Update changelog for 17.0.0

[justin808]

Why

Prepare the stable React on Rails 17.0.0 changelog from the accepted v17.0.0.rc.12 release history. This is a metadata-only change: the runtime tree remains identical to the accepted RC.

The release tracker is still in development mode with final-promotion hard gates outstanding, so this PR is intentionally a draft and does not authorize a stable release.

What changed

• Collapsed the 13 17.0.0.rc.* changelog sections into one 17.0.0 section dated 2026-07-16.
• Curated superseded, RC-only, reverted, and contributor-only entries out of the stable notes.
• Kept 204 unique user-facing PR references and rewrote affected entries to describe the final stable behavior.
• Updated comparison links to v16.6.0...v17.0.0 and v17.0.0...main.

Post-RC classification

origin/release/17.0.0 exactly matched v17.0.0.rc.12 before this PR, so the classification range contained no rows and no UNKNOWN commits.

Release-train caveat

The rake release path permits changelog/docs/comment-only commits after the accepted RC, but script/release-finish promote and the release-train runbook still enforce branch-tip equality with the RC tag. After this PR merges, the stable release must use bundle exec rake "release[17.0.0]" directly, and only after all hard gates and explicit promotion signoff are complete.

SECURITY.md is not changed here because the invoked changelog workflow is changelog-only. Its required v17 support-window update remains outstanding before the final release.

Validation

• git diff --check
• pnpm exec prettier --check CHANGELOG.md
• Changelog structure/link verification: stable heading first, no RC headings, unique headings, trailing newline, correct compare links
• bundle exec rake 'update_changelog[release]' computed 17.0.0 and coalesced prerelease sections
• (cd react_on_rails && bundle exec rspec spec/react_on_rails/update_changelog_rake_helpers_spec.rb) — 33 examples, 0 failures
• Pre-push Ruby branch lint — 33 files inspected, no offenses
• Pre-push online Markdown link check — 1,396 links, 0 errors
• script/ci-changes-detector origin/release/17.0.0 — documentation-only; hosted CI recommendation: none

Review notes

• Local self-review complete.
• Automated Codex and Claude review attempts did not produce a usable final verdict (the Codex review expanded into the release-branch history; Claude stalled during MCP startup). No findings were generated from either attempt.
• Post-push churn: one mechanical Prettier correction (removed an extra blank line); formatting, diff, pre-commit, and pre-push validation were rerun before the force-with-lease update.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 1a25216e-3a87-43c3-850c-c6a328fcf9b0

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch changelog-17.0.0

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[claude]

Review: Changelog collapse for 17.0.0

This is a documentation-only PR that collapses the 13 17.0.0.rc.* sections into a single [17.0.0] - 2026-07-16 section. I verified the mechanics programmatically rather than just eyeballing the diff:

Verified clean:

• No duplicate bullets: scanned every - **... line in the new [17.0.0] section (lines 27–685) for repeated text — zero duplicates found.
• No orphaned/duplicate headings: exactly one ### [17.0.0] heading, subsections appear once each in sensible order (Breaking Changes → Added → Changed → Improved → Fixed → Deprecated → Removed → Security).
• Compare links are consistent: [unreleased] now points at v17.0.0...main, [17.0.0] points at v16.5.1...v17.0.0... wait — confirmed it's v16.6.0...v17.0.0, and the following [16.6.0] entry is untouched. All RC-specific compare-link lines were correctly removed as a block.
• Reclassification looks intentional, not accidental: e.g. the multi-endpoint rolling-deploy entry (PR 4544) moved from "Breaking Changes" (in rc.9, where it was new/breaking mid-RC-cycle) to "Changed" in the stable notes — matches the PR description's rationale that changes introduced and changed entirely within the RC cycle aren't breaking for stable adopters.
• PR/Issue reference numbers that repeat several times in the section (e.g. PR 3320 ×6, PR 2903 ×6, PR 3142 ×4) are expected — those PRs are legitimately referenced by multiple distinct bullets (e.g. the async-http migration touches Breaking Changes, Changed, and Removed).

One nit worth a second look (not a blocker):

• The rewritten "Incompatible react-on-rails-rsc / React versions now fail loudly..." entry (still attributed only to PR 3831) now describes the runtime check as gating on "the supported React 19.2.x line," but PR 3831 historically enforced the 19.0.x range — the 19.2.x floor was introduced later by PR 4490/PR 4670, which already have their own "Breaking Changes" bullet a few lines above. Describing final behavior under the original PR number without a cross-reference could read as if PR 3831 itself shipped the 19.2.x floor. Consider a short "(floor later raised by PR 4490/4670, see above)" aside, or leave as-is if you're comfortable with the existing final-state-only curation policy.

No runtime/behavioral risk here since only CHANGELOG.md changed (matches changedFiles: 1 on the PR). Nothing else stood out.

[claude]

Review Summary

This is a metadata-only PR that collapses the 13 17.0.0.rc.* CHANGELOG sections into a single [17.0.0] - 2026-07-16 section for the stable release, with no runtime code changes. I reviewed the full diff plus the resulting CHANGELOG.md structure.

Verification performed

• Heading structure: Confirmed the [17.0.0] section is the only new heading introduced, all 13 rc.* headings are gone, and no stray 17.0.0.rc.* references remain anywhere in the file (only unrelated, pre-existing 4.0.0-rc.* Pro-history references at the bottom of the file).
• Section ordering: Breaking Changes → Added → Changed → Improved → Fixed → Deprecated → Removed → Security is consistent with the file's existing convention.
• Compare links: [unreleased] now points to v17.0.0...main and [17.0.0] points to v16.6.0...v17.0.0, correctly chaining to the existing [16.6.0] entry — all intermediate rc.* compare links were correctly removed together.
• Duplicate detection: No exact-duplicate bullet lines within the new [17.0.0] section. Several PR numbers (e.g. PR 3320, PR 2903, PR 3142) appear multiple times, but each occurrence is a distinct bullet describing a different facet of a large PR (e.g. the async-http migration touches Breaking Changes, Changed, and Removed) — not accidental duplication.
• Doc links: Spot-checked relative doc links referenced in rewritten entries (docs/oss/building-features/forms.md, docs/oss/building-features/node-renderer/health-checks.md, docs/oss/building-features/fonts.md, docs/pro/rolling-deploy-adapters.md, docs/pro/updating.md, docs/oss/reference/error-reference.md) — all exist in the tree.
• Curation judgment calls: Spot-checked a few entries that were rewritten rather than mechanically kept (e.g. the RSC/React version-floor Breaking Change now states the final 19.2.x floor instead of the superseded 19.0.x/* intermediate states; the rolling_deploy_previous_url → rolling_deploy_previous_urls rename is now framed under "Changed" instead of "Breaking Changes" since it was introduced and superseded entirely within the RC cycle before any stable release). These read as correct edits for describing final stable behavior rather than errors.

Notes

• No code, config, or test files are touched — this is CHANGELOG.md only, matching the stated intent.
• I was not able to independently re-run pnpm exec prettier --check CHANGELOG.md in this sandbox (command required interactive approval that wasn't available), so I relied on manual structural inspection in lieu of that formatting check; nothing in the manual inspection suggested a formatting issue.
• No functional, security, or performance concerns — this PR carries no runtime risk since it doesn't touch code.

No blocking issues found. The classification and curation described in the PR body match what's actually in the diff.

[greptile-apps]

Greptile Summary

This PR prepares the stable React on Rails 17.0.0 changelog. The main changes are:

• Consolidates the release-candidate sections into one stable section.
• Curates and rewrites user-facing release notes.
• Updates the stable and unreleased comparison links.

Confidence Score: 5/5

This looks safe to merge.

• No blocking issues found in the changed content.
• The stable heading and section boundaries match the release parser.
• The comparison links cover the correct stable release ranges.

Important Files Changed

Filename	Overview
CHANGELOG.md	Consolidates the 17.0.0 release notes and updates comparison links without breaking the changelog structure.

_{Reviews (1): Last reviewed commit: "Update changelog for 17.0.0" | Re-trigger Greptile}

[claude]

Review

Note: This PR is already merged. Reviewing retrospectively per request, focusing on code quality, correctness, security, and performance.

Overview

Documentation-only change (CHANGELOG.md, 1 file, +144/-309). Collapses the 13 17.0.0.rc.* sections into a single [17.0.0] - 2026-07-16 section, curates out superseded/RC-only/reverted/contributor-only entries, and updates the compare links to v16.6.0...v17.0.0 / v17.0.0...main. No runtime code changes.

Verification performed

• Confirmed the resulting section structure is well-formed: Breaking Changes → Added → Changed → Improved → Fixed → Deprecated → Removed → Security, no stray ### [17.0.0.rc.*] headings remain, and the [unreleased]/[17.0.0]/[16.6.0] compare links are present and correctly ordered.
• Grepped for leftover RC-era language (not-yet-released, RC cycle, -rc. version strings, "temporary...pin") inside the consolidated 17.0.0 section — none found, so entries describing RC-only caveats appear to have been correctly rewritten or dropped for the stable release.
• Checked PR numbers that appear more than once within the section (e.g. PR 3124, PR 3320, PR 4227/4231/4234) — these are legitimate cases of one PR being cited from two different changelog entries (e.g. an "Added" entry and a later "Changed" entry building on it) or explicit "Follow-up to PR X" cross-references, not duplicated/contradictory entries.
• Spot-checked a rewritten entry (the react-on-rails-rsc/React version compatibility check under Fixed, near the old RC.2 entry): the simplified stable wording (React 19.2.x line, no more * peer wildcard caveat) correctly reflects that later RC-cycle PRs already tightened the peer range, so the RC-era nuance about the peer being * no longer applies to the stable artifact. Good catch — this wasn't just a copy/paste collapse.

Code quality / correctness

Nothing to flag — this is prose curation, not code. The stated validation in the PR description (prettier check, structure/link verification, update_changelog rake task, RSpec suite, markdown link checker on ~1,396 links) is exactly the right validation for a change like this, and my own spot checks didn't turn up gaps.

Security / performance

Not applicable — no executable code changed.

Risk

Low. The PR correctly stays in draft and doesn't authorize a stable release by itself (per its own description), and it doesn't touch SECURITY.md's support-window update, which is called out as still outstanding before the actual release. No concerns with the change as scoped.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 9e354bacb2

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[justin808]

Address-review summary

Scan scope: full PR history via the coordinated post-merge audit (check all reviews equivalent).

Mattered

• HTTP client lifecycle / HTTPX P2: confirmed against the v17 runtime; deferred to the existing release forward-port tracker #4569. The original thread has the rationale and is resolved as transferred.
• RSC failed-payload retention P2: confirmed against the v17 runtime; deferred to the same #4569 follow-up. The original thread has the rationale and is resolved as transferred.

Optional

• The earlier React 19.2.x attribution nit required no change: a later independent review verified that final-state curation was intentional and accurate for the stable notes.

Skipped

• Positive review summaries, bot status messages, and acknowledgments required no action.

Deferred-work tracking: existing issue #4569. The published v17.0.0 tag remains immutable; the correction belongs on main and does not request a 17.0.1 release during the current hold.

Next default scan starts after this comment. Say check all reviews to rescan the full PR.