Bump the "shakapacker" group with 2 updates across multiple ecosystems

[dependabot]

Bumps the shakapacker group with 1 update: shakapacker.

Updates shakapacker from 10.3.1 to 10.3.2

Release notes

Sourced from shakapacker's releases.

v10.3.2

Changed

• Bumped the development and CI pin for Rspack from 2.0.1 to 2.2.0. [PR #1258](shakacode/shakapacker#1258) by justin808. The @rspack/core, @rspack/cli, @rspack/dev-server, and @rspack/plugin-react-refresh peer ranges are unchanged at ^2.0.0, so applications may stay on any Rspack 2.x release; only this repository's own development pins and dummy-app lockfiles move, so CI now exercises Rspack 2.2 against the range it already advertises. Annotated config exports (bin/shakapacker-config --annotate) also now list the complete optimization.moduleIds and optimization.chunkIds value sets for both bundlers, including 'compat-hashed', which requires Rspack 2.2 or newer and is documented as opt-in rather than made a default.

Fixed

• Fixed shakapacker:doctor not telling Rspack apps that a .swcrc is ignored outright. [PR #1276](shakacode/shakapacker#1276) by justin808. Doctor previously told Rspack apps only that moving .swcrc settings into config/swc.config.js would not help, while deliberately making no claim about the .swcrc itself, because the behavior had never been verified. It has now been verified against @rspack/core 2.0.1 and 2.2.0: Rspack's builtin:swc-loader never reads .swcrc. A .swcrc setting jsc.target and injecting an optimizer global produced byte-identical output to no .swcrc at all, while the same options passed inline as loader options did change the output. A .swcrc enabling decorator syntax likewise failed to unblock a decorator source, including with empty loader options and with swcrc/configFile set, so this is not merely inline options taking precedence. Doctor now states that a .swcrc is not read on Rspack and that every setting in it is silently inert - the mirror image of the config/swc.config.js case in #1259 - and continues to point at overriding the built-in builtin:swc-loader rule. Webpack messaging is unchanged. Fixes #1263.
• Fixed shakapacker:doctor staying silent about SWC configuration on Rspack apps that do not set javascript_transpiler: swc. [PR #1269](shakacode/shakapacker#1269) by justin808. Shakapacker's Rspack rules always transpile with builtin:swc-loader and never consult javascript_transpiler, so config/swc.config.js goes unread on an Rspack app configured for Babel or esbuild exactly as it does on one configured for SWC. Doctor's Rspack SWC-configuration warnings were gated on javascript_transpiler: swc, so those apps got no warning at all. Those warnings now reach any Rspack app: that config/swc.config.js is not read, and, for a .swcrc, that moving its settings into config/swc.config.js would not affect the build. The webpack-only SWC content checks and the "merged with Shakapacker's defaults" messaging stay gated on javascript_transpiler: swc, and apps with javascript_transpiler: none remain opted out. Fixes #1265.
• Fixed shakapacker:doctor and rake shakapacker:migrate_to_swc telling Rspack apps that config/swc.config.js is merged into their build. [PR #1260](shakacode/shakapacker#1260) by justin808. Rspack builds never read config/swc.config.js, because Shakapacker's Rspack rules set their builtin:swc-loader options inline. Doctor now warns that the file is unread on Rspack instead of reporting it as merged (and skips its content checks there), and no longer tells Rspack users with a .swcrc to migrate those settings into config/swc.config.js. The migrator's post-migration guidance and the generated file header instead show how to override the built-in builtin:swc-loader rule: apply webpack-merge's mergeWithRules to the output of generateRspackConfig(), since that function merges with plain merge, which concatenates module.rules, so an override passed into it is appended alongside the built-in rule rather than replacing it. Webpack apps keep the existing messaging. Fixes #1259.
• Fixed post-publish GitHub release failures hiding successful package publication details. The release task now prints its normal publication summary and the exact sync_github_release recovery command before exiting nonzero. [PR #1250](shakacode/shakapacker#1250) by justin808.
• Fixed helper binstubs to fail closed when PATH is unset. [PR #1240](shakacode/shakapacker#1240) by justin808. bin/shakapacker-config and bin/diff-bundler-config now report the missing-Node error without executing an app-root node binary when PATH is unset, while explicit PATH values retain their existing Node-resolution behavior. Fixes #1234.
• Fixed the deprecation warning for the legacy bundler config key claiming the value was understood while it was ignored. [PR #1270](shakacode/shakapacker#1270) by justin808. An app whose config/shakapacker.yml set only bundler: was told the key was deprecated and then built with a different bundler, because assets_bundler always resolves from the bundled defaults and the legacy key was never read. The warning now states that the value is ignored, names the bundler actually in use, and tells you to set assets_bundler instead. One resolution change accompanies it: a config that leaves assets_bundler: blank while setting bundler: previously resolved the legacy value in Ruby and now resolves webpack, matching what package/config.ts already built for it. Fixes #1262.

Changelog

Sourced from shakapacker's changelog.

[v10.3.2] - August 28, 2026

Changed

• Bumped the development and CI pin for Rspack from 2.0.1 to 2.2.0. [PR #1258](shakacode/shakapacker#1258) by justin808. The @rspack/core, @rspack/cli, @rspack/dev-server, and @rspack/plugin-react-refresh peer ranges are unchanged at ^2.0.0, so applications may stay on any Rspack 2.x release; only this repository's own development pins and dummy-app lockfiles move, so CI now exercises Rspack 2.2 against the range it already advertises. Annotated config exports (bin/shakapacker-config --annotate) also now list the complete optimization.moduleIds and optimization.chunkIds value sets for both bundlers, including 'compat-hashed', which requires Rspack 2.2 or newer and is documented as opt-in rather than made a default.

Fixed

• Fixed shakapacker:doctor not telling Rspack apps that a .swcrc is ignored outright. [PR #1276](shakacode/shakapacker#1276) by justin808. Doctor previously told Rspack apps only that moving .swcrc settings into config/swc.config.js would not help, while deliberately making no claim about the .swcrc itself, because the behavior had never been verified. It has now been verified against @rspack/core 2.0.1 and 2.2.0: Rspack's builtin:swc-loader never reads .swcrc. A .swcrc setting jsc.target and injecting an optimizer global produced byte-identical output to no .swcrc at all, while the same options passed inline as loader options did change the output. A .swcrc enabling decorator syntax likewise failed to unblock a decorator source, including with empty loader options and with swcrc/configFile set, so this is not merely inline options taking precedence. Doctor now states that a .swcrc is not read on Rspack and that every setting in it is silently inert - the mirror image of the config/swc.config.js case in #1259 - and continues to point at overriding the built-in builtin:swc-loader rule. Webpack messaging is unchanged. Fixes #1263.
• Fixed shakapacker:doctor staying silent about SWC configuration on Rspack apps that do not set javascript_transpiler: swc. [PR #1269](shakacode/shakapacker#1269) by justin808. Shakapacker's Rspack rules always transpile with builtin:swc-loader and never consult javascript_transpiler, so config/swc.config.js goes unread on an Rspack app configured for Babel or esbuild exactly as it does on one configured for SWC. Doctor's Rspack SWC-configuration warnings were gated on javascript_transpiler: swc, so those apps got no warning at all. Those warnings now reach any Rspack app: that config/swc.config.js is not read, and, for a .swcrc, that moving its settings into config/swc.config.js would not affect the build. The webpack-only SWC content checks and the "merged with Shakapacker's defaults" messaging stay gated on javascript_transpiler: swc, and apps with javascript_transpiler: none remain opted out. Fixes #1265.
• Fixed shakapacker:doctor and rake shakapacker:migrate_to_swc telling Rspack apps that config/swc.config.js is merged into their build. [PR #1260](shakacode/shakapacker#1260) by justin808. Rspack builds never read config/swc.config.js, because Shakapacker's Rspack rules set their builtin:swc-loader options inline. Doctor now warns that the file is unread on Rspack instead of reporting it as merged (and skips its content checks there), and no longer tells Rspack users with a .swcrc to migrate those settings into config/swc.config.js. The migrator's post-migration guidance and the generated file header instead show how to override the built-in builtin:swc-loader rule: apply webpack-merge's mergeWithRules to the output of generateRspackConfig(), since that function merges with plain merge, which concatenates module.rules, so an override passed into it is appended alongside the built-in rule rather than replacing it. Webpack apps keep the existing messaging. Fixes #1259.
• Fixed post-publish GitHub release failures hiding successful package publication details. The release task now prints its normal publication summary and the exact sync_github_release recovery command before exiting nonzero. [PR #1250](shakacode/shakapacker#1250) by justin808.
• Fixed helper binstubs to fail closed when PATH is unset. [PR #1240](shakacode/shakapacker#1240) by justin808. bin/shakapacker-config and bin/diff-bundler-config now report the missing-Node error without executing an app-root node binary when PATH is unset, while explicit PATH values retain their existing Node-resolution behavior. Fixes #1234.
• Fixed the deprecation warning for the legacy bundler config key claiming the value was understood while it was ignored. [PR #1270](shakacode/shakapacker#1270) by justin808. An app whose config/shakapacker.yml set only bundler: was told the key was deprecated and then built with a different bundler, because assets_bundler always resolves from the bundled defaults and the legacy key was never read. The warning now states that the value is ignored, names the bundler actually in use, and tells you to set assets_bundler instead. One resolution change accompanies it: a config that leaves assets_bundler: blank while setting bundler: previously resolved the legacy value in Ruby and now resolves webpack, matching what package/config.ts already built for it. Fixes #1262.

Commits

• f152fe6 Release 10.3.2
• 594a691 Update changelog for 10.3.2 (#1278)
• 843409a Tell Rspack apps that .swcrc is ignored outright, not just unmigratable (#1276)
• ee6bba9 Warn Rspack apps that SWC config files are unread for any javascript_transpil...
• ac81bcf Fix the misleading deprecation warning for the ignored legacy bundler key (#1...
• 7eddfe1 Document how to override builtin:swc-loader options on Rspack (#1267)
• 24f3c2e Trigger Node based checks on markdown-only pull requests (#1266)
• 8d6ed80 Make AGENTS.md canonical for shared agent guidance (#1244)
• 980c194 Document rspack 2.2 user-facing changes: SWC Wasm plugin break, rspackPublicP...
• d51c1a8 Bump rspack dev pin from 2.0.1 to 2.2.0 and correct moduleIds/chunkIds config...
• Additional commits viewable in compare view

Bumps the shakapacker group with 1 update: shakapacker-webpack.

Updates shakapacker-webpack from 10.3.1 to 10.3.2

Release notes

Sourced from shakapacker-webpack's releases.

v10.3.2

Changed

• Bumped the development and CI pin for Rspack from 2.0.1 to 2.2.0. [PR #1258](shakacode/shakapacker#1258) by justin808. The @rspack/core, @rspack/cli, @rspack/dev-server, and @rspack/plugin-react-refresh peer ranges are unchanged at ^2.0.0, so applications may stay on any Rspack 2.x release; only this repository's own development pins and dummy-app lockfiles move, so CI now exercises Rspack 2.2 against the range it already advertises. Annotated config exports (bin/shakapacker-config --annotate) also now list the complete optimization.moduleIds and optimization.chunkIds value sets for both bundlers, including 'compat-hashed', which requires Rspack 2.2 or newer and is documented as opt-in rather than made a default.

Fixed

• Fixed shakapacker:doctor not telling Rspack apps that a .swcrc is ignored outright. [PR #1276](shakacode/shakapacker#1276) by justin808. Doctor previously told Rspack apps only that moving .swcrc settings into config/swc.config.js would not help, while deliberately making no claim about the .swcrc itself, because the behavior had never been verified. It has now been verified against @rspack/core 2.0.1 and 2.2.0: Rspack's builtin:swc-loader never reads .swcrc. A .swcrc setting jsc.target and injecting an optimizer global produced byte-identical output to no .swcrc at all, while the same options passed inline as loader options did change the output. A .swcrc enabling decorator syntax likewise failed to unblock a decorator source, including with empty loader options and with swcrc/configFile set, so this is not merely inline options taking precedence. Doctor now states that a .swcrc is not read on Rspack and that every setting in it is silently inert - the mirror image of the config/swc.config.js case in #1259 - and continues to point at overriding the built-in builtin:swc-loader rule. Webpack messaging is unchanged. Fixes #1263.
• Fixed shakapacker:doctor staying silent about SWC configuration on Rspack apps that do not set javascript_transpiler: swc. [PR #1269](shakacode/shakapacker#1269) by justin808. Shakapacker's Rspack rules always transpile with builtin:swc-loader and never consult javascript_transpiler, so config/swc.config.js goes unread on an Rspack app configured for Babel or esbuild exactly as it does on one configured for SWC. Doctor's Rspack SWC-configuration warnings were gated on javascript_transpiler: swc, so those apps got no warning at all. Those warnings now reach any Rspack app: that config/swc.config.js is not read, and, for a .swcrc, that moving its settings into config/swc.config.js would not affect the build. The webpack-only SWC content checks and the "merged with Shakapacker's defaults" messaging stay gated on javascript_transpiler: swc, and apps with javascript_transpiler: none remain opted out. Fixes #1265.
• Fixed shakapacker:doctor and rake shakapacker:migrate_to_swc telling Rspack apps that config/swc.config.js is merged into their build. [PR #1260](shakacode/shakapacker#1260) by justin808. Rspack builds never read config/swc.config.js, because Shakapacker's Rspack rules set their builtin:swc-loader options inline. Doctor now warns that the file is unread on Rspack instead of reporting it as merged (and skips its content checks there), and no longer tells Rspack users with a .swcrc to migrate those settings into config/swc.config.js. The migrator's post-migration guidance and the generated file header instead show how to override the built-in builtin:swc-loader rule: apply webpack-merge's mergeWithRules to the output of generateRspackConfig(), since that function merges with plain merge, which concatenates module.rules, so an override passed into it is appended alongside the built-in rule rather than replacing it. Webpack apps keep the existing messaging. Fixes #1259.
• Fixed post-publish GitHub release failures hiding successful package publication details. The release task now prints its normal publication summary and the exact sync_github_release recovery command before exiting nonzero. [PR #1250](shakacode/shakapacker#1250) by justin808.
• Fixed helper binstubs to fail closed when PATH is unset. [PR #1240](shakacode/shakapacker#1240) by justin808. bin/shakapacker-config and bin/diff-bundler-config now report the missing-Node error without executing an app-root node binary when PATH is unset, while explicit PATH values retain their existing Node-resolution behavior. Fixes #1234.
• Fixed the deprecation warning for the legacy bundler config key claiming the value was understood while it was ignored. [PR #1270](shakacode/shakapacker#1270) by justin808. An app whose config/shakapacker.yml set only bundler: was told the key was deprecated and then built with a different bundler, because assets_bundler always resolves from the bundled defaults and the legacy key was never read. The warning now states that the value is ignored, names the bundler actually in use, and tells you to set assets_bundler instead. One resolution change accompanies it: a config that leaves assets_bundler: blank while setting bundler: previously resolved the legacy value in Ruby and now resolves webpack, matching what package/config.ts already built for it. Fixes #1262.

Changelog

Sourced from shakapacker-webpack's changelog.

[v10.3.2] - August 28, 2026

Changed

• Bumped the development and CI pin for Rspack from 2.0.1 to 2.2.0. [PR #1258](shakacode/shakapacker#1258) by justin808. The @rspack/core, @rspack/cli, @rspack/dev-server, and @rspack/plugin-react-refresh peer ranges are unchanged at ^2.0.0, so applications may stay on any Rspack 2.x release; only this repository's own development pins and dummy-app lockfiles move, so CI now exercises Rspack 2.2 against the range it already advertises. Annotated config exports (bin/shakapacker-config --annotate) also now list the complete optimization.moduleIds and optimization.chunkIds value sets for both bundlers, including 'compat-hashed', which requires Rspack 2.2 or newer and is documented as opt-in rather than made a default.

Fixed

• Fixed shakapacker:doctor not telling Rspack apps that a .swcrc is ignored outright. [PR #1276](shakacode/shakapacker#1276) by justin808. Doctor previously told Rspack apps only that moving .swcrc settings into config/swc.config.js would not help, while deliberately making no claim about the .swcrc itself, because the behavior had never been verified. It has now been verified against @rspack/core 2.0.1 and 2.2.0: Rspack's builtin:swc-loader never reads .swcrc. A .swcrc setting jsc.target and injecting an optimizer global produced byte-identical output to no .swcrc at all, while the same options passed inline as loader options did change the output. A .swcrc enabling decorator syntax likewise failed to unblock a decorator source, including with empty loader options and with swcrc/configFile set, so this is not merely inline options taking precedence. Doctor now states that a .swcrc is not read on Rspack and that every setting in it is silently inert - the mirror image of the config/swc.config.js case in #1259 - and continues to point at overriding the built-in builtin:swc-loader rule. Webpack messaging is unchanged. Fixes #1263.
• Fixed shakapacker:doctor staying silent about SWC configuration on Rspack apps that do not set javascript_transpiler: swc. [PR #1269](shakacode/shakapacker#1269) by justin808. Shakapacker's Rspack rules always transpile with builtin:swc-loader and never consult javascript_transpiler, so config/swc.config.js goes unread on an Rspack app configured for Babel or esbuild exactly as it does on one configured for SWC. Doctor's Rspack SWC-configuration warnings were gated on javascript_transpiler: swc, so those apps got no warning at all. Those warnings now reach any Rspack app: that config/swc.config.js is not read, and, for a .swcrc, that moving its settings into config/swc.config.js would not affect the build. The webpack-only SWC content checks and the "merged with Shakapacker's defaults" messaging stay gated on javascript_transpiler: swc, and apps with javascript_transpiler: none remain opted out. Fixes #1265.
• Fixed shakapacker:doctor and rake shakapacker:migrate_to_swc telling Rspack apps that config/swc.config.js is merged into their build. [PR #1260](shakacode/shakapacker#1260) by justin808. Rspack builds never read config/swc.config.js, because Shakapacker's Rspack rules set their builtin:swc-loader options inline. Doctor now warns that the file is unread on Rspack instead of reporting it as merged (and skips its content checks there), and no longer tells Rspack users with a .swcrc to migrate those settings into config/swc.config.js. The migrator's post-migration guidance and the generated file header instead show how to override the built-in builtin:swc-loader rule: apply webpack-merge's mergeWithRules to the output of generateRspackConfig(), since that function merges with plain merge, which concatenates module.rules, so an override passed into it is appended alongside the built-in rule rather than replacing it. Webpack apps keep the existing messaging. Fixes #1259.
• Fixed post-publish GitHub release failures hiding successful package publication details. The release task now prints its normal publication summary and the exact sync_github_release recovery command before exiting nonzero. [PR #1250](shakacode/shakapacker#1250) by justin808.
• Fixed helper binstubs to fail closed when PATH is unset. [PR #1240](shakacode/shakapacker#1240) by justin808. bin/shakapacker-config and bin/diff-bundler-config now report the missing-Node error without executing an app-root node binary when PATH is unset, while explicit PATH values retain their existing Node-resolution behavior. Fixes #1234.
• Fixed the deprecation warning for the legacy bundler config key claiming the value was understood while it was ignored. [PR #1270](shakacode/shakapacker#1270) by justin808. An app whose config/shakapacker.yml set only bundler: was told the key was deprecated and then built with a different bundler, because assets_bundler always resolves from the bundled defaults and the legacy key was never read. The warning now states that the value is ignored, names the bundler actually in use, and tells you to set assets_bundler instead. One resolution change accompanies it: a config that leaves assets_bundler: blank while setting bundler: previously resolved the legacy value in Ruby and now resolves webpack, matching what package/config.ts already built for it. Fixes #1262.

Commits

• f152fe6 Release 10.3.2
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions