Declare and pin the supported rspack range after the 2.x bump (peer/meta statement + 2.x compat-matrix row)

[justin808]

Summary

PR #140 bumped the @rspack/core devDependency 1.7.11 → 2.1.2 (a major) inside the 19.2.1 line. The bump is safe (verified: hook ordering unchanged, both majors exercised), but the package now has no declared supported-rspack range and its compat matrix only tests 1.x — so 2.x coverage exists only by accident of the lockfile, and a future 3.x bump would silently drop it. Best resolved before 19.2.1 final.

Evidence

• At origin/main (9fae9c7) there is no rspack peerDependency — peers list only react ^19.2.7, react-dom ^19.2.7, webpack ^5.59.0. Consumers bring their own rspack; the plugin duck-types the compiler (AnyCompiler, resolveBundler).
• No README/docs statement of supported rspack majors.
• .github/workflows/compatibility-matrix.yml pins rspack-version: '1.x' in all four rows. 2.x is only exercised because the lockfile happens to resolve 2.1.2 for the unit/e2e jobs.
• docs/versioning.md states bundler peers are "compatibility contracts for the plugin layer — keep them tied to tested bundler behavior".

Implementation plan

1. Add explicit rspack 2.x row(s) to compatibility-matrix.yml so 2.x is a pinned, guaranteed lane (keep a 1.x row if 1.x is still supported).
2. Add an optional peerDependenciesMeta rspack entry or a documented support statement (README + docs/versioning.md) naming the supported rspack majors.
3. Note the supported majors in the README/CHANGELOG for 19.2.1.

Acceptance criteria

• CI has a pinned rspack 2.x compatibility lane that cannot be silently dropped by a future dependency bump.
• The supported rspack range is stated in docs/peer metadata and the 19.2.1 release notes.

Audit ledger: shakacode/react_on_rails#4010 (comment)

Post-merge audit follow-up (19.2.1-rc.0 wave, e528e8b..9fae9c7). Filed by Claude Code on behalf of Justin Gordon.

[justin808]

Codex batch evidence - 2026-07-07 UTC

No PR opened in this pass. The editor lane is blocked by active reservations:

• PR Add opt-in entry-scoped client-reference discovery asset (#134 Phase 1) #176 is open and owns CHANGELOG.md plus src/webpack/RSCWebpackPlugin.ts and src/react-server-dom-rspack/plugin.ts.
• PR Organize package docs as internal #178 is open draft and owns README.md plus the docs/versioning.md relocation surface.

For #179, .github/workflows/compatibility-matrix.yml and package.json are clear, but the acceptance criteria also need docs/support-range text and release notes/changelog. Implementing only the clear subset would create a partial high-risk workflow/package PR and leave reserved paths unresolved.

Final state: blocked-user-input / active reservation, no PR opened.

Resume when #176 and #178 are merged or closed, or when a maintainer gives a new path ownership map. Expected work then: add pinned rspack 2.x compatibility coverage, support-range docs/metadata, changelog entry, Workflow Change Audit PR comment, and new-gate rollout/open-PR sweep evidence.

qa-evidence v1
status: blocked
scope: #179
evidence: SECURITY_PREFLIGHT_OK for #179-#182; live PR file collision check against #176/#178; no local tests run because no files changed.

[justin808]

qa-evidence v1

Batch blocker update (2026-07-07):

• PR Organize package docs as internal #178 is merged and its README/docs move reservation is cleared.
• PR Add opt-in entry-scoped client-reference discovery asset (#134 Phase 1) #176 remains open on current head 4facbef; all full gh pr checks 176 rows are green/skipped as expected, mergeability is CLEAN, review decision is APPROVED, and unresolved review-thread count is 0.
• PR Add opt-in entry-scoped client-reference discovery asset (#134 Phase 1) #176 includes a package.json build-if-needed guard change, so AGENTS classifies it as build/package high-risk and it cannot be batch-auto-merged without an explicit maintainer waiver.
• CHANGELOG.md remains reserved by open PR Add opt-in entry-scoped client-reference discovery asset (#134 Phase 1) #176, so issue Declare and pin the supported rspack range after the 2.x bump (peer/meta statement + 2.x compat-matrix row) #179's workflow/package/docs/changelog editor lane remains blocked. No Declare and pin the supported rspack range after the 2.x bump (peer/meta statement + 2.x compat-matrix row) #179 PR was opened and no Workflow Change Audit is due yet.

Unblock action: explicitly approve the high-risk merge of PR #176, merge it, then re-run reservation/current-main discovery before opening the serial #179 lane.