v17.1.0

No user-visible changes since 17.1.0.rc.4; this candidate completes publication after the partial RC4 release.

Fixed

• [Pro] Side-effect-only RSC client modules work in generated apps again: Generated RSC apps now pin
  react-on-rails-rsc@19.3.0-rc.4 with React/React DOM ~19.2.8. RC4 accepts "use client" browser
  registration modules that intentionally perform runtime side effects without exporting a client reference,
  while continuing to reject inert, type-only, and CommonJS-style modules that may have lost their exports.
  It also preserves CSS-wrapper side effects through production Webpack and Rspack tree shaking. RC3 remains
  outside the qualified prerelease window because it rejected valid side-effect-only registration entrypoints.
  See Tutorial Issue 823 and the
  RSC RC4 release.
  #5066 by
  justin808.

• [Pro] RSC 19.3 prerelease compatibility: The 17.1 series adds JSX/TSX client-export parsing,
  Rspack shared-chunk fixes, and stylesheet hints when Webpack or Rspack scope-hoists CSS-bearing
  client-reference trees into concatenated modules. Generated apps use the RC4 tuple described above.
  Doctor and the Node Renderer accept this qualified tuple while preserving stable RSC 19.2.x >=19.2.1
  with stable React 19.2.x >=19.2.7. Nonqualified RSC-package prereleases and unsupported React minors
  remain rejected. The Node Renderer explicitly rejects React/React DOM prereleases, including apps using
  stable RSC 19.2.1, and standalone RSC generators warn about React prereleases instead of discarding their
  version suffix. See #4958.
  #5026 by justin808.

• [Pro] Prerender-cached streamed renders now hydrate on every request: The automatic prerender cache key
  deliberately ignores random dom ids so one cached render serves every mount point, but the cached
  chunks still embedded the first request's dom id in their React Server Component payload keys.
  Every cache hit therefore refetched the payload and failed hydration whenever the render was not
  byte-identical. Cached streams are now rebound to the dom id of the render being served. Fixes
  #4984. #4987 by
  justin808.

• Release failures now provide supervised, reason-specific recovery: script/release --evaluate-head
  supports strict exact-HEAD CI evaluation for both preview and live retries, foreign claims identify the available
  holder/task/session metadata and targeted status command, and npm readiness distinguishes stale dependencies,
  pnpm-version mismatches, and package-build failures without requiring bin/setup. Fixes
  #4955.

• Fresh generated apps now preserve their resolved Shakapacker version: The installer now pins
  bundle add shakapacker --strict to the version already selected through React on Rails instead
  of allowing an older globally installed gem to downgrade the app's lockfile. The tested
  Shakapacker baseline is now 10.3.2, which includes the rack-proxy v1 development-server proxy fix
  and the macOS 27 liveness fix. Fixes
  #4947. #4948 by
  justin808.

• [Pro] Expected Node Renderer cold starts no longer emit OpenTelemetry error spans: The
  ror.bundle.build_execution_context cache-first probe previously ended with status ERROR when a worker had not
  compiled a bundle's VM context yet, even though the normal cache-miss path then rendered successfully. The probe
  now treats that expected miss as normal control flow while preserving error spans for genuine failures.
  #4908 by
  sashakhar1.

• [Pro] Hydrated Redux stores no longer leak across Turbo/Turbolinks navigations: The hydrated-store
  registry is now cleared on client-side page unload (soft navigation), alongside the existing component
  teardown. Previously a leftover entry from the previous page made getOrWaitForStore resolve immediately
  with the previous page's store, silently defeating the store_dependencies hydration gate — most visibly
  with deferred stores (redux_store(..., defer: true)), where a mid-page component could render the
  previous page's Redux state instead of waiting for its own page's hydration data. Registered store
  generators are unaffected and persist across navigations. Note for apps that relied on a store surviving a
  soft navigation without re-rendering its hydration data: each page using a store must now render its own
  redux_store call (the documented model). Fixes
  #4861.
  #4871 by
  AbanoubGhadban.

• On-demand renders initialize only the island's declared store dependencies:
  reactOnRailsComponentLoaded walked every store element on the page even when asked to render a
  single component, so an unrelated store element whose generator was not registered (e.g. its
  bundle had not loaded yet) aborted the requested render, and unrelated new stores were hydrated
  as a side effect. It now reads the data-store-dependencies attribute the react_component
  helper already emits (defaulted to the stores registered in the request, or set explicitly with
  the store_dependencies option) and initializes exactly those stores, matching the Pro
  renderer's dependency gating; a declared dependency that cannot initialize is logged without
  aborting the render. Markup without the attribute keeps the previous initialize-every-store
  behavior, and reactOnRailsPageLoaded/full page loads are unchanged. Completes
  #4862.
  #4870 by
  AbanoubGhadban.

• [Pro] Rails requests to the Node Renderer once again continue OpenTelemetry traces: The async-http transport
  now creates a CLIENT span and injects W3C trace context for regular and streaming renders, incremental async-props
  renders, raw-render requests, and asset uploads when the Rails application has configured the OpenTelemetry SDK.
  OpenTelemetry remains optional, and spans record only the HTTP method, normalized request path, response status, and
  request/response byte sizes. Fixes
  #4866.
  #4869 by
  sashakhar1.

• [Pro] Node Renderer transport follow-ups now expose protocol errors and accurate Fastify modes:
  Rails retries continue for network disconnects and peer-reset HTTP/2 streams, while HTTP parser and framing errors
  surface directly. Public configureFastify callbacks and fastifyServerOptions now reflect both HTTP/1.1 and
  HTTP/2 runtime modes.
  #4893 by
  sashakhar1.

• [Pro] Bounded Node Renderer VM retention now avoids old/new RSC rebuild thrash during rolling deploys:
  The default per-worker VM hard cap now retains four contexts, enough for the server and RSC bundles from one
  draining and one current revision. Successful bundle sets remain reusable through a configurable, timer-driven
  drain window, while inactive contexts, generation metadata, and pressure logs stay bounded. Pre-seeding now emits
  an immutable revision-scoped current-generation declaration; each configured renderer worker validates and compiles
  that complete server/RSC set before listening, pins it across old-only traffic gaps, and reports ready only after the
  compile barrier. Symlink-mode cache paths reuse the validated immutable snapshot VM identity without rebuilding on
  the first request. Doctor now requires valid renderer JavaScript before launcher-derived capacity can prove a warm
  pass, and reports observed/unverified declaration evidence rather than claiming success from invalid syntax,
  loopback, or Rails-process configuration. Upgrade memory impact: the
  default maxVMPoolSize doubles from 2 to 4 per worker, and total VM retention scales with renderer workers and
  replicas, so operators should re-check deployment memory requests and limits. Invalid MAX_VM_POOL_SIZE values
  that previously fell back to the default now fail fast during renderer startup. Fixes
  #4810.
  #4811 by
  justin808.

• Routine startup diagnostics no longer appear in default INFO logs: Successful package validation, valid
  Pro license checks, non-production missing-license notices, and Node renderer connection setup now log at DEBUG
  instead of INFO. Package validation still runs, while expired or invalid configured licenses remain visible outside
  production, and production license warnings and renderer failures remain actionable. Fixes
  #4848.
  #4849 by
  Justin Gordon.

• Generated server webpack configs no longer include an unused merge import or stale comments:
  commonWebpackConfig already clones the shared client configuration, so the generated server configuration
  stays lint-clean without changing its runtime behavior. Fixes
  #4791.
  #4840 by
  ihabadham.

• Release retries now durably reuse maintainer-verified ShakaPerf evidence: rake release can bind an
  existing successful run to the canonical release tracker with RELEASE_SHAKAPERF_RUN, then re-fetch and
  re-verify the exact SHA or machine-proven runtime-equivalent evidence on later invocations instead of
  dispatching duplicate performance runs. Tracker trust is bound to the exact
  Release gate: react_on_rails X.Y.Z stable-base title, explicit selectors take precedence over automatic
  accepted-RC reuse, and persisted accelerated retries cannot silently consume a selector. Automatic reuse
  falls back to normal discovery only for authoritative natural invalidation such as stale or missing evidence,
  a failed/cancelled live run, or proven runtime divergence; indeterminate API or Git failures, detector errors,
  and record mutations remain blocking. Raw REST-selected runs now preserve their creation timestamp through
  strict-final verification. Before either a live release or dry run can reach registry checks, confirmation,
  mut...

v17.1.0.rc.5

No user-visible changes since 17.1.0.rc.4; this candidate completes publication after the partial RC4 release.

v17.1.0.rc.3

Fixed

• [Pro] RSC 19.3 release-candidate compatibility and generated defaults: Generated RSC apps now pin
  react-on-rails-rsc@19.3.0-rc.3 with React/React DOM ~19.2.8, bringing the JSX/TSX client-export
  parsing and Rspack shared-chunk fixes into the 17.1 RC soak. RC3 also restores stylesheet hints
  when Webpack or Rspack scope-hoists CSS-bearing client-reference trees into concatenated modules.
  Doctor and the Node Renderer accept
  this qualified RC tuple while preserving stable RSC 19.2.x >=19.2.1 with stable React 19.2.x >=19.2.7.
  Nonqualified RSC-package prereleases and unsupported React minors remain rejected. The Node Renderer
  now explicitly rejects React/React DOM prereleases, including apps using stable RSC 19.2.1.
  Action required: use matching supported stable React/React DOM versions, and upgrade the Pro gem/npm
  packages together before adopting this RSC RC. A "use client"
  file without runtime ES-module exports now fails the build instead of silently disappearing.
  Standalone RSC generators also warn about React prereleases instead of discarding their version suffix.
  See #4958 and
  RSC release notes.
  #5026 by justin808.

v17.1.0.rc.2

Fixed

• [Pro] Prerender-cached streamed renders now hydrate on every request: The automatic prerender cache key
  deliberately ignores random dom ids so one cached render serves every mount point, but the cached
  chunks still embedded the first request's dom id in their React Server Component payload keys.
  Every cache hit therefore refetched the payload and failed hydration whenever the render was not
  byte-identical. Cached streams are now rebound to the dom id of the render being served. Fixes
  #4984. #4987 by
  justin808.

v17.1.0.rc.1

Fixed

• Release failures now provide supervised, reason-specific recovery: script/release --evaluate-head
  supports strict exact-HEAD CI evaluation for both preview and live retries, foreign claims identify the available
  holder/task/session metadata and targeted status command, and npm readiness distinguishes stale dependencies,
  pnpm-version mismatches, and package-build failures without requiring bin/setup. Fixes
  #4955.

• Fresh generated apps now preserve their resolved Shakapacker version: The installer now pins
  bundle add shakapacker --strict to the version already selected through React on Rails instead
  of allowing an older globally installed gem to downgrade the app's lockfile. The tested
  Shakapacker baseline is now 10.3.2, which includes the rack-proxy v1 development-server proxy fix
  and the macOS 27 liveness fix. Fixes
  #4947. #4948 by
  justin808.

v17.1.0.rc.0

Fixed

• [Pro] Expected Node Renderer cold starts no longer emit OpenTelemetry error spans: The
  ror.bundle.build_execution_context cache-first probe previously ended with status ERROR when a worker had not
  compiled a bundle's VM context yet, even though the normal cache-miss path then rendered successfully. The probe
  now treats that expected miss as normal control flow while preserving error spans for genuine failures.
  #4908 by
  sashakhar1.

• [Pro] Hydrated Redux stores no longer leak across Turbo/Turbolinks navigations: The hydrated-store
  registry is now cleared on client-side page unload (soft navigation), alongside the existing component
  teardown. Previously a leftover entry from the previous page made getOrWaitForStore resolve immediately
  with the previous page's store, silently defeating the store_dependencies hydration gate — most visibly
  with deferred stores (redux_store(..., defer: true)), where a mid-page component could render the
  previous page's Redux state instead of waiting for its own page's hydration data. Registered store
  generators are unaffected and persist across navigations. Note for apps that relied on a store surviving a
  soft navigation without re-rendering its hydration data: each page using a store must now render its own
  redux_store call (the documented model). Fixes
  #4861.
  #4871 by
  AbanoubGhadban.

• On-demand renders initialize only the island's declared store dependencies:
  reactOnRailsComponentLoaded walked every store element on the page even when asked to render a
  single component, so an unrelated store element whose generator was not registered (e.g. its
  bundle had not loaded yet) aborted the requested render, and unrelated new stores were hydrated
  as a side effect. It now reads the data-store-dependencies attribute the react_component
  helper already emits (defaulted to the stores registered in the request, or set explicitly with
  the store_dependencies option) and initializes exactly those stores, matching the Pro
  renderer's dependency gating; a declared dependency that cannot initialize is logged without
  aborting the render. Markup without the attribute keeps the previous initialize-every-store
  behavior, and reactOnRailsPageLoaded/full page loads are unchanged. Completes
  #4862.
  #4870 by
  AbanoubGhadban.

• [Pro] Rails requests to the Node Renderer once again continue OpenTelemetry traces: The async-http transport
  now creates a CLIENT span and injects W3C trace context for regular and streaming renders, incremental async-props
  renders, raw-render requests, and asset uploads when the Rails application has configured the OpenTelemetry SDK.
  OpenTelemetry remains optional, and spans record only the HTTP method, normalized request path, response status, and
  request/response byte sizes. Fixes
  #4866.
  #4869 by
  sashakhar1.

• [Pro] Node Renderer transport follow-ups now expose protocol errors and accurate Fastify modes:
  Rails retries continue for network disconnects and peer-reset HTTP/2 streams, while HTTP parser and framing errors
  surface directly. Public configureFastify callbacks and fastifyServerOptions now reflect both HTTP/1.1 and
  HTTP/2 runtime modes.
  #4893 by
  sashakhar1.

• [Pro] Bounded Node Renderer VM retention now avoids old/new RSC rebuild thrash during rolling deploys:
  The default per-worker VM hard cap now retains four contexts, enough for the server and RSC bundles from one
  draining and one current revision. Successful bundle sets remain reusable through a configurable, timer-driven
  drain window, while inactive contexts, generation metadata, and pressure logs stay bounded. Pre-seeding now emits
  an immutable revision-scoped current-generation declaration; each configured renderer worker validates and compiles
  that complete server/RSC set before listening, pins it across old-only traffic gaps, and reports ready only after the
  compile barrier. Symlink-mode cache paths reuse the validated immutable snapshot VM identity without rebuilding on
  the first request. Doctor now requires valid renderer JavaScript before launcher-derived capacity can prove a warm
  pass, and reports observed/unverified declaration evidence rather than claiming success from invalid syntax,
  loopback, or Rails-process configuration. Upgrade memory impact: the
  default maxVMPoolSize doubles from 2 to 4 per worker, and total VM retention scales with renderer workers and
  replicas, so operators should re-check deployment memory requests and limits. Invalid MAX_VM_POOL_SIZE values
  that previously fell back to the default now fail fast during renderer startup. Fixes
  #4810.
  #4811 by
  justin808.

• Routine startup diagnostics no longer appear in default INFO logs: Successful package validation, valid
  Pro license checks, non-production missing-license notices, and Node renderer connection setup now log at DEBUG
  instead of INFO. Package validation still runs, while expired or invalid configured licenses remain visible outside
  production, and production license warnings and renderer failures remain actionable. Fixes
  #4848.
  #4849 by
  Justin Gordon.

• Generated server webpack configs no longer include an unused merge import or stale comments:
  commonWebpackConfig already clones the shared client configuration, so the generated server configuration
  stays lint-clean without changing its runtime behavior. Fixes
  #4791.
  #4840 by
  ihabadham.

• Release retries now durably reuse maintainer-verified ShakaPerf evidence: rake release can bind an
  existing successful run to the canonical release tracker with RELEASE_SHAKAPERF_RUN, then re-fetch and
  re-verify the exact SHA or machine-proven runtime-equivalent evidence on later invocations instead of
  dispatching duplicate performance runs. Tracker trust is bound to the exact
  Release gate: react_on_rails X.Y.Z stable-base title, explicit selectors take precedence over automatic
  accepted-RC reuse, and persisted accelerated retries cannot silently consume a selector. Automatic reuse
  falls back to normal discovery only for authoritative natural invalidation such as stale or missing evidence,
  a failed/cancelled live run, or proven runtime divergence; indeterminate API or Git failures, detector errors,
  and record mutations remain blocking. Raw REST-selected runs now preserve their creation timestamp through
  strict-final verification. Before either a live release or dry run can reach registry checks, confirmation,
  mutation, tagging, or publication, the task also verifies the frozen pnpm install state, the repository-pinned
  pnpm version, and lifecycle-enabled builds of all four npm release packages before creating a release checkout,
  pulling, authenticating, or reading any remote release state. The successful check is bound to the exact commit;
  when a live git pull --rebase advances HEAD, the task rebuilds and rebinds readiness before resolving the release
  version or continuing. npm publication now retries only explicit OTP challenges and context-qualified transient
  network/HTTP failures; successful lifecycle/tool banners no longer mask those diagnostics, while authentication,
  actual lifecycle failures, registry rejection, incidental numeric diagnostics, and unknown failures stop immediately
  with OTP values redacted. Saved ShakaPerf evidence also recognizes GitHub CLI's exact
  no valid artifacts found to download diagnostic as authoritative absence while preserving observation failures as
  blocking. Stable releases also support
  an append-only, tracker-bound schema-v2 observation waiver bound to the exact run attempt and canonical
  repository/workflow/event/branch identity. Legacy schema-v1 waiver markers remain readable audit history but cannot
  authorize publication. The waiver does not
  claim the run succeeded or bypass any other release gate; the tracker, waiver, and exact run are revalidated
  before remote tag push and package publication, and a rerun attempt blocks both boundaries. Fixes
  #4812.
  #4833 by
  justin808.

• [Pro] RSC render-error details no longer reach browser-facing payloads in production-like
  environments: Fetched RSC payload metadata now uses a fail-closed allowlist that exposes only the
  generic hasErrors signal needed by client error boundaries. Inline error-bearing payload chunks now
  also suppress console replay in production, staging, and unrecognized environments, closing a path
  that could repeat the server error message or source-mapped file paths after diagnostic metadata was
  redacted. Full diagnostics and console replay remain available in development and test, clean
  production chunks retain console replay, and server-side reporting still receives the original error
  details before the browser-boundary redaction runs. Fixes
  #4736,
  #4822, and
  #4827.
  #4821 and
  #4856 by
  justin808.

• HTTP-served SSR bundle loading now honors the response charset, rejects non-2xx responses,
  and no longer leaks URL credentials into error messages:
  When server_bundle_js_file resolves to an HTTP(S) URL, RubyEmbeddedJavaScript.file_url_to_string
  no longer assumes the Content-Type header always ends in an exact ; charset=... form. A response
  with no charset, a Content-Type with no charset parameter, a missing Content-Type header, or a
  quoted charset value (charset="ISO-8859-1") now transcodes to UTF-8 successfully instead of
  raising or silently mislabeling the bytes, falling back to UTF-8 when no usable charset is declared.
  A non-2xx response (for example a 404 page or a proxy error) is now rejected with a clear
  bundle-load error naming the URL and status, ins...

v17.0.1

Fixed

• Corrected the OSS npm package license metadata and packed license: react-on-rails now declares
  MIT, includes a package-local MIT license in the published tarball, and verifies the packed
  artifact cannot inherit React on Rails Pro commercial terms.
  PR 4792 by
  justin808.

v17.0.1.rc.0

Fixed

• Corrected the OSS npm package license metadata and packed license: react-on-rails now declares
  MIT, includes a package-local MIT license in the published tarball, and verifies the packed
  artifact cannot inherit React on Rails Pro commercial terms.
  PR 4792 by
  justin808.

v17.0.0

Breaking Changes

• [Pro] Removed the undocumented ReactOnRailsPro::Cache.fetch_react_component class API:
  Pro apps should use the supported cached helper APIs (cached_react_component,
  cached_react_component_hash, and related helpers) instead of calling the low-level cache class
  directly. The helper cache path still preserves generated-pack loading on cache hits, tag
  registration, and expires_at handling internally. Fixes
  #4497.
  #4541 by
  justin808.
• [Pro] React Server Components now require the stable React 19.2.x RSC line: Pro RSC apps on React on Rails 17 require react-on-rails-rsc >= 19.2.1 < 19.3, React >= 19.2.7, and matching React DOM. Non-RSC Pro apps retain React 18 support. The Pro generator scaffolds that coordinated stable runtime and rejects all prerelease RSC packages while the stable floor is active. The adopted react-on-rails-rsc artifact uses the React on Rails Pro commercial terms rather than MIT and reports SEE LICENSE IN LICENSE.md in npm metadata. Set REACT_ON_RAILS_PRO_DISABLE_VERSION_CHECK=1 only as an emergency rollout escape hatch to downgrade startup errors to warnings. #4357. #4490 and #4670 by justin808.
• Removed the inert config.server_render_method option: The open-source configuration no longer accepts config.server_render_method. The option never selected a server render method — the open-source gem always renders with ExecJS — and its validator raised ReactOnRails::Error at boot for any value other than blank or "ExecJS". Setting it now raises NoMethodError at boot, so delete any config.server_render_method = ... line from config/initializers/react_on_rails.rb; rake react_on_rails:doctor also flags the stale line. For a standalone Node rendering process, use React on Rails Pro's Node renderer, configured via ReactOnRailsPro.configure. Fixes #4415. #4423 by justin808.
• Removed three deprecated configuration options (config.generated_assets_dirs, config.skip_display_none, config.defer_generated_component_packs): These were deprecated in v16 and are gone in v17. Setting any of them now raises NoMethodError at boot; delete the stale lines from config/initializers/react_on_rails.rb (rake react_on_rails:doctor flags them). Migration: delete config.generated_assets_dirs — public asset paths come from public_output_path in config/shakapacker.yml; delete config.skip_display_none — it had no runtime effect; replace config.defer_generated_component_packs = true with config.generated_component_packs_loading_strategy = :defer, and simply delete config.defer_generated_component_packs = false (the removed option was truthy-gated — only = true set :defer; = false was a no-op that fell through to the default strategy, so it did not mean :sync; set :sync explicitly only if you relied on synchronous loading). The default strategy is :async for Pro or :defer for non-Pro on Shakapacker 8.2.0+, and :sync on older Shakapacker. Fixes #4419. #4432 by justin808.
• Removed the never-wired RenderRequest / JsCodeBuilder / RenderingStrategy rendering layer: The internal strategy-pattern classes ReactOnRails::RenderRequest, ReactOnRails::JsCodeBuilder, ReactOnRails::RenderingStrategy (with ExecJsStrategy), and — in Pro — ReactOnRailsPro::JsCodeBuilder and ReactOnRailsPro::RenderingStrategy::NodeStrategy, plus the undocumented ReactOnRails.rendering_strategy and ReactOnRails.js_code_builder module accessors, are removed. This scaffolding was built for the strategy-pattern refactor in #2905 (closed without wiring it in) and was never invoked on any production server-rendering path — SSR runs through ServerRenderingJsCode and ServerRenderingPool, which never touched this layer. These constants and accessors were internal and undocumented; if you reference them in application code, remove the reference (the layer performed no work). Fixes #4414. #4437 by justin808.
• Removed undocumented ReactOnRails::Utils helpers: React on Rails 17 removes the unused ReactOnRails::Utils.server_rendering_is_enabled? and ReactOnRails::Utils.rails_version_less_than helper methods. Remove any application calls to those helpers; release-example generation now owns its private Rails-version check outside the public Utils surface. Fixes #4418. #4431 by justin808.
• Ruby 3.3+ is required for React on Rails v17: The open-source gem now requires Ruby >= 3.3.0, aligning it with React on Rails Pro, create-react-on-rails-app, and the CI minimum matrix. React on Rails v16 remains the upgrade path for applications that must stay on Ruby 3.2 or older. #3500 by justin808.
• [Pro] Node Renderer now requires Ruby 3.3+ for the async-http transport: The react-on-rails-pro gem now requires Ruby >= 3.3 (raised from >= 3.0) because async-http depends on Ruby 3.3 features. Upgrade Ruby before moving to this release. See docs/pro/updating.md for the full upgrade guide. #3320 by AbanoubGhadban.
• [Pro] config.renderer_http_pool_size now limits async-http connections per renderer client: Existing numeric values now cap concurrent async-http connections for each renderer client instead of sizing a persistent process-wide connection pool. HTTP/2 may multiplex request streams over those pooled connections. Setting nil keeps the default connection limit and does not make the async-http client unlimited. Persistent connection reuse is automatic when a long-lived Fiber.scheduler is present. See docs/pro/updating.md for the full upgrade guide. #3320 by AbanoubGhadban.

Added

• [Pro] React 18 support for non-RSC streaming SSR: stream_react_component with synchronous
  props is now explicitly supported on React 18 as well as React 19. Permanent packed-artifact
  coverage verifies a production Webpack build and progressive Suspense output on React 18 without
  installing or bundling react-on-rails-rsc; async props and React Server Components remain React
  19-only. Fixes #4642.
  #4658 by
  justin808.

• Generated Rails response TypeScript contracts: Rails apps can now register explicit JSON response
  contracts with ReactOnRails::TypeScriptResponseTypes and run
  rake react_on_rails:generate_response_types to emit importable .d.ts declarations plus a
  RailsResponseTypes lookup map for TanStack Query clients. Fixes
  #4247. #4259 by justin808.

• Typed Rails action callers for TanStack Query mutations: The react-on-rails/railsAction
  subpath now exports createRailsAction, a same-origin JSON caller that attaches Rails CSRF headers and
  lets mutation code type responses with the generated RailsResponseType<'controller.action'> lookup.
  Fixes #4248. #4260 by justin808.

• [Pro] Typed Rails action callers for TanStack Query mutations: The Pro package mirrors the
  createRailsAction helper at react-on-rails-pro/railsAction. #4260 by justin808.

• [Pro] Loader-time RSC prefetch through the provider cache: Client-router loaders can now
  call prefetchServerComponent to warm a bounded page-global prefetch store that RSCProvider
  adopts on the next RSCRoute render. Prefetches no-op when the SSR payload is already embedded,
  support loader abort signals, and resolve without unhandled rejections after fetch/decode failure
  self-eviction. Fixes #4460.
  #4489 by
  justin808.

• bin/dev clean clears generated bundles and caches: The command stops development processes, reads config/shakapacker.yml or SHAKAPACKER_CONFIG, removes configured Shakapacker public/private output and cache paths plus common Rails, JavaScript, and renderer bundle caches, and skips unsafe paths outside the app root. #4218 by justin808.

• [Pro] Buffered RSC rendering for static pages:
  buffered_stream_react_component and cached_buffered_stream_react_component
  now render server components through the Pro streaming/RSC renderer while
  returning complete HTML to Rails, so static or cacheable pages can avoid
  ActionController::Live response commits when progressive streaming is not
  needed. When RSC support is enabled, prerendered Pro fragment cache keys now
  include the RSC bundle digest, or a missing-bundle sentinel until that bundle
  exists, so deploys that update only the RSC bundle invalidate cached RSC output
  consistently. Fixes
  #4263.
  #4268 by
  justin808.

• [Pro] Cached static RSC public-page helper and diagnostics:
  cached_static_rsc_component caches stripped static RSC HTML for public pages
  that intentionally skip the generated page pack, while respecting
  auto_load_bundle: false and preserving explicit sidecar assets. Static RSC
  render diagnostics report cache hit/miss state, redacted cache-key digests,
  HTML and stripped payload bytes, emitted asset bytes, and RSC client-reference
  entries for performance investigations. Fixes
  #4295 and
  #4296.
  #4386 by
  justin808.

• [Pro] Opt-in browser performance marks for streamed RSC observability: Pro streaming can now emit inline browser marks for RSC stream completion, embedded Flight payload chunks, Node-side flushes, hydration start, and first interactive client effects, with byte counts and timing details that avoid serialized props or payload contents. The documented path uses body-delivered marks and a fallback queue instead of HTTP trailers, so apps can measure streamed RSC responses across CDN paths that may strip or hide trailer timing. Fixes #4205, #4206, and #4207. #4222 by justin808.

• [Pro] Server-Timing attribution for streamed RSC responses: When rsc_stream_observability: true, the streamed RSC response now also carries a `Server-Timin...

v17.0.0.rc.12

Added

• [Pro] React 18 support for non-RSC streaming SSR: stream_react_component with synchronous
  props is now explicitly supported on React 18 as well as React 19. Permanent packed-artifact
  coverage verifies a production Webpack build and progressive Suspense output on React 18 without
  installing or bundling react-on-rails-rsc; async props and React Server Components remain React
  19-only. Fixes Issue 4642.
  PR 4658 by
  justin808.