fix: allow webpack-dev-server v6#1102
Conversation
Updated peer dependency version range for webpack-dev-server.
WalkthroughThis PR expands webpack-dev-server peer dependency support from version ^5.2.2 to include version ^6.0.0. The same version range change is applied consistently across the main package.json peer dependencies, the installation package config, and the peer dependency documentation. Changeswebpack-dev-server v6 Support
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~5 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Greptile SummaryThis PR widens the
Confidence Score: 4/5Safe to merge — the change is a one-line peer dependency range widening applied consistently across all three relevant files, with no runtime code touched. The dependency range update is correct and consistent. The only gap is a missing CHANGELOG entry that the project's own conventions require for user-visible fixes like this one. CHANGELOG.md should receive an entry under the Unreleased section before merging. Important Files Changed
Flowchart%%{init: {'theme': 'neutral'}}%%
flowchart TD
A[Shakapacker 10.x] --> B{webpack-dev-server version?}
B -->|v5.2.2 and above| C[Supported before this PR]
B -->|v6.0.0 and above| D[Newly supported by this PR]
B -->|v4.x or older| E[Not supported]
C --> F[peerDependencies range updated]
D --> F
Reviews (1): Last reviewed commit: "fix: allow `webpack-dev-server` v6" | Re-trigger Greptile |
|
@G-Rath I asked copilot about the failing CI: The failure is happening during the generator install step itself, not in the assertions afterward. The common failing point is the shell command launched from
That command is executed through Most likely root causeThe failures line up with the PR’s new Babel-related expectations:
Because 63 examples fail across npm/pnpm/bun/TypeScript/auto-detect cases, this strongly suggests the installer now writes or validates package/config state inconsistently and aborts early for all variants. Focused solutionFix the installer so transpiler selection is centralized and consistent: 1. Compute transpiler mode onceIn the install code, derive one value from env/options: transpiler =
if ENV["JAVASCRIPT_TRANSPILER"] == "babel"
"babel"
elsif Shakapacker::Utils::Misc.object_to_boolean(ENV["USE_BABEL_PACKAGES"])
"babel"
else
"swc"
endUse that same value everywhere:
2. Separate “runtime transpiler” from “installed compatibility packages”Based on the spec:
That means the dependency logic should look more like: use_babel_packages = Shakapacker::Utils::Misc.object_to_boolean(ENV["USE_BABEL_PACKAGES"])
babel_only = ENV["JAVASCRIPT_TRANSPILER"] == "babel"
dependencies = base_dependencies.dup
dependencies.merge!(babel_dependencies) if use_babel_packages || babel_only
dependencies.merge!(swc_dependencies) unless babel_only3. Update
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@package.json`:
- Line 123: The peerDependencies entry for "webpack-dev-server" lists a
non-existent v6 range ("^5.2.2 || ^6.0.0"); update the package.json
peerDependencies so the "webpack-dev-server" range only includes valid released
versions (remove the "|| ^6.0.0" portion), e.g., change the value to "^5.2.2"
(or to a single valid v5 range such as "^5.2.2" or a bumped v5 like "^5.2.4" if
you want to target the latest patch).
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: cacd7101-6b82-4290-8708-0801cc39152a
📒 Files selected for processing (3)
docs/peer-dependencies.mdlib/install/package.jsonpackage.json
| "webpack-assets-manifest": "^5.0.6 || ^6.0.0", | ||
| "webpack-cli": "^4.9.2 || ^5.0.0 || ^6.0.0 || ^7.0.0", | ||
| "webpack-dev-server": "^5.2.2", | ||
| "webpack-dev-server": "^5.2.2 || ^6.0.0", |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Description: Verify webpack-dev-server v6 availability and security status
# Check available versions on npm
echo "=== Checking webpack-dev-server versions on npm ==="
curl -s https://registry.npmjs.org/webpack-dev-server | jq -r '.versions | keys[] | select(startswith("6."))' | head -10
echo -e "\n=== Checking latest version ==="
curl -s https://registry.npmjs.org/webpack-dev-server/latest | jq -r '.version'
echo -e "\n=== Checking for security advisories ==="
gh api graphql -f query='
{
securityVulnerabilities(first: 5, ecosystem: NPM, package: "webpack-dev-server") {
nodes {
advisory {
ghsaId
summary
severity
publishedAt
}
vulnerableVersionRange
firstPatchedVersion {
identifier
}
}
}
}'Repository: shakacode/shakapacker
Length of output: 1097
🌐 Web query:
webpack-dev-server v6 migration guide breaking changes
💡 Result:
As of May 16, 2026, webpack-dev-server has not released a version 6.0.0 [1][2]. The current stable version is in the 5.x series (specifically 5.2.4, released May 11, 2026) [2]. Because no v6 release exists, there is no official migration guide for it. If you are looking to migrate to the latest version, you should refer to the migration guide for v5.0.0 [3][1]. Key breaking changes introduced in the v5.0.0 release include: - Minimum Node.js version: 18.12.0 [3]. - Minimum webpack version: 5.0.0 [3]. - Server configuration: The http2 and https options were removed in favor of a unified server option [3]. - Middleware: onAfterSetupMiddleware and onBeforeSetupMiddleware were replaced by setupMiddlewares [3]. - Proxy: The proxy option now requires an array [3]. - CLI options: --open-app was replaced by --open-app-name, and --web-socket-server was replaced by --web-socket-server-type [3]. - Environment variables: The WEBPACK_SERVE environment variable value changed from a boolean true to the string 'true' [3]. - API changes: The constructor arguments were updated (first argument is options, second is compiler), and the listen method was replaced by async start or startCallback methods [3]. For detailed instructions on upgrading to the current stable version, consult the official migration-v5.md document in the webpack-dev-server GitHub repository [3].
Citations:
- 1: https://github.com/webpack/webpack-dev-server/blob/master/CHANGELOG.md
- 2: https://www.npmjs.com/package/webpack-dev-server
- 3: https://github.com/webpack/webpack-dev-server/blob/main/migration-v5.md
Remove non-existent webpack-dev-server v6 from peer dependency range.
The peer dependency range specifies ^6.0.0, but webpack-dev-server v6 has not been released on npm. The current latest version is 5.2.4. Remove ^6.0.0 from the OR clause so the range reflects only available versions (e.g., ^5.2.2).
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@package.json` at line 123, The peerDependencies entry for
"webpack-dev-server" lists a non-existent v6 range ("^5.2.2 || ^6.0.0"); update
the package.json peerDependencies so the "webpack-dev-server" range only
includes valid released versions (remove the "|| ^6.0.0" portion), e.g., change
the value to "^5.2.2" (or to a single valid v5 range such as "^5.2.2" or a
bumped v5 like "^5.2.4" if you want to target the latest patch).
|
@justin808 I expect the failures are because CI attempts to install the latest package version possible for peer dependencies, and 
If you want to land this now, then probably easiest solution would be to have CI special case |
2 participants
Summary
This version will be released in the next week or so, and importantly enables addressing GHSA-w5hq-g745-h8pq
The migration docs are here - I don't think any of the breaking changes require any changes to Shakapacker
Pull Request checklist
Other Information
Summary by CodeRabbit
Documentation
Chores