Update CHANGELOG for v9.5.0 release #861

justin808 · 2026-01-08T03:54:24Z

Summary

Move Unreleased content to v9.5.0 section with January 7, 2026 date
Add placeholder for new Unreleased section
Update version comparison links at the bottom of the file

Test plan

Verify changelog formatting is correct
Verify version links work correctly

🤖 Generated with Claude Code

Summary by CodeRabbit

Documentation
- Updated changelog for v9.5.0 release with security, added, changed, and fixed sections.
Bug Fixes
- Gemfile.lock is now excluded from the published gem.

_{✏️ Tip: You can customize this high-level summary in your review settings.}

claude · 2026-01-08T03:57:29Z

Code Review for PR #861

Summary

This PR prepares the CHANGELOG for the v9.5.0 release by moving unreleased content to a versioned section and updating comparison links.

✅ Positive Observations

Correct Version Link Updates: The version comparison links are properly updated:
- [Unreleased] now compares v9.5.0...main
- New [v9.5.0] link added comparing v9.4.0...v9.5.0
Proper Release Date: January 7, 2026 matches the PR creation date
Clean Placeholder: _None yet._ follows the existing pattern for empty Unreleased sections
Critical Security Fix Documentation: The PR properly documents a serious security vulnerability fix (environment variable leak), which is essential for users to understand the urgency of upgrading

⚠️ Issues Found

1. Inconsistent Formatting - Missing Trailing Newlines (Critical per CLAUDE.md)

The diff shows 3 instances where blank lines were added after numbered list items (lines 254, 271, 537). While this improves readability, it creates inconsistent formatting:

Lines 254-255: Blank line added after item 1 of "Breaking Changes"
Lines 271-272: Blank line added after item 2 of "Breaking Changes"
Line 537-538: Blank line added in v7.0.0 section

Issue: These formatting changes appear unintentional and unrelated to the v9.5.0 release. They modify historical changelog entries for v9.0.0 and v7.0.0.

Recommendation: Either:

Remove these formatting changes to keep the PR focused on v9.5.0 release preparation only
If intentional, mention in the PR description that you're also cleaning up formatting consistency

Looking at the existing file, I can see that other numbered lists don't have these blank lines consistently, so adding them here creates an inconsistent pattern.

2. No Test Coverage Mentioned

While the PR includes a test plan checklist:

Verify changelog formatting is correct
Verify version links work correctly

These items are unchecked. It would be good to verify:

The markdown renders correctly on GitHub
The comparison links work (you can test by clicking them once merged)

📋 Minor Observations

Date Format: "January 7, 2026" is consistent with other entries (e.g., "November 22, 2025" for v9.4.0) ✓
Breaking Change Documentation: The v9.5.0 entry clearly marks the EnvironmentPlugin change as BREAKING, which is correct ✓
Migration Guidance: Good inclusion of migration examples for the breaking change ✓

🔒 Security Considerations

The changelog properly emphasizes the CRITICAL security fix. Users should note:

This fixes a vulnerability present since webpacker v1.0.0 (January 2017)
Action required: Rotate any secrets that may have been exposed
The fix introduces a breaking change (allowlist approach)

📊 Overall Assessment

Code Quality: Good
Changelog Accuracy: Excellent
Main Concern: Unrelated formatting changes to historical entries

Recommendation

Approve with changes: Consider removing the 3 blank line additions in the v9.0.0 and v7.0.0 sections (lines 255, 272, 538 in the new file) to keep this PR focused solely on the v9.5.0 release preparation.

If the formatting cleanup is intentional, please:

Mention it in the PR description
Consider doing comprehensive formatting cleanup in a separate PR
Update the entire file consistently rather than just 3 instances

claude · 2026-01-08T03:57:38Z

Code Review for v9.5.0 CHANGELOG Update

Overview

This PR updates the CHANGELOG to prepare for the v9.5.0 release. The changes are straightforward and follow the standard release preparation pattern.

✅ Positive Findings

Correct version link format: The new version links follow the established pattern correctly:
- [Unreleased]: https://github.com/shakacode/shakapacker/compare/v9.5.0...main
- [v9.5.0]: https://github.com/shakacode/shakapacker/compare/v9.4.0...v9.5.0
Proper placeholder: Added _None yet._ placeholder for the new Unreleased section, which is clean and consistent.
Date format: Uses "January 7, 2026" which matches the existing format in the CHANGELOG (e.g., "November 22, 2025" for v9.4.0).

⚠️ Issues Found

1. CRITICAL: Version files not updated

The PR only updates CHANGELOG.md, but the actual version files still reference 9.4.0:

lib/shakapacker/version.rb:3 still has VERSION = "9.4.0".freeze
package.json:3 still has "version": "9.4.0"

Impact: This will cause the gem and npm package to still be published as 9.4.0 instead of 9.5.0.

Required action: Update both version files before releasing:

# lib/shakapacker/version.rb
VERSION = "9.5.0".freeze

// package.json
"version": "9.5.0"

2. Unintended formatting changes

The diff shows several blank lines added to existing content (lines 252, 271, 537 in the diff). These appear to be unintended formatting changes in the v9.0.0, v9.0.0-beta.0, and v8.0.0 sections:

After "SWC is now the default JavaScript transpiler" (line 254)
After "CSS Modules now use named exports" (line 271)
In the v8.0.0 section (line 537)

Impact: These create unnecessary diffs that don't serve the release purpose and violate the "keep changes focused and minimal - avoid extraneous diffs" guideline from CLAUDE.md.

Recommendation: Remove these blank line additions unless they're intentionally fixing formatting issues. If the latter, they should be in a separate PR.

📋 Pre-Release Checklist

Before merging, ensure:

Update lib/shakapacker/version.rb to "9.5.0"
Update package.json to "9.5.0"
Remove unintended blank line changes
Run bundle exec rubocop (as per CLAUDE.md guidelines)
Verify all version comparison links work correctly
Confirm the date (January 7, 2026 vs January 8, 2026 - today's date)

🔍 Date Discrepancy Note

The PR description and CHANGELOG show January 7, 2026, but today's date is January 8, 2026. If the release is being cut today, the date should be updated to January 8, 2026 to match the actual release date.

Summary

The CHANGELOG structure is correct, but this PR is incomplete for a release as it doesn't update the version files. The unintended formatting changes should also be addressed. Once the version files are updated and the extra blank lines are removed, this will be ready to merge.

- Move Unreleased content to v9.5.0 section with January 7, 2026 date - Add placeholder for new Unreleased section - Update version comparison links 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

coderabbitai · 2026-01-08T04:00:20Z

Walkthrough

This change introduces a new v9.5.0 release block to CHANGELOG.md with Security, Added, Changed, and Fixed sections, including a fix noting that Gemfile.lock is excluded from the published gem. Unreleased anchor references are updated to point to v9.5.0, with formatting adjustments for readability.

Changes

Cohort / File(s)	Summary
Changelog Updates `CHANGELOG.md`	Added v9.5.0 release section with Security, Added, Changed, and Fixed subsections; updated Unreleased references to v9.5.0; adjusted formatting and spacing.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Possibly related PRs

Update CHANGELOG.md for v9.3.0-beta.0 #718: Modifies CHANGELOG.md by adding a new release section and updating Unreleased references in parallel manner.
Update CHANGELOG.md with recent PRs #690: Edits CHANGELOG.md's release and Unreleased sections with overlapping structural changes.

Poem

🐰 A version released in markdown so neat,
Nine-five-oh takes its rightful seat!
Security patched, new features unfold,
The changelog's story is timely told,
A rabbit rejoices—the release is complete! 🥕

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'Update CHANGELOG for v9.5.0 release' directly and accurately describes the main change in the PR, which is updating the CHANGELOG.md file to document the v9.5.0 release.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Post copyable unit tests in a comment
Commit unit tests in branch jg/changelog-9.5.0

📜 Recent review details

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 3074164 and ff53542.

📒 Files selected for processing (1)

CHANGELOG.md

🧰 Additional context used

📓 Path-based instructions (1)

CHANGELOG.md

📄 CodeRabbit inference engine (CLAUDE.md)

CHANGELOG.md: Update CHANGELOG.md for user-visible changes only (features, bug fixes, breaking changes, deprecations, performance improvements)
Do NOT add CHANGELOG entries for: linting, formatting, refactoring, tests, or documentation fixes
Use changelog format: [PR #123](https://github.com/shakacode/shakapacker/pull/123) by [username](https://github.com/username) - Shakapacker uses # in PR links

Files:

CHANGELOG.md

🧠 Learnings (7)

📓 Common learnings

Learnt from: CR
Repo: shakacode/shakapacker PR: 0
File: CLAUDE.md:0-0
Timestamp: 2025-12-22T04:44:25.430Z
Learning: Applies to CHANGELOG.md : Use changelog format: `[PR #123](https://github.com/shakacode/shakapacker/pull/123) by [username](https://github.com/username)` - Shakapacker uses `#` in PR links

Learnt from: CR
Repo: shakacode/shakapacker PR: 0
File: CLAUDE.md:0-0
Timestamp: 2025-12-22T04:44:25.430Z
Learning: Applies to CHANGELOG.md : Update CHANGELOG.md for user-visible changes only (features, bug fixes, breaking changes, deprecations, performance improvements)

Learnt from: CR
Repo: shakacode/shakapacker PR: 0
File: CLAUDE.md:0-0
Timestamp: 2025-12-22T04:44:25.430Z
Learning: Applies to CHANGELOG.md : Do NOT add CHANGELOG entries for: linting, formatting, refactoring, tests, or documentation fixes

Learnt from: CR
Repo: shakacode/shakapacker PR: 0
File: CLAUDE.md:0-0
Timestamp: 2025-12-22T04:44:25.430Z
Learning: Run `bundle exec rake update_changelog` after releases to update version headers