v16.6.0

Removed

• Removed immediate_hydration configuration and parameter: The immediate_hydration config option, helper parameter, data-immediate-hydration HTML attribute, and redux_store immediate_hydration: keyword argument have been completely removed. Immediate hydration is now always enabled for React on Rails Pro users and disabled for non-Pro users, with no per-component override. Remove any immediate_hydration references from your initializer and helper calls. Passing immediate_hydration: to react_component / react_component_hash is now ignored, and passing it to stream_react_component logs a warning. This change also fixes HTML attribute escaping for redux store names to prevent attribute injection from unsafe store keys. Closes Issue 2142.
  PR 2834 by
  justin808.

Added

• [Pro] Auto-resolve renderer password from ENV: setup_renderer_password now falls back to ENV["RENDERER_PASSWORD"] when neither config.renderer_password nor a URL-embedded password is set, aligning Rails-side behavior with the Node Renderer defaults. Blank values (nil or "") are treated identically and fall through the full resolution chain: config → URL → ENV. PR 2921 by justin808.
• Interactive mode prompt for create-react-on-rails-app: Running npx create-react-on-rails-app without --pro or --rsc now shows an interactive prompt to choose between Standard, Pro, and RSC modes (default: RSC recommended). Explicit flags skip the prompt, and non-interactive environments fall back to standard mode automatically. PR 3063 by justin808.
• [Pro] Configurable HTTP keep-alive timeout for node renderer connections: Added renderer_http_keep_alive_timeout configuration option (default: 30s) to control how long idle persistent HTTP/2 connections to the node renderer are kept alive, preventing SSR failures from stale connections. PR 3069 by justin808.
• [Pro] react_on_rails:pro now automates Pro and RSC Pro upgrades: Added first-class --rsc-pro install mode, automatic react_on_rails -> react_on_rails_pro Gemfile and package swaps, and frontend import rewrites to streamline existing app upgrades. PR 2822 by justin808.

Improved

• [Pro] Clearer node renderer request context in exception messages: Exception formatting now uses a generic Request: label instead of render-specific wording, so /upload-assets failures and other non-render paths report the actual request context more clearly. PR 2877 by AbanoubGhadban.
• [Pro] Cleaner node renderer diagnostic output: Invalid render-request diagnostics no longer redundantly list renderingRequest in the bodyKeys output since it is already reported via the Received type: line, and renderer_http_keep_alive_timeout documentation now recommends setting it shorter than the node renderer's server-side idle timeout. PR 3086 by justin808.
• Doctor enforces strict version constraints: react_on_rails:doctor now escalates non-exact gem and npm version specs (^, ~, >=) from warnings to errors, matching the runtime VersionChecker behavior. Wildcard checks now also cover Pro packages (react-on-rails-pro, react_on_rails_pro). PR 3070 by justin808.
• Error messages recommend doctor: Runtime version-check crashes, configuration validation errors, and autobundling errors now suggest running bundle exec rake react_on_rails:doctor for diagnostics and bundle exec rake react_on_rails:sync_versions WRITE=true to fix version mismatches. PR 3070 by justin808.
• sync_versions handles range specs: Version ranges like ^16.5.0, ~16.5.0, and >=16.5.0 are now parsed and rewritten to the exact expected version instead of being skipped as unsupported. When FIX=true is set, doctor auto-runs sync_versions to fix detected mismatches. PR 3070 by justin808.
• [Pro] Improved node renderer error messages for malformed render requests: Added early validation for missing or invalid renderingRequest payloads on the render endpoint, returning actionable 400 messages that include received type, body keys, and likely causes (truncation, malformed multipart, content-length mismatch). PR 3068 by justin808.
• react_on_rails:doctor now prefers runtime configuration: Doctor now reads loaded ReactOnRails.configuration values before falling back to initializer parsing, improving diagnostics for customized SSR and NodeRenderer setups. PR 2823 by justin808.
• Fresh app onboarding for create-react-on-rails-app: New apps now land on a generated root page with links to the local demos, docs, OSS vs Pro guidance, the Pro quick start, and the marketplace RSC demo. bin/dev opens that page on first boot, --rsc scaffolds the same fresh-app experience, and the generated app records step-by-step educational git commits for each scaffold phase. PR 2849 by justin808.

Fixed

• Pin third-party npm dependency versions in generator: All third-party npm dependencies installed by the react_on_rails:install generator and bin/switch-bundler are now pinned to ^major.0.0 version ranges, preventing peer dependency conflicts from uncontrolled major version bumps. Fixes CI breakage caused by @rspack/plugin-react-refresh@2.0.0 requiring @rspack/core@^2.0.0-0 while @rspack/core latest was still 1.7.11. SWC dependency pins match Shakapacker's own version constraints. Closes Issue 3082. PR 3083 by ihabadham.
• [Pro] Fixed TanStack Router SSR hydration mismatches in the async path: Client hydration now restores server match data before first render, uses RouterProvider directly to match the server-rendered tree, and stops the post-hydration load when a custom router.options.hydrate callback fails instead of continuing with partially hydrated client state. PR 2932 by justin808.
• [Pro] Fixed infinite fork loop when node renderer worker fails to bind port: When a worker failed during app.listen() (e.g., EADDRINUSE), the master previously reforked unconditionally, causing an infinite fork/crash loop that consumed CPU and filled logs. Workers now send a WORKER_STARTUP_FAILURE IPC message to the master before exiting; the master sets an abort flag and exits with a clear error message instead of reforking. Scheduled restarts and runtime crashes continue to refork as before. PR 2881 by justin808.
• [Pro] Fixed Pro generator multiline and template-literal rewrites: The Pro install generator now correctly handles multiline non-parenthesized gem "react_on_rails" declarations while preserving trailing options, and correctly rewrites module specifiers around template literals by preserving escaped sequences and detecting multiline template-literal starts after a closed inline template. PR 2918 by justin808.
• [Pro] Fixed SSR failures from stale persistent HTTP/2 connections to the node renderer: When idle connections became stale (closed by the node renderer but still considered active by the Ruby side), render requests could be truncated mid-flight, producing confusing FST_ERR_CTP_INVALID_CONTENT_LENGTH and "INVALID NIL or NULL result for rendering" errors. The new renderer_http_keep_alive_timeout config (default: 30s) prevents this by closing idle connections before they go stale. Content-Length mismatches now produce specific diagnostic messages instead of generic errors, and sensitive field names are filtered from diagnostic output. Fixes Issue 3071. PR 3069 by justin808.
• Legacy Shakapacker migrations are more resilient: react_on_rails:install now falls back cleanly when the package_json gem is unavailable, installs only missing JS packages through the detected package manager, and auto-switches legacy JSX-in-.js apps to Babel when needed. PR 2901 by justin808.
• New-app root-route generation is more robust: Generator root-route detection is now centralized, duplicate route insertion is avoided, and home-page generation warns instead of failing when config/routes.rb is missing or unexpected. PR 2891 by justin808.
• bin/dev now exits quietly on Ctrl-C: The process manager and generated Shakapacker watcher wrapper now treat interrupt-driven shutdown as a clean exit, avoiding Ruby backtraces during local development. PR 2652 by justin808.
• bin/dev browser auto-open now waits for route readiness: --open-browser and --open-browser-once now poll the target app route and open the browser only after receiving a success or redirect response, reducing premature opens during boot. PR 2885 by justin808.