Codestin Search App

renovate · 2026-05-18T01:49:43Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Type	Update
@auth/core (source)	`^0.41.1` → `^0.41.2`		dependencies	patch
@babel/code-frame (source)	`7.27.1` → `7.29.0`		dependencies	minor
@babel/core (source)	`^7.28.5` → `^7.29.0`		dependencies	minor
@babel/core (source)	`^7.28.5` → `^7.29.0`		devDependencies	minor
@babel/generator (source)	`^7.28.5` → `^7.29.1`		dependencies	minor
@babel/parser (source)	`^7.28.5` → `^7.29.3`		dependencies	minor
@babel/plugin-syntax-jsx (source)	`^7.27.1` → `^7.28.6`		dependencies	minor
@babel/plugin-syntax-typescript (source)	`^7.27.1` → `^7.28.6`		dependencies	minor
@babel/preset-typescript (source)	`^7.27.1` → `^7.28.5`		devDependencies	minor
@babel/template (source)	`^7.27.2` → `^7.28.6`		dependencies	minor
@babel/traverse (source)	`^7.28.5` → `^7.29.0`		dependencies	minor
@babel/types (source)	`^7.28.5` → `^7.29.0`		dependencies	minor
@babel/types (source)	`^7.28.5` → `^7.29.0`		dependencies	patch
@changesets/cli (source)	`^2.30.0` → `^2.31.0`		devDependencies	minor
@clerk/tanstack-react-start (source)	`^0.27.14` → `^0.29.11`		dependencies	minor
@clerk/tanstack-react-start (source)	`^0.19.0` → `^0.29.11`		dependencies	minor
@cloudflare/vite-plugin (source)	`^1.29.0` → `^1.37.1`		devDependencies	minor
@codspeed/vitest-plugin (source)	`^5.0.1` → `^5.4.0`		devDependencies	minor
@convex-dev/better-auth	`^0.9.7` → `^0.12.2`		dependencies	minor
@convex-dev/react-query	`0.0.0-alpha.8` → `0.1.0`		dependencies	minor
@emotion/styled (source)	`11.14.0` → `11.14.1`		dependencies	patch
@eslint-react/eslint-plugin (source)	`^1.26.2` → `^1.53.1`		devDependencies	minor
@eslint/js (source)	`^9.36.0` → `^9.39.4`		devDependencies	minor
@fontsource-variable/roboto (source)	`5.2.5` → `5.2.10`		dependencies	patch
@inlang/paraglide-js (source)	`^2.4.0` → `^2.18.0`		devDependencies	minor
@libsql/client (source)	`^0.15.15` → `^0.17.3`		dependencies	minor
@mui/material (source)	`6.4.7` → `6.5.0`		dependencies	minor
@netlify/vite-plugin-tanstack-start (source)	`^1.1.4` → `^1.3.13`		devDependencies	minor
@nx/devkit (source)	`22.6.5` → `22.7.2`		devDependencies	minor
@playwright/test (source)	`^1.57.0` → `^1.60.0`		devDependencies	minor
@playwright/test (source)	`^1.50.1` → `^1.60.0`		devDependencies	minor
@prisma/adapter-libsql (source)	`^7.0.0` → `^7.8.0`		dependencies	minor
@prisma/client (source)	`^7.0.0` → `^7.8.0`		dependencies	minor
@radix-ui/react-dialog (source)	`^1.1.6` → `^1.1.15`		dependencies	patch
@rolldown/pluginutils (source)	`1.0.0-beta.40` → `1.0.1`		dependencies	patch
@rsbuild/core (source)	`^2.0.1` → `^2.0.6`		devDependencies	patch
@rsbuild/core (source)	`^2.0.0` → `^2.0.6`		devDependencies	patch
@rsbuild/plugin-babel (source)	`^1.0.5` → `^1.1.2`		devDependencies	minor
@rsbuild/plugin-solid (source)	`^1.1.1` → `^1.2.0`		devDependencies	minor
@rsbuild/plugin-vue (source)	`^1.2.2` → `^1.2.8`		devDependencies	patch
@rsbuild/plugin-vue (source)	`^1.2.7` → `^1.2.8`		devDependencies	patch
@rsbuild/plugin-vue-jsx	`^1.1.1` → `^1.1.2`		devDependencies	patch
@rspack/core (source)	`2.0.0` → `2.0.3`		devDependencies	patch
@sentry/react (source)	`^10.32.0` → `^10.53.1`		dependencies	minor
@sentry/solid (source)	`^10.32.0` → `^10.53.1`		dependencies	minor
@sentry/vite-plugin (source)	`^4.6.1` → `^4.9.1`		dependencies	minor
@sentry/vue (source)	`^10.32.0` → `^10.53.1`		dependencies	minor
@solid-devtools/logger (source)	`^0.9.4` → `^0.9.11`		dependencies	patch
@solid-primitives/refs (source)	`^1.0.8` → `^1.1.3`		dependencies	patch
@standard-schema/spec (source)	`^1.0.0` → `^1.1.0`		devDependencies	minor
@supabase/ssr	`^0.5.2` → `^0.10.3`		dependencies	minor
@supabase/supabase-js (source)	`^2.48.1` → `^2.105.4`		dependencies	minor
@swc/core (source)	`^1.10.15` → `^1.15.33`		devDependencies	minor
@tailwindcss/postcss (source)	`^4.2.2` → `^4.3.0`		dependencies	minor
@tailwindcss/postcss (source)	`^4.2.2` → `^4.3.0`		devDependencies	minor
@tailwindcss/vite (source)	`^4.2.2` → `^4.3.0`		devDependencies	minor
@tailwindcss/vite (source)	`^4.2.2` → `^4.3.0`		dependencies	minor
@tailwindcss/vite (source)	`^4.1.18` → `^4.3.0`		devDependencies	minor
@tanstack/eslint-config (source)	`^0.3.2` → `^0.4.0`		devDependencies	minor
@tanstack/query-core (source)	`>=5.90.0` → `>=5.100.10`		devDependencies	minor
@tanstack/query-core (source)	`^5.99.0` → `^5.100.10`		devDependencies	minor
@tanstack/react-devtools (source)	`^0.7.0` → `^0.10.5`		dependencies	minor
@tanstack/react-query (source)	`>=5.90.0` → `>=5.100.10`		devDependencies	minor
@tanstack/react-query (source)	`^5.99.0` → `^5.100.10`		devDependencies	minor
@tanstack/react-query (source)	`^5.90.0` → `^5.100.10`		dependencies	minor
@tanstack/react-query (source)	`^5.80.7` → `^5.100.10`		dependencies	minor
@tanstack/react-query-devtools (source)	`^5.90.0` → `^5.100.10`		dependencies	minor
@tanstack/react-query-devtools (source)	`^5.67.2` → `^5.100.10`		dependencies	minor
@tanstack/react-store (source)	`^0.9.3` → `^0.11.0`		dependencies	minor
@tanstack/react-virtual (source)	`^3.13.0` → `^3.13.24`		dependencies	patch
@tanstack/router-core (source)	`>=1.170.0` → `>=1.171.2`		devDependencies	minor
@tanstack/solid-devtools (source)	`^0.7.0` → `^0.8.5`		dependencies	minor
@tanstack/solid-query (source)	`>=5.90.0` → `>=5.100.10`		devDependencies	minor
@tanstack/solid-query (source)	`^5.99.0` → `^5.100.10`		devDependencies	minor
@tanstack/solid-query (source)	`^5.90.9` → `^5.100.10`		dependencies	minor
@tanstack/solid-query (source)	`^5.90.9` → `^5.100.10`		dependencies	minor
@tanstack/solid-query-devtools (source)	`^5.90.0` → `^5.100.10`		dependencies	minor
@tanstack/solid-virtual (source)	`^3.13.0` → `^3.13.24`		dependencies	patch
@tanstack/store (source)	`^0.9.3` → `^0.11.0`		devDependencies	minor
@tanstack/vue-query (source)	`^5.92.0` → `^5.100.10`		devDependencies	minor
@tanstack/vue-query (source)	`^5.99.0` → `^5.100.10`		devDependencies	minor
@tanstack/vue-query (source)	`^5.90.9` → `^5.100.10`		dependencies	minor
@tanstack/vue-query (source)	`^5.90.0` → `^5.100.10`		dependencies	minor
@tanstack/vue-query (source)	`^5.92.1` → `^5.100.10`		dependencies	minor
@tanstack/vue-query-devtools (source)	`^5.90.0` → `^5.91.0`		dependencies	patch
@tanstack/vue-query-devtools (source)	`^6.1.2` → `^6.1.29`		dependencies	patch
@tanstack/vue-store (source)	`^0.9.3` → `^0.11.0`		dependencies	minor
@tanstack/vue-virtual (source)	`^3.13.0` → `^3.13.24`		dependencies	patch
@testing-library/jest-dom	`^6.6.3` → `^6.9.1`		devDependencies	minor
@testing-library/react	`^16.2.0` → `^16.3.2`		devDependencies	minor
@testing-library/react	`^16.2.0` → `^16.3.2`		devDependencies	patch
@testing-library/react	`^16.3.0` → `^16.3.2`		devDependencies	patch
@trpc/client (source)	`^11.4.3` → `^11.17.0`		dependencies	minor
@trpc/tanstack-react-query (source)	`^11.4.3` → `^11.17.0`		dependencies	minor
@types/babel__code-frame (source)	`^7.0.6` → `^7.27.0`		devDependencies	minor
@types/bun (source)	`^1.2.22` → `^1.3.14`		devDependencies	minor
@types/express (source)	`^4.17.23` → `^4.17.25`		devDependencies	patch
@types/express (source)	`^5.0.3` → `^5.0.6`		devDependencies	patch
@types/jsdom (source)	`28.0.0` → `28.0.3`		devDependencies	patch
@types/picomatch (source)	`^4.0.2` → `^4.0.3`		devDependencies	patch
@types/yargs (source)	`^17.0.33` → `^17.0.35`		devDependencies	patch
@typescript-eslint/eslint-plugin (source)	`^8.44.1` → `^8.59.3`		devDependencies	minor
@typescript-eslint/parser (source)	`^8.44.1` → `^8.59.3`		devDependencies	minor
@typescript-eslint/parser (source)	`^8.23.0` → `^8.59.3`		devDependencies	minor
@typescript-eslint/parser (source)	`^8.23.0` → `^8.59.3`		devDependencies	minor
@typescript-eslint/rule-tester (source)	`^8.44.1` → `^8.59.3`		devDependencies	minor
@typescript-eslint/rule-tester (source)	`^8.23.0` → `^8.59.3`		devDependencies	minor
@typescript-eslint/utils (source)	`^8.44.1` → `^8.59.3`		dependencies	minor
@typescript-eslint/utils (source)	`^8.23.0` → `^8.59.3`		dependencies	minor
@vitejs/plugin-react (source)	`^4.3.4` → `^4.7.0`		devDependencies	minor
@vitejs/plugin-react (source)	`^4.3.4` → `^4.7.0`		devDependencies	patch
@vitejs/plugin-react (source)	`^4.3.4` → `^4.7.0`		devDependencies	minor
@vitejs/plugin-react (source)	`^6.0.1` → `^6.0.2`		devDependencies	patch
@vitejs/plugin-react (source)	`^6.0.1` → `^6.0.2`		dependencies	patch
@vitejs/plugin-rsc (source)	`^0.5.20` → `^0.5.26`		devDependencies	patch
@vitejs/plugin-vue (source)	`^5.2.3` → `^5.2.4`		devDependencies	patch
@vitejs/plugin-vue (source)	`^6.0.5` → `^6.0.7`	![age](https://developer.mend.io/api/mc/badges/age/npm/@

✂ Note

PR body was truncated to here.

renovate · 2026-05-18T01:49:46Z

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: pnpm-lock.yaml

Scope: all 294 workspace projects
Progress: resolved 1, reused 0, downloaded 0, added 0
Progress: resolved 23, reused 0, downloaded 0, added 0
Progress: resolved 30, reused 0, downloaded 0, added 0
Progress: resolved 38, reused 0, downloaded 0, added 0
Progress: resolved 52, reused 0, downloaded 0, added 0
Progress: resolved 55, reused 0, downloaded 0, added 0
Progress: resolved 58, reused 0, downloaded 0, added 0
Progress: resolved 59, reused 0, downloaded 0, added 0
Progress: resolved 66, reused 0, downloaded 0, added 0
[WARN] Request took 10668ms: https://registry.npmjs.org/tailwindcss
Progress: resolved 67, reused 0, downloaded 0, added 0
Progress: resolved 72, reused 0, downloaded 0, added 0
Progress: resolved 78, reused 0, downloaded 0, added 0
/tmp/renovate/repos/github/TanStack/router/e2e/react-start/basic:
[ERR_PNPM_TRUST_DOWNGRADE] High-risk trust downgrade for "[email protected]" (possible package takeover)

This error happened while installing a direct dependency of /tmp/renovate/repos/github/TanStack/router/e2e/react-start/basic

Trust checks are based solely on publish date, not semver. A package cannot be installed if any earlier-published version had stronger trust evidence. Earlier versions had trusted publisher, but this version has no trust evidence. A trust downgrade may indicate a supply chain incident.
Progress: resolved 82, reused 0, downloaded 0, added 0

coderabbitai · 2026-05-18T01:50:04Z

📝 Walkthrough

Walkthrough

Bumps pinned commits for three GitHub Actions and updates dependency/devDependency versions across root, packages, benchmarks, e2e fixtures, and examples. No source or runtime logic changes.

Changes

Dependency/version bumps and CI pin updates

Layer / File(s)	Summary
CI workflow action pin updates `.github/workflows/*`	Pins benchmark, labeler, and zizmor actions to newer commits.
Repository-wide dependency/tooling version bumps `package.json`, `packages//package.json`, `benchmarks//package.json`, `e2e//package.json`, `examples//package.json`	Updates dependency/devDependency versions across workspaces (Vite, plugins, Tailwind, Solid/Vue/React, TanStack Query, tooling).

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Possibly related PRs

TanStack/router#6035 — Similar Tailwind dependency updates across e2e/example manifests.
TanStack/router#5634 — TanStack Query version bumps overlap with current query-core/react-query updates.
TanStack/router#5661 — Prior Solid solid-js version increments in similar manifests.

Suggested reviewers

Sheraff
beaussan
SeanCassiere

Poem

I nibbled the deps, hop-hop, precise,
Carrots of versions, crispy and nice.
CI now pins with a confident thrum,
Benchmarks and apps all hum-hum-hum.
With whiskers twitching, I merge and grin—
Fresh fields of green, let builds begin! 🥕🐇

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch renovate/all-minor-patch

nx-cloud · 2026-05-18T01:50:12Z

View your CI Pipeline Execution ↗ for commit 36c8876

☁️ Nx Cloud last updated this comment at 2026-05-18 01:50:11 UTC

coderabbitai

Actionable comments posted: 9

🧹 Nitpick comments (2)

e2e/react-start/clerk-basic/package.json (1)
14-14: ⚡ Quick win

Consider expanding E2E test coverage for Clerk authentication flows.

The @clerk/tanstack-react-start package updated from 0.19.0 to 0.29.11 as part of routine dependency maintenance. The Clerk integration (ClerkProvider, getAuth, and UI components) is properly implemented and functional. However, the current E2E test suite only validates page load; it does not test authentication flows, sign-in/sign-out, or user session management. Consider adding tests for these critical paths to ensure the integration remains stable with future updates.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@e2e/react-start/clerk-basic/package.json` at line 14, Add E2E tests that
exercise the Clerk authentication flows now that `@clerk/tanstack-react-start` was
upgraded: create tests that render the app (where ClerkProvider is used),
simulate sign-in and sign-out using the app's UI components, assert session
state via getAuth and visible user info, and verify protected routes are
accessible only when authenticated; target the existing e2e test suite (replace
or extend the simple page-load test) and reference ClerkProvider, getAuth, the
app's sign-in/sign-out UI component names, and any protected route handlers to
validate end-to-end behavior.
packages/react-router-ssr-query/package.json (1)
74-74: ⚡ Quick win

Use bounded ranges (^5.100.10) instead of unbounded lower bounds (>=5.100.10).

The unbounded ranges at lines 74 and 82 can silently pull future major versions, making CI/test behavior non-reproducible. Replace both >=5.100.10 and >=5.90.0 with their caret equivalents.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/react-router-ssr-query/package.json` at line 74, Replace the
unbounded dependency ranges in package.json by changing the
"`@tanstack/react-query`" entry currently using ">=5.100.10" to a bounded caret
range "^5.100.10" (and similarly change the other unbounded entry ">=5.90.0" to
"^5.90.0"); update the version strings in package.json so both dependencies use
caret-bounded ranges to prevent pulling future major versions and ensure
reproducible CI.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@e2e/react-start/rsc/package.json`:
- Line 50: The TypeScript dependency in the rsc package is pinned to "^5.7.2"
and must be updated to "^6.0.2" to match other e2e projects; open the
package.json for the rsc package and replace the "typescript": "^5.7.2" entry
with "typescript": "^6.0.2", and also update the same dependency in the
rsc-query package.json (the "typescript" field) so both packages use "^6.0.2".

In `@e2e/solid-router/sentry-integration/package.json`:
- Around line 14-16: Remove the unused and incompatible "`@sentry/tracing`"
dependency from package.json: delete the "`@sentry/tracing`": "^7.120.4" entry so
only compatible Sentry packages (e.g., "`@sentry/solid`" and
"`@sentry/vite-plugin`") remain, then run your package manager (npm/yarn/pnpm) to
update lockfile and node_modules; ensure no imports reference "`@sentry/tracing`"
(search for that symbol) before committing.

In `@e2e/vue-start/basic-vue-query/package.json`:
- Line 25: The package.json dependency "zod" was upgraded to "^4.4.3" but must
match the other e2e Vue Start packages; change the "zod" entry in this
package.json back to "3.25.76" (or the exact semver used across the suite) and
regenerate the lockfile (npm/yarn/pnpm install) so the lockfile and node_modules
are consistent; locate the "zod" dependency string in package.json to make the
edit and then run the project package manager to update the lockfile.

In `@examples/react/basic-ssr-streaming-file-based/package.json`:
- Around line 16-18: Update the vulnerable Vite dependency by replacing the
current "vite": "8.0.13" entry with a patched version (>=8.0.5); locate the
"vite" dependency in package.json (look for the "vite" key and version "8.0.13")
and bump it to a secure release (e.g., "8.0.5" or later), then run your package
manager install to update lockfiles and verify the updated dependency is
installed; keep other verified packages (e.g., "compression", "express",
"get-port", "zod", "tailwindcss") unchanged unless additional advisories appear.

In `@examples/react/with-trpc-react-query/package.json`:
- Around line 19-21: Update the `@trpc/server` dependency in package.json from
^11.4.3 to ^11.17.0 so it matches the peer requirements of `@trpc/client` and
`@trpc/tanstack-react-query` (both at ^11.17.0); locate the "`@trpc/server`" entry
next to "`@trpc/client`" and "`@trpc/tanstack-react-query`" and change its version
specifier to ^11.17.0, then reinstall/update lockfile.

In `@examples/react/with-trpc/package.json`:
- Around line 17-18: The package.json currently pins "`@trpc/client`" to ^11.17.0
while "`@trpc/server`" is ^11.4.3; update the "`@trpc/server`" entry to ^11.17.0 so
both `@trpc/`* packages match (adjust the "`@trpc/server`" version string in
package.json to "^11.17.0"), then reinstall deps to resolve any
peer/compatibility issues.

In `@examples/solid/with-trpc/package.json`:
- Around line 17-18: Update the tRPC dependency versions so client and server
are on the same release line: in package.json locate the "`@trpc/client`" and
"`@trpc/server`" entries and make their semver ranges match (e.g., set
"`@trpc/server`" to the same "^11.17.0" as "`@trpc/client`" or align both to a
single chosen 11.x version); apply the same change across all tRPC example
package.json files to avoid client/server type/protocol mismatches.

In `@package.json`:
- Line 68: Update the pinned dependency "eslint-plugin-react-hooks" in
package.json from "^5.2.0" to "^7.1.0" to get React Compiler diagnostics and
ESLint v10 compatibility; after changing the version, run your package manager
(npm/yarn/pnpm) to update node_modules and the lockfile, and then run the
linter/CI lint job to ensure no new rule changes break the codebase.
- Around line 83-85: The package.json TS alias entries currently point all three
keys to 5.9.3; update the aliases so they map to the correct minor versions:
change "typescript57" to "npm:[email protected]", change "typescript58" to
"npm:[email protected]", and leave "typescript59" as "npm:[email protected]" so
the version matrix (typescript57, typescript58, typescript59) correctly
represents 5.7, 5.8, and 5.9 respectively.

---

Nitpick comments:
In `@e2e/react-start/clerk-basic/package.json`:
- Line 14: Add E2E tests that exercise the Clerk authentication flows now that
`@clerk/tanstack-react-start` was upgraded: create tests that render the app
(where ClerkProvider is used), simulate sign-in and sign-out using the app's UI
components, assert session state via getAuth and visible user info, and verify
protected routes are accessible only when authenticated; target the existing e2e
test suite (replace or extend the simple page-load test) and reference
ClerkProvider, getAuth, the app's sign-in/sign-out UI component names, and any
protected route handlers to validate end-to-end behavior.

In `@packages/react-router-ssr-query/package.json`:
- Line 74: Replace the unbounded dependency ranges in package.json by changing
the "`@tanstack/react-query`" entry currently using ">=5.100.10" to a bounded
caret range "^5.100.10" (and similarly change the other unbounded entry
">=5.90.0" to "^5.90.0"); update the version strings in package.json so both
dependencies use caret-bounded ranges to prevent pulling future major versions
and ensure reproducible CI.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 3c2bae9f-0b86-4dbf-a7da-9185a524aeb9

📥 Commits

Reviewing files that changed from the base of the PR and between 2506478 and 36c8876.

📒 Files selected for processing (300)

.github/workflows/bundle-size.yml
.github/workflows/labeler.yml
.github/workflows/zizmor.yml
benchmarks/bundle-size/package.json
benchmarks/client-nav/package.json
benchmarks/ssr/package.json
e2e/e2e-utils/package.json
e2e/eslint-plugin-start/package.json
e2e/react-router/basepath-file-based/package.json
e2e/react-router/basic-esbuild-file-based/package.json
e2e/react-router/basic-file-based-code-splitting/package.json
e2e/react-router/basic-file-based/package.json
e2e/react-router/basic-react-query-file-based/package.json
e2e/react-router/basic-react-query/package.json
e2e/react-router/basic-scroll-restoration/package.json
e2e/react-router/basic-virtual-file-based/package.json
e2e/react-router/basic-virtual-named-export-config-file-based/package.json
e2e/react-router/basic/package.json
e2e/react-router/escaped-special-strings/package.json
e2e/react-router/generator-cli-only/package.json
e2e/react-router/i18n-paraglide/package.json
e2e/react-router/js-only-file-based/package.json
e2e/react-router/match-params/package.json
e2e/react-router/rspack-basic-file-based/package.json
e2e/react-router/rspack-basic-virtual-named-export-config-file-based/package.json
e2e/react-router/scroll-restoration-sandbox-vite/package.json
e2e/react-router/sentry-integration/package.json
e2e/react-router/view-transitions/package.json
e2e/react-start/basic-auth/package.json
e2e/react-start/basic-cloudflare/package.json
e2e/react-start/basic-react-query/package.json
e2e/react-start/basic-tsr-config/package.json
e2e/react-start/basic/package.json
e2e/react-start/clerk-basic/package.json
e2e/react-start/csp/package.json
e2e/react-start/css-inline/package.json
e2e/react-start/css-modules/package.json
e2e/react-start/custom-basepath/package.json
e2e/react-start/custom-server-rsbuild/package.json
e2e/react-start/dev-ssr-styles/package.json
e2e/react-start/early-hints/package.json
e2e/react-start/flamegraph-bench/package.json
e2e/react-start/hmr/package.json
e2e/react-start/i18n-paraglide/package.json
e2e/react-start/import-protection-custom-config/package.json
e2e/react-start/import-protection/package.json
e2e/react-start/query-integration/package.json
e2e/react-start/rsc-query/package.json
e2e/react-start/rsc/package.json
e2e/react-start/scroll-restoration/package.json
e2e/react-start/selective-ssr/package.json
e2e/react-start/serialization-adapters/package.json
e2e/react-start/server-functions-global-middleware/package.json
e2e/react-start/server-functions/package.json
e2e/react-start/server-routes-global-middleware/package.json
e2e/react-start/server-routes/package.json
e2e/react-start/spa-mode/package.json
e2e/react-start/split-base-and-basepath/package.json
e2e/react-start/start-manifest/package.json
e2e/react-start/static-server-functions/package.json
e2e/react-start/streaming-ssr/package.json
e2e/react-start/transform-asset-urls/package.json
e2e/react-start/virtual-routes/package.json
e2e/react-start/website/package.json
e2e/solid-router/basepath-file-based/package.json
e2e/solid-router/basic-esbuild-file-based/package.json
e2e/solid-router/basic-file-based-code-splitting/package.json
e2e/solid-router/basic-file-based/package.json
e2e/solid-router/basic-scroll-restoration/package.json
e2e/solid-router/basic-solid-query-file-based/package.json
e2e/solid-router/basic-solid-query/package.json
e2e/solid-router/basic-virtual-file-based/package.json
e2e/solid-router/basic-virtual-named-export-config-file-based/package.json
e2e/solid-router/basic/package.json
e2e/solid-router/generator-cli-only/package.json
e2e/solid-router/js-only-file-based/package.json
e2e/solid-router/rspack-basic-file-based/package.json
e2e/solid-router/rspack-basic-virtual-named-export-config-file-based/package.json
e2e/solid-router/scroll-restoration-sandbox-vite/package.json
e2e/solid-router/sentry-integration/package.json
e2e/solid-router/view-transitions/package.json
e2e/solid-start/basic-auth/package.json
e2e/solid-start/basic-cloudflare/package.json
e2e/solid-start/basic-solid-query/package.json
e2e/solid-start/basic-tsr-config/package.json
e2e/solid-start/basic/package.json
e2e/solid-start/csp/package.json
e2e/solid-start/css-modules/package.json
e2e/solid-start/custom-basepath/package.json
e2e/solid-start/query-integration/package.json
e2e/solid-start/scroll-restoration/package.json
e2e/solid-start/selective-ssr/package.json
e2e/solid-start/serialization-adapters/package.json
e2e/solid-start/server-functions/package.json
e2e/solid-start/server-routes/package.json
e2e/solid-start/solid-query-layout-suspense/package.json
e2e/solid-start/spa-mode/package.json
e2e/solid-start/start-manifest/package.json
e2e/solid-start/virtual-routes/package.json
e2e/solid-start/website/package.json
e2e/vue-router/basepath-file-based/package.json
e2e/vue-router/basic-esbuild-file-based/package.json
e2e/vue-router/basic-file-based-jsx/package.json
e2e/vue-router/basic-file-based-sfc/package.json
e2e/vue-router/basic-scroll-restoration/package.json
e2e/vue-router/basic-virtual-file-based/package.json
e2e/vue-router/basic-virtual-named-export-config-file-based/package.json
e2e/vue-router/basic-vue-query-file-based/package.json
e2e/vue-router/basic-vue-query/package.json
e2e/vue-router/basic/package.json
e2e/vue-router/generator-cli-only/package.json
e2e/vue-router/js-only-file-based/package.json
e2e/vue-router/rspack-basic-file-based/package.json
e2e/vue-router/rspack-basic-virtual-named-export-config-file-based/package.json
e2e/vue-router/scroll-restoration-sandbox-vite/package.json
e2e/vue-router/sentry-integration/package.json
e2e/vue-router/view-transitions/package.json
e2e/vue-start/basic-auth/package.json
e2e/vue-start/basic-cloudflare/package.json
e2e/vue-start/basic-tsr-config/package.json
e2e/vue-start/basic-vue-query/package.json
e2e/vue-start/basic/package.json
e2e/vue-start/css-modules/package.json
e2e/vue-start/custom-basepath/package.json
e2e/vue-start/query-integration/package.json
e2e/vue-start/scroll-restoration/package.json
e2e/vue-start/selective-ssr/package.json
e2e/vue-start/serialization-adapters/package.json
e2e/vue-start/server-functions/package.json
e2e/vue-start/server-routes/package.json
e2e/vue-start/spa-mode/package.json
e2e/vue-start/start-manifest/package.json
e2e/vue-start/virtual-routes/package.json
e2e/vue-start/website/package.json
examples/react/authenticated-routes-firebase/package.json
examples/react/authenticated-routes/package.json
examples/react/basic-default-search-params/package.json
examples/react/basic-devtools-panel/package.json
examples/react/basic-file-based/package.json
examples/react/basic-non-nested-devtools/package.json
examples/react/basic-react-query-file-based/package.json
examples/react/basic-react-query/package.json
examples/react/basic-ssr-file-based/package.json
examples/react/basic-ssr-streaming-file-based/package.json
examples/react/basic-virtual-file-based/package.json
examples/react/basic-virtual-inside-file-based/package.json
examples/react/basic/package.json
examples/react/deferred-data/package.json
examples/react/i18n-paraglide/package.json
examples/react/kitchen-sink-file-based/package.json
examples/react/kitchen-sink-react-query-file-based/package.json
examples/react/kitchen-sink-react-query/package.json
examples/react/kitchen-sink/package.json
examples/react/large-file-based/package.json
examples/react/location-masking/package.json
examples/react/navigation-blocking/package.json
examples/react/quickstart-esbuild-file-based/package.json
examples/react/quickstart-file-based/package.json
examples/react/quickstart-rspack-file-based/package.json
examples/react/quickstart-webpack-file-based/package.json
examples/react/quickstart/package.json
examples/react/router-monorepo-react-query/package.json
examples/react/router-monorepo-react-query/packages/app/package.json
examples/react/router-monorepo-react-query/packages/post-feature/package.json
examples/react/router-monorepo-react-query/packages/post-query/package.json
examples/react/router-monorepo-react-query/packages/router/package.json
examples/react/router-monorepo-simple-lazy/package.json
examples/react/router-monorepo-simple-lazy/packages/app/package.json
examples/react/router-monorepo-simple-lazy/packages/post-feature/package.json
examples/react/router-monorepo-simple-lazy/packages/router/package.json
examples/react/router-monorepo-simple/package.json
examples/react/router-monorepo-simple/packages/app/package.json
examples/react/router-monorepo-simple/packages/post-feature/package.json
examples/react/router-monorepo-simple/packages/router/package.json
examples/react/scroll-restoration/package.json
examples/react/search-validator-adapters/package.json
examples/react/start-bare/package.json
examples/react/start-basic-auth/package.json
examples/react/start-basic-authjs/package.json
examples/react/start-basic-cloudflare/package.json
examples/react/start-basic-react-query/package.json
examples/react/start-basic-static/package.json
examples/react/start-basic/package.json
examples/react/start-bun/package.json
examples/react/start-clerk-basic/package.json
examples/react/start-convex-trellaux/package.json
examples/react/start-counter/package.json
examples/react/start-i18n-paraglide/package.json
examples/react/start-large/package.json
examples/react/start-material-ui/package.json
examples/react/start-rscs/package.json
examples/react/start-streaming-data-from-server-functions/package.json
examples/react/start-supabase-basic/package.json
examples/react/start-tailwind-v4/package.json
examples/react/start-trellaux/package.json
examples/react/start-workos/package.json
examples/react/view-transitions/package.json
examples/react/with-framer-motion/package.json
examples/react/with-trpc-react-query/package.json
examples/react/with-trpc/package.json
examples/solid/authenticated-routes-firebase/package.json
examples/solid/authenticated-routes/package.json
examples/solid/basic-default-search-params/package.json
examples/solid/basic-devtools-panel/package.json
examples/solid/basic-file-based/package.json
examples/solid/basic-non-nested-devtools/package.json
examples/solid/basic-solid-query-file-based/package.json
examples/solid/basic-solid-query/package.json
examples/solid/basic-ssr-file-based/package.json
examples/solid/basic-ssr-streaming-file-based/package.json
examples/solid/basic-virtual-file-based/package.json
examples/solid/basic-virtual-inside-file-based/package.json
examples/solid/basic/package.json
examples/solid/deferred-data/package.json
examples/solid/i18n-paraglide/package.json
examples/solid/kitchen-sink-file-based/package.json
examples/solid/kitchen-sink-solid-query-file-based/package.json
examples/solid/kitchen-sink-solid-query/package.json
examples/solid/kitchen-sink/package.json
examples/solid/large-file-based/package.json
examples/solid/location-masking/package.json
examples/solid/navigation-blocking/package.json
examples/solid/quickstart-esbuild-file-based/package.json
examples/solid/quickstart-file-based/package.json
examples/solid/quickstart-rspack-file-based/package.json
examples/solid/quickstart-webpack-file-based/package.json
examples/solid/quickstart/package.json
examples/solid/router-monorepo-simple-lazy/package.json
examples/solid/router-monorepo-simple-lazy/packages/app/package.json
examples/solid/router-monorepo-simple-lazy/packages/post-feature/package.json
examples/solid/router-monorepo-simple-lazy/packages/router/package.json
examples/solid/router-monorepo-simple/package.json
examples/solid/router-monorepo-simple/packages/app/package.json
examples/solid/router-monorepo-simple/packages/post-feature/package.json
examples/solid/router-monorepo-simple/packages/router/package.json
examples/solid/router-monorepo-solid-query/package.json
examples/solid/router-monorepo-solid-query/packages/app/package.json
examples/solid/router-monorepo-solid-query/packages/post-feature/package.json
examples/solid/router-monorepo-solid-query/packages/post-query/package.json
examples/solid/router-monorepo-solid-query/packages/router/package.json
examples/solid/scroll-restoration/package.json
examples/solid/search-validator-adapters/package.json
examples/solid/start-basic-auth/package.json
examples/solid/start-basic-authjs/package.json
examples/solid/start-basic-cloudflare/package.json
examples/solid/start-basic-netlify/package.json
examples/solid/start-basic-nitro/package.json
examples/solid/start-basic-solid-query/package.json
examples/solid/start-basic-static/package.json
examples/solid/start-basic/package.json
examples/solid/start-bun/package.json
examples/solid/start-convex-better-auth/package.json
examples/solid/start-counter/package.json
examples/solid/start-i18n-paraglide/package.json
examples/solid/start-large/package.json
examples/solid/start-streaming-data-from-server-functions/package.json
examples/solid/start-supabase-basic/package.json
examples/solid/start-tailwind-v4/package.json
examples/solid/view-transitions/package.json
examples/solid/with-framer-motion/package.json
examples/solid/with-trpc/package.json
examples/vue/basic-file-based-jsx/package.json
examples/vue/basic-file-based-sfc/package.json
examples/vue/basic/package.json
package.json
packages/arktype-adapter/package.json
packages/eslint-plugin-router/package.json
packages/eslint-plugin-start/package.json
packages/nitro-v2-vite-plugin/package.json
packages/react-router-devtools/package.json
packages/react-router-ssr-query/package.json
packages/react-router/package.json
packages/react-start-client/package.json
packages/react-start-rsc/package.json
packages/react-start-server/package.json
packages/react-start/package.json
packages/router-cli/package.json
packages/router-core/package.json
packages/router-devtools-core/package.json
packages/router-devtools/package.json
packages/router-generator/package.json
packages/router-plugin/package.json
packages/router-ssr-query-core/package.json
packages/router-utils/package.json
packages/solid-router-devtools/package.json
packages/solid-router-ssr-query/package.json
packages/solid-router/package.json
packages/solid-start-client/package.json
packages/solid-start-server/package.json
packages/solid-start/package.json
packages/start-plugin-core/package.json
packages/start-server-core/package.json
packages/valibot-adapter/package.json
packages/vue-router-devtools/package.json
packages/vue-router-ssr-query/package.json
packages/vue-router/package.json
packages/vue-start-client/package.json
packages/vue-start-server/package.json
packages/vue-start/package.json
packages/zod-adapter/package.json

coderabbitai · 2026-05-18T02:00:36Z

+    "@vitejs/plugin-rsc": "^0.5.26",
+    "eslint": "^9.39.4",
+    "srvx": "^0.11.15",
    "typescript": "^5.7.2",


⚠️ Potential issue | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash # Verify TypeScript version availability and check for inconsistencies # Check npm registry for TypeScript versions echo "=== Checking TypeScript versions on npm ===" npm view typescript versions --json | jq '.[-10:]' echo "" echo "=== Latest TypeScript version ===" npm view typescript version echo "" # Search for all TypeScript version declarations in e2e/react-start echo "=== TypeScript versions across e2e/react-start ===" rg -n '"typescript":\s*"\^[\d.]+' e2e/react-start/ -g 'package.json' | head -20

Repository: TanStack/router

Length of output: 1932

🌐 Web query:

What is the latest stable version of TypeScript as of May 2024?

💡 Result:

As of May 2024, the latest stable version of TypeScript was 5.4.5 [1]. While TypeScript 5.5 was released on June 20, 2024 [2][3], it had not yet been released as of May 2024. The 5.4.x series was the current stable branch during that month, with version 5.4.5 being the relevant patch release [1].

Citations:

1: https://releaserun.com/typescript-releases/

2: https://effectivetypescript.com/2024/07/02/ts-55/

3: https://en.wikipedia.org/wiki/TypeScript

Update TypeScript version to match other e2e projects.

The rsc package (line 50) uses TypeScript ^5.7.2 while most other e2e/react-start projects use ^6.0.2. Update to ^6.0.2 for consistency across the project. Note: rsc-query also uses ^5.7.2 and should be updated similarly.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@e2e/react-start/rsc/package.json` at line 50, The TypeScript dependency in the rsc package is pinned to "^5.7.2" and must be updated to "^6.0.2" to match other e2e projects; open the package.json for the rsc package and replace the "typescript": "^5.7.2" entry with "typescript": "^6.0.2", and also update the same dependency in the rsc-query package.json (the "typescript" field) so both packages use "^6.0.2".

coderabbitai · 2026-05-18T02:00:37Z

+    "@sentry/solid": "^10.53.1",
    "@sentry/tracing": "^7.120.4",
-    "@sentry/vite-plugin": "^4.6.1",
-    "@tailwindcss/vite": "^4.2.2",
+    "@sentry/vite-plugin": "^4.9.1",


⚠️ Potential issue | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash # Verify whether legacy tracing package is actually used in this fixture rg -n --type=ts --type=tsx --type=js --type=jsx '`@sentry/tracing`|BrowserTracing' e2e/solid-router/sentry-integration -S # Inspect declared Sentry deps together rg -n '"`@sentry/`(solid|tracing|vite-plugin)"' e2e/solid-router/sentry-integration/package.json -S

Repository: TanStack/router

Length of output: 219

🌐 Web query:

Is @sentry/tracingversion 7.x compatible with@sentry/solid version 10.x, and what is the recommended migration path for tracing in modern Sentry JS SDK versions?

💡 Result:

The @sentry/tracing package is not compatible with @sentry/solid version 10.x [1][2]. In fact, the @sentry/tracing package was officially deprecated in Sentry SDK version 7.47.0 and completely removed in version 8.0.0 [3][2]. In modern Sentry JavaScript SDK versions (v8 and later), the functionality previously provided by @sentry/tracing has been merged directly into the main SDK packages [3][2]. You should no longer install or import from @sentry/tracing [3][4]. Recommended Migration Path for Tracing: 1. Remove @sentry/tracing: Uninstall the package from your project, as it is obsolete [3][4]. 2. Update Imports: Replace any imports from @sentry/tracing with direct imports from your main Sentry SDK package (e.g., @sentry/solid or @sentry/browser) [3][2]. 3. Use New Tracing APIs: Sentry v8+ introduced revamped tracing APIs [5][6]. For example, instead of the deprecated BrowserTracing class, you should use the functional integration Sentry.browserTracingIntegration [7][8][6]. 4. Configuration: Ensure your trace propagation settings are configured in Sentry.init using the tracePropagationTargets option, which replaces the older tracingOrigins [5][6][9]. If you are migrating from an older version (e.g., 7.x) to a modern version (10.x), it is recommended to first upgrade to the latest 7.x release and use the @sentry/migr8 codemod tool to automate many of these breaking changes, though manual review is still required [5][6][4].

Citations:

1: https://registry.npmjs.org/@sentry/solid

2: https://www.npmjs.com/package/@sentry/tracing

3: [v8] Remove @sentry/tracing package getsentry/sentry-javascript#8796

4: https://github.com/getsentry/sentry-migr8

5: https://docs.sentry.io/platforms/javascript/guides/solid/migration/v7-to-v8/

6: https://docs.sentry.io/platforms/javascript/migration/v7-to-v8/

7: https://docs.sentry.io/platforms/javascript/guides/solid/migration/v7-to-v8/v7-deprecations/

8: https://docs.sentry.io/platforms/javascript/migration/v7-to-v8/v7-deprecations/

9: https://docs.sentry.io/platforms/javascript/guides/node/migration/v7-to-v8/

Remove unused @sentry/tracing dependency; it's incompatible and obsolete.

Line 15 declares @sentry/tracing@^7.120.4, which was deprecated in v7.47.0 and removed entirely in v8.0.0. This package is incompatible with @sentry/solid@^10.53.1 (line 14) and the fixture does not import it. Remove it from dependencies.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@e2e/solid-router/sentry-integration/package.json` around lines 14 - 16, Remove the unused and incompatible "`@sentry/tracing`" dependency from package.json: delete the "`@sentry/tracing`": "^7.120.4" entry so only compatible Sentry packages (e.g., "`@sentry/solid`" and "`@sentry/vite-plugin`") remain, then run your package manager (npm/yarn/pnpm) to update lockfile and node_modules; ensure no imports reference "`@sentry/tracing`" (search for that symbol) before committing.

coderabbitai · 2026-05-18T02:00:37Z

+    "tailwind-merge": "^2.6.1",
+    "vite": "^8.0.13",
+    "vue": "^3.5.34",
+    "zod": "^4.4.3"


⚠️ Potential issue | 🟠 Major | 🏗️ Heavy lift

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash # Check Zod versions across all vue-start e2e packages rg -n '"zod":\s*"\^?[0-9]' e2e/vue-start/*/package.json | sort

Repository: TanStack/router

Length of output: 788

Revert Zod version to match other e2e packages.

This file upgrades to Zod 4.4.3, but 10 other Vue Start e2e packages remain on Zod 3.25.76. Zod 4 introduces breaking changes including unified error customization, standalone string schemas, and different default value logic. This inconsistency could cause runtime failures if schemas are shared between e2e fixtures and contradicts the PR title "update all non-major dependencies" (Zod 3→4 is a major version change). Align this package with the rest of the e2e suite by reverting to Zod 3.25.76.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@e2e/vue-start/basic-vue-query/package.json` at line 25, The package.json dependency "zod" was upgraded to "^4.4.3" but must match the other e2e Vue Start packages; change the "zod" entry in this package.json back to "3.25.76" (or the exact semver used across the suite) and regenerate the lockfile (npm/yarn/pnpm install) so the lockfile and node_modules are consistent; locate the "zod" dependency string in package.json to make the edit and then run the project package manager to update the lockfile.

coderabbitai · 2026-05-18T02:00:37Z

+    "compression": "^1.8.1",
+    "express": "^4.22.2",
+    "get-port": "^7.2.0",


⚠️ Potential issue | 🔴 Critical | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash # Verify key package versions exist and check for security advisories echo "=== Checking npm registry for package versions ===" # Check Tailwind CSS echo -e "\n📦 `@tailwindcss/vite`@4.3.0" npm view `@tailwindcss/vite`@4.3.0 version 2>/dev/null || echo "❌ Version not found" echo -e "\n📦 [email protected]" npm view [email protected] version 2>/dev/null || echo "❌ Version not found" # Check Zod (large patch jump) echo -e "\n📦 [email protected]" npm view [email protected] version 2>/dev/null || echo "❌ Version not found" # Check React Query echo -e "\n📦 `@tanstack/react-query`@5.100.10" npm view `@tanstack/react-query`@5.100.10 version 2>/dev/null || echo "❌ Version not found" # Check Vite ecosystem echo -e "\n📦 [email protected]" npm view [email protected] version 2>/dev/null || echo "❌ Version not found" echo -e "\n📦 `@vitejs/plugin-react`@6.0.2" npm view `@vitejs/plugin-react`@6.0.2 version 2>/dev/null || echo "❌ Version not found" # Check Express ecosystem echo -e "\n📦 [email protected]" npm view [email protected] version 2>/dev/null || echo "❌ Version not found" echo -e "\n📦 [email protected]" npm view [email protected] version 2>/dev/null || echo "❌ Version not found" echo -e "\n📦 [email protected]" npm view [email protected] version 2>/dev/null || echo "❌ Version not found" echo -e "\n=== Checking for security advisories (via GitHub) ===" # Check for security advisories using GitHub GraphQL API for pkg in "tailwindcss" "zod" "vite" "express"; do echo -e "\n🔍 Security advisories for $pkg:" gh api graphql -f query=" { securityVulnerabilities(first: 5, ecosystem: NPM, package: \"$pkg\") { nodes { advisory { summary severity publishedAt } vulnerableVersionRange firstPatchedVersion { identifier } } } } " 2>/dev/null | jq -r '.data.securityVulnerabilities.nodes[] | " ⚠️ \(.advisory.severity): \(.advisory.summary) | Vulnerable: \(.vulnerableVersionRange) | Patched: \(.firstPatchedVersion.identifier // "N/A")"' || echo " ✅ No recent advisories found or API unavailable" done

Repository: TanStack/router

Length of output: 1864

Address critical vulnerabilities in Vite 8.0.13 (applies to lines 25-30).

All package versions are confirmed to exist in the npm registry. However, verification identified critical security issues:

[email protected]: HIGH severity "server.fs.deny bypassed with queries" and MODERATE "Path Traversal in optimized deps .map handling" — both vulnerable in 8.0.0-8.0.4 range, patched in 8.0.5+. Upgrade required.

[email protected]: Verified as patched (denial of service vulnerability was in ≤3.22.2).

[email protected], [email protected], [email protected] (lines 16-18): All verified secure or properly patched.

[email protected]: No advisories detected.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@examples/react/basic-ssr-streaming-file-based/package.json` around lines 16 - 18, Update the vulnerable Vite dependency by replacing the current "vite": "8.0.13" entry with a patched version (>=8.0.5); locate the "vite" dependency in package.json (look for the "vite" key and version "8.0.13") and bump it to a secure release (e.g., "8.0.5" or later), then run your package manager install to update lockfiles and verify the updated dependency is installed; keep other verified packages (e.g., "compression", "express", "get-port", "zod", "tailwindcss") unchanged unless additional advisories appear.

coderabbitai · 2026-05-18T02:00:37Z

+    "@trpc/client": "^11.17.0",
    "@trpc/server": "^11.4.3",
-    "@trpc/tanstack-react-query": "^11.4.3",
-    "express": "^4.21.2",
+    "@trpc/tanstack-react-query": "^11.17.0",


🛠️ Refactor suggestion | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash # Verify tRPC version skew in the affected manifests and inspect published peer requirements. set -euo pipefail echo "== Local manifest versions ==" for f in examples/react/with-trpc/package.json examples/react/with-trpc-react-query/package.json; do echo "--- $f ---" jq -r '{ client: .dependencies["`@trpc/client`"], server: .dependencies["`@trpc/server`"], tanstack: .dependencies["`@trpc/tanstack-react-query`"] }' "$f" done echo echo "== Published peerDependencies ==" curl -s https://registry.npmjs.org/%40trpc%2Ftanstack-react-query/11.17.0 | jq '.peerDependencies' curl -s https://registry.npmjs.org/%40trpc%2Fclient/11.17.0 | jq '.peerDependencies'

Repository: TanStack/router

Length of output: 581

Align @trpc/server to ^11.17.0 to match peer dependency requirements.

The published peer dependencies for @trpc/[email protected] and @trpc/[email protected] both require @trpc/[email protected] exactly. The current version ^11.4.3 violates this constraint and may resolve to incompatible versions. Update to ^11.17.0 to match.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@examples/react/with-trpc-react-query/package.json` around lines 19 - 21, Update the `@trpc/server` dependency in package.json from ^11.4.3 to ^11.17.0 so it matches the peer requirements of `@trpc/client` and `@trpc/tanstack-react-query` (both at ^11.17.0); locate the "`@trpc/server`" entry next to "`@trpc/client`" and "`@trpc/tanstack-react-query`" and change its version specifier to ^11.17.0, then reinstall/update lockfile.

coderabbitai · 2026-05-18T02:00:37Z

+    "@trpc/client": "^11.17.0",
    "@trpc/server": "^11.4.3",


⚠️ Potential issue | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🌐 Web query:

For tRPC v11, is it recommended or required that @trpc/clientand@trpc/server stay on the same minor version (for example 11.17.x together), and are there known compatibility caveats when mixing 11.17.x client with 11.4.x server?

💡 Result:

For tRPC v11, it is strongly recommended to keep @trpc/client and @trpc/server on the same version [1][2]. Official documentation and maintainer guidance explicitly state that you should ensure all @trpc/* packages match across your projects [1][2]. Mixing versions, such as using a 11.17.x client with an 11.4.x server, is not recommended and can lead to several issues: 1. Peer Dependency Errors: The packages define strict peer dependencies on each other [3][1]. Mismatched versions will likely trigger package manager warnings or errors during installation [4]. 2. Runtime and Type Compatibility: While tRPC adheres to semantic versioning and does not introduce breaking changes in minor or patch releases [1][2], the ecosystem relies on shared types and internal contracts. Maintaining version parity ensures that the client and server are synchronized, preventing potential runtime mismatches or type-related issues that can occur when the client expects features or structures that the older server version does not provide [5]. 3. Best Practices: The tRPC maintainers have explicitly stated that you are "never safe to only update one of them without updating all" [4]. Using a monorepo or a consistent versioning strategy across your client and server deployments is the standard approach to avoid version skew and ensure the guarantees of end-to-end type safety [1][5]. In summary, while a minor version mismatch might not always cause an immediate hard crash due to the nature of the RPC protocol, it is unsupported and risks breaking the type-safety guarantees that tRPC provides [1][5]. You should always keep your @trpc/* packages at the same version [1][2].

Citations:

1: https://trpc.io/faq

2: https://trpc.io/docs/v10/faq

3: trpc/trpc@v11.9.0...v11.10.0

4: Requirements and best practices for updating minor and patch versions trpc/trpc#4811

5: https://www.skovhus.dev/blog/trpc-auto-versioning

Align @trpc/server to match @trpc/client version.

Currently mixing @trpc/client@^11.17.0 with @trpc/server@^11.4.3. Official tRPC documentation requires keeping all @trpc/* packages on the same version to maintain type-safety guarantees. Version mismatches can cause peer dependency errors, runtime compatibility issues, and loss of end-to-end type safety. Update @trpc/server to ^11.17.0.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@examples/react/with-trpc/package.json` around lines 17 - 18, The package.json currently pins "`@trpc/client`" to ^11.17.0 while "`@trpc/server`" is ^11.4.3; update the "`@trpc/server`" entry to ^11.17.0 so both `@trpc/`* packages match (adjust the "`@trpc/server`" version string in package.json to "^11.17.0"), then reinstall deps to resolve any peer/compatibility issues.

coderabbitai · 2026-05-18T02:00:37Z

+    "@trpc/client": "^11.17.0",
    "@trpc/server": "^11.4.3",


⚠️ Potential issue | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash # Verify `@trpc` version alignment in package manifests # Expected: each manifest using both `@trpc/client` and `@trpc/server` should keep them on the same minor line. fd package.json | while read -r f; do python - <<'PY' "$f" import json, sys p = sys.argv[1] try: data = json.load(open(p)) except Exception: raise SystemExit deps = data.get("dependencies", {}) c = deps.get("`@trpc/client`") s = deps.get("`@trpc/server`") if c and s: print(f"{p}: client={c} server={s}") PY done

Repository: TanStack/router

Length of output: 281

Align @trpc/client and @trpc/server versions.

@trpc/client is bumped to ^11.17.0 while @trpc/server stays at ^11.4.3. This divergence exists across all tRPC example packages and can cause subtle client/server type or protocol mismatches. Keep both dependencies on the same release line.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@examples/solid/with-trpc/package.json` around lines 17 - 18, Update the tRPC dependency versions so client and server are on the same release line: in package.json locate the "`@trpc/client`" and "`@trpc/server`" entries and make their semver ranges match (e.g., set "`@trpc/server`" to the same "^11.17.0" as "`@trpc/client`" or align both to a single chosen 11.x version); apply the same change across all tRPC example package.json files to avoid client/server type/protocol mismatches.

coderabbitai · 2026-05-18T02:00:37Z

+    "@vitest/browser": "^4.1.6",
+    "@vitest/ui": "^4.1.6",
+    "eslint": "^9.39.4",
+    "eslint-plugin-react-hooks": "^5.2.0",


⚠️ Potential issue | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash # Verify current React + react-hooks plugin versions in root manifest python - <<'PY' import json with open("package.json") as f: pkg = json.load(f) dev = pkg.get("devDependencies", {}) print("react:", dev.get("react")) print("eslint-plugin-react-hooks:", dev.get("eslint-plugin-react-hooks")) PY

Repository: TanStack/router

Length of output: 108

🌐 Web query:

React 19.2 eslint-plugin-react-hooks v6 compatibility requirements

💡 Result:

React 19.2, released on October 1, 2025 [1][2], does not have a strict, exclusive dependency on eslint-plugin-react-hooks v6. While early documentation around the release of React 19.2 may have referenced v6 [3], the ecosystem has since evolved. As of May 2026, the latest stable version of the plugin is v7.1.0 (released April 16, 2026) [4], which is fully compatible with React 19.x and introduces support for ESLint v10 [4]. Key compatibility and usage notes: 1. Versioning: You are not restricted to v6. Version 7.x is the current standard and is recommended for use with React 19.2 to benefit from the latest performance improvements, bug fixes, and enhanced React Compiler diagnostic support [5][4]. 2. Configuration: The plugin supports ESLint's flat configuration format (eslint.config.js) [6][7]. For v6 and later, you can typically import the plugin and use the recommended configuration directly [7][8]: import reactHooks from 'eslint-plugin-react-hooks'; export default [ { plugins: { 'react-hooks': reactHooks }, rules: {...reactHooks.configs.recommended.rules, }, }, ]; 3. React Compiler: The plugin is designed to surface React Compiler diagnostics automatically [5]. Using the latest version (v7.x) ensures you have the most accurate linting for these compiler-specific rules [4]. If you are maintaining an older project, v6 remains functional, but upgrading to the latest v7.x release is advised to ensure compatibility with modern ESLint versions and to receive the most recent linting improvements [4].

Citations:

1: https://github.com/facebook/react/releases/tag/v19.2.0

2: https://react.dev/blog/2025/10/01/react-19-2

3: https://www.reddit.com/r/reactjs/comments/1ocab09/eslint_6_or_7_react_192/

4: https://github.com/facebook/react/releases/tag/eslint-plugin-react-hooks%407.1.0

5: https://react.dev/reference/eslint-plugin-react-hooks

6: https://www.npmjs.com/package/eslint-plugin-react-hooks?activeTab=versions

7: https://www.npmjs.com/package/eslint-plugin-react-hooks/v/6.0.0-rc.1

8: Bug: eslint-plugin-react-hooks v.6.1.0 recommended config uses array instead of object facebook/react#34679

🌐 Web query:

eslint-plugin-react-hooks v6 release notes breaking changes React 19

💡 Result:

The v6 release of eslint-plugin-react-hooks introduced significant changes, primarily to support the React Compiler and modernize ESLint configuration [1]. Note that version 6.0.0 was released accidentally and subsequently deprecated; users should refer to version 6.1.0 and later for the intended release [1]. Key breaking changes in the v6.x series include: - Node.js Requirement: The plugin now requires Node.js 18 or newer [1]. - Flat Config Default: The recommended preset now defaults to ESLint flat config format [1]. Users who have not migrated to flat config must use the recommended-legacy preset instead [1]. - Configuration Renaming: The legacy configuration was moved to recommended-legacy [1]. - Dependency Removal: The plugin removed dependencies on hermes-parser and @babel/plugin-proposal-private-methods [1]. - Rule Changes: The NoUnusedOptOutDirectives rule was removed [1]. New features and improvements include: - React Compiler Support: The plugin includes rules to validate code against syntax supported by the React Compiler [1][2]. - New Violations: Added rules to disallow calling use within try/catch blocks and to disallow calling useEffectEvent functions in arbitrary closures [1]. - Enhanced Hooks Support: The rules-of-hooks now handles React.useEffect in addition to useEffect, and a new settings option allows for configuring additionalEffectHooks [1]. As of May 2026, the plugin has progressed to version 7.x, which includes further improvements such as ESLint v10 support and enhanced compiler diagnostics [3]. Users are generally encouraged to use the latest stable version [3][4].

Citations:

1: https://github.com/facebook/react/blob/main/packages/eslint-plugin-react-hooks/CHANGELOG.md

2: https://react.dev/reference/eslint-plugin-react-hooks

3: https://github.com/facebook/react/releases/tag/eslint-plugin-react-hooks%407.1.0

4: https://security.snyk.io/package/npm/eslint-plugin-react-hooks/6.0.0

Upgrade eslint-plugin-react-hooks to v7.x (currently on v5.2.0).

Version 5.2.0 is outdated and lacks React Compiler diagnostics support introduced in v6+. The current recommended version is v7.1.0, which provides enhanced React Compiler support and ESLint v10 compatibility.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@package.json` at line 68, Update the pinned dependency "eslint-plugin-react-hooks" in package.json from "^5.2.0" to "^7.1.0" to get React Compiler diagnostics and ESLint v10 compatibility; after changing the version, run your package manager (npm/yarn/pnpm) to update node_modules and the lockfile, and then run the linter/CI lint job to ensure no new rule changes break the codebase.

coderabbitai · 2026-05-18T02:00:37Z

+    "typescript57": "npm:typescript@5.9.3",
+    "typescript58": "npm:typescript@5.9.3",
+    "typescript59": "npm:[email protected].3",


⚠️ Potential issue | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash # Verify TS alias mapping in root package.json python - <<'PY' import json with open("package.json") as f: pkg = json.load(f) dev = pkg.get("devDependencies", {}) for k in ("typescript55","typescript56","typescript57","typescript58","typescript59"): print(f"{k}: {dev.get(k)}") PY

Repository: TanStack/router

Length of output: 230

🏁 Script executed:

# Check the context around lines 83-85 in package.json sed -n '75,95p' package.json

Repository: TanStack/router

Length of output: 486

🏁 Script executed:

# Check available TypeScript versions to confirm 5.7 and 5.8 exist npm view [email protected] version 2>/dev/null || echo "5.7 not found" npm view [email protected] version 2>/dev/null || echo "5.8 not found" npm view [email protected] version 2>/dev/null || echo "5.9 not found" npm view [email protected] version 2>/dev/null || echo "5.9.3 not found"

Repository: TanStack/router

Length of output: 215

Restore distinct TS alias versions.

typescript57, typescript58, and typescript59 all point to npm:[email protected], eliminating type coverage for versions 5.7 and 5.8. Given the established pattern (typescript55 → 5.5, typescript56 → 5.6), these should map to 5.7.3 and 5.8.3 respectively to maintain full version matrix testing.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@package.json` around lines 83 - 85, The package.json TS alias entries currently point all three keys to 5.9.3; update the aliases so they map to the correct minor versions: change "typescript57" to "npm:[email protected]", change "typescript58" to "npm:[email protected]", and leave "typescript59" as "npm:[email protected]" so the version matrix (typescript57, typescript58, typescript59) correctly represents 5.7, 5.8, and 5.9 respectively.

chore(deps): update all non-major dependencies

36c8876

renovate Bot requested a review from a team as a code owner May 18, 2026 01:49

renovate Bot added the dependencies Pull requests that update a dependency file label May 18, 2026

github-actions Bot added package: solid-router-ssr-query package: vue-router package: vue-router-devtools package: vue-router-ssr-query package: vue-start-client package: vue-start package: vue-start-server package: react-start-rsc package: eslint-plugin-start labels May 18, 2026

coderabbitai Bot reviewed May 18, 2026

View reviewed changes

Uh oh!

Conversation

renovate Bot commented May 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

renovate Bot commented May 18, 2026

⚠️ Artifact update problem

File name: pnpm-lock.yaml

Uh oh!

coderabbitai Bot commented May 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Possibly related PRs

Suggested reviewers

Poem

Uh oh!

nx-cloud Bot commented May 18, 2026

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot May 18, 2026

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot May 18, 2026

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot May 18, 2026

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot May 18, 2026

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot May 18, 2026

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot May 18, 2026

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot May 18, 2026

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot May 18, 2026

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot May 18, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented May 18, 2026 •

edited

Loading

coderabbitai Bot commented May 18, 2026 •

edited

Loading