Walkthrough

Added a new Pro-focused RSC upgrade guide and linked it from the Pro tutorial and upgrade pages; updated prerequisite/versioning language and checks in the new guide. All changes are documentation-only.

Changes

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related PRs

• Add RSC upgrade guide for existing Pro apps #2830: Edits the same Pro RSC upgrade guide and related cross-links; likely overlapping changes.

Poem

🐇 I nibbled through pages, soft and spry,

A Pro guide grew beneath my sky,
Links aligned and versions shone,
Old exports noted, new checks known,
Hooray — RSC hops on by!

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

Greptile Summary

This PR adds a standalone upgrade guide (docs/pro/react-server-components/upgrading-existing-pro-app-to-rsc.md) for existing React on Rails Pro users who want to add RSC support, and wires it into the docs navigation from four locations. The guide covers prerequisites, the react_on_rails:rsc generator, generated/modified files, webpack export style compatibility, a verification checklist, and troubleshooting steps.

Key observations:

• The webpack backward-compatibility pattern documented in the guide (serverWebpackModule.default || serverWebpackModule) was verified against the actual rscWebpackConfig.js.tt template — they match exactly.
• All relative links resolve to existing files. The #modified-files anchor target is correct (heading is ### Modified files).
• The documented CVEs (CVE-2025-55182, CVE-2025-67779, CVE-2026-23864) are referenced appropriately in the context of the react-on-rails-rsc package.
• Minor: the callout about react-on-rails-rsc 19.0.4 appears immediately after the prerequisite that also specifies React 19.0.4, which may cause readers to conflate the two packages. Making the package name explicit in the closing sentence would eliminate the ambiguity.

Confidence Score: 5/5

• Documentation-only PR with accurate content verified against the actual template source; safe to merge as-is.
• All changed files are Markdown documentation. The core code snippet in the guide was verified against the real rscWebpackConfig.js.tt template and matches exactly. All internal links and anchor references are valid. The one P2 comment (version number disambiguation) is a minor wording improvement that does not block merge.
• No files require special attention.

Important Files Changed

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Existing React on Rails App] --> B{Using Pro?}
    B -- No --> C[Run rails generate react_on_rails:pro]
    C --> D[Now a Pro App]
    B -- Yes --> D
    D --> E{React 19.0.x\nNode renderer\nShakapacker?}
    E -- No --> F[Install prerequisites]
    F --> G[Run rails generate react_on_rails:rsc]
    E -- Yes --> G
    G --> H[Creates: rscWebpackConfig.js\nHelloServer components]
    G --> I[Modifies: react_on_rails_pro.rb\nserverWebpackConfig.js\nclientWebpackConfig.js\nServerClientOrBoth.js\nroutes.rb\nProcfile.dev]
    H --> J[Verification: bin/dev]
    I --> J
    J --> K{All 3 bundles build?}
    K -- No --> L[Troubleshooting]
    K -- Yes --> M[Visit /hello_server\nand /rsc_payload/HelloServer]
    M --> N[RSC enabled ✓]

_{Reviews (1): Last reviewed commit: "Add standalone RSC upgrade guide for exi..." | Re-trigger Greptile}

Review: Add standalone RSC upgrade guide for existing Pro apps

Overall this is a well-structured, useful guide. The code snippets match the actual rscWebpackConfig.js.tt template, the cross-links all resolve to real files, and the troubleshooting section covers the most common failure modes accurately.

One blocking issue

Line 34 — CVE identifiers appear to be AI-hallucinated.
The three CVE IDs (CVE-2025-55182, CVE-2025-67779, CVE-2026-23864) do not match the sequential numbering pattern the NVD uses, and I cannot verify them in any public advisory database. Shipping fabricated CVE numbers in public docs misleads users and creates a future squatting risk. See my inline comment for a suggested replacement. Please verify the real advisory IDs (or drop the IDs and just link to npm advisories) before merging.

Minor observations

• Version staleness: The statement "React 19.1.x and later are not yet supported" is a point-in-time constraint that will become inaccurate as support expands. Consider either linking to a release-notes page that will stay current, or phrasing it as "as of this writing" so readers know to check.

• #modified-files anchor: The troubleshooting section links to #modified-files, but the actual heading is ### Modified files (under ## What the Generator Creates and Modifies). Most renderers will resolve this correctly, but it is worth testing on the docs site since some renderers scope anchors by parent section.

• Idempotency claim: The generator is described as idempotent ("skips files that already exist"), but the modified-files table shows it also patches existing files (serverWebpackConfig.js, routes.rb, Procfile.dev, etc.) using regex transforms. The troubleshooting section already acknowledges those can fail silently. Consider softening the idempotency claim to "safe to re-run — new files are skipped and existing-file patches are applied only when the target pattern is not already present."

None of the minor items are blockers, but the CVE issue should be resolved before this ships publicly.

Review posted via inline comments below.

Review summary - two blocking issues found. See inline comments for details on all items.

Full review — two blocking issues, three non-blocking (see inline comments on specific lines)

BLOCKING 1: CVE identifiers are unverifiable (line 34)
The three CVE IDs (CVE-2025-55182, CVE-2025-67779, CVE-2026-23864) cannot be found in public vulnerability databases and have been flagged independently by multiple reviewers as potentially AI-fabricated. The existing upgrading-existing-pro-app.md handles this more safely on line 27 by linking to the v16.2.0 release notes rather than citing CVE IDs directly. Shipping fabricated CVE numbers misleads users and creates squatting risk. Remove or verify before publishing.

BLOCKING 2: Duplicate guide — upgrading-existing-pro-app.md already exists
docs/pro/react-server-components/upgrading-existing-pro-app.md covers the same topic (standalone react_on_rails:rsc generator for existing Pro apps) and is already linked from index.md line 68. This PR adds a second guide without removing or redirecting the original, leaving two authoritative pages for the same workflow. The version requirements also conflict: the existing file requires Pro gem v16.4.0+ while this new guide states v4.0.0+. The PR should either replace/consolidate the old file (and update index.md), or clearly explain why both guides should coexist with distinct scopes.

Non-blocking (inline comments posted on specific lines):

• Lines 24-28: Version-check commands use yarn why only; repo convention requires npm, yarn, and pnpm alternatives
• Line 48: Idempotency claim contradicts Modified Files table — generator also patches existing files via regex transforms, not just skips new ones; soften the wording
• Lines 72-75: react-server-dom-webpack listed as a separately installed NPM dep — verify it is not vendored inside react-on-rails-rsc before listing it here (CodeRabbit flags this same issue)

Review: Add standalone RSC upgrade guide for existing Pro apps

This is a documentation-only PR so the main concerns are accuracy and consistency with existing docs.

Critical: Duplicate documentation file

docs/pro/react-server-components/upgrading-existing-pro-app.md already exists and covers the exact same subject with more complete and accurate content. The new upgrading-existing-pro-app-to-rsc.md is a near-duplicate that is less accurate in several ways (see inline comments).

The RSC index page (docs/pro/react-server-components/index.md) currently links to the old file and was not updated by this PR. The two most important entry points now diverge:

• docs/README.md, tutorial.md, upgrading-to-pro.md point to the new file (this PR)
• docs/pro/react-server-components/index.md still points to the old file (unchanged)

Recommendation: Rather than shipping two conflicting upgrade guides, either update the existing upgrading-existing-pro-app.md with improvements from this PR, or replace it and update index.md to point to the new path.

Other issues (detailed inline)

1. New files table is incomplete — the generator also creates hello_server_controller.rb and app/views/hello_server/index.html.erb (confirmed from rsc_setup.rb). The existing guide lists these correctly.
2. Pro version requirement is ambiguous — the new doc says v4.0.0+ while the existing doc says the more useful v16.4.0+.
3. Manifest verification paths are hardcoded to ssr-generated/ and public/packs/, which are non-default; the existing guide correctly notes these paths vary by configuration.

Minor note (pre-existing, outside this PR scope)

rsc_setup.rb still contains incorrect CVE identifiers that this PR correctly removed from the doc. CVE-2025-55182 should be CVE-2025-55183 (per the 16.2.0 release notes), and CVE-2026-23864 appears to be fabricated (future 2026 date). Worth a follow-up fix.

Review

Good doc addition overall — well-structured with clear prerequisites, generator walkthrough, legacy webpack compatibility explanation, and troubleshooting. Version numbers are now correct (v4.0.0+ for Pro gem, v16.0.0+ for OSS gem), and all cross-document links resolve.

One concrete bug

The "Generated Files Check" section (Step 3) tells users to look for rsc-bundle.js in the webpack output directory (public/webpack/production/ etc.), but rsc-bundle.js is a server bundle — it goes to server_bundle_output_path (default: ssr-generated/), not the public webpack directory. This is intentional; server bundles are kept out of public/ for security. The authoritative rsc-preparing-app.md (line 541) correctly separates these two locations. A user following this checklist verbatim will not find rsc-bundle.js where the guide says to look.

Left an inline comment with a suggested fix.

Minor

• Idempotency claim (line 38): the unqualified "idempotent -- safe to run multiple times" assertion survived into the final file. Commit 2 in this PR intended to soften it given regex-based patching behavior, but the fix was applied to the duplicate file that was subsequently deleted in commit 3.
• Dev-server manifest note: same consolidation gap — the note that react-client-manifest.json is kept in memory (not written to disk) during webpack-dev-server runs did not carry over to the surviving file. Both are included in the inline suggestion.

Review: Add standalone RSC upgrade guide for existing Pro apps

Good documentation addition overall — the prerequisite table expansion and webpack export shape explanation are well-structured. A few issues worth addressing:

Broken link (potential 404)

In the prerequisites table, ../../oss/upgrading/release-notes/ resolves to a directory with no index.md, which will likely be a 404 on the docs site. See inline comment on line 16.

Package manager consistency

The prerequisites table was helpfully broadened to show npm / yarn / pnpm alternatives, but two commands in the document remain pnpm-only:

• Line 25 — The pnpm add react@~19.0.4 react-dom@~19.0.4 upgrade command
• Line 204 (troubleshooting) — pnpm add react-on-rails-rsc

Both should offer the same three-manager alternatives shown in the table.

Removed requirement note in legacy export shape section

The old text warned "These apps must upgrade to v16.4.0+ before adding RSC". Removing it silently changes the documented requirement. If the RSC generator now handles both export shapes without a manual migration (which the new rscWebpackConfig.js compatibility code supports), that's great — but a brief explicit note saying "no reshaping needed" would prevent reader confusion. See inline comment on line 87.

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

Review: Add standalone RSC upgrade guide for existing Pro apps

This is a well-structured documentation PR. The new upgrade guide covers the key areas a user would need: prerequisites, generator usage, webpack export compatibility, and verification steps. A few specific issues worth addressing:

1. Broken directory link (line 16 of upgrading-existing-pro-app.md)

The prerequisites table links to ../../oss/upgrading/release-notes/ (a directory) but there is no index.md in that directory. Most documentation platforms (GitHub, Docusaurus, etc.) will 404 on this. It should point to a specific file — probably the latest release notes (e.g., release-notes/16.4.0.md).

2. Package manager inconsistency

The prerequisites table correctly lists npm/yarn/pnpm alternatives for check commands, but the React upgrade snippet on line 25 only shows pnpm:

pnpm add react@~19.0.4 react-dom@~19.0.4

Users on npm or Yarn will need to translate this. Either show all three variants (as done in the table) or add a note that pnpm is the project's default and npm/Yarn users should substitute accordingly. Same applies to line 204 in the troubleshooting section.

3. Idempotency claim (line 38)

The guide states the generator is "idempotent -- safe to run multiple times." A previous review cycle softened this claim because the generator uses regex-based patching which may produce unintended results on re-runs. If the claim has since been verified, it's fine — but if regex-based patching still applies, this should be qualified (e.g., "generally safe to re-run; review any modifications to existing files before committing").

Overall the content is accurate and well-organized. The webpack export compatibility section is particularly helpful for teams with older setups.

Good documentation addition overall. The guide is well-structured and covers the right material. The corrections across multiple commits (removing fabricated CVEs, fixing file paths, consolidating the duplicate) show good iteration. Three issues to address:

1. React version inconsistency in the prerequisites table -- The Expected column says '19.0.x (see release notes for latest support)' but the callout below says '19.0.4+ recommended, 19.0.0-19.0.3 have known security vulnerabilities'. The table implies any 19.0.x is acceptable. The Expected column should say '19.0.4+' to surface the security guidance at the point of the check. Also, the 16.4.0.md release notes link does not mention React version support ranges — 16.2.0.md or rsc-preparing-app.md would be more accurate targets.

2. Package manager inconsistency -- The prerequisites table was correctly expanded to show npm/yarn/pnpm variants, but two other places still assume pnpm only: the React upgrade command on line 25 (pnpm add react@~19.0.4 react-dom@~19.0.4) and the troubleshooting hint on line 206 (pnpm add react-on-rails-rsc). Users following npm/yarn paths will hit pnpm-only commands at the next step.

3. Unqualified idempotency claim -- Line 38 says 'The generator is idempotent -- safe to run multiple times.' An earlier commit (2af1e63) softened this claim specifically because the generator uses regex-based patching. Running it twice on an already-patched file may double-apply the patch or not recognize the already-modified shape. The current wording reverts to the strong claim. Qualifying it ('generally safe to re-run') or adding a caveat about already-modified configs would be more accurate.

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

Review: Add standalone RSC upgrade guide for existing Pro apps

Overall this is a solid documentation improvement. The multi-package-manager support in the prerequisites table, the explicit 19.0.4+ minimum with security context, and the corrected rsc-bundle.js output path location are all good changes.

Consistency gap in the Troubleshooting section (line 207, not in diff): This line still says "React 19.0.x" (should be 19.0.4+ to match the updated prerequisites) and is pnpm-only (inconsistent with the table that now shows npm/yarn/pnpm). Suggested fix: change to "RSC requires React 19.0.4+. Check with npm ls react / yarn why react / pnpm list react"

index.md inconsistency (not changed by this PR): docs/pro/react-server-components/index.md line 48 still reads "React 19.0.x (19.1.x and later are not yet supported)" — worth aligning with the 19.0.4+ language in a follow-up.

Pnpm-only install command: The React upgrade command at line 25 only shows pnpm, but the prerequisites table now shows all three package managers — see inline comment.

Nits:

• The PR description says "Links the new page from: RSC index" but index.md is not in the diff — the link was already there pre-PR. Not a bug, just a slightly misleading PR summary.
• The react_on_rails gem row added to the prerequisites table (v16.4.0+) is a good addition; worth confirming this is a hard generator dependency rather than just a soft co-requirement.

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

Good documentation improvement overall. The PR correctly addresses the package-manager-agnostic feedback from previous reviews and improves accuracy (file output paths, React version security context). A few issues worth addressing: (1) Inconsistency in React version requirement: the prerequisites table and upgrade note now correctly say 19.0.4+, but the Troubleshooting section (line 207) still refers to 'React 19.0.x' as the requirement. Also, docs/pro/react-server-components/index.md (not changed by this PR) still says 'React 19.0.x (19.1.x and later are not yet supported)' -- should get the same 19.0.4+ update. (2) React upgrade command is pnpm-only: the prerequisites table now shows npm/yarn/pnpm alternatives for every check command, but the upgrade command (line 25) only shows pnpm. Should include npm/yarn equivalents for consistency. (3) Minor: line 28 uses 19.0.0--19.0.3 (double hyphen as range separator). Rendered Markdown does not auto-convert this -- consider 'versions earlier than 19.0.4' for clarity.