Skip to content

chore(deps): update all non-major dependencies#290

Open
renovate[bot] wants to merge 1 commit intomainfrom
renovate/all-minor-patch
Open

chore(deps): update all non-major dependencies#290
renovate[bot] wants to merge 1 commit intomainfrom
renovate/all-minor-patch

Conversation

@renovate
Copy link
Contributor

@renovate renovate bot commented Dec 15, 2025

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
@babel/core (source) ^7.28.4^7.29.0 age confidence
@babel/generator (source) ^7.28.3^7.29.1 age confidence
@babel/parser (source) ^7.28.4^7.29.2 age confidence
@babel/traverse (source) ^7.28.4^7.29.0 age confidence
@babel/types (source) ^7.28.4^7.29.0 age confidence
@biomejs/biome (source) 2.2.42.4.9 age confidence
@cloudflare/vite-plugin (source) ^1.13.8^1.30.1 age confidence
@preact/preset-vite ^2.10.3^2.10.5 age confidence
@solid-primitives/event-listener (source) ^2.4.3^2.4.5 age confidence
@solid-primitives/keyboard (source) ^1.3.3^1.3.5 age confidence
@solid-primitives/resize-observer (source) ^2.1.3^2.1.5 age confidence
@solidjs/start (source) ^1.2.0^1.3.2 age confidence
@tailwindcss/vite (source) ^4.0.6^4.2.2 age confidence
@tanstack/eslint-config (source) 0.3.20.4.0 age confidence
@tanstack/intent ^0.0.14^0.0.23 age confidence
@tanstack/react-form (source) ^1.23.7^1.28.5 age confidence
@tanstack/react-form-devtools (source) ^0.1.7^0.2.19 age confidence
@tanstack/react-query (source) ^5.90.1^5.95.2 age confidence
@tanstack/react-query-devtools (source) ^5.90.1^5.95.2 age confidence
@tanstack/react-router (source) ^1.132.0^1.168.4 age confidence
@tanstack/react-router-devtools (source) ^1.132.0^1.166.11 age confidence
@tanstack/react-router-ssr-query (source) ^1.131.7^1.166.10 age confidence
@tanstack/react-start (source) ^1.132.0^1.167.7 age confidence
@tanstack/react-store (source) ^0.9.0^0.9.3 age confidence
@tanstack/router-plugin (source) ^1.132.0^1.167.5 age confidence
@tanstack/solid-query (source) ^5.90.1^5.95.2 age confidence
@tanstack/solid-query-devtools (source) ^5.90.1^5.95.2 age confidence
@tanstack/solid-router (source) ^1.131.50^1.168.4 age confidence
@tanstack/solid-router-devtools (source) ^1.131.50^1.166.11 age confidence
@tanstack/store (source) ^0.9.0^0.9.3 age confidence
@tanstack/vite-config (source) 0.4.30.5.2 age confidence
@tanstack/vue-query (source) ^5.90.5^5.95.2 age confidence
@tanstack/vue-query-devtools (source) ^6.1.0^6.1.10 age confidence
@testing-library/dom ^10.4.0^10.4.1 age confidence
@testing-library/jest-dom ^6.8.0^6.9.1 age confidence
@testing-library/react ^16.2.0^16.3.2 age confidence
@types/react (source) ^19.2.0^19.2.14 age confidence
@types/react (source) ^19.2.0^19.2.14 age confidence
@types/react-dom (source) ^19.2.0^19.2.3 age confidence
@vitejs/plugin-vue (source) ^6.0.1^6.0.5 age confidence
axe-core (source) ^4.10.0^4.11.1 age confidence
dayjs (source) ^1.11.19^1.11.20 age confidence
drizzle-kit (source) ^0.31.4^0.31.10 age confidence
drizzle-orm (source) ^0.44.5^0.45.1 age confidence
eslint (source) ^9.36.0^9.39.4 age confidence
eslint-plugin-unused-imports ^4.2.0^4.4.1 age confidence
eslint-plugin-vue (source) ^10.5.1^10.8.0 age confidence
goober ^2.1.16^2.1.18 age confidence
jsdom ^27.0.0^27.4.0 age confidence
knip (source) ^5.64.0^5.88.1 age confidence
launch-editor ^2.11.1^2.13.2 age confidence
lucide-react (source) ^0.561.0^0.577.0 age confidence
markdown-link-extractor ^4.0.2^4.0.3 age confidence
nx (source) 22.1.322.6.1 age confidence
pg (source) ^8.16.3^8.20.0 age confidence
picomatch ^4.0.3^4.0.4 age confidence
pnpm (source) 10.24.010.33.0 age confidence
preact (source) ^10.28.0^10.29.0 age confidence
prettier-plugin-svelte ^3.4.1^3.5.1 age confidence
publint (source) ^0.3.13^0.3.18 age confidence
react (source) ^19.2.0^19.2.4 age confidence
react (source) ^19.2.0^19.2.4 age confidence
react-dom (source) ^19.2.0^19.2.4 age confidence
react-dom (source) ^19.2.0^19.2.4 age confidence
sherif ^1.7.0^1.11.0 age confidence
solid-js (source) ^1.9.9^1.9.12 age confidence
solid-js (source) ^1.9.9^1.9.12 age confidence
sonda (source) 0.9.00.11.1 age confidence
streamdown (source) ^1.6.5^1.6.11 age confidence
tailwind-merge ^3.0.2^3.5.0 age confidence
tailwindcss (source) ^4.0.6^4.2.2 age confidence
tsup (source) ^8.5.0^8.5.1 age confidence
tw-animate-css ^1.3.6^1.4.0 age confidence
typescript (source) ~5.9.2~5.9.3 age confidence
vinxi (source) ^0.5.8^0.5.11 age confidence
vite (source) ^8.0.0^8.0.2 age confidence
vite-plugin-mkcert ^1.17.8^1.17.10 age confidence
vite-tsconfig-paths ^6.0.2^6.1.1 age confidence
vue (source) ^3.5.22^3.5.31 age confidence
web-vitals ^5.1.0^5.2.0 age confidence
wrangler (source) ^4.40.3^4.77.0 age confidence
ws ^8.18.3^8.20.0 age confidence
zod (source) ^4.3.5^4.3.6 age confidence
zustand ^5.0.8^5.0.12 age confidence

Release Notes

babel/babel (@​babel/core)

v7.29.0

Compare Source

v7.29.0 (2026-01-31)

Thanks @​simbahax for your first PR!

🚀 New Feature
🐛 Bug Fix
  • babel-parser
  • babel-traverse
    • #​17708 fix(traverse): provide a hub when traversing a File or Program and no parentPath is given (@​simbahax)
  • babel-plugin-transform-block-scoping, babel-traverse
    • #​17737 [7.x backport] fix: Rename switch discriminant references when body creates shadowing variable (@​magic-akari)
🏃‍♀️ Performance
Committers: 6
babel/babel (@​babel/generator)

v7.29.1

Compare Source

v7.29.0

Compare Source

v7.29.0 (2026-01-31)

Thanks @​simbahax for your first PR!

🚀 New Feature
🐛 Bug Fix
  • babel-parser
  • babel-traverse
    • #​17708 fix(traverse): provide a hub when traversing a File or Program and no parentPath is given (@​simbahax)
  • babel-plugin-transform-block-scoping, babel-traverse
    • #​17737 [7.x backport] fix: Rename switch discriminant references when body creates shadowing variable (@​magic-akari)
🏃‍♀️ Performance
Committers: 6
biomejs/biome (@​biomejs/biome)

v2.4.9

Compare Source

Patch Changes
  • #​9315 085d324 Thanks @​ematipico! - Added a new nursery CSS rule noDuplicateSelectors, that disallows duplicate selector lists within the same at-rule context.

    For example, the following snippet triggers the rule because the second selector and the first selector are the same:

    /* First selector */
    .x .y .z {
    }
    
    /* Second selector */
    .x {
      .y {
        .z {
        }
      }
    }
  • #​9567 b7ab931 Thanks @​ematipico! - Fixed #​7211: useOptionalChain now detects negated logical OR chains. The following code is now considered invalid:

    !foo || !foo.bar;
  • #​8670 607ebf9 Thanks @​tt-a1i! - Fixed #​8345: useAdjacentOverloadSignatures no longer reports false positives for static and instance methods with the same name. Static methods and instance methods are now treated as separate overload groups.

    class Kek {
      static kek(): number {
        return 0;
      }
      another(): string {
        return "";
      }
      kek(): number {
        return 1;
      } // no longer reported as non-adjacent
    }
  • #​9476 97b80a8 Thanks @​masterkain! - Fixed #9475: Fixed a panic when Biome analyzed ambient TypeScript modules containing class constructor, getter, or setter signatures that reference local type aliases. Biome now handles these declarations without crashing during semantic analysis.

  • #​9553 0cd5298 Thanks @​dyc3! - Fixed a bug where enabling the rules of a whole group, would enable rules that belonged to a domain under the same group.

    For example, linter.rules.correctness = "error" no longer enables React- or Qwik-specific correctness rules unless linter.domains.react, linter.domains.qwik, or an explicit rule config also enables them, or their relative dependencies are installed.

  • #​9586 4cafb71 Thanks @​dyc3! - Fixed #​8828: Grit patterns using export { $foo } from $source now match named re-exports in JavaScript and TypeScript files.

  • #​9550 d4e3d6e Thanks @​dyc3! - Fixed #​9548: Biome now parses conditional expressions whose consequent is an arrow function returning a parenthesized object expression.

  • #​8696 a7c19cc Thanks @​Faizanq! - Fixed #​8685 where noUselessLoneBlockStatements would remove empty blocks containing comments. The rule now preserves these blocks since comments may contain important information like TODOs or commented-out code.

  • #​9557 6671ac5 Thanks @​datalek! - Fixed #​9557: Biome's LSP server no longer crashes on startup when used with editors that don't send workspaceFolders during initialization. This affected any LSP client that only sends rootUri, which is valid per the LSP specification.

  • #​9455 1710cf1 Thanks @​omar-y-abdi! - Fixed #​9174: useExpect now correctly rejects asymmetric matchers in Vitest or Jest like expect.stringContaining(), expect.objectContaining(), and utilities like expect.extend() that are not valid assertions. Previously these constructs caused false negatives, allowing tests without real assertions to pass the lint rule.

  • #​9584 956e367 Thanks @​ematipico! - Fixed a bug where Vue directive attribute values like v-bind:class="{'dynamic': true}" were incorrectly parsed as JavaScript statements instead of expressions. Object literals inside directive values like :class, v-if, and v-html are now correctly parsed as expressions, preventing spurious parse errors.

  • #​9474 e168494 Thanks @​ematipico! - Added the new nursery rule noUntrustedLicenses. This rule disallows dependencies that ship with invalid licenses or licenses that don't meet the criteria of your project/organisation.

    The rule has the following options:

    • allow: a list of licenses that can be allowed. Useful to bypass possible invalid licenses from downstream dependencies.
    • deny: a list of licenses that should trigger the rule. Useful to deny licenses that don't fit your project/organisation.
      When both deny and allow are provided, deny takes precedence.
    • requireOsiApproved: whether the licenses need to be approved by the Open Source Initiative.
    • requireFsfLibre: whether the licenses need to be approved by the Free Software Foundation.
  • #​9544 723798b Thanks @​ViniciusDev26! - Added an unsafe fix to useConsistentMethodSignatures that automatically converts between method-style and property-style signatures.

  • #​9555 8a3647b Thanks @​ematipico! - Fixed #188: the Biome Language Server no longer panics when open files change abruptly, such as during git branch checkouts.

  • #​9605 f65c637 Thanks @​ematipico! - Fixed #​9589. Now Biome correctly parses object expressions inside props and directives. The following code doesn't emit errors anymore:

    <style is:global define:vars={{ bgLight: light }}>
    <Component name={{ first, name }} />
  • #​9565 ccb249e Thanks @​eyupcanakman! - Fixed #​9505: noUselessStringConcat no longer reports tagged template literals as useless string concatenations. Tagged templates invoke a function and can return non-string values, so combining them with + is not equivalent to a single template literal.

  • #​9534 4d050df Thanks @​Netail! - Added the nursery rule noInlineStyles. The rule disallows the use of inline style attributes in HTML and the style prop in JSX, including React.createElement calls. Inline styles make code harder to maintain and can interfere with Content Security Policy.

  • #​9611 cddaa44 Thanks @​gaauwe! - Fixed a regression where Biome LSP could misread editor settings sent through workspace/didChangeConfiguration when the payload was wrapped in a top-level biome key. This caused requireConfiguration and related settings to be ignored in some editors.

v2.4.8

Compare Source

Patch Changes

Configuration

📅 Schedule: Branch creation - Between 12:00 AM and 03:59 AM, only on Monday ( * 0-3 * * 1 ) (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@changeset-bot
Copy link

changeset-bot bot commented Dec 15, 2025

⚠️ No Changeset found

Latest commit: 346d88c

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@nx-cloud
Copy link

nx-cloud bot commented Dec 15, 2025

🤖 Nx Cloud AI Fix Eligible

An automatically generated fix could have helped fix failing tasks for this run, but Self-healing CI is disabled for this workspace. Visit workspace settings to enable it and get automatic fixes in future runs.

To disable these notifications, a workspace admin can disable them in workspace settings.


View your CI Pipeline Execution ↗ for commit 8e3e81b

Command Status Duration Result
nx affected --targets=test:eslint,test:sherif,t... ❌ Failed 2m 23s View ↗
nx run-many --targets=build --exclude=examples/** ✅ Succeeded 36s View ↗

☁️ Nx Cloud last updated this comment at 2026-03-25 21:56:37 UTC

@pkg-pr-new
Copy link

pkg-pr-new bot commented Dec 15, 2025

More templates

@tanstack/devtools

npm i https://pkg.pr.new/@tanstack/devtools@290

@tanstack/devtools-a11y

npm i https://pkg.pr.new/@tanstack/devtools-a11y@290

@tanstack/devtools-client

npm i https://pkg.pr.new/@tanstack/devtools-client@290

@tanstack/devtools-ui

npm i https://pkg.pr.new/@tanstack/devtools-ui@290

@tanstack/devtools-utils

npm i https://pkg.pr.new/@tanstack/devtools-utils@290

@tanstack/devtools-vite

npm i https://pkg.pr.new/@tanstack/devtools-vite@290

@tanstack/devtools-event-bus

npm i https://pkg.pr.new/@tanstack/devtools-event-bus@290

@tanstack/devtools-event-client

npm i https://pkg.pr.new/@tanstack/devtools-event-client@290

@tanstack/preact-devtools

npm i https://pkg.pr.new/@tanstack/preact-devtools@290

@tanstack/react-devtools

npm i https://pkg.pr.new/@tanstack/react-devtools@290

@tanstack/solid-devtools

npm i https://pkg.pr.new/@tanstack/solid-devtools@290

@tanstack/vue-devtools

npm i https://pkg.pr.new/@tanstack/vue-devtools@290

commit: 8e3e81b

@renovate renovate bot force-pushed the renovate/all-minor-patch branch 26 times, most recently from 8f5167e to 09c56be Compare December 20, 2025 17:05
@renovate renovate bot force-pushed the renovate/all-minor-patch branch 23 times, most recently from e861232 to 4b90eb1 Compare December 30, 2025 21:54
@coderabbitai
Copy link

coderabbitai bot commented Mar 13, 2026

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

  • @coderabbitai resume to resume automatic reviews.
  • @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

  • ▶️ Resume reviews
  • 🔍 Trigger review
📝 Walkthrough

Walkthrough

Updated GitHub Actions workflows and bumped dependency/devDependency versions across root, packages, and example projects; no source code logic or exported API signatures were changed.

Changes

Cohort / File(s) Summary
GitHub Actions workflows
\.github/workflows/autofix.yml, \.github/workflows/pr.yml, \.github/workflows/release.yml
Bumped actions/checkout from v6.0.1v6.0.2. release.yml also updated changesets/action to v1.7.0 and added commit/title and GITHUB_TOKEN to the Run Changesets step.
Root workspace
package.json
Updated packageManager to pnpm@10.32.1 and bumped numerous devDependencies (changesets CLI, eslint, nx, typescript, vite, tooling configs, testing and linting tools).
Core devtools packages
packages/devtools/package.json, packages/devtools-ui/package.json, packages/devtools-utils/package.json, packages/devtools-vite/package.json, packages/event-bus/package.json
Runtime and tooling dependency bumps (solid-js, goober, dayjs, ws, tsup, vite-plugin-solid, Babel libs, launch-editor, etc.).
Framework-specific devtools
packages/preact-devtools/package.json, packages/react-devtools/package.json, packages/solid-devtools/package.json, packages/vue-devtools/package.json
Updated framework/runtime and tooling versions (preact, react, solid-js, vue, typings, Vite plugins, eslint plugin for Vue).
Examples — React
examples/react/.../package.json
Wide dependency upgrades across TanStack packages, React, react-dom, typings, Vite plugins and other tooling; consistent version bumps across many React examples (including specialized examples like drizzle, start, bundling-repro).
Examples — Solid / Preact / Vue
examples/solid/.../package.json, examples/preact/.../package.json, examples/vue/basic/package.json
Framework and tooling version bumps (solid-js, @solidjs/start, preact, vite, vite-plugin-solid, @vitejs/plugin-vue, @tanstack/vue-query, etc.).
Misc examples & smaller bumps
examples/preact/.../package.json, examples/.../*
Smaller dependency/devDependency increments in other example projects (zod, sonda, vite, vite plugins, sonda, tailwind-related, zustand, drizzle tooling).

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Poem

🐰 I hopped through versions, bright and quick,
nudged checkout, bumped a patch or tick.
Examples polished, workflows tuned,
tiny hops and changes pruned. 🥕

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Description check ⚠️ Warning PR description is auto-generated by Renovate and contains a comprehensive dependency update table with version changes, release notes, and configuration details, but lacks required sections from the template. Add the required sections: '## 🎯 Changes' with clear summary, '## ✅ Checklist' with items checked, and '## 🚀 Release Impact' with changeset information or docs-only confirmation.
✅ Passed checks (2 passed)
Check name Status Explanation
Title check ✅ Passed Title accurately describes the PR's primary objective: updating all non-major dependencies across the repository.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch renovate/all-minor-patch

Comment @coderabbitai help to get the list of available commands and usage tips.

Copy link

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick comments (1)
examples/react/bundling-repro/package.json (1)

18-26: Consider pinning @tanstack/ai-* packages to specific versions.

Using "latest" for these AI packages means builds are non-reproducible and could break unexpectedly when new versions are published. While acceptable for a repro/debugging example, consider pinning to specific versions if this example is used for CI or regression testing.

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@examples/react/bundling-repro/package.json` around lines 18 - 26, The
package.json currently pins multiple `@tanstack/ai` packages to "latest" which
makes builds unreproducible; replace the "latest" specifiers for "@tanstack/ai",
"@tanstack/ai-anthropic", "@tanstack/ai-client", "@tanstack/ai-gemini",
"@tanstack/ai-ollama", "@tanstack/ai-openai", "@tanstack/ai-react",
"@tanstack/react-ai-devtools", and "@tanstack/react-devtools" with concrete
version numbers (choose a specific semver like "^X.Y.Z" or an exact "X.Y.Z") to
lock dependencies for CI/regression tests and update the lockfile accordingly.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In `@examples/react/bundling-repro/package.json`:
- Around line 18-26: The package.json currently pins multiple `@tanstack/ai`
packages to "latest" which makes builds unreproducible; replace the "latest"
specifiers for "@tanstack/ai", "@tanstack/ai-anthropic", "@tanstack/ai-client",
"@tanstack/ai-gemini", "@tanstack/ai-ollama", "@tanstack/ai-openai",
"@tanstack/ai-react", "@tanstack/react-ai-devtools", and
"@tanstack/react-devtools" with concrete version numbers (choose a specific
semver like "^X.Y.Z" or an exact "X.Y.Z") to lock dependencies for CI/regression
tests and update the lockfile accordingly.

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: de66d22c-d3cb-4f54-a7b2-387035694052

📥 Commits

Reviewing files that changed from the base of the PR and between a120650 and 11e75ba.

⛔ Files ignored due to path filters (1)
  • pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml
📒 Files selected for processing (26)
  • .github/workflows/autofix.yml
  • .github/workflows/pr.yml
  • .github/workflows/release.yml
  • examples/preact/basic/package.json
  • examples/preact/custom-devtools/package.json
  • examples/react/basic/package.json
  • examples/react/bundling-repro/package.json
  • examples/react/custom-devtools/package.json
  • examples/react/drizzle/package.json
  • examples/react/https/package.json
  • examples/react/start/package.json
  • examples/react/time-travel/package.json
  • examples/solid/basic/package.json
  • examples/solid/devtools-ui/package.json
  • examples/solid/start/package.json
  • examples/vue/basic/package.json
  • package.json
  • packages/devtools-ui/package.json
  • packages/devtools-utils/package.json
  • packages/devtools-vite/package.json
  • packages/devtools/package.json
  • packages/event-bus/package.json
  • packages/preact-devtools/package.json
  • packages/react-devtools/package.json
  • packages/solid-devtools/package.json
  • packages/vue-devtools/package.json

Copy link

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Inline comments:
In @.github/workflows/release.yml:
- Line 26: Replace mutable action references like uses: actions/checkout@v6.0.2
with the immutable commit SHA form (e.g., uses:
actions/checkout@<FULL_COMMIT_SHA>) while preserving the human-friendly tag as a
trailing comment (e.g., # v6.0.2) to maintain readability; update the checkout
usages in the release workflow (the uses: actions/checkout entries) and apply
the same SHA-pinning pattern to the checkout actions referenced in pr.yml (the
uses: actions/checkout entries on the other specified lines).

In `@package.json`:
- Around line 62-65: The `@tanstack` package upgrades introduce breaking changes:
update our build/docs configs accordingly by (1) in typedoc-related code/configs
(search for any Typedoc config files or usages that expect lower-cased output)
remove or adjust any post-processing that lower-cases Typedoc output and ensure
templates/consumers accept the new casing produced by `@tanstack/typedoc-config`
v0.3.3, and (2) in vite.config.ts (look for references to viteConfig or imports
from `@tanstack/vite-config`) migrate the old viteConfig usage to the new shape:
upgrade to Vite 8+ if not already and replace viteConfig options with
rolldownOptions and use the new native resolve.tsconfigPaths behavior (update
imports, option names, and any tsconfig path resolution code). Make these
changes where viteConfig and Typedoc config objects are defined so the project
builds and docs generate correctly with the new `@tanstack` versions.

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 3e3729bd-9872-4d23-b9a5-164d848e5c26

📥 Commits

Reviewing files that changed from the base of the PR and between 11e75ba and b24a560.

⛔ Files ignored due to path filters (1)
  • pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml
📒 Files selected for processing (26)
  • .github/workflows/autofix.yml
  • .github/workflows/pr.yml
  • .github/workflows/release.yml
  • examples/preact/basic/package.json
  • examples/preact/custom-devtools/package.json
  • examples/react/basic/package.json
  • examples/react/bundling-repro/package.json
  • examples/react/custom-devtools/package.json
  • examples/react/drizzle/package.json
  • examples/react/https/package.json
  • examples/react/start/package.json
  • examples/react/time-travel/package.json
  • examples/solid/basic/package.json
  • examples/solid/devtools-ui/package.json
  • examples/solid/start/package.json
  • examples/vue/basic/package.json
  • package.json
  • packages/devtools-ui/package.json
  • packages/devtools-utils/package.json
  • packages/devtools-vite/package.json
  • packages/devtools/package.json
  • packages/event-bus/package.json
  • packages/preact-devtools/package.json
  • packages/react-devtools/package.json
  • packages/solid-devtools/package.json
  • packages/vue-devtools/package.json
🚧 Files skipped from review as they are similar to previous changes (17)
  • examples/react/time-travel/package.json
  • packages/preact-devtools/package.json
  • packages/devtools/package.json
  • packages/devtools-ui/package.json
  • packages/devtools-utils/package.json
  • packages/react-devtools/package.json
  • examples/solid/devtools-ui/package.json
  • packages/solid-devtools/package.json
  • .github/workflows/autofix.yml
  • examples/solid/basic/package.json
  • packages/vue-devtools/package.json
  • examples/react/basic/package.json
  • examples/vue/basic/package.json
  • examples/preact/basic/package.json
  • packages/devtools-vite/package.json
  • examples/preact/custom-devtools/package.json
  • examples/react/start/package.json

steps:
- name: Checkout
uses: actions/checkout@v6.0.1
uses: actions/checkout@v6.0.2
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "Unpinned GitHub Actions references in workflows:"
rg -nP '^\s*uses:\s*[^@]+@(?![0-9a-f]{40}\b)\S+' .github/workflows

echo
echo "Resolve immutable SHAs for tags touched in this PR:"
for item in "actions/checkout v6.0.2" "changesets/action v1.7.0"; do
  repo=$(awk '{print $1}' <<<"$item")
  tag=$(awk '{print $2}' <<<"$item")
  sha=$(git ls-remote --refs --tags "https://github.com/${repo}.git" \
        "refs/tags/${tag}" "refs/tags/${tag}^{}" | awk 'END{print $1}')
  printf "%s@%s -> %s\n" "$repo" "$tag" "$sha"
done

Repository: TanStack/devtools

Length of output: 1721


Pin GitHub Actions to immutable commit SHAs.

Lines 26 and 34 use mutable version tags. Pinning to full commit SHAs improves CI integrity and provenance; keep the tag as a trailing comment for readability. Apply the same pattern to all checkout actions in .github/workflows/pr.yml (lines 26, 42, and 56).

Suggested changes
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
...
-        uses: changesets/action@v1.7.0
+        uses: changesets/action@e87c8ed249971350e47fab7515075f44eb134e5b # v1.7.0
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
uses: actions/checkout@v6.0.2
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/release.yml at line 26, Replace mutable action references
like uses: actions/checkout@v6.0.2 with the immutable commit SHA form (e.g.,
uses: actions/checkout@<FULL_COMMIT_SHA>) while preserving the human-friendly
tag as a trailing comment (e.g., # v6.0.2) to maintain readability; update the
checkout usages in the release workflow (the uses: actions/checkout entries) and
apply the same SHA-pinning pattern to the checkout actions referenced in pr.yml
(the uses: actions/checkout entries on the other specified lines).

package.json Outdated
Comment on lines +62 to +65
"@tanstack/eslint-config": "0.4.0",
"@tanstack/intent": "^0.0.14",
"@tanstack/typedoc-config": "0.2.1",
"@tanstack/vite-config": "0.2.1",
"@testing-library/jest-dom": "^6.8.0",
"@tanstack/typedoc-config": "0.3.3",
"@tanstack/vite-config": "0.5.0",
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

🌐 Web query:

`What are the breaking changes (if any) between:

  1. @tanstack/eslint-config 0.3.2 -> 0.4.0
  2. @tanstack/typedoc-config 0.2.1 -> 0.3.3
  3. @tanstack/vite-config 0.2.1 -> 0.5.0
    Please cite official release notes/changelogs.`

💡 Result:

1) @tanstack/eslint-config 0.3.2 → 0.4.0

  • No explicit BREAKING change is called out in the release notes; the only noted change is: “update to @eslint/js v10”. [1]
  • However, the official docs for this config state you must have ESLint v9+ installed, which may be a practical breaking requirement if you were on ESLint 8. [2]

2) @tanstack/typedoc-config 0.2.1 → 0.3.3

  • Breaking change introduced in 0.3.0: upgrade to TypeDoc v0.28, and “typedoc output is no longer lower-cased” (marked BREAKING in the release notes). [3]
  • 0.3.3 is a patch release (“migrate to tsdown”) and does not list breaking changes. [4]

3) @tanstack/vite-config 0.2.1 → 0.5.0

  • 0.3.0: update to Vite v7 (major Vite bump; not labeled breaking in the release note, but it is a major underlying dependency change). [5]
  • 0.4.0: “support for bundling dependencies” (not labeled breaking). [6]
  • Breaking change in 0.5.0: “Bump to Vite 8 with Rolldown. Drops Vite 6/7 support. Switches to rolldownOptions and native resolve.tsconfigPaths.” [7]

Sources (official release notes/docs): GitHub Releases for TanStack/config and TanStack Config docs. [1][2][3][4][5][6][7]


Address breaking changes in upgraded @tanstack config packages before merge.

Lines 62–65 upgrade three @tanstack config packages with 0.x minor bumps that introduce breaking changes:

  • @tanstack/typedoc-config (0.2.1 → 0.3.3): Breaking change in 0.3.0 — "typedoc output is no longer lower-cased" (output format changed).
  • @tanstack/vite-config (0.2.1 → 0.5.0): Breaking change in 0.5.0 — drops support for Vite 6/7, requires Vite 8+, and switches configuration from viteConfig to rolldownOptions with native resolve.tsconfigPaths.

These upgrades require corresponding changes to the codebase configuration (especially vite.config.ts). Verify and apply necessary config adjustments before merging.

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@package.json` around lines 62 - 65, The `@tanstack` package upgrades introduce
breaking changes: update our build/docs configs accordingly by (1) in
typedoc-related code/configs (search for any Typedoc config files or usages that
expect lower-cased output) remove or adjust any post-processing that lower-cases
Typedoc output and ensure templates/consumers accept the new casing produced by
`@tanstack/typedoc-config` v0.3.3, and (2) in vite.config.ts (look for references
to viteConfig or imports from `@tanstack/vite-config`) migrate the old viteConfig
usage to the new shape: upgrade to Vite 8+ if not already and replace viteConfig
options with rolldownOptions and use the new native resolve.tsconfigPaths
behavior (update imports, option names, and any tsconfig path resolution code).
Make these changes where viteConfig and Typedoc config objects are defined so
the project builds and docs generate correctly with the new `@tanstack` versions.

Copy link

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

♻️ Duplicate comments (2)
.github/workflows/release.yml (1)

26-34: ⚠️ Potential issue | 🟠 Major

Pin GitHub Actions to immutable SHAs instead of mutable tags.

Line 26 and Line 34 still use mutable tags (v6.0.2, v1.7.0). Please pin to full commit SHAs (keep tag as inline comment) to reduce supply-chain risk. This also applies to matching checkout entries in .github/workflows/pr.yml.

#!/bin/bash
set -euo pipefail

echo "Mutable action refs in workflows:"
rg -nP '^\s*uses:\s*[^@]+@(?![0-9a-f]{40}\b)\S+' .github/workflows

echo
echo "Resolve immutable SHAs for tags touched here:"
for item in "actions/checkout v6.0.2" "changesets/action v1.7.0"; do
  repo=$(awk '{print $1}' <<<"$item")
  tag=$(awk '{print $2}' <<<"$item")
  sha=$(git ls-remote --refs --tags "https://github.com/${repo}.git" \
    "refs/tags/${tag}" "refs/tags/${tag}^{}" | awk 'END{print $1}')
  printf "%s@%s -> %s\n" "$repo" "$tag" "$sha"
done
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/release.yml around lines 26 - 34, Replace mutable action
refs with immutable commit SHAs: for each uses entry shown
(actions/checkout@v6.0.2 and changesets/action@v1.7.0, and any other mutable
refs like tanstack/config/.github/setup@main), resolve the tag to its full
40-char commit SHA (e.g., via git ls-remote or the repo's tags API) and update
the uses value to repo@<full-sha>, keeping the original tag as an inline comment
for readability; also mirror these exact SHA-pinned changes for the matching
checkout/uses entries in the pr.yml workflow so all workflow invocations use
immutable SHAs.
package.json (1)

62-65: ⚠️ Potential issue | 🟠 Major

Re-verify breaking config implications for upgraded @tanstack config packages.

Line 65 (@tanstack/vite-config@0.5.0) alongside Line 82 (vite@^7.3.1) may be incompatible depending on current config usage. Line 64 (@tanstack/typedoc-config@0.3.3) can also require doc pipeline adjustments. Please confirm required migrations are already applied before merge.

#!/bin/bash
set -euo pipefail

echo "1) Find usages of `@tanstack/vite-config` and old/new option names:"
rg -nP --type=ts --type=js --type=json \
  '@tanstack/vite-config|viteConfig|rolldownOptions|resolve\.tsconfigPaths'

echo
echo "2) Find typedoc config usage and possible output-casing assumptions:"
rg -nP --type=ts --type=js --type=json \
  '@tanstack/typedoc-config|typedoc|toLowerCase\(|lower-?case'

echo
echo "3) Show vite versions pinned across manifests:"
rg -nP '"vite"\s*:\s*"[^"]+"' --glob '**/package.json'
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@package.json` around lines 62 - 65, Upgrade of `@tanstack` packages may
introduce breaking config/name changes; re-verify and apply migrations for
`@tanstack/vite-config` (0.5.0) vs vite@^7.3.1 and `@tanstack/typedoc-config`
(0.3.3). Search the repo for usages of '@tanstack/vite-config', 'viteConfig',
'rollupOptions', and 'resolve.tsconfigPaths' and update any renamed options or
import paths in your Vite config (e.g., viteConfig-related exports), verify vite
plugin/api compatibility or pin/bump vite accordingly, and search for
'@tanstack/typedoc-config', 'typedoc' and any case-transforming assumptions
(toLowerCase / lower-case) to update the typedoc pipeline or output casing.
After making changes, run the project build/tests and lockfile update to ensure
no runtime errors and include migration notes in the PR.
🧹 Nitpick comments (1)
examples/react/bundling-repro/package.json (1)

50-65: Consider adding a engines.node field to improve tooling compatibility.

The repository and all example packages lack Node version constraints. With Vite ^7.3.1 and Wrangler ^4.73.0 in bundling-repro, and no explicit Node version pinning in CI workflows (pr.yml, release.yml), adding engines.node to the root or example package.json files would make local and CI behavior more deterministic.

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@examples/react/bundling-repro/package.json` around lines 50 - 65, Add an
engines.node field to the package.json (root or this example) to pin a supported
Node range for Vite and Wrangler; for example target the current LTS used by
those tools (e.g., Node 18.x — something like ">=18.16.0 <21") so local/dev/CI
environments are deterministic. Update the package.json containing Vite and
Wrangler (the file shown in the diff) to include that engines.node range, and
mirror that constraint in CI workflows (pr.yml, release.yml) or GitHub Actions
matrix so pipelines use a matching Node version; run the install/test matrix
locally or in CI to verify compatibility.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Duplicate comments:
In @.github/workflows/release.yml:
- Around line 26-34: Replace mutable action refs with immutable commit SHAs: for
each uses entry shown (actions/checkout@v6.0.2 and changesets/action@v1.7.0, and
any other mutable refs like tanstack/config/.github/setup@main), resolve the tag
to its full 40-char commit SHA (e.g., via git ls-remote or the repo's tags API)
and update the uses value to repo@<full-sha>, keeping the original tag as an
inline comment for readability; also mirror these exact SHA-pinned changes for
the matching checkout/uses entries in the pr.yml workflow so all workflow
invocations use immutable SHAs.

In `@package.json`:
- Around line 62-65: Upgrade of `@tanstack` packages may introduce breaking
config/name changes; re-verify and apply migrations for `@tanstack/vite-config`
(0.5.0) vs vite@^7.3.1 and `@tanstack/typedoc-config` (0.3.3). Search the repo for
usages of '@tanstack/vite-config', 'viteConfig', 'rollupOptions', and
'resolve.tsconfigPaths' and update any renamed options or import paths in your
Vite config (e.g., viteConfig-related exports), verify vite plugin/api
compatibility or pin/bump vite accordingly, and search for
'@tanstack/typedoc-config', 'typedoc' and any case-transforming assumptions
(toLowerCase / lower-case) to update the typedoc pipeline or output casing.
After making changes, run the project build/tests and lockfile update to ensure
no runtime errors and include migration notes in the PR.

---

Nitpick comments:
In `@examples/react/bundling-repro/package.json`:
- Around line 50-65: Add an engines.node field to the package.json (root or this
example) to pin a supported Node range for Vite and Wrangler; for example target
the current LTS used by those tools (e.g., Node 18.x — something like ">=18.16.0
<21") so local/dev/CI environments are deterministic. Update the package.json
containing Vite and Wrangler (the file shown in the diff) to include that
engines.node range, and mirror that constraint in CI workflows (pr.yml,
release.yml) or GitHub Actions matrix so pipelines use a matching Node version;
run the install/test matrix locally or in CI to verify compatibility.

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: e678879d-8d9a-43d3-ba5e-e0fa5aebf4bb

📥 Commits

Reviewing files that changed from the base of the PR and between b24a560 and d2763b0.

⛔ Files ignored due to path filters (1)
  • pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml
📒 Files selected for processing (26)
  • .github/workflows/autofix.yml
  • .github/workflows/pr.yml
  • .github/workflows/release.yml
  • examples/preact/basic/package.json
  • examples/preact/custom-devtools/package.json
  • examples/react/basic/package.json
  • examples/react/bundling-repro/package.json
  • examples/react/custom-devtools/package.json
  • examples/react/drizzle/package.json
  • examples/react/https/package.json
  • examples/react/start/package.json
  • examples/react/time-travel/package.json
  • examples/solid/basic/package.json
  • examples/solid/devtools-ui/package.json
  • examples/solid/start/package.json
  • examples/vue/basic/package.json
  • package.json
  • packages/devtools-ui/package.json
  • packages/devtools-utils/package.json
  • packages/devtools-vite/package.json
  • packages/devtools/package.json
  • packages/event-bus/package.json
  • packages/preact-devtools/package.json
  • packages/react-devtools/package.json
  • packages/solid-devtools/package.json
  • packages/vue-devtools/package.json
🚧 Files skipped from review as they are similar to previous changes (14)
  • examples/react/drizzle/package.json
  • examples/solid/start/package.json
  • packages/devtools-ui/package.json
  • packages/solid-devtools/package.json
  • examples/solid/basic/package.json
  • examples/vue/basic/package.json
  • packages/preact-devtools/package.json
  • packages/devtools/package.json
  • examples/react/https/package.json
  • examples/preact/custom-devtools/package.json
  • packages/event-bus/package.json
  • packages/devtools-vite/package.json
  • .github/workflows/autofix.yml
  • examples/react/custom-devtools/package.json

Copy link

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

♻️ Duplicate comments (1)
package.json (1)

62-65: ⚠️ Potential issue | 🟠 Major

Verify Vite version compatibility with @tanstack/vite-config 0.5.0.

The past review correctly identified that @tanstack/vite-config 0.5.0 requires Vite 8+ and drops support for Vite 6/7. However, this PR updates vite to ^7.3.1 (Line 82), which would be incompatible with @tanstack/vite-config 0.5.0.

Either:

  1. Upgrade vite to ^8.x to match the requirements of @tanstack/vite-config 0.5.0, or
  2. Pin @tanstack/vite-config to a version compatible with Vite 7 (e.g., 0.4.x)

Also applies to: 82-82

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@package.json` around lines 62 - 65, The package version mismatch:
"@tanstack/vite-config"@0.5.0 requires Vite 8+, but this PR sets "vite" to
"^7.3.1"; update package.json so versions are compatible by either (A) bumping
"vite" to a 8.x version (e.g., "^8.0.0") to match "@tanstack/vite-config"@0.5.0,
or (B) pinning "@tanstack/vite-config" to a Vite-7-compatible release (e.g.,
"0.4.x"); pick one approach and make the corresponding change to the dependency
entry for "vite" or "@tanstack/vite-config" so the two packages are aligned.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Duplicate comments:
In `@package.json`:
- Around line 62-65: The package version mismatch: "@tanstack/vite-config"@0.5.0
requires Vite 8+, but this PR sets "vite" to "^7.3.1"; update package.json so
versions are compatible by either (A) bumping "vite" to a 8.x version (e.g.,
"^8.0.0") to match "@tanstack/vite-config"@0.5.0, or (B) pinning
"@tanstack/vite-config" to a Vite-7-compatible release (e.g., "0.4.x"); pick one
approach and make the corresponding change to the dependency entry for "vite" or
"@tanstack/vite-config" so the two packages are aligned.

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 03c422c2-f992-4780-bceb-2f7fb298b00e

📥 Commits

Reviewing files that changed from the base of the PR and between d2763b0 and 7f1f126.

⛔ Files ignored due to path filters (1)
  • pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml
📒 Files selected for processing (29)
  • .github/workflows/autofix.yml
  • .github/workflows/pr.yml
  • .github/workflows/release.yml
  • examples/preact/basic/package.json
  • examples/preact/custom-devtools/package.json
  • examples/react/a11y-devtools/package.json
  • examples/react/basic/package.json
  • examples/react/bundling-repro/package.json
  • examples/react/custom-devtools/package.json
  • examples/react/drizzle/package.json
  • examples/react/https/package.json
  • examples/react/start/package.json
  • examples/react/time-travel/package.json
  • examples/solid/a11y-devtools/package.json
  • examples/solid/basic/package.json
  • examples/solid/devtools-ui/package.json
  • examples/solid/start/package.json
  • examples/vue/basic/package.json
  • package.json
  • packages/devtools-a11y/package.json
  • packages/devtools-ui/package.json
  • packages/devtools-utils/package.json
  • packages/devtools-vite/package.json
  • packages/devtools/package.json
  • packages/event-bus/package.json
  • packages/preact-devtools/package.json
  • packages/react-devtools/package.json
  • packages/solid-devtools/package.json
  • packages/vue-devtools/package.json
🚧 Files skipped from review as they are similar to previous changes (13)
  • packages/devtools-vite/package.json
  • packages/event-bus/package.json
  • packages/devtools-utils/package.json
  • packages/vue-devtools/package.json
  • examples/react/start/package.json
  • examples/solid/devtools-ui/package.json
  • examples/solid/start/package.json
  • examples/react/https/package.json
  • packages/devtools/package.json
  • examples/react/drizzle/package.json
  • examples/solid/basic/package.json
  • examples/preact/basic/package.json
  • packages/devtools-ui/package.json

@github-actions
Copy link
Contributor

github-actions bot commented Mar 17, 2026

🚀 Changeset Version Preview

No changeset entries found. Merging this PR will not cause a version bump for any packages.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants