e Fix rubocop warnings.
• 237b69b Update --quiet param description (#730)
• 1f3305f Update action.
• 674cb07 Fix rubocop warning.
• 877e6f1 Update actions.
• 7e27159 Require ruby 3.2+.
• 58c32fd Disable rubocop rule.
• Additional commits viewable in compare view

Updates shakapacker from 9.5.0 to 10.3.2

Release notes

Sourced from shakapacker's releases.

v10.3.2

Changed

• Bumped the development and CI pin for Rspack from 2.0.1 to 2.2.0. [PR #1258](shakacode/shakapacker#1258) by justin808. The @rspack/core, @rspack/cli, @rspack/dev-server, and @rspack/plugin-react-refresh peer ranges are unchanged at ^2.0.0, so applications may stay on any Rspack 2.x release; only this repository's own development pins and dummy-app lockfiles move, so CI now exercises Rspack 2.2 against the range it already advertises. Annotated config exports (bin/shakapacker-config --annotate) also now list the complete optimization.moduleIds and optimization.chunkIds value sets for both bundlers, including 'compat-hashed', which requires Rspack 2.2 or newer and is documented as opt-in rather than made a default.

Fixed

• Fixed shakapacker:doctor not telling Rspack apps that a .swcrc is ignored outright. [PR #1276](shakacode/shakapacker#1276) by justin808. Doctor previously told Rspack apps only that moving .swcrc settings into config/swc.config.js would not help, while deliberately making no claim about the .swcrc itself, because the behavior had never been verified. It has now been verified against @rspack/core 2.0.1 and 2.2.0: Rspack's builtin:swc-loader never reads .swcrc. A .swcrc setting jsc.target and injecting an optimizer global produced byte-identical output to no .swcrc at all, while the same options passed inline as loader options did change the output. A .swcrc enabling decorator syntax likewise failed to unblock a decorator source, including with empty loader options and with swcrc/configFile set, so this is not merely inline options taking precedence. Doctor now states that a .swcrc is not read on Rspack and that every setting in it is silently inert - the mirror image of the config/swc.config.js case in #1259 - and continues to point at overriding the built-in builtin:swc-loader rule. Webpack messaging is unchanged. Fixes #1263.
• Fixed shakapacker:doctor staying silent about SWC configuration on Rspack apps that do not set javascript_transpiler: swc. [PR #1269](shakacode/shakapacker#1269) by justin808. Shakapacker's Rspack rules always transpile with builtin:swc-loader and never consult javascript_transpiler, so config/swc.config.js goes unread on an Rspack app configured for Babel or esbuild exactly as it does on one configured for SWC. Doctor's Rspack SWC-configuration warnings were gated on javascript_transpiler: swc, so those apps got no warning at all. Those warnings now reach any Rspack app: that config/swc.config.js is not read, and, for a .swcrc, that moving its settings into config/swc.config.js would not affect the build. The webpack-only SWC content checks and the "merged with Shakapacker's defaults" messaging stay gated on javascript_transpiler: swc, and apps with javascript_transpiler: none remain opted out. Fixes #1265.
• Fixed shakapacker:doctor and rake shakapacker:migrate_to_swc telling Rspack apps that config/swc.config.js is merged into their build. [PR #1260](shakacode/shakapacker#1260) by justin808. Rspack builds never read config/swc.config.js, because Shakapacker's Rspack rules set their builtin:swc-loader options inline. Doctor now warns that the file is unread on Rspack instead of reporting it as merged (and skips its content checks there), and no longer tells Rspack users with a .swcrc to migrate those settings into config/swc.config.js. The migrator's post-migration guidance and the generated file header instead show how to override the built-in builtin:swc-loader rule: apply webpack-merge's mergeWithRules to the output of generateRspackConfig(), since that function merges with plain merge, which concatenates module.rules, so an override passed into it is appended alongside the built-in rule rather than replacing it. Webpack apps keep the existing messaging. Fixes #1259.
• Fixed post-publish GitHub release failures hiding successful package publication details. The release task now prints its normal publication summary and the exact sync_github_release recovery command before exiting nonzero. [PR #1250](shakacode/shakapacker#1250) by justin808.
• Fixed helper binstubs to fail closed when PATH is unset. [PR #1240](shakacode/shakapacker#1240) by justin808. bin/shakapacker-config and bin/diff-bundler-config now report the missing-Node error without executing an app-root node binary when PATH is unset, while explicit PATH values retain their existing Node-resolution behavior. Fixes #1234.
• Fixed the deprecation warning for the legacy bundler config key claiming the value was understood while it was ignored. [PR #1270](shakacode/shakapacker#1270) by justin808. An app whose config/shakapacker.yml set only bundler: was told the key was deprecated and then built with a different bundler, because assets_bundler always resolves from the bundled defaults and the legacy key was never read. The warning now states that the value is ignored, names the bundler actually in use, and tells you to set assets_bundler instead. One resolution change accompanies it: a config that leaves assets_bundler: blank while setting bundler: previously resolved the legacy value in Ruby and now resolves webpack, matching what package/config.ts already built for it. Fixes #1262.

v10.3.1

Fixed

• Fixed 502 responses for proxied dev server assets under rack-proxy v1. [PR #1222](shakacode/shakapacker#1222) by jcbpl. Fixes #1220.
• Fixed dev-server liveness checks treating refused macOS 27 connections as running. The Ruby probe now verifies the connected socket's SO_ERROR result before proxying asset requests, avoiding false-positive dev-server detection and resulting 502 responses. [PR #1225](shakacode/shakapacker#1225) by justin808. Fixes #1224.
• Fixed webpack Babel, SWC, and esbuild rules skipping explicitly included .cjs files. [PR #1219](shakacode/shakapacker#1219) by oiahoon. Fixes #1218.
• Added a shakapacker:doctor warning for Rspack React Refresh v2 configs that still use the v1 default-export constructor pattern. [PR #1207](shakacode/shakapacker#1207) by justin808. Existing configs with const ReactRefreshPlugin = require("@rspack/plugin-react-refresh") followed by new ReactRefreshPlugin() can fail after upgrading to @rspack/plugin-react-refresh v2 with ReactRefreshPlugin is not a constructor; Doctor now points to the affected JS/TS config file and suggests the named-export/default/module compatibility form. Fixes #1204.
• Fixed the missing-@babel/core failure to report an actionable install message. [PR #1212](shakacode/shakapacker#1212) by justin808. Babel-transpiled builds whose app lacks @babel/core previously surfaced a raw module-resolution error from the Babel 8 compatibility check; the rule now explains which package to install and how to switch javascript_transpiler instead. Refs #1163.

Documentation

• Documented the required css-loader@^7.1.4 in the v10 Rspack upgrade instructions. [PR #1211](shakacode/shakapacker#1211) by justin808. The v10 upgrade guide's copy-paste Rspack v2 commands omitted css-loader, so apps following them could upgrade into an unsatisfied peer dependency.

v10.3.0

Added

• Allowed webpack-dev-server v6. [PR #1102](shakacode/shakapacker#1102) by G-Rath.

Fixed

• Fixed implicit SWC defaults for existing webpack/Babel apps without swc-loader. [PR #1206](shakacode/shakapacker#1206) by justin808. Webpack apps that omit both javascript_transpiler and the deprecated webpack_loader now fall back to Babel with a warning when Shakapacker's bundled SWC default is active, swc-loader is missing, and Babel is present. Explicit transpiler settings, webpack apps with swc-loader, and Rspack's built-in SWC path keep their existing behavior. Closes #1203.
• Fixed JavaScript config loading for missing Rails environments to use the production fallback. [PR #1206](shakacode/shakapacker#1206) by justin808. When RAILS_ENV has no matching section in config/shakapacker.yml, the Node package config now merges the production section instead of only bundled defaults, matching Ruby configuration loading and honoring explicit production javascript_transpiler, source_path, dev_server, and related settings for custom environments such as staging.
• Fixed helper binstubs delegating Node resolution to Ruby exec in unset and empty PATH environments. [PR #1200](shakacode/shakapacker#1200) and [PR #1201](shakacode/shakapacker#1201) by justin808. Restores shell-compatible Node lookup for bin/shakapacker-config and bin/diff-bundler-config after the v10.2.0 Ruby-binstub regression, while keeping friendly missing-Node errors for ENOENT and EACCES.

v10.2.0

Added

• Added webpack_compile_flags configuration. [PR #1180](shakacode/shakapacker#1180) by justin808. Allows Rails-driven Shakapacker compiles to pass extra webpack/rspack CLI flags, such as --fail-on-warnings or --progress, through bin/shakapacker. Fixes #1175.
• Added AI analysis prompt generation to the config exporter. [PR #695](shakacode/shakapacker#695), [PR #1184](shakacode/shakapacker#1184) by justin808. When running doctor mode (bin/shakapacker-config --doctor), the exporter now also writes an AI-ANALYSIS-PROMPT.md: a ready-to-paste prompt that guides an AI assistant (ChatGPT, Claude, Gemini, etc.) to review the configuration for migration issues (webpack ↔ rspack), build errors, client/server and development/production optimizations, and best practices. The React on Rails–specific guidance in the generated prompt is included only when React on Rails is detected in the app (via package.json, Gemfile, or Gemfile.lock). This is purely additive; existing exports are unchanged, and a failure to write the prompt file only warns without affecting the exported configs.
• Added support for sass-loader v17. [PR #1141](shakacode/shakapacker#1141) by fukayatsu. Widened the optional sass-loader peer range to ^13.0.0 || ^14.0.0 || ^15.0.0 || ^16.0.0 || ^17.0.0 in core shakapacker, shakapacker-webpack, and shakapacker-rspack. The Sass rule already selects loadPaths for v16+ and keeps api: "modern", both of which remain valid in v17. Note that sass-loader v17 requires Node.js 22.11.0+ and drops node-sass and the legacy Sass JS API, so apps that opt into v17 must already be on Node 22.12+ (the upper branch of Shakapacker's engines.node range).
• Added Babel 8 peer dependency support. [PR #1187](shakacode/shakapacker#1187) by justin808. Widened the Babel peer ranges in core shakapacker and the shakapacker-webpack supplemental package to allow Babel 8, and updated the Shakapacker Babel preset to omit options removed in Babel 8 while preserving existing Babel 7 behavior. Repository development pins stay on Babel 7, with added compatibility tests covering Babel 8. Refs #1163.

Changed

• New installs now default to Rspack instead of webpack. [PR #1150](shakacode/shakapacker#1150) by justin808. bundle exec rake shakapacker:install now scaffolds an Rspack project (config, dependencies, and config/shakapacker.yml) by default. This is a new-install default only: existing applications are unaffected. The Rspack default applies only to brand-new installs — re-running the installer on an app that already has a config/shakapacker.yml keeps that app's current bundler (and installs that bundler's dependencies), so the installer never silently switches an existing project's bundler. To install with webpack, run bundle exec rake shakapacker:install[webpack] or set SHAKAPACKER_ASSETS_BUNDLER=webpack; to change an existing app's bundler, use bundle exec rake shakapacker:switch_bundler.

... (truncated)

Changelog

Sourced from shakapacker's changelog.

[v10.3.2] - August 28, 2026

Changed

• Bumped the development and CI pin for Rspack from 2.0.1 to 2.2.0. [PR #1258](shakacode/shakapacker#1258) by justin808. The @rspack/core, @rspack/cli, @rspack/dev-server, and @rspack/plugin-react-refresh peer ranges are unchanged at ^2.0.0, so applications may stay on any Rspack 2.x release; only this repository's own development pins and dummy-app lockfiles move, so CI now exercises Rspack 2.2 against the range it already advertises. Annotated config exports (bin/shakapacker-config --annotate) also now list the complete optimization.moduleIds and optimization.chunkIds value sets for both bundlers, including 'compat-hashed', which requires Rspack 2.2 or newer and is documented as opt-in rather than made a default.

Fixed

• Fixed shakapacker:doctor not telling Rspack apps that a .swcrc is ignored outright. [PR #1276](shakacode/shakapacker#1276) by justin808. Doctor previously told Rspack apps only that moving .swcrc settings into config/swc.config.js would not help, while deliberately making no claim about the .swcrc itself, because the behavior had never been verified. It has now been verified against @rspack/core 2.0.1 and 2.2.0: Rspack's builtin:swc-loader never reads .swcrc. A .swcrc setting jsc.target and injecting an optimizer global produced byte-identical output to no .swcrc at all, while the same options passed inline as loader options did change the output. A .swcrc enabling decorator syntax likewise failed to unblock a decorator source, including with empty loader options and with swcrc/configFile set, so this is not merely inline options taking precedence. Doctor now states that a .swcrc is not read on Rspack and that every setting in it is silently inert - the mirror image of the config/swc.config.js case in #1259 - and continues to point at overriding the built-in builtin:swc-loader rule. Webpack messaging is unchanged. Fixes #1263.
• Fixed shakapacker:doctor staying silent about SWC configuration on Rspack apps that do not set javascript_transpiler: swc. [PR #1269](shakacode/shakapacker#1269) by justin808. Shakapacker's Rspack rules always transpile with builtin:swc-loader and never consult javascript_transpiler, so config/swc.config.js goes unread on an Rspack app configured for Babel or esbuild exactly as it does on one configured for SWC. Doctor's Rspack SWC-configuration warnings were gated on javascript_transpiler: swc, so those apps got no warning at all. Those warnings now reach any Rspack app: that config/swc.config.js is not read, and, for a .swcrc, that moving its settings into config/swc.config.js would not affect the build. The webpack-only SWC content checks and the "merged with Shakapacker's defaults" messaging stay gated on javascript_transpiler: swc, and apps with javascript_transpiler: none remain opted out. Fixes #1265.
• Fixed shakapacker:doctor and rake shakapacker:migrate_to_swc telling Rspack apps that config/swc.config.js is merged into their build. [PR #1260](shakacode/shakapacker#1260) by justin808. Rspack builds never read config/swc.config.js, because Shakapacker's Rspack rules set their builtin:swc-loader options inline. Doctor now warns that the file is unread on Rspack instead of reporting it as merged (and skips its content checks there), and no longer tells Rspack users with a .swcrc to migrate those settings into config/swc.config.js. The migrator's post-migration guidance and the generated file header instead show how to override the built-in builtin:swc-loader rule: apply webpack-merge's mergeWithRules to the output of generateRspackConfig(), since that function merges with plain merge, which concatenates module.rules, so an override passed into it is appended alongside the built-in rule rather than replacing it. Webpack apps keep the existing messaging. Fixes #1259.
• Fixed post-publish GitHub release failures hiding successful package publication details. The release task now prints its normal publication summary and the exact sync_github_release recovery command before exiting nonzero. [PR #1250](shakacode/shakapacker#1250) by justin808.
• Fixed helper binstubs to fail closed when PATH is unset. [PR #1240](shakacode/shakapacker#1240) by justin808. bin/shakapacker-config and bin/diff-bundler-config now report the missing-Node error without executing an app-root node binary when PATH is unset, while explicit PATH values retain their existing Node-resolution behavior. Fixes #1234.
• Fixed the deprecation warning for the legacy bundler config key claiming the value was understood while it was ignored. [PR #1270](shakacode/shakapacker#1270) by justin808. An app whose config/shakapacker.yml set only bundler: was told the key was deprecated and then built with a different bundler, because assets_bundler always resolves from the bundled defaults and the legacy key was never read. The warning now states that the value is ignored, names the bundler actually in use, and tells you to set assets_bundler instead. One resolution change accompanies it: a config that leaves assets_bundler: blank while setting bundler: previously resolved the legacy value in Ruby and now resolves webpack, matching what package/config.ts already built for it. Fixes #1262.

[v10.3.1] - August 3, 2026

Fixed

• Fixed 502 responses for proxied dev server assets under rack-proxy v1. [PR #1222](shakacode/shakapacker#1222) by jcbpl. Fixes #1220.
• Fixed dev-server liveness checks treating refused macOS 27 connections as running. The Ruby probe now verifies the connected socket's SO_ERROR result before proxying asset requests, avoiding false-positive dev-server detection and resulting 502 responses. [PR #1225](shakacode/shakapacker#1225) by justin808. Fixes #1224.
• Fixed webpack Babel, SWC, and esbuild rules skipping explicitly included .cjs files. [PR #1219](shakacode/shakapacker#1219) by oiahoon. Fixes #1218.
• Added a shakapacker:doctor warning for Rspack React Refresh v2 configs that still use the v1 default-export constructor pattern. [PR #1207](shakacode/shakapacker#1207) by justin808. Existing configs with const ReactRefreshPlugin = require("@rspack/plugin-react-refresh") followed by new ReactRefreshPlugin() can fail after upgrading to @rspack/plugin-react-refresh v2 with ReactRefreshPlugin is not a constructor; Doctor now points to the affected JS/TS config file and suggests the named-export/default/module compatibility form. Fixes #1204.
• Fixed the missing-@babel/core failure to report an actionable install message. [PR #1212](shakacode/shakapacker#1212) by justin808. Babel-transpiled builds whose app lacks @babel/core previously surfaced a raw module-resolution error from the Babel 8 compatibility check; the rule now explains which package to install and how to switch javascript_transpiler instead. Refs #1163.

Documentation

• Documented the required css-loader@^7.1.4 in the v10 Rspack upgrade instructions. [PR #1211](shakacode/shakapacker#1211) by justin808. The v10 upgrade guide's copy-paste Rspack v2 commands omitted css-loader, so apps following them could upgrade into an unsatisfied peer dependency.

[v10.3.0] - July 5, 2026

Added

• Allowed webpack-dev-server v6. [PR #1102](shakacode/shakapacker#1102) by G-Rath.

Fixed

• Fixed implicit SWC defaults for existing webpack/Babel apps without swc-loader. [PR #1206](shakacode/shakapacker#1206) by justin808. Webpack apps that omit both javascript_transpiler and the deprecated webpack_loader now fall back to Babel with a warning when Shakapacker's bundled SWC default is active, swc-loader is missing, and Babel is present. Explicit transpiler settings, webpack apps with swc-loader, and Rspack's built-in SWC path keep their existing behavior. Closes #1203.
• Fixed JavaScript config loading for missing Rails environments to use the production fallback. [PR #1206](shakacode/shakapacker#1206) by justin808. When RAILS_ENV has no matching section in config/shakapacker.yml, the Node package config now merges the production section instead of only bundled defaults, matching Ruby configuration loading and honoring explicit production javascript_transpiler, source_path, dev_server, and related settings for custom environments such as staging.
• Fixed helper binstub Node resolution after the v10.2.0 Ruby-binstub regression. [PR #1200](shakacode/shakapacker#1200) and [PR #1201](shakacode/shakapacker#1201) by justin808. Restores shell-compatible Node lookup for bin/shakapacker-config and bin/diff-bundler-config when PATH is empty, while keeping friendly missing-Node errors for ENOENT and EACCES. For an unset PATH, PR #1200 deliberately delegates Node resolution to Ruby exec's default-path behavior; PR #1240 later changed that case to fail closed.

[v10.2.0] - July 3, 2026

Added

• Added webpack_compile_flags configuration. [PR #1180](shakacode/shakapacker#1180) by justin808. Allows Rails-driven Shakapacker compiles to pass extra webpack/rspack CLI flags, such as --fail-on-warnings or --progress, through bin/shakapacker. Fixes #1175.
• Added AI analysis prompt generation to the config exporter. [PR #695](shakacode/shakapacker#695), [PR #1184](shakacode/shakapacker#1184) by justin808. When running doctor mode (bin/shakapacker-config --doctor), the exporter now also writes an AI-ANALYSIS-PROMPT.md: a ready-to-paste prompt that guides an AI assistant (ChatGPT, Claude, Gemini, etc.) to review the configuration for migration issues (webpack ↔ rspack), build errors, client/server and development/production optimizations, and best practices. The React on Rails–specific guidance in the generated prompt is included only when React on Rails is detected in the app (via package.json, Gemfile, or Gemfile.lock). This is purely additive; existing exports are unchanged, and a failure to write the prompt file only warns without affecting the exported configs.
• Added support for sass-loader v17. [PR #1141](shakacode/shakapacker#1141) by fukayatsu. Widened the optional sass-loader peer range to ^13.0.0 || ^14.0.0 || ^15.0.0 || ^16.0.0 || ^17.0.0 in core shakapacker, shakapacker-webpack, and shakapacker-rspack. The Sass rule already selects loadPaths for v16+ and keeps api: "modern", both of which remain valid in v17. Note that sass-loader v17 requires Node.js 22.11.0+ and drops node-sass and the legacy Sass JS API, so apps that opt into v17 must already be on Node 22.12+ (the upper branch of Shakapacker's engines.node range).
• Added Babel 8 peer dependency support. [PR #1187](shakacode/shakapacker#1187) by justin808. Widened the Babel peer ranges in core shakapacker and the shakapacker-webpack supplemental package to allow Babel 8, and updated the Shakapacker Babel preset to omit options removed in Babel 8 while preserving existing Babel 7 behavior. Repository development pins stay on Babel 7, with added compatibility tests covering Babel 8. Refs #1163.

... (truncated)

Commits

• f152fe6 Release 10.3.2
• 594a691 Update changelog for 10.3.2 (#1278)
• 843409a Tell Rspack apps that .swcrc is ignored outright, not just unmigratable (#1276)
• ee6bba9 Warn Rspack apps that SWC config files are unread for any javascript_transpil...
• ac81bcf Fix the misleading deprecation warning for the ignored legacy bundler key (#1...
• 7eddfe1 Document how to override builtin:swc-loader options on Rspack (#1267)
• 24f3c2e Trigger Node based checks on markdown-only pull requests (#1266)
• 8d6ed80 Make AGENTS.md canonical for shared agent guidance (#1244)
• 980c194 Document rspack 2.2 user-facing changes: SWC Wasm plugin break, rspackPublicP...
• d51c1a8 Bump rspack dev pin from 2.0.1 to 2.2.0 and correct moduleIds/chunkIds config...
• Additional commits viewable in compare view

Updates sentry-rails from 6.7.0 to 7.0.0

Changelog

Sourced from sentry-rails's changelog.

7.0.0

Breaking Changes 🛠

• Logs are now enabled by default and enable_logs is removed. by @​sl0thentr0py in #3053

  Using sentry-rails will automatically turn on automatic structured logging from Rails. if you want to turn it off, use:

  Sentry.init do |config
    # ...
    config.rails.structured_logging.enabled = false
  end

• Metrics are now enabled by default and enable_metrics is removed. by @​sl0thentr0py in #3061

• config.otlp.setup_otlp_traces_exporter and config.otlp.setup_propagator now default to false. by @​sl0thentr0py in #3063

New Features ✨

Data Collection

We are moving away from send_default_pii to a more granular configuration called data_collection.
It allows you to precisely control the data that Sentry collects from your app.

Sentry.init do |config|
  # ...
  config.data_collection.user_info = false
  config.data_collection.http_bodies = []
end

send_default_pii is deprecated but will continue to default to false.
data_collection will be backfilled when send_default_pii = false with the following values in 7.0.0:

data_collection.user_info = false
data_collection.cookies.mode = :off
data_collection.http_headers.request.mode = :deny_list
data_collection.http_headers.request.terms = %w[forwarded -ip _ip remote via _user -user]
data_collection.http_headers.response.mode = :deny_list
data_collection.http_headers.response.terms = %w[forwarded -ip _ip remote via _user -user]
data_collection.http_bodies = []
data_collection.url_query_params.mode = :off
data_collection.graphql.document = false
data_collection.graphql.variables = false
data_collection.database_query_data = false
data_collection.queues = false
data_collection.frame_context_lines = 3

... (truncated)

Commits

• 28e4246 release: 7.0.0
• b6c4ddd feat(data-collection): Make rails breadcrumbs respect data collection (#3068)
• 3bf6552 feat(data-collection): Change stack_frame_variables to KeyValueCollection (#3...
• caa1b0c feat(data-collection): Gate ActiveJob arguments and ExecutionContext inclusio...
• 685e82a ci: 🤖 Update pinned CI lockfiles (#3060)
• 100cdc9 feat!: Remove enable_logs (#3053)
• 040fb0d fix(rails): set dummy rails app before calling initializers (#3055)
• f34bffb ci: 🤖 Update pinned CI lockfiles (#3054)
• c071bcd feat(data-collection): Port Rails log subscribers (#3034)
• 5a2f1ed feat(data-collection): Port Rails controller and ActiveStorage (#3033)
• Additional commits viewable in compare view

Updates sentry-ruby from 6.7.0 to 7.0.0

Changelog

Sourced from sentry-ruby's changelog.

7.0.0

Breaking Changes 🛠

• Logs are now enabled by default and enable_logs is removed. by @​sl0thentr0py in #3053

  Using sentry-rails will automatically turn on automatic structured logging from Rails. if you want to turn it off, use:

  Sentry.init do |config
    # ...
    config.rails.structured_logging.enabled = false
  end

• Metrics...

  Description has been truncated