Skip to content

chore(deps): update all non-major dependencies#290

Open
renovate[bot] wants to merge 1 commit intomainfrom
renovate/all-minor-patch
Open

chore(deps): update all non-major dependencies#290
renovate[bot] wants to merge 1 commit intomainfrom
renovate/all-minor-patch

Conversation

@renovate
Copy link
Contributor

@renovate renovate bot commented Dec 15, 2025

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence Type Update
@babel/core (source) ^7.28.4^7.29.0 age confidence dependencies minor
@babel/generator (source) ^7.28.3^7.29.1 age confidence dependencies minor
@babel/parser (source) ^7.28.4^7.29.0 age confidence dependencies minor
@babel/traverse (source) ^7.28.4^7.29.0 age confidence dependencies minor
@babel/types (source) ^7.28.4^7.29.0 age confidence dependencies minor
@biomejs/biome (source) 2.2.42.4.7 age confidence devDependencies minor
@changesets/cli (source) ^2.29.7^2.30.0 age confidence devDependencies minor
@cloudflare/vite-plugin (source) ^1.13.8^1.28.0 age confidence dependencies minor
@preact/preset-vite ^2.10.2^2.10.3 age confidence devDependencies patch
@solid-primitives/event-listener (source) ^2.4.3^2.4.5 age confidence dependencies patch
@solid-primitives/keyboard (source) ^1.3.3^1.3.5 age confidence dependencies patch
@solid-primitives/resize-observer (source) ^2.1.3^2.1.5 age confidence dependencies patch
@solidjs/start (source) ^1.2.0^1.3.2 age confidence dependencies minor
@tailwindcss/vite (source) ^4.0.6^4.2.1 age confidence dependencies minor
@tanstack/eslint-config (source) 0.3.20.4.0 age confidence devDependencies minor
@tanstack/intent ^0.0.14^0.0.19 age confidence devDependencies patch
@tanstack/react-form (source) ^1.23.7^1.28.5 age confidence dependencies patch
@tanstack/react-form-devtools (source) ^0.1.7^0.2.18 age confidence devDependencies minor
@tanstack/react-query (source) ^5.90.1^5.90.21 age confidence dependencies patch
@tanstack/react-query-devtools (source) ^5.90.1^5.91.3 age confidence dependencies patch
@tanstack/react-router (source) ^1.132.0^1.166.8 age confidence dependencies minor
@tanstack/react-router-devtools (source) ^1.132.0^1.166.7 age confidence dependencies minor
@tanstack/react-router-ssr-query (source) ^1.131.7^1.166.7 age confidence dependencies minor
@tanstack/react-start (source) ^1.132.0^1.166.9 age confidence dependencies minor
@tanstack/react-store (source) ^0.9.0^0.9.2 age confidence dependencies patch
@tanstack/router-plugin (source) ^1.132.0^1.166.8 age confidence dependencies minor
@tanstack/solid-query (source) ^5.90.1^5.90.26 age confidence dependencies patch
@tanstack/solid-query-devtools (source) ^5.90.1^5.91.3 age confidence dependencies patch
@tanstack/solid-router (source) ^1.131.50^1.166.7 age confidence dependencies minor
@tanstack/solid-router-devtools (source) ^1.131.50^1.166.7 age confidence dependencies minor
@tanstack/store (source) ^0.9.0^0.9.2 age confidence dependencies patch
@tanstack/typedoc-config (source) 0.2.10.3.3 age confidence devDependencies minor
@tanstack/vite-config (source) 0.2.10.5.0 age confidence devDependencies minor
@tanstack/vue-query (source) ^5.90.5^5.92.9 age confidence dependencies patch
@tanstack/vue-query-devtools (source) ^6.1.0^6.1.5 age confidence dependencies patch
@testing-library/dom ^10.4.0^10.4.1 age confidence devDependencies patch
@testing-library/jest-dom ^6.8.0^6.9.1 age confidence devDependencies patch
@testing-library/react ^16.2.0^16.3.2 age confidence devDependencies patch
@types/react (source) ^19.2.0^19.2.14 age confidence devDependencies patch
@types/react (source) ^19.2.0^19.2.14 age confidence devDependencies patch
@types/react-dom (source) ^19.2.0^19.2.3 age confidence devDependencies patch
@vitejs/plugin-react (source) ^5.0.4^5.2.0 age confidence devDependencies minor
@vitejs/plugin-vue (source) ^6.0.1^6.0.5 age confidence devDependencies patch
actions/checkout v6.0.1v6.0.2 age confidence action patch
axe-core (source) ^4.10.0^4.11.1 age confidence dependencies patch
changesets/action v1.5.3v1.7.0 age confidence action minor
dayjs (source) ^1.11.19^1.11.20 age confidence dependencies patch
drizzle-kit (source) ^0.31.4^0.31.9 age confidence devDependencies patch
drizzle-orm (source) ^0.44.5^0.45.1 age confidence devDependencies minor
eslint (source) ^9.36.0^9.39.4 age confidence devDependencies patch
eslint-plugin-unused-imports ^4.2.0^4.4.1 age confidence devDependencies minor
eslint-plugin-vue (source) ^10.5.1^10.8.0 age confidence devDependencies minor
goober ^2.1.16^2.1.18 age confidence dependencies patch
jsdom ^27.0.0^27.4.0 age confidence devDependencies patch
knip (source) ^5.64.0^5.86.0 age confidence devDependencies minor
launch-editor ^2.11.1^2.13.1 age confidence dependencies minor
lucide-react (source) ^0.561.0^0.577.0 age confidence dependencies minor
markdown-link-extractor ^4.0.2^4.0.3 age confidence devDependencies patch
nx (source) 22.1.322.5.4 age confidence devDependencies minor
pg (source) ^8.16.3^8.20.0 age confidence devDependencies minor
pnpm (source) 10.24.010.32.1 age confidence packageManager minor
preact (source) ^10.28.0^10.29.0 age confidence devDependencies minor
preact (source) ^10.28.0^10.29.0 age confidence dependencies minor
prettier-plugin-svelte ^3.4.1^3.5.1 age confidence devDependencies minor
publint (source) ^0.3.13^0.3.18 age confidence devDependencies patch
react (source) ^19.2.0^19.2.4 age confidence devDependencies patch
react (source) ^19.2.0^19.2.4 age confidence dependencies patch
react (source) ^19.2.0^19.2.4 age confidence dependencies patch
react-dom (source) ^19.2.0^19.2.4 age confidence dependencies patch
react-dom (source) ^19.2.0^19.2.4 age confidence dependencies patch
sherif ^1.7.0^1.10.0 age confidence devDependencies patch
solid-js (source) ^1.9.9^1.9.11 age confidence devDependencies patch
solid-js (source) ^1.9.9^1.9.11 age confidence dependencies patch
solid-js (source) ^1.9.9^1.9.11 age confidence dependencies patch
sonda (source) 0.9.00.11.1 age confidence devDependencies minor
streamdown (source) ^1.6.5^1.6.11 age confidence dependencies patch
tailwind-merge ^3.0.2^3.5.0 age confidence dependencies minor
tailwindcss (source) ^4.0.6^4.2.1 age confidence dependencies minor
tsup (source) ^8.5.0^8.5.1 age confidence devDependencies patch
tw-animate-css ^1.3.6^1.4.0 age confidence dependencies patch
typescript (source) ~5.9.2~5.9.3 age confidence devDependencies patch
vinxi (source) ^0.5.8^0.5.11 age confidence dependencies patch
vite (source) ^7.1.7^7.3.1 age confidence devDependencies patch
vite-plugin-mkcert ^1.17.8^1.17.10 age confidence devDependencies patch
vite-plugin-solid ^2.11.8^2.11.11 age confidence devDependencies patch
vite-tsconfig-paths ^6.0.2^6.1.1 age confidence dependencies minor
vue (source) ^3.5.22^3.5.30 age confidence devDependencies patch
vue (source) ^3.5.22^3.5.30 age confidence dependencies patch
wrangler (source) ^4.40.3^4.73.0 age confidence devDependencies minor
ws ^8.18.3^8.19.0 age confidence dependencies patch
zod (source) ^4.3.5^4.3.6 age confidence dependencies patch
zustand ^5.0.8^5.0.11 age confidence dependencies patch

Release Notes

babel/babel (@​babel/core)

v7.29.0

Compare Source

v7.29.0 (2026-01-31)

Thanks @​simbahax for your first PR!

🚀 New Feature
🐛 Bug Fix
  • babel-parser
  • babel-traverse
    • #​17708 fix(traverse): provide a hub when traversing a File or Program and no parentPath is given (@​simbahax)
  • babel-plugin-transform-block-scoping, babel-traverse
    • #​17737 [7.x backport] fix: Rename switch discriminant references when body creates shadowing variable (@​magic-akari)
🏃‍♀️ Performance
Committers: 6
babel/babel (@​babel/generator)

v7.29.1

Compare Source

v7.29.0

Compare Source

v7.29.0 (2026-01-31)

Thanks @​simbahax for your first PR!

🚀 New Feature
🐛 Bug Fix
  • babel-parser
  • babel-traverse
    • #​17708 fix(traverse): provide a hub when traversing a File or Program and no parentPath is given (@​simbahax)
  • babel-plugin-transform-block-scoping, babel-traverse
    • #​17737 [7.x backport] fix: Rename switch discriminant references when body creates shadowing variable (@​magic-akari)
🏃‍♀️ Performance
Committers: 6
biomejs/biome (@​biomejs/biome)

v2.4.7

Compare Source

Patch Changes
  • #​9318 3ac98eb Thanks @​ematipico! - Added new nursery lint rule useBaseline for CSS. The rule reports when CSS properties, property values, at-rules, media conditions, functions, or pseudo-selectors are not part of the configured Baseline tier.

    For example, at the time of writing, the rule will trigger for the use of accent-color because it has limited availability:

    a {
      accent-color: bar;
    }
  • #​9272 2de8362 Thanks @​terror! - Added the nursery rule useImportsFirst that enforces all import statements appear before any non-import statements in a module. Inspired by the eslint-plugin-import import/first rule.

    // Invalid
    import { foo } from "foo";
    const bar = 1;
    import { baz } from "baz"; // ← flagged
    
    // Valid
    import { foo } from "foo";
    import { baz } from "baz";
    const bar = 1;
  • #​9285 93ea495 Thanks @​dyc3! - Fixed noUndeclaredVariables from erroneously flagging props only used in the template section in Vue SFCs

  • #​9435 6c5a8f2 Thanks @​siketyan! - Fixed #​9432: Values referenced as a JSX element in Astro/Vue/Svelte templates are now correctly detected; noUnusedImports and useImportType rules no longer reports these values as false positives.

  • #​9362 fc9ca4c Thanks @​Netail! - Extra rule source references. biome migrate eslint should do a bit better detecting rules in your eslint configurations.

  • #​9392 b881fea Thanks @​g-ortuno! - Fixed biomejs/biome-vscode#959: LSP now correctly resolves project directory when configurationPath points to a configuration file outside the workspace.

  • #​9420 a1c46af Thanks @​ematipico! - Fixed #​9385: noUselessEscapeInString no longer incorrectly flags valid CSS hex escapes (e.g. \e7bb) as useless. The rule now recognizes all hex digits (0-9, a-f, A-F) as valid escape characters in CSS strings.

  • #​9416 f2581b8 Thanks @​ematipico! - Fixed #​9131, #​9112, #​9166: the formatter no longer crashes or produces corrupt output when a JS file with experimentalEmbeddedSnippetsEnabled contains non-embedded template literals alongside embedded ones (e.g. console.log(\test`)next tographql(`...`)`).

  • #​9344 cb4d7d7 Thanks @​ematipico! - Fixed #​6921: noShadow no longer incorrectly flags destructured variable bindings in sibling scopes as shadowing. Object destructuring, array destructuring, nested patterns, and rest elements are now properly recognized as declarations.

  • #​9360 bc5dd99 Thanks @​ematipico! - Fixed #​7125: The rule noShadow no longer incorrectly flags parameters in TypeScript constructor and method overload signatures.

  • #​9371 29cac17 Thanks @​ematipico! - Fixed #​5279: Tabs in diagnostic diff output are now rendered at a consistent width across context and changed lines, fixing visual misalignment when source files use tab indentation.

  • #​9043 61e2a02 Thanks @​dyc3! - Fixed #​8897: Biome now parses @utility names containing / when Tailwind directives are enabled.

  • #​9354 930c858 Thanks @​denbezrukov! - Improved CSS parser recovery for invalid unicode-range values that mix wildcard ranges with range intervals. For example, Biome now reports clearer diagnostics for invalid syntax like:

    unicode-range: U+11???-2??;
    unicode-range: U+11???-;

    with diagnostics such as:

    × Wildcard ranges cannot be combined with a range interval.
      > unicode-range: U+11???-2??;
                                ^
    
    × Expected a codepoint but instead found ';'.
      > unicode-range: U+11???-;
                                 ^
    
  • #​9355 78e74a2 Thanks @​SchahinRohani! - Fixed #​9349: Biome now correctly handles Vue dynamic :alt and v-bind:alt bindings in useAltText, preventing false positives in .vue files.

  • #​9369 b309dde Thanks @​costajohnt! - Fixed #​9210: useAnchorContent no longer reports an accessibility error for Astro Image components inside links when they provide non-empty alt text.

  • #​9345 70c2d4e Thanks @​ematipico! - Fixed #​7214: useOptionalChain now detects optional chain patterns that don't start at the beginning of a logical AND expression. For example, bar && foo && foo.length is now correctly flagged and fixed to bar && foo?.length.

  • #​9311 78c4e9b Thanks @​ruidosujeira! - Fixed #​9245: the useSemanticElements rule no longer suggests <output> for role="status" and role="alert". The <output> element is only a relatedConcept of these roles, not a direct semantic equivalent. These roles are now excluded from suggestions, aligning with the intended behavior of the upstream prefer-tag-over-role rule.

  • #​9363 b2ffb4a Thanks @​ematipico! - Fixed #​5212: useSemanticElements no longer reports a diagnostic when a semantic element already has its corresponding role attribute (e.g. <nav role="navigation">, <footer role="contentinfo">). These cases are now correctly left to noRedundantRoles.

  • #​9364 1bb9edc Thanks @​xvchris! - Fixed #​9357. Improved the information emitted by some diagnostics.

  • [#​


Configuration

📅 Schedule: Branch creation - Between 12:00 AM and 03:59 AM, only on Monday ( * 0-3 * * 1 ) (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@changeset-bot
Copy link

changeset-bot bot commented Dec 15, 2025

⚠️ No Changeset found

Latest commit: e3d99f3

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@nx-cloud
Copy link

nx-cloud bot commented Dec 15, 2025

🤖 Nx Cloud AI Fix Eligible

An automatically generated fix could have helped fix failing tasks for this run, but Self-healing CI is disabled for this workspace. Visit workspace settings to enable it and get automatic fixes in future runs.

To disable these notifications, a workspace admin can disable them in workspace settings.


View your CI Pipeline Execution ↗ for commit e3d99f3

Command Status Duration Result
nx affected --targets=test:eslint,test:sherif,t... ❌ Failed 1m 55s View ↗
nx run-many --targets=build --exclude=examples/** ✅ Succeeded 37s View ↗

☁️ Nx Cloud last updated this comment at 2026-03-14 01:26:35 UTC

@pkg-pr-new
Copy link

pkg-pr-new bot commented Dec 15, 2025

More templates

@tanstack/devtools

npm i https://pkg.pr.new/@tanstack/devtools@290

@tanstack/devtools-client

npm i https://pkg.pr.new/@tanstack/devtools-client@290

@tanstack/devtools-ui

npm i https://pkg.pr.new/@tanstack/devtools-ui@290

@tanstack/devtools-utils

npm i https://pkg.pr.new/@tanstack/devtools-utils@290

@tanstack/devtools-vite

npm i https://pkg.pr.new/@tanstack/devtools-vite@290

@tanstack/devtools-event-bus

npm i https://pkg.pr.new/@tanstack/devtools-event-bus@290

@tanstack/devtools-event-client

npm i https://pkg.pr.new/@tanstack/devtools-event-client@290

@tanstack/preact-devtools

npm i https://pkg.pr.new/@tanstack/preact-devtools@290

@tanstack/react-devtools

npm i https://pkg.pr.new/@tanstack/react-devtools@290

@tanstack/solid-devtools

npm i https://pkg.pr.new/@tanstack/solid-devtools@290

@tanstack/vue-devtools

npm i https://pkg.pr.new/@tanstack/vue-devtools@290

commit: 0552f14

@renovate renovate bot force-pushed the renovate/all-minor-patch branch 26 times, most recently from 8f5167e to 09c56be Compare December 20, 2025 17:05
@renovate renovate bot force-pushed the renovate/all-minor-patch branch 24 times, most recently from e861232 to 4b90eb1 Compare December 30, 2025 21:54
@coderabbitai
Copy link

coderabbitai bot commented Mar 13, 2026

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

  • @coderabbitai resume to resume automatic reviews.
  • @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

  • ▶️ Resume reviews
  • 🔍 Trigger review
📝 Walkthrough

Walkthrough

Updated GitHub Actions workflows and bumped dependency/devDependency versions across root, packages, and example projects; no source code logic or exported API signatures were changed.

Changes

Cohort / File(s) Summary
GitHub Actions workflows
\.github/workflows/autofix.yml, \.github/workflows/pr.yml, \.github/workflows/release.yml
Bumped actions/checkout from v6.0.1v6.0.2. release.yml also updated changesets/action to v1.7.0 and added commit/title and GITHUB_TOKEN to the Run Changesets step.
Root workspace
package.json
Updated packageManager to pnpm@10.32.1 and bumped numerous devDependencies (changesets CLI, eslint, nx, typescript, vite, tooling configs, testing and linting tools).
Core devtools packages
packages/devtools/package.json, packages/devtools-ui/package.json, packages/devtools-utils/package.json, packages/devtools-vite/package.json, packages/event-bus/package.json
Runtime and tooling dependency bumps (solid-js, goober, dayjs, ws, tsup, vite-plugin-solid, Babel libs, launch-editor, etc.).
Framework-specific devtools
packages/preact-devtools/package.json, packages/react-devtools/package.json, packages/solid-devtools/package.json, packages/vue-devtools/package.json
Updated framework/runtime and tooling versions (preact, react, solid-js, vue, typings, Vite plugins, eslint plugin for Vue).
Examples — React
examples/react/.../package.json
Wide dependency upgrades across TanStack packages, React, react-dom, typings, Vite plugins and other tooling; consistent version bumps across many React examples (including specialized examples like drizzle, start, bundling-repro).
Examples — Solid / Preact / Vue
examples/solid/.../package.json, examples/preact/.../package.json, examples/vue/basic/package.json
Framework and tooling version bumps (solid-js, @solidjs/start, preact, vite, vite-plugin-solid, @vitejs/plugin-vue, @tanstack/vue-query, etc.).
Misc examples & smaller bumps
examples/preact/.../package.json, examples/.../*
Smaller dependency/devDependency increments in other example projects (zod, sonda, vite, vite plugins, sonda, tailwind-related, zustand, drizzle tooling).

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Poem

🐰 I hopped through versions, bright and quick,
nudged checkout, bumped a patch or tick.
Examples polished, workflows tuned,
tiny hops and changes pruned. 🥕

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Description check ⚠️ Warning PR description is largely incomplete and truncated. Author provided only a Renovate-generated table with minimal context about the changes. Add a meaningful description explaining the purpose, scope, and impact of the dependency updates. Include information about testing and any breaking changes.
✅ Passed checks (2 passed)
Check name Status Explanation
Title check ✅ Passed Title accurately describes the PR's primary objective: updating all non-major dependencies across the repository.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
  • 📝 Generate docstrings (stacked PR)
  • 📝 Generate docstrings (commit on current branch)
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Post copyable unit tests in a comment
  • Commit unit tests in branch renovate/all-minor-patch
📝 Coding Plan
  • Generate coding plan for human review comments

Comment @coderabbitai help to get the list of available commands and usage tips.

Copy link

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick comments (1)
examples/react/bundling-repro/package.json (1)

18-26: Consider pinning @tanstack/ai-* packages to specific versions.

Using "latest" for these AI packages means builds are non-reproducible and could break unexpectedly when new versions are published. While acceptable for a repro/debugging example, consider pinning to specific versions if this example is used for CI or regression testing.

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@examples/react/bundling-repro/package.json` around lines 18 - 26, The
package.json currently pins multiple `@tanstack/ai` packages to "latest" which
makes builds unreproducible; replace the "latest" specifiers for "@tanstack/ai",
"@tanstack/ai-anthropic", "@tanstack/ai-client", "@tanstack/ai-gemini",
"@tanstack/ai-ollama", "@tanstack/ai-openai", "@tanstack/ai-react",
"@tanstack/react-ai-devtools", and "@tanstack/react-devtools" with concrete
version numbers (choose a specific semver like "^X.Y.Z" or an exact "X.Y.Z") to
lock dependencies for CI/regression tests and update the lockfile accordingly.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In `@examples/react/bundling-repro/package.json`:
- Around line 18-26: The package.json currently pins multiple `@tanstack/ai`
packages to "latest" which makes builds unreproducible; replace the "latest"
specifiers for "@tanstack/ai", "@tanstack/ai-anthropic", "@tanstack/ai-client",
"@tanstack/ai-gemini", "@tanstack/ai-ollama", "@tanstack/ai-openai",
"@tanstack/ai-react", "@tanstack/react-ai-devtools", and
"@tanstack/react-devtools" with concrete version numbers (choose a specific
semver like "^X.Y.Z" or an exact "X.Y.Z") to lock dependencies for CI/regression
tests and update the lockfile accordingly.

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: de66d22c-d3cb-4f54-a7b2-387035694052

📥 Commits

Reviewing files that changed from the base of the PR and between a120650 and 11e75ba.

⛔ Files ignored due to path filters (1)
  • pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml
📒 Files selected for processing (26)
  • .github/workflows/autofix.yml
  • .github/workflows/pr.yml
  • .github/workflows/release.yml
  • examples/preact/basic/package.json
  • examples/preact/custom-devtools/package.json
  • examples/react/basic/package.json
  • examples/react/bundling-repro/package.json
  • examples/react/custom-devtools/package.json
  • examples/react/drizzle/package.json
  • examples/react/https/package.json
  • examples/react/start/package.json
  • examples/react/time-travel/package.json
  • examples/solid/basic/package.json
  • examples/solid/devtools-ui/package.json
  • examples/solid/start/package.json
  • examples/vue/basic/package.json
  • package.json
  • packages/devtools-ui/package.json
  • packages/devtools-utils/package.json
  • packages/devtools-vite/package.json
  • packages/devtools/package.json
  • packages/event-bus/package.json
  • packages/preact-devtools/package.json
  • packages/react-devtools/package.json
  • packages/solid-devtools/package.json
  • packages/vue-devtools/package.json

Copy link

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Inline comments:
In @.github/workflows/release.yml:
- Line 26: Replace mutable action references like uses: actions/checkout@v6.0.2
with the immutable commit SHA form (e.g., uses:
actions/checkout@<FULL_COMMIT_SHA>) while preserving the human-friendly tag as a
trailing comment (e.g., # v6.0.2) to maintain readability; update the checkout
usages in the release workflow (the uses: actions/checkout entries) and apply
the same SHA-pinning pattern to the checkout actions referenced in pr.yml (the
uses: actions/checkout entries on the other specified lines).

In `@package.json`:
- Around line 62-65: The `@tanstack` package upgrades introduce breaking changes:
update our build/docs configs accordingly by (1) in typedoc-related code/configs
(search for any Typedoc config files or usages that expect lower-cased output)
remove or adjust any post-processing that lower-cases Typedoc output and ensure
templates/consumers accept the new casing produced by `@tanstack/typedoc-config`
v0.3.3, and (2) in vite.config.ts (look for references to viteConfig or imports
from `@tanstack/vite-config`) migrate the old viteConfig usage to the new shape:
upgrade to Vite 8+ if not already and replace viteConfig options with
rolldownOptions and use the new native resolve.tsconfigPaths behavior (update
imports, option names, and any tsconfig path resolution code). Make these
changes where viteConfig and Typedoc config objects are defined so the project
builds and docs generate correctly with the new `@tanstack` versions.

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 3e3729bd-9872-4d23-b9a5-164d848e5c26

📥 Commits

Reviewing files that changed from the base of the PR and between 11e75ba and b24a560.

⛔ Files ignored due to path filters (1)
  • pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml
📒 Files selected for processing (26)
  • .github/workflows/autofix.yml
  • .github/workflows/pr.yml
  • .github/workflows/release.yml
  • examples/preact/basic/package.json
  • examples/preact/custom-devtools/package.json
  • examples/react/basic/package.json
  • examples/react/bundling-repro/package.json
  • examples/react/custom-devtools/package.json
  • examples/react/drizzle/package.json
  • examples/react/https/package.json
  • examples/react/start/package.json
  • examples/react/time-travel/package.json
  • examples/solid/basic/package.json
  • examples/solid/devtools-ui/package.json
  • examples/solid/start/package.json
  • examples/vue/basic/package.json
  • package.json
  • packages/devtools-ui/package.json
  • packages/devtools-utils/package.json
  • packages/devtools-vite/package.json
  • packages/devtools/package.json
  • packages/event-bus/package.json
  • packages/preact-devtools/package.json
  • packages/react-devtools/package.json
  • packages/solid-devtools/package.json
  • packages/vue-devtools/package.json
🚧 Files skipped from review as they are similar to previous changes (17)
  • examples/react/time-travel/package.json
  • packages/preact-devtools/package.json
  • packages/devtools/package.json
  • packages/devtools-ui/package.json
  • packages/devtools-utils/package.json
  • packages/react-devtools/package.json
  • examples/solid/devtools-ui/package.json
  • packages/solid-devtools/package.json
  • .github/workflows/autofix.yml
  • examples/solid/basic/package.json
  • packages/vue-devtools/package.json
  • examples/react/basic/package.json
  • examples/vue/basic/package.json
  • examples/preact/basic/package.json
  • packages/devtools-vite/package.json
  • examples/preact/custom-devtools/package.json
  • examples/react/start/package.json

steps:
- name: Checkout
uses: actions/checkout@v6.0.1
uses: actions/checkout@v6.0.2
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "Unpinned GitHub Actions references in workflows:"
rg -nP '^\s*uses:\s*[^@]+@(?![0-9a-f]{40}\b)\S+' .github/workflows

echo
echo "Resolve immutable SHAs for tags touched in this PR:"
for item in "actions/checkout v6.0.2" "changesets/action v1.7.0"; do
  repo=$(awk '{print $1}' <<<"$item")
  tag=$(awk '{print $2}' <<<"$item")
  sha=$(git ls-remote --refs --tags "https://github.com/${repo}.git" \
        "refs/tags/${tag}" "refs/tags/${tag}^{}" | awk 'END{print $1}')
  printf "%s@%s -> %s\n" "$repo" "$tag" "$sha"
done

Repository: TanStack/devtools

Length of output: 1721


Pin GitHub Actions to immutable commit SHAs.

Lines 26 and 34 use mutable version tags. Pinning to full commit SHAs improves CI integrity and provenance; keep the tag as a trailing comment for readability. Apply the same pattern to all checkout actions in .github/workflows/pr.yml (lines 26, 42, and 56).

Suggested changes
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
...
-        uses: changesets/action@v1.7.0
+        uses: changesets/action@e87c8ed249971350e47fab7515075f44eb134e5b # v1.7.0
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
uses: actions/checkout@v6.0.2
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/release.yml at line 26, Replace mutable action references
like uses: actions/checkout@v6.0.2 with the immutable commit SHA form (e.g.,
uses: actions/checkout@<FULL_COMMIT_SHA>) while preserving the human-friendly
tag as a trailing comment (e.g., # v6.0.2) to maintain readability; update the
checkout usages in the release workflow (the uses: actions/checkout entries) and
apply the same SHA-pinning pattern to the checkout actions referenced in pr.yml
(the uses: actions/checkout entries on the other specified lines).

Comment on lines +62 to +65
"@tanstack/eslint-config": "0.4.0",
"@tanstack/intent": "^0.0.14",
"@tanstack/typedoc-config": "0.2.1",
"@tanstack/vite-config": "0.2.1",
"@testing-library/jest-dom": "^6.8.0",
"@tanstack/typedoc-config": "0.3.3",
"@tanstack/vite-config": "0.5.0",
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

🌐 Web query:

`What are the breaking changes (if any) between:

  1. @tanstack/eslint-config 0.3.2 -> 0.4.0
  2. @tanstack/typedoc-config 0.2.1 -> 0.3.3
  3. @tanstack/vite-config 0.2.1 -> 0.5.0
    Please cite official release notes/changelogs.`

💡 Result:

1) @tanstack/eslint-config 0.3.2 → 0.4.0

  • No explicit BREAKING change is called out in the release notes; the only noted change is: “update to @eslint/js v10”. [1]
  • However, the official docs for this config state you must have ESLint v9+ installed, which may be a practical breaking requirement if you were on ESLint 8. [2]

2) @tanstack/typedoc-config 0.2.1 → 0.3.3

  • Breaking change introduced in 0.3.0: upgrade to TypeDoc v0.28, and “typedoc output is no longer lower-cased” (marked BREAKING in the release notes). [3]
  • 0.3.3 is a patch release (“migrate to tsdown”) and does not list breaking changes. [4]

3) @tanstack/vite-config 0.2.1 → 0.5.0

  • 0.3.0: update to Vite v7 (major Vite bump; not labeled breaking in the release note, but it is a major underlying dependency change). [5]
  • 0.4.0: “support for bundling dependencies” (not labeled breaking). [6]
  • Breaking change in 0.5.0: “Bump to Vite 8 with Rolldown. Drops Vite 6/7 support. Switches to rolldownOptions and native resolve.tsconfigPaths.” [7]

Sources (official release notes/docs): GitHub Releases for TanStack/config and TanStack Config docs. [1][2][3][4][5][6][7]


Address breaking changes in upgraded @tanstack config packages before merge.

Lines 62–65 upgrade three @tanstack config packages with 0.x minor bumps that introduce breaking changes:

  • @tanstack/typedoc-config (0.2.1 → 0.3.3): Breaking change in 0.3.0 — "typedoc output is no longer lower-cased" (output format changed).
  • @tanstack/vite-config (0.2.1 → 0.5.0): Breaking change in 0.5.0 — drops support for Vite 6/7, requires Vite 8+, and switches configuration from viteConfig to rolldownOptions with native resolve.tsconfigPaths.

These upgrades require corresponding changes to the codebase configuration (especially vite.config.ts). Verify and apply necessary config adjustments before merging.

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@package.json` around lines 62 - 65, The `@tanstack` package upgrades introduce
breaking changes: update our build/docs configs accordingly by (1) in
typedoc-related code/configs (search for any Typedoc config files or usages that
expect lower-cased output) remove or adjust any post-processing that lower-cases
Typedoc output and ensure templates/consumers accept the new casing produced by
`@tanstack/typedoc-config` v0.3.3, and (2) in vite.config.ts (look for references
to viteConfig or imports from `@tanstack/vite-config`) migrate the old viteConfig
usage to the new shape: upgrade to Vite 8+ if not already and replace viteConfig
options with rolldownOptions and use the new native resolve.tsconfigPaths
behavior (update imports, option names, and any tsconfig path resolution code).
Make these changes where viteConfig and Typedoc config objects are defined so
the project builds and docs generate correctly with the new `@tanstack` versions.

Copy link

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

♻️ Duplicate comments (2)
.github/workflows/release.yml (1)

26-34: ⚠️ Potential issue | 🟠 Major

Pin GitHub Actions to immutable SHAs instead of mutable tags.

Line 26 and Line 34 still use mutable tags (v6.0.2, v1.7.0). Please pin to full commit SHAs (keep tag as inline comment) to reduce supply-chain risk. This also applies to matching checkout entries in .github/workflows/pr.yml.

#!/bin/bash
set -euo pipefail

echo "Mutable action refs in workflows:"
rg -nP '^\s*uses:\s*[^@]+@(?![0-9a-f]{40}\b)\S+' .github/workflows

echo
echo "Resolve immutable SHAs for tags touched here:"
for item in "actions/checkout v6.0.2" "changesets/action v1.7.0"; do
  repo=$(awk '{print $1}' <<<"$item")
  tag=$(awk '{print $2}' <<<"$item")
  sha=$(git ls-remote --refs --tags "https://github.com/${repo}.git" \
    "refs/tags/${tag}" "refs/tags/${tag}^{}" | awk 'END{print $1}')
  printf "%s@%s -> %s\n" "$repo" "$tag" "$sha"
done
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/release.yml around lines 26 - 34, Replace mutable action
refs with immutable commit SHAs: for each uses entry shown
(actions/checkout@v6.0.2 and changesets/action@v1.7.0, and any other mutable
refs like tanstack/config/.github/setup@main), resolve the tag to its full
40-char commit SHA (e.g., via git ls-remote or the repo's tags API) and update
the uses value to repo@<full-sha>, keeping the original tag as an inline comment
for readability; also mirror these exact SHA-pinned changes for the matching
checkout/uses entries in the pr.yml workflow so all workflow invocations use
immutable SHAs.
package.json (1)

62-65: ⚠️ Potential issue | 🟠 Major

Re-verify breaking config implications for upgraded @tanstack config packages.

Line 65 (@tanstack/vite-config@0.5.0) alongside Line 82 (vite@^7.3.1) may be incompatible depending on current config usage. Line 64 (@tanstack/typedoc-config@0.3.3) can also require doc pipeline adjustments. Please confirm required migrations are already applied before merge.

#!/bin/bash
set -euo pipefail

echo "1) Find usages of `@tanstack/vite-config` and old/new option names:"
rg -nP --type=ts --type=js --type=json \
  '@tanstack/vite-config|viteConfig|rolldownOptions|resolve\.tsconfigPaths'

echo
echo "2) Find typedoc config usage and possible output-casing assumptions:"
rg -nP --type=ts --type=js --type=json \
  '@tanstack/typedoc-config|typedoc|toLowerCase\(|lower-?case'

echo
echo "3) Show vite versions pinned across manifests:"
rg -nP '"vite"\s*:\s*"[^"]+"' --glob '**/package.json'
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@package.json` around lines 62 - 65, Upgrade of `@tanstack` packages may
introduce breaking config/name changes; re-verify and apply migrations for
`@tanstack/vite-config` (0.5.0) vs vite@^7.3.1 and `@tanstack/typedoc-config`
(0.3.3). Search the repo for usages of '@tanstack/vite-config', 'viteConfig',
'rollupOptions', and 'resolve.tsconfigPaths' and update any renamed options or
import paths in your Vite config (e.g., viteConfig-related exports), verify vite
plugin/api compatibility or pin/bump vite accordingly, and search for
'@tanstack/typedoc-config', 'typedoc' and any case-transforming assumptions
(toLowerCase / lower-case) to update the typedoc pipeline or output casing.
After making changes, run the project build/tests and lockfile update to ensure
no runtime errors and include migration notes in the PR.
🧹 Nitpick comments (1)
examples/react/bundling-repro/package.json (1)

50-65: Consider adding a engines.node field to improve tooling compatibility.

The repository and all example packages lack Node version constraints. With Vite ^7.3.1 and Wrangler ^4.73.0 in bundling-repro, and no explicit Node version pinning in CI workflows (pr.yml, release.yml), adding engines.node to the root or example package.json files would make local and CI behavior more deterministic.

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@examples/react/bundling-repro/package.json` around lines 50 - 65, Add an
engines.node field to the package.json (root or this example) to pin a supported
Node range for Vite and Wrangler; for example target the current LTS used by
those tools (e.g., Node 18.x — something like ">=18.16.0 <21") so local/dev/CI
environments are deterministic. Update the package.json containing Vite and
Wrangler (the file shown in the diff) to include that engines.node range, and
mirror that constraint in CI workflows (pr.yml, release.yml) or GitHub Actions
matrix so pipelines use a matching Node version; run the install/test matrix
locally or in CI to verify compatibility.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Duplicate comments:
In @.github/workflows/release.yml:
- Around line 26-34: Replace mutable action refs with immutable commit SHAs: for
each uses entry shown (actions/checkout@v6.0.2 and changesets/action@v1.7.0, and
any other mutable refs like tanstack/config/.github/setup@main), resolve the tag
to its full 40-char commit SHA (e.g., via git ls-remote or the repo's tags API)
and update the uses value to repo@<full-sha>, keeping the original tag as an
inline comment for readability; also mirror these exact SHA-pinned changes for
the matching checkout/uses entries in the pr.yml workflow so all workflow
invocations use immutable SHAs.

In `@package.json`:
- Around line 62-65: Upgrade of `@tanstack` packages may introduce breaking
config/name changes; re-verify and apply migrations for `@tanstack/vite-config`
(0.5.0) vs vite@^7.3.1 and `@tanstack/typedoc-config` (0.3.3). Search the repo for
usages of '@tanstack/vite-config', 'viteConfig', 'rollupOptions', and
'resolve.tsconfigPaths' and update any renamed options or import paths in your
Vite config (e.g., viteConfig-related exports), verify vite plugin/api
compatibility or pin/bump vite accordingly, and search for
'@tanstack/typedoc-config', 'typedoc' and any case-transforming assumptions
(toLowerCase / lower-case) to update the typedoc pipeline or output casing.
After making changes, run the project build/tests and lockfile update to ensure
no runtime errors and include migration notes in the PR.

---

Nitpick comments:
In `@examples/react/bundling-repro/package.json`:
- Around line 50-65: Add an engines.node field to the package.json (root or this
example) to pin a supported Node range for Vite and Wrangler; for example target
the current LTS used by those tools (e.g., Node 18.x — something like ">=18.16.0
<21") so local/dev/CI environments are deterministic. Update the package.json
containing Vite and Wrangler (the file shown in the diff) to include that
engines.node range, and mirror that constraint in CI workflows (pr.yml,
release.yml) or GitHub Actions matrix so pipelines use a matching Node version;
run the install/test matrix locally or in CI to verify compatibility.

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: e678879d-8d9a-43d3-ba5e-e0fa5aebf4bb

📥 Commits

Reviewing files that changed from the base of the PR and between b24a560 and d2763b0.

⛔ Files ignored due to path filters (1)
  • pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml
📒 Files selected for processing (26)
  • .github/workflows/autofix.yml
  • .github/workflows/pr.yml
  • .github/workflows/release.yml
  • examples/preact/basic/package.json
  • examples/preact/custom-devtools/package.json
  • examples/react/basic/package.json
  • examples/react/bundling-repro/package.json
  • examples/react/custom-devtools/package.json
  • examples/react/drizzle/package.json
  • examples/react/https/package.json
  • examples/react/start/package.json
  • examples/react/time-travel/package.json
  • examples/solid/basic/package.json
  • examples/solid/devtools-ui/package.json
  • examples/solid/start/package.json
  • examples/vue/basic/package.json
  • package.json
  • packages/devtools-ui/package.json
  • packages/devtools-utils/package.json
  • packages/devtools-vite/package.json
  • packages/devtools/package.json
  • packages/event-bus/package.json
  • packages/preact-devtools/package.json
  • packages/react-devtools/package.json
  • packages/solid-devtools/package.json
  • packages/vue-devtools/package.json
🚧 Files skipped from review as they are similar to previous changes (14)
  • examples/react/drizzle/package.json
  • examples/solid/start/package.json
  • packages/devtools-ui/package.json
  • packages/solid-devtools/package.json
  • examples/solid/basic/package.json
  • examples/vue/basic/package.json
  • packages/preact-devtools/package.json
  • packages/devtools/package.json
  • examples/react/https/package.json
  • examples/preact/custom-devtools/package.json
  • packages/event-bus/package.json
  • packages/devtools-vite/package.json
  • .github/workflows/autofix.yml
  • examples/react/custom-devtools/package.json

Copy link

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

♻️ Duplicate comments (1)
package.json (1)

62-65: ⚠️ Potential issue | 🟠 Major

Verify Vite version compatibility with @tanstack/vite-config 0.5.0.

The past review correctly identified that @tanstack/vite-config 0.5.0 requires Vite 8+ and drops support for Vite 6/7. However, this PR updates vite to ^7.3.1 (Line 82), which would be incompatible with @tanstack/vite-config 0.5.0.

Either:

  1. Upgrade vite to ^8.x to match the requirements of @tanstack/vite-config 0.5.0, or
  2. Pin @tanstack/vite-config to a version compatible with Vite 7 (e.g., 0.4.x)

Also applies to: 82-82

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@package.json` around lines 62 - 65, The package version mismatch:
"@tanstack/vite-config"@0.5.0 requires Vite 8+, but this PR sets "vite" to
"^7.3.1"; update package.json so versions are compatible by either (A) bumping
"vite" to a 8.x version (e.g., "^8.0.0") to match "@tanstack/vite-config"@0.5.0,
or (B) pinning "@tanstack/vite-config" to a Vite-7-compatible release (e.g.,
"0.4.x"); pick one approach and make the corresponding change to the dependency
entry for "vite" or "@tanstack/vite-config" so the two packages are aligned.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Duplicate comments:
In `@package.json`:
- Around line 62-65: The package version mismatch: "@tanstack/vite-config"@0.5.0
requires Vite 8+, but this PR sets "vite" to "^7.3.1"; update package.json so
versions are compatible by either (A) bumping "vite" to a 8.x version (e.g.,
"^8.0.0") to match "@tanstack/vite-config"@0.5.0, or (B) pinning
"@tanstack/vite-config" to a Vite-7-compatible release (e.g., "0.4.x"); pick one
approach and make the corresponding change to the dependency entry for "vite" or
"@tanstack/vite-config" so the two packages are aligned.

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 03c422c2-f992-4780-bceb-2f7fb298b00e

📥 Commits

Reviewing files that changed from the base of the PR and between d2763b0 and 7f1f126.

⛔ Files ignored due to path filters (1)
  • pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml
📒 Files selected for processing (29)
  • .github/workflows/autofix.yml
  • .github/workflows/pr.yml
  • .github/workflows/release.yml
  • examples/preact/basic/package.json
  • examples/preact/custom-devtools/package.json
  • examples/react/a11y-devtools/package.json
  • examples/react/basic/package.json
  • examples/react/bundling-repro/package.json
  • examples/react/custom-devtools/package.json
  • examples/react/drizzle/package.json
  • examples/react/https/package.json
  • examples/react/start/package.json
  • examples/react/time-travel/package.json
  • examples/solid/a11y-devtools/package.json
  • examples/solid/basic/package.json
  • examples/solid/devtools-ui/package.json
  • examples/solid/start/package.json
  • examples/vue/basic/package.json
  • package.json
  • packages/devtools-a11y/package.json
  • packages/devtools-ui/package.json
  • packages/devtools-utils/package.json
  • packages/devtools-vite/package.json
  • packages/devtools/package.json
  • packages/event-bus/package.json
  • packages/preact-devtools/package.json
  • packages/react-devtools/package.json
  • packages/solid-devtools/package.json
  • packages/vue-devtools/package.json
🚧 Files skipped from review as they are similar to previous changes (13)
  • packages/devtools-vite/package.json
  • packages/event-bus/package.json
  • packages/devtools-utils/package.json
  • packages/vue-devtools/package.json
  • examples/react/start/package.json
  • examples/solid/devtools-ui/package.json
  • examples/solid/start/package.json
  • examples/react/https/package.json
  • packages/devtools/package.json
  • examples/react/drizzle/package.json
  • examples/solid/basic/package.json
  • examples/preact/basic/package.json
  • packages/devtools-ui/package.json

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants