Update React on Rails to 16.1.1 and move SSR to private directory

.gitignore

@@ -52,3 +52,10 @@ lib/bs
 /lib/ocaml
 
 client/app/bundles/comments/rescript/**/*.bs.js
+
+# Server-side rendering bundles (private)
+# Using React on Rails default directory
+/ssr-generated/
+
+# Generated files
+/client/app/generated/

config/initializers/react_on_rails.rb

@@ -14,6 +14,11 @@
   # not affect performance.
   config.server_bundle_js_file = "server-bundle.js"
 
+  # Server bundle output path for private SSR bundles (React on Rails 16+)
+  # This keeps server bundles separate from public assets for security
+  # Using the default from React on Rails docs
+  config.server_bundle_output_path = "ssr-generated"
+
   # React on Rails 16 compatibility: Workaround for removed error handling
   #
   # BREAKING CHANGE in v16: React on Rails 14.2.1 had robust error handling that would

config/webpack/serverWebpackConfig.js

@@ -1,6 +1,7 @@
 // The source code including full typescript support is available at:
 // https://github.com/shakacode/react_on_rails_tutorial_with_ssr_and_hmr_fast_refresh/blob/master/config/webpack/serverWebpackConfig.js
 
+const path = require('path');
 const { config } = require('shakapacker');
 const commonWebpackConfig = require('./commonWebpackConfig');
 
@@ -45,12 +46,14 @@ const configureServer = () => {
 
   // Custom output for the server-bundle that matches the config in
   // config/initializers/react_on_rails.rb
+  // Output to a private directory for SSR bundles (not in public/)
+  // Using the default React on Rails path: ssr-generated
   serverWebpackConfig.output = {
     filename: 'server-bundle.js',
     globalObject: 'this',
     // If using the React on Rails Pro node server renderer, uncomment the next line
     // libraryTarget: 'commonjs2',
-    path: config.outputPath,
+    path: path.resolve(__dirname, '../../ssr-generated'),
     publicPath: config.publicPath,
     // https://webpack.js.org/configuration/output/#outputglobalobject
   };