chore(deps): Bump shakapacker from 9.2.0 to 10.1.0

[dependabot]

Bumps shakapacker from 9.2.0 to 10.1.0.

Release notes

Sourced from shakapacker's releases.

v10.1.0

Added

• Added supplemental npm packages shakapacker-webpack and shakapacker-rspack. [PR #1096](shakacode/shakapacker#1096), [PR #1133](shakacode/shakapacker#1133) by justin808. Optional packages that lockstep with core and declare the managed-build stack as required peer dependencies (so on npm 7+ a single yarn add shakapacker-webpack auto-installs shakapacker, webpack, webpack-cli, and webpack-assets-manifest; shakapacker-rspack declares shakapacker, @rspack/core, @rspack/cli, and rspack-manifest-plugin). Required peers eliminate the silent duplicate-bundler failure mode that direct dependencies could cause when an app or transitive dep pins a different bundler version. Optional features (transpilers, dev-server, CSS preprocessors, react-refresh) remain as opt-in peerDependencies so SCSS/native-binding bloat isn't forced on every install. The wrappers emit structured warnings (SHAKAPACKER_BUNDLER_MISMATCH, SHAKAPACKER_NO_TRANSPILER) when config.assets_bundler or javascript_transpiler doesn't match the installed peers. pnpm and Yarn PnP users should keep packages imported by app config files as explicit app dependencies (the Rails installer handles this automatically). See the v10.1 migration guide for adoption steps and https://github.com/shakacode/shakapacker/blob/HEAD/docs/dependency-strategy.md for the design rationale and v11 roadmap.
• Added shakapacker:doctor check for disabled Rspack cache. [PR #1100](shakacode/shakapacker#1100) by justin808. The doctor now inspects the Rspack config file for an explicit cache: false, warns when found (disabling cache causes significantly slower builds), and also flags Rspack v1 installs (where persistent cache is experimental) with a recommendation to upgrade to v2.
• Added a shakapacker:doctor hint to compiler output. [PR #1100](shakacode/shakapacker#1100) by justin808. The compiler now logs a one-time tip suggesting bundle exec rake shakapacker:doctor after a failed compilation, so healthy build loops stay quiet.

Migration Notes

• Simplify your package.json by adopting a supplemental package. On npm 7+ (or Yarn 2+ in nodeLinker: node-modules mode), existing apps can drop the explicit managed-build deps from devDependencies and let the supplemental package's required peers be auto-installed:

  • Rspack apps can replace shakapacker + @rspack/core + @rspack/cli + rspack-manifest-plugin with a single shakapacker-rspack. See packages/shakapacker-rspack/README.md §"Simplifying an existing rspack install" for the before/after.
  • Webpack apps can replace shakapacker + webpack + webpack-cli + webpack-assets-manifest with a single shakapacker-webpack. See packages/shakapacker-webpack/README.md §"Simplifying an existing webpack install" for the before/after.
  • Optional peers (transpilers, webpack-dev-server, CSS preprocessors, react-refresh) stay only if your app uses those features.
  • Adoption is opt-in: leaving your package.json untouched on v10.1 also continues to work.

• Adopting shakapacker-webpack requires webpack-assets-manifest@^6.0.0. Core shakapacker still accepts both v5 and v6 (^5.0.6 || ^6.0.0), but shakapacker-webpack pins ~6.5.1. Apps still on webpack-assets-manifest@5.x must upgrade when switching to the supplemental package; v6 fixed an ENOENT crash on clean builds with merge: true and dropped a Node 14 install path. See the v5→v6 release notes and packages/shakapacker-webpack/README.md for details.

⚠️ Breaking Changes

• Breaking: tightened package.json engines.node to ^20.19.0 || >=22.12.0. [PR #1099](shakacode/shakapacker#1099) by justin808. Raised from >= 20, dropping support for Node 20.0.0–20.18.x and Node 21.x to match @rspack/core@2.0.0-rc.0. Consumers on those versions will hit an engine error with --engine-strict or yarn workspaces and need to upgrade. The PR also bumps .node-version to 22.20.0 and updates conductor-setup.sh to enforce the same disjoint range up front, so contributors get a clear error before yarn install fails with a confusing engine mismatch.

Changed

• Changed shakapacker:install to default fresh Rspack installs to v2 (^2.0.0-0). [PR #1091](shakacode/shakapacker#1091) by ihabadham. lib/install/package.json now declares @rspack/core and @rspack/cli as ^1.0.0 || ^2.0.0-0; fresh installs pick the v2 range. Existing apps are unaffected. Note: Rspack v2 requires Node.js 20.19.0+.
• Slimmed the published gem from ~486K (294 files) to ~121K (75 files). [PR #1110](shakacode/shakapacker#1110), [PR #1120](shakacode/shakapacker#1120) by justin808. Replaced the broad git ls-files gem manifest with an explicit runtime/install allowlist (CHANGELOG.md, MIT-LICENSE, README.md, gemspec, lib, sig, package.json), excluding repo-only docs, tests, JavaScript package source, CI/tooling files, and test_files metadata from the published gem. Fixes #987.

Fixed

• Fixed webpack-dev-server static config defaulting to watch public/ directory unnecessarily. [PR #1032](shakacode/shakapacker#1032) by ihabadham. Three bugs fixed: (1) static now defaults to false instead of a misconfigured object that caused webpack-dev-server to watch the public/ directory, which is already served by Rails via ActionDispatch::Static; (2) setting static: false in shakapacker.yml is no longer silently ignored; (3) the default template no longer includes static.watch, which was a v3→v4 migration artifact. Fixes #1031.
• Fixed Rspack React Refresh plugin loading with @rspack/plugin-react-refresh v2. [PR #1116](shakacode/shakapacker#1116) by justin808. Shakapacker now reads the v2 named ReactRefreshRspackPlugin export while retaining compatibility with v1 direct/default CommonJS export shapes, preventing TypeError: ReactRefreshRspackPlugin is not a constructor during rspack dev-server startup.
• Widened @rspack/plugin-react-refresh peer range to ^1.0.0 || ^2.0.0-0. [PR #1091](shakacode/shakapacker#1091) by ihabadham. Fixes the ERESOLVE conflict when installing @rspack/plugin-react-refresh@^2.0.0 alongside shakapacker@10.0.0.
• Fixed NodePackageVersion#find_version for local-path shakapacker installs (e.g. yalc, file:, relative paths). [PR #1086](shakacode/shakapacker#1086), [PR #1106](shakacode/shakapacker#1106) by justin808. The version check now consults package.json first and short-circuits on ../, ./, and file: dependencies, so stale lockfile semvers no longer trigger false gem↔node version mismatches. package_json_dependency also consults devDependencies in addition to dependencies. The LOCAL_PATH_REGEX constant replaces a duplicated inline regex and anchors both alternatives to the start of the string, removing a latent false-positive on version strings containing .. mid-value. Fixes #1103.
• Fix rspack setup not reusing certain shared webpack-rspack config settings. [PR #1085](shakacode/shakapacker#1085) by brunodccarvalho. Default config changes include optimization.splitChunks.chunks="all", optimization.runtimeChunk="single", the webpack compression plugin in production, and the removal of minimization plugins in development. Fixes #984.
• Fixed Rspack Sass rule blocking sass-embedded users by requiring the sass package. [PR #1105](shakacode/shakapacker#1105) by justin808. Rspack Sass detection now only checks for sass-loader; the implementation (sass, sass-embedded, etc.) is resolved by the loader at build time, matching the webpack code path.
• Fixed bin/shakapacker-config and bin/diff-bundler-config in ESM apps and on upgraded apps. [PR #1104](shakacode/shakapacker#1104), [PR #1132](shakacode/shakapacker#1132) by justin808. Apps with "type": "module" in package.json failed to run the JavaScript binstubs because Node parsed them as ESM. The binstubs are now Ruby wrappers that locate Node (without executing it during lookup) and invoke .cjs package scripts shipped inside node_modules/shakapacker/package/bin/. The wrappers also map NODE_ENV from RAILS_ENV and print useful messages for non-Error CLI rejections. shakapacker:export_bundler_config dispatches binstubs by shebang, so upgraded apps with legacy JavaScript binstubs continue to run via Node while Ruby wrappers run via Ruby. Existing apps with the old JavaScript binstubs should re-run bundle exec rake shakapacker:binstubs to install the new Ruby wrappers. Fixes #1123.

v10.1.0-rc.2

Added

• Added supplemental npm packages shakapacker-webpack and shakapacker-rspack. [PR #1096](shakacode/shakapacker#1096) by justin808. Optional packages that lockstep with core and bundle the managed-build stack as direct dependencies (so a single yarn add shakapacker-webpack pulls in shakapacker, webpack, webpack-cli, and webpack-assets-manifest; the rspack package bundles shakapacker, @rspack/core, @rspack/cli, and rspack-manifest-plugin). Optional features (transpilers, dev-server, CSS preprocessors, react-refresh) remain as opt-in peerDependencies so SCSS/native-binding bloat isn't forced on every install. The wrappers emit structured warnings (SHAKAPACKER_BUNDLER_MISMATCH, SHAKAPACKER_NO_TRANSPILER) when config.assets_bundler or javascript_transpiler doesn't match the installed peers. See the v10.1 migration guide for adoption steps and https://github.com/shakacode/shakapacker/blob/HEAD/docs/dependency-strategy.md for the design rationale and v11 roadmap.
• Added shakapacker:doctor check for disabled Rspack cache. [PR #1100](shakacode/shakapacker#1100) by justin808. The doctor now inspects the Rspack config file for an explicit cache: false, warns when found (disabling cache causes significantly slower builds), and also flags Rspack v1 installs (where persistent cache is experimental) with a recommendation to upgrade to v2.
• Added a shakapacker:doctor hint to compiler output. [PR #1100](shakacode/shakapacker#1100) by justin808. The compiler now logs a one-time tip suggesting bundle exec rake shakapacker:doctor after a failed compilation, so healthy build loops stay quiet.

Migration Notes

• Simplify your package.json by adopting a supplemental package. Existing apps can drop the explicit managed-build deps from devDependencies and rely on the bundled stack:
  • Rspack apps can replace shakapacker + @rspack/core + @rspack/cli + rspack-manifest-plugin with a single shakapacker-rspack. See packages/shakapacker-rspack/README.md §"Simplifying an existing rspack install" for the before/after.
  • Webpack apps can replace shakapacker + webpack + webpack-cli + webpack-assets-manifest with a single shakapacker-webpack. See packages/shakapacker-webpack/README.md §"Simplifying an existing webpack install" for the before/after.
  • Optional peers (transpilers, webpack-dev-server, CSS preprocessors, react-refresh) stay only if your app uses those features.
  • Adoption is opt-in: leaving your package.json untouched on v10.1 also continues to work.

... (truncated)

Changelog

Sourced from shakapacker's changelog.

[v10.1.0] - May 27, 2026

Added

• Added supplemental npm packages shakapacker-webpack and shakapacker-rspack. [PR #1096](shakacode/shakapacker#1096), [PR #1133](shakacode/shakapacker#1133) by justin808. Optional packages that lockstep with core and declare the managed-build stack as required peer dependencies (so on npm 7+ a single yarn add shakapacker-webpack auto-installs shakapacker, webpack, webpack-cli, and webpack-assets-manifest; shakapacker-rspack declares shakapacker, @rspack/core, @rspack/cli, and rspack-manifest-plugin). Required peers eliminate the silent duplicate-bundler failure mode that direct dependencies could cause when an app or transitive dep pins a different bundler version. Optional features (transpilers, dev-server, CSS preprocessors, react-refresh) remain as opt-in peerDependencies so SCSS/native-binding bloat isn't forced on every install. The wrappers emit structured warnings (SHAKAPACKER_BUNDLER_MISMATCH, SHAKAPACKER_NO_TRANSPILER) when config.assets_bundler or javascript_transpiler doesn't match the installed peers. pnpm and Yarn PnP users should keep packages imported by app config files as explicit app dependencies (the Rails installer handles this automatically). See the v10.1 migration guide for adoption steps and https://github.com/shakacode/shakapacker/blob/main/docs/dependency-strategy.md for the design rationale and v11 roadmap.
• Added shakapacker:doctor check for disabled Rspack cache. [PR #1100](shakacode/shakapacker#1100) by justin808. The doctor now inspects the Rspack config file for an explicit cache: false, warns when found (disabling cache causes significantly slower builds), and also flags Rspack v1 installs (where persistent cache is experimental) with a recommendation to upgrade to v2.
• Added a shakapacker:doctor hint to compiler output. [PR #1100](shakacode/shakapacker#1100) by justin808. The compiler now logs a one-time tip suggesting bundle exec rake shakapacker:doctor after a failed compilation, so healthy build loops stay quiet.

Migration Notes

• Simplify your package.json by adopting a supplemental package. On npm 7+ (or Yarn 2+ in nodeLinker: node-modules mode), existing apps can drop the explicit managed-build deps from devDependencies and let the supplemental package's required peers be auto-installed:

  • Rspack apps can replace shakapacker + @rspack/core + @rspack/cli + rspack-manifest-plugin with a single shakapacker-rspack. See packages/shakapacker-rspack/README.md §"Simplifying an existing rspack install" for the before/after.
  • Webpack apps can replace shakapacker + webpack + webpack-cli + webpack-assets-manifest with a single shakapacker-webpack. See packages/shakapacker-webpack/README.md §"Simplifying an existing webpack install" for the before/after.
  • Optional peers (transpilers, webpack-dev-server, CSS preprocessors, react-refresh) stay only if your app uses those features.
  • Adoption is opt-in: leaving your package.json untouched on v10.1 also continues to work.

• Adopting shakapacker-webpack requires webpack-assets-manifest@^6.0.0. Core shakapacker still accepts both v5 and v6 (^5.0.6 || ^6.0.0), but shakapacker-webpack pins ~6.5.1. Apps still on webpack-assets-manifest@5.x must upgrade when switching to the supplemental package; v6 fixed an ENOENT crash on clean builds with merge: true and dropped a Node 14 install path. See the v5→v6 release notes and packages/shakapacker-webpack/README.md for details.

⚠️ Breaking Changes

• Breaking: tightened package.json engines.node to ^20.19.0 || >=22.12.0. [PR #1099](shakacode/shakapacker#1099) by justin808. Raised from >= 20, dropping support for Node 20.0.0–20.18.x and Node 21.x to match @rspack/core@2.0.0-rc.0. Consumers on those versions will hit an engine error with --engine-strict or yarn workspaces and need to upgrade. The PR also bumps .node-version to 22.20.0 and updates conductor-setup.sh to enforce the same disjoint range up front, so contributors get a clear error before yarn install fails with a confusing engine mismatch.

Changed

• Changed shakapacker:install to default fresh Rspack installs to v2 (^2.0.0-0). [PR #1091](shakacode/shakapacker#1091) by ihabadham. lib/install/package.json now declares @rspack/core and @rspack/cli as ^1.0.0 || ^2.0.0-0; fresh installs pick the v2 range. Existing apps are unaffected. Note: Rspack v2 requires Node.js 20.19.0+.
• Slimmed the published gem from ~486K (294 files) to ~121K (75 files). [PR #1110](shakacode/shakapacker#1110), [PR #1120](shakacode/shakapacker#1120) by justin808. Replaced the broad git ls-files gem manifest with an explicit runtime/install allowlist (CHANGELOG.md, MIT-LICENSE, README.md, gemspec, lib, sig, package.json), excluding repo-only docs, tests, JavaScript package source, CI/tooling files, and test_files metadata from the published gem. Fixes #987.

Fixed

• Fixed webpack-dev-server static config defaulting to watch public/ directory unnecessarily. [PR #1032](shakacode/shakapacker#1032) by ihabadham. Three bugs fixed: (1) static now defaults to false instead of a misconfigured object that caused webpack-dev-server to watch the public/ directory, which is already served by Rails via ActionDispatch::Static; (2) setting static: false in shakapacker.yml is no longer silently ignored; (3) the default template no longer includes static.watch, which was a v3→v4 migration artifact. Fixes #1031.
• Fixed Rspack React Refresh plugin loading with @rspack/plugin-react-refresh v2. [PR #1116](shakacode/shakapacker#1116) by justin808. Shakapacker now reads the v2 named ReactRefreshRspackPlugin export while retaining compatibility with v1 direct/default CommonJS export shapes, preventing TypeError: ReactRefreshRspackPlugin is not a constructor during rspack dev-server startup.
• Widened @rspack/plugin-react-refresh peer range to ^1.0.0 || ^2.0.0-0. [PR #1091](shakacode/shakapacker#1091) by ihabadham. Fixes the ERESOLVE conflict when installing @rspack/plugin-react-refresh@^2.0.0 alongside shakapacker@10.0.0.
• Fixed NodePackageVersion#find_version for local-path shakapacker installs (e.g. yalc, file:, relative paths). [PR #1086](shakacode/shakapacker#1086), [PR #1106](shakacode/shakapacker#1106) by justin808. The version check now consults package.json first and short-circuits on ../, ./, and file: dependencies, so stale lockfile semvers no longer trigger false gem↔node version mismatches. package_json_dependency also consults devDependencies in addition to dependencies. The LOCAL_PATH_REGEX constant replaces a duplicated inline regex and anchors both alternatives to the start of the string, removing a latent false-positive on version strings containing .. mid-value. Fixes #1103.
• Fix rspack setup not reusing certain shared webpack-rspack config settings. [PR #1085](shakacode/shakapacker#1085) by brunodccarvalho. Default config changes include optimization.splitChunks.chunks="all", optimization.runtimeChunk="single", the webpack compression plugin in production, and the removal of minimization plugins in development. Fixes #984.
• Fixed Rspack Sass rule blocking sass-embedded users by requiring the sass package. [PR #1105](shakacode/shakapacker#1105) by justin808. Rspack Sass detection now only checks for sass-loader; the implementation (sass, sass-embedded, etc.) is resolved by the loader at build time, matching the webpack code path.
• Fixed bin/shakapacker-config and bin/diff-bundler-config in ESM apps and on upgraded apps. [PR #1104](shakacode/shakapacker#1104), [PR #1132](shakacode/shakapacker#1132) by justin808. Apps with "type": "module" in package.json failed to run the JavaScript binstubs because Node parsed them as ESM. The binstubs are now Ruby wrappers that locate Node (without executing it during lookup) and invoke .cjs package scripts shipped inside node_modules/shakapacker/package/bin/. The wrappers also map NODE_ENV from RAILS_ENV and print useful messages for non-Error CLI rejections. shakapacker:export_bundler_config dispatches binstubs by shebang, so upgraded apps with legacy JavaScript binstubs continue to run via Node while Ruby wrappers run via Ruby. Existing apps with the old JavaScript binstubs should re-run bundle exec rake shakapacker:binstubs to install the new Ruby wrappers. Fixes #1123.

[v10.0.0] - April 8, 2026

Added

• Added bin/diff-bundler-config CLI for semantic bundler configuration diffs. [PR #973](shakacode/shakapacker#973) by justin808. Wraps the extracted pack-config-diff package to provide semantic diffing of webpack/rspack configurations with normalized exit codes. Supersedes #961.
• Added bin/shakapacker-watch binstub for clean Ctrl-C shutdown in Procfile-based workflows. [PR #1026](shakacode/shakapacker#1026) by justin808. The new wrapper script traps INT/TERM signals and forwards TERM to the underlying bin/shakapacker --watch process, preventing Ruby interrupt backtraces when stopping bin/dev. Use bin/shakapacker-watch --watch in Procfiles instead of bin/shakapacker --watch.
• Allowed webpack-cli v7 (^7.0.0) in peer dependencies. [PR #1021](shakacode/shakapacker#1021) by justin808. Fixes #1020. Note: webpack-cli v7 requires Node.js >= 20.9.0.

⚠️ Breaking Changes

• Breaking: bumped the minimum webpack version to ^5.101.0. [PR #1021](shakacode/shakapacker#1021) by justin808. The previous minimum was ^5.76.0.
• Breaking: required webpack-dev-server ^5.2.2 and dropped support for v4. [PR #1021](shakacode/shakapacker#1021) by justin808. The removed v4 range was ^4.15.2.

... (truncated)

Commits

• e55fa43 Release 10.1.0
• 92ef391 Update CHANGELOG.md for v10.1.0 (#1139)
• 6ea6fd8 Expand prerelease-to-stable changelog coalesce guidance in /update-changelog ...
• bc20166 Release 10.1.0-rc.2
• e29372b [codex] Update changelog for v10.1.0-rc.2 (#1136)
• 843f18b Teach /update-changelog to drop RC-only regression fixes (#1125)
• ba495cd Restructure supplemental package dependencies (#1131) (#1133)
• e3ac6a9 [codex] Add Shakapacker brand assets (#1135)
• 75515af [codex] Fix shakapacker config helper binstubs (#1132)
• 94392be Surface v10.1 supplemental packages from README and key docs (#1134)
• Additional commits viewable in compare view

[arkirchner]

@dependabot rebase