From 537dff1f69d81dc1ae5b3d4fc1a5f28a93cb4339 Mon Sep 17 00:00:00 2001
From: hnton <hongocton0406@gmail.com>
Date: Mon, 28 Sep 2026 22:36:46 +0700
Subject: [PATCH 1/3] fix(table-core): guard range filter values that are not
 [min, max] tuples

---
 .changeset/guard-range-filter-tuple.md        |   5 +
 .../features/column-filtering/filterFns.ts    |  44 ++++++-
 .../tests/unit/fns/filterFns.test.ts          | 113 +++++++++++++++++-
 3 files changed, 159 insertions(+), 3 deletions(-)
 create mode 100644 .changeset/guard-range-filter-tuple.md

diff --git a/.changeset/guard-range-filter-tuple.md b/.changeset/guard-range-filter-tuple.md
new file mode 100644
index 0000000000..6ad6891b53
--- /dev/null
+++ b/.changeset/guard-range-filter-tuple.md
@@ -0,0 +1,5 @@
+---
+'@tanstack/table-core': patch
+---
+
+Guard `resolveFilterValue` in `inNumberRange` and `inDateRange` against filter values that are not `[min, max]` tuples. Previously a string was destructured per character (`'30'` became the range `[0, 3]`, filtering silently wrong) and a number, boolean or `Date` threw `TypeError: val is not iterable`. Such values now leave the range fully open and warn in development.
diff --git a/packages/table-core/src/features/column-filtering/filterFns.ts b/packages/table-core/src/features/column-filtering/filterFns.ts
index fc94971170..68f4426b0f 100644
--- a/packages/table-core/src/features/column-filtering/filterFns.ts
+++ b/packages/table-core/src/features/column-filtering/filterFns.ts
@@ -280,7 +280,9 @@ export const filterFn_betweenInclusive = constructFilterFn({
  * Filter values are normalized so blank endpoints become open-ended and
  * reversed endpoints are swapped. Only real numbers can fall inside the
  * range: non-numeric row values (`null`, `undefined`, strings, booleans)
- * never match.
+ * never match. A filter value that is not a `[min, max]` tuple leaves the
+ * range fully open (and warns in development) rather than filtering on a
+ * range read out of its characters.
  */
 export const filterFn_inNumberRange = constructFilterFn({
   filter: (dataValue: number, filterValue: [number, number]) => {
@@ -294,6 +296,10 @@ export const filterFn_inNumberRange = constructFilterFn({
     return dataValue >= min && dataValue <= max
   },
   resolveFilterValue: (val: [any, any]) => {
+    if (!isRangeTuple(val, 'inNumberRange')) {
+      return [-Infinity, Infinity] as const
+    }
+
     const [unsafeMin, unsafeMax] = val
 
     const parsedMin =
@@ -326,7 +332,10 @@ export const filterFn_inNumberRange = constructFilterFn({
  *
  * Row values and range endpoints may be `Date` objects, timestamps, or
  * parseable date strings. Blank or invalid endpoints become open-ended and
- * reversed endpoints are swapped. Rows without a valid date never match.
+ * reversed endpoints are swapped. Rows without a valid date never match. A
+ * filter value that is not a `[min, max]` tuple leaves the range fully open
+ * (and warns in development) rather than filtering on a range read out of its
+ * characters.
  */
 export const filterFn_inDateRange = constructFilterFn({
   filter: (dataValue: number, filterValue: [number, number]) => {
@@ -334,6 +343,10 @@ export const filterFn_inDateRange = constructFilterFn({
     return dataValue >= min && dataValue <= max
   },
   resolveFilterValue: (val: [any, any]) => {
+    if (!isRangeTuple(val, 'inDateRange')) {
+      return [-Infinity, Infinity] as const
+    }
+
     const [unsafeMin, unsafeMax] = val
 
     const parsedMin = toDateTimestamp(unsafeMin)
@@ -468,6 +481,33 @@ function testFalsy(val: any) {
   return val === undefined || val === null || val === ''
 }
 
+/**
+ * Guards a range filter value before it is destructured.
+ *
+ * `[any, any]` only exists at compile time: at runtime `setFilterValue()` can
+ * be handed anything. Destructuring a string splits it per character (`'30'`
+ * becomes `'3'` and `'0'`, a range nothing asked for), and destructuring a
+ * number, boolean or `Date` throws. `autoRemove` does not catch either case,
+ * since it only drops falsy values and fully blank tuples.
+ */
+function isRangeTuple(val: any, filterFnName: string): val is [any, any] {
+  if (Array.isArray(val)) {
+    return true
+  }
+
+  if (
+    typeof process !== 'undefined' &&
+    process.env.NODE_ENV === 'development'
+  ) {
+    console.warn(
+      `filterFn '${filterFnName}' expects a [min, max] tuple, received:`,
+      val,
+    )
+  }
+
+  return false
+}
+
 function testValueEmpty(dataValue: any) {
   return dataValue == null || String(dataValue).trim() === ''
 }
diff --git a/packages/table-core/tests/unit/fns/filterFns.test.ts b/packages/table-core/tests/unit/fns/filterFns.test.ts
index 8c0c359a4e..7660b2fcd8 100644
--- a/packages/table-core/tests/unit/fns/filterFns.test.ts
+++ b/packages/table-core/tests/unit/fns/filterFns.test.ts
@@ -1,4 +1,4 @@
-import { describe, expect, it, vi } from 'vitest'
+import { afterEach, describe, expect, it, vi } from 'vitest'
 import {
   columnFilteringFeature,
   constructFilterFn,
@@ -917,6 +917,58 @@ describe('Number Range Filters', () => {
       ])
     })
 
+    describe('filterFn_inNumberRange.resolveFilterValue non-tuple guard', () => {
+      const resolve = filterFn_inNumberRange.resolveFilterValue!
+
+      it('should leave the range open for a string instead of splitting it per character', () => {
+        // Destructuring `'30'` used to yield min `'3'`, max `'0'`, i.e. the
+        // range [0, 3] — a `<select>` sends strings, so this is reachable.
+        expect(resolve('30' as any)).toEqual([-Infinity, Infinity])
+        expect(resolve('7' as any)).toEqual([-Infinity, Infinity])
+        // A fresh tuple each time, so a caller writing into one cannot
+        // change what every later malformed value resolves to.
+        expect(resolve('30' as any)).not.toBe(resolve('7' as any))
+      })
+
+      it('should leave the range open for non-iterable values instead of throwing', () => {
+        expect(() => resolve(30 as any)).not.toThrow()
+        expect(resolve(30 as any)).toEqual([-Infinity, Infinity])
+        expect(resolve(new Date('2026-01-01') as any)).toEqual([
+          -Infinity,
+          Infinity,
+        ])
+        expect(resolve(true as any)).toEqual([-Infinity, Infinity])
+      })
+
+      // The guard warning only fires in development builds.
+      function spyOnDevWarnings() {
+        vi.stubEnv('NODE_ENV', 'development')
+        return vi.spyOn(console, 'warn').mockImplementation(() => {})
+      }
+
+      afterEach(() => {
+        vi.unstubAllEnvs()
+        vi.restoreAllMocks()
+      })
+
+      it('should warn once per resolve in development', () => {
+        const warn = spyOnDevWarnings()
+
+        resolve('30' as any)
+
+        expect(warn).toHaveBeenCalledTimes(1)
+        expect(warn.mock.calls[0]![0]).toContain('inNumberRange')
+      })
+
+      it('should not warn for a well-formed tuple', () => {
+        const warn = spyOnDevWarnings()
+
+        expect(resolve([29, 31])).toEqual([29, 31])
+
+        expect(warn).not.toHaveBeenCalled()
+      })
+    })
+
     it('should auto-remove only fully empty ranges', () => {
       const autoRemove = filterFn_inNumberRange.autoRemove!
 
@@ -1094,6 +1146,11 @@ describe('filterFn_empty / filterFn_notEmpty', () => {
 describe('filterFn_inDateRange', () => {
   const resolve = filterFn_inDateRange.resolveFilterValue!
 
+  afterEach(() => {
+    vi.unstubAllEnvs()
+    vi.restoreAllMocks()
+  })
+
   function makeValueRow(value: unknown) {
     const sampleTable = constructTable<typeof features, { value: unknown }>({
       features,
@@ -1114,6 +1171,26 @@ describe('filterFn_inDateRange', () => {
     ])
   })
 
+  it('leaves the range open for filter values that are not [min, max] tuples', () => {
+    // The guard warning only fires in development builds.
+    vi.stubEnv('NODE_ENV', 'development')
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+
+    // Every character used to be run through `new Date()`, so both of these
+    // resolved to the same nonsensical range around the year 2000.
+    expect(resolve('2026-06-15' as any)).toEqual([-Infinity, Infinity])
+    expect(resolve('2026' as any)).toEqual([-Infinity, Infinity])
+    // A bare Date is not iterable: destructuring it threw a TypeError.
+    expect(() => resolve(new Date('2026-01-01') as any)).not.toThrow()
+    expect(resolve(new Date('2026-01-01') as any)).toEqual([
+      -Infinity,
+      Infinity,
+    ])
+    expect(warn.mock.calls[0]![0]).toContain('inDateRange')
+    // A fresh tuple each time, as for `inNumberRange`.
+    expect(resolve('2026' as any)).not.toBe(resolve('2027' as any))
+  })
+
   it('treats blank or invalid endpoints as open-ended and swaps reversed ranges', () => {
     const min = new Date('2026-01-01')
 
@@ -1171,6 +1248,40 @@ describe('filterFn_inDateRange', () => {
   })
 })
 
+// Regression for #6078: the published ESM build keeps raw `process.env` reads,
+// so runtimes with no `process` global (a browser loading the package through
+// an import map) must not reach one. The guard's dev warning sits on exactly
+// the malformed-input path, so without the `typeof process` check it would
+// trade the old `TypeError` for a new one.
+describe('range filter guards without a `process` global', () => {
+  afterEach(() => {
+    vi.unstubAllGlobals()
+    vi.restoreAllMocks()
+  })
+
+  it.each([
+    ['inNumberRange', filterFn_inNumberRange],
+    ['inDateRange', filterFn_inDateRange],
+  ] as const)(
+    '%s leaves the range open without throwing or warning',
+    (_name, filterFn) => {
+      const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+      vi.stubGlobal('process', undefined)
+
+      const resolve = filterFn.resolveFilterValue!
+
+      expect(() => resolve('30' as any)).not.toThrow()
+      expect(resolve('30' as any)).toEqual([-Infinity, Infinity])
+      expect(resolve(30 as any)).toEqual([-Infinity, Infinity])
+      expect(resolve(new Date('2026-01-01') as any)).toEqual([
+        -Infinity,
+        Infinity,
+      ])
+      expect(warn).not.toHaveBeenCalled()
+    },
+  )
+})
+
 describe('filter fn registry', () => {
   it('registers the case-sensitive string equality filter fn', () => {
     expect(filterFns.equalsStringSensitive).toBe(filterFn_equalsStringSensitive)

From 8b267be6bcf0b347d12de88252ccb33e90e55e5c Mon Sep 17 00:00:00 2001
From: hnton <hongocton0406@gmail.com>
Date: Mon, 28 Sep 2026 23:03:21 +0700
Subject: [PATCH 2/3] fix(table-core): describe the range filter guard as
 rejecting non-arrays

The guard only checks Array.isArray, and arrays keep the endpoint handling
they had on main (`[30]` still resolves to `[30, Infinity]`). Say "not an
array" instead of "not a [min, max] tuple" in the JSDoc and changeset,
rename isRangeTuple to isRangeArray, and add a test pinning the array path.
---
 .changeset/guard-range-filter-tuple.md        |  2 +-
 .../features/column-filtering/filterFns.ts    | 20 +++++++++----------
 .../tests/unit/fns/filterFns.test.ts          | 10 ++++++++--
 3 files changed, 19 insertions(+), 13 deletions(-)

diff --git a/.changeset/guard-range-filter-tuple.md b/.changeset/guard-range-filter-tuple.md
index 6ad6891b53..5ae01d88a5 100644
--- a/.changeset/guard-range-filter-tuple.md
+++ b/.changeset/guard-range-filter-tuple.md
@@ -2,4 +2,4 @@
 '@tanstack/table-core': patch
 ---
 
-Guard `resolveFilterValue` in `inNumberRange` and `inDateRange` against filter values that are not `[min, max]` tuples. Previously a string was destructured per character (`'30'` became the range `[0, 3]`, filtering silently wrong) and a number, boolean or `Date` threw `TypeError: val is not iterable`. Such values now leave the range fully open and warn in development.
+Guard `resolveFilterValue` in `inNumberRange` and `inDateRange` against filter values that are not arrays. Previously a string was destructured per character (`'30'` became the range `[0, 3]`, filtering silently wrong) and a number, boolean or `Date` threw `TypeError: val is not iterable`. Such values now leave the range fully open and warn in development.
diff --git a/packages/table-core/src/features/column-filtering/filterFns.ts b/packages/table-core/src/features/column-filtering/filterFns.ts
index 68f4426b0f..fd733c4a8b 100644
--- a/packages/table-core/src/features/column-filtering/filterFns.ts
+++ b/packages/table-core/src/features/column-filtering/filterFns.ts
@@ -280,9 +280,9 @@ export const filterFn_betweenInclusive = constructFilterFn({
  * Filter values are normalized so blank endpoints become open-ended and
  * reversed endpoints are swapped. Only real numbers can fall inside the
  * range: non-numeric row values (`null`, `undefined`, strings, booleans)
- * never match. A filter value that is not a `[min, max]` tuple leaves the
- * range fully open (and warns in development) rather than filtering on a
- * range read out of its characters.
+ * never match. A filter value that is not an array leaves the range fully
+ * open and warns in development, instead of being split per character or
+ * throwing.
  */
 export const filterFn_inNumberRange = constructFilterFn({
   filter: (dataValue: number, filterValue: [number, number]) => {
@@ -296,7 +296,7 @@ export const filterFn_inNumberRange = constructFilterFn({
     return dataValue >= min && dataValue <= max
   },
   resolveFilterValue: (val: [any, any]) => {
-    if (!isRangeTuple(val, 'inNumberRange')) {
+    if (!isRangeArray(val, 'inNumberRange')) {
       return [-Infinity, Infinity] as const
     }
 
@@ -333,9 +333,8 @@ export const filterFn_inNumberRange = constructFilterFn({
  * Row values and range endpoints may be `Date` objects, timestamps, or
  * parseable date strings. Blank or invalid endpoints become open-ended and
  * reversed endpoints are swapped. Rows without a valid date never match. A
- * filter value that is not a `[min, max]` tuple leaves the range fully open
- * (and warns in development) rather than filtering on a range read out of its
- * characters.
+ * filter value that is not an array leaves the range fully open and warns in
+ * development, instead of being split per character or throwing.
  */
 export const filterFn_inDateRange = constructFilterFn({
   filter: (dataValue: number, filterValue: [number, number]) => {
@@ -343,7 +342,7 @@ export const filterFn_inDateRange = constructFilterFn({
     return dataValue >= min && dataValue <= max
   },
   resolveFilterValue: (val: [any, any]) => {
-    if (!isRangeTuple(val, 'inDateRange')) {
+    if (!isRangeArray(val, 'inDateRange')) {
       return [-Infinity, Infinity] as const
     }
 
@@ -488,9 +487,10 @@ function testFalsy(val: any) {
  * be handed anything. Destructuring a string splits it per character (`'30'`
  * becomes `'3'` and `'0'`, a range nothing asked for), and destructuring a
  * number, boolean or `Date` throws. `autoRemove` does not catch either case,
- * since it only drops falsy values and fully blank tuples.
+ * since it only drops falsy values and fully blank tuples. Arrays of any
+ * length pass through to the existing endpoint handling unchanged.
  */
-function isRangeTuple(val: any, filterFnName: string): val is [any, any] {
+function isRangeArray(val: any, filterFnName: string): val is Array<any> {
   if (Array.isArray(val)) {
     return true
   }
diff --git a/packages/table-core/tests/unit/fns/filterFns.test.ts b/packages/table-core/tests/unit/fns/filterFns.test.ts
index 7660b2fcd8..0e87d02c11 100644
--- a/packages/table-core/tests/unit/fns/filterFns.test.ts
+++ b/packages/table-core/tests/unit/fns/filterFns.test.ts
@@ -917,7 +917,7 @@ describe('Number Range Filters', () => {
       ])
     })
 
-    describe('filterFn_inNumberRange.resolveFilterValue non-tuple guard', () => {
+    describe('filterFn_inNumberRange.resolveFilterValue non-array guard', () => {
       const resolve = filterFn_inNumberRange.resolveFilterValue!
 
       it('should leave the range open for a string instead of splitting it per character', () => {
@@ -940,6 +940,12 @@ describe('Number Range Filters', () => {
         expect(resolve(true as any)).toEqual([-Infinity, Infinity])
       })
 
+      it('should leave arrays to the existing endpoint handling', () => {
+        // Only non-arrays are guarded. An array is read by position exactly
+        // as before, so a lone endpoint stays an open-ended range.
+        expect(resolve([30] as any)).toEqual([30, Infinity])
+      })
+
       // The guard warning only fires in development builds.
       function spyOnDevWarnings() {
         vi.stubEnv('NODE_ENV', 'development')
@@ -1171,7 +1177,7 @@ describe('filterFn_inDateRange', () => {
     ])
   })
 
-  it('leaves the range open for filter values that are not [min, max] tuples', () => {
+  it('leaves the range open for filter values that are not arrays', () => {
     // The guard warning only fires in development builds.
     vi.stubEnv('NODE_ENV', 'development')
     const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})

From dd1542ac0f2af22b9d9acbb6ac5932799209197c Mon Sep 17 00:00:00 2001
From: hnton <hongocton0406@gmail.com>
Date: Wed, 30 Sep 2026 06:37:35 +0700
Subject: [PATCH 3/3] fix(table-core): use the bare NODE_ENV check for the
 range filter warning

Bundlers replace `process.env.NODE_ENV` but not `typeof process`, which is
'undefined' in the browser, so the guarded check silenced the warning in
Vite and esbuild dev builds. Match the other dev warnings in table-core and
leave environments without a `process` global to #6078.
---
 .../features/column-filtering/filterFns.ts    |  5 +--
 .../tests/unit/fns/filterFns.test.ts          | 34 -------------------
 2 files changed, 1 insertion(+), 38 deletions(-)

diff --git a/packages/table-core/src/features/column-filtering/filterFns.ts b/packages/table-core/src/features/column-filtering/filterFns.ts
index fd733c4a8b..0ed3a7b91a 100644
--- a/packages/table-core/src/features/column-filtering/filterFns.ts
+++ b/packages/table-core/src/features/column-filtering/filterFns.ts
@@ -495,10 +495,7 @@ function isRangeArray(val: any, filterFnName: string): val is Array<any> {
     return true
   }
 
-  if (
-    typeof process !== 'undefined' &&
-    process.env.NODE_ENV === 'development'
-  ) {
+  if (process.env.NODE_ENV === 'development') {
     console.warn(
       `filterFn '${filterFnName}' expects a [min, max] tuple, received:`,
       val,
diff --git a/packages/table-core/tests/unit/fns/filterFns.test.ts b/packages/table-core/tests/unit/fns/filterFns.test.ts
index 0e87d02c11..76caab38bc 100644
--- a/packages/table-core/tests/unit/fns/filterFns.test.ts
+++ b/packages/table-core/tests/unit/fns/filterFns.test.ts
@@ -1254,40 +1254,6 @@ describe('filterFn_inDateRange', () => {
   })
 })
 
-// Regression for #6078: the published ESM build keeps raw `process.env` reads,
-// so runtimes with no `process` global (a browser loading the package through
-// an import map) must not reach one. The guard's dev warning sits on exactly
-// the malformed-input path, so without the `typeof process` check it would
-// trade the old `TypeError` for a new one.
-describe('range filter guards without a `process` global', () => {
-  afterEach(() => {
-    vi.unstubAllGlobals()
-    vi.restoreAllMocks()
-  })
-
-  it.each([
-    ['inNumberRange', filterFn_inNumberRange],
-    ['inDateRange', filterFn_inDateRange],
-  ] as const)(
-    '%s leaves the range open without throwing or warning',
-    (_name, filterFn) => {
-      const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
-      vi.stubGlobal('process', undefined)
-
-      const resolve = filterFn.resolveFilterValue!
-
-      expect(() => resolve('30' as any)).not.toThrow()
-      expect(resolve('30' as any)).toEqual([-Infinity, Infinity])
-      expect(resolve(30 as any)).toEqual([-Infinity, Infinity])
-      expect(resolve(new Date('2026-01-01') as any)).toEqual([
-        -Infinity,
-        Infinity,
-      ])
-      expect(warn).not.toHaveBeenCalled()
-    },
-  )
-})
-
 describe('filter fn registry', () => {
   it('registers the case-sensitive string equality filter fn', () => {
     expect(filterFns.equalsStringSensitive).toBe(filterFn_equalsStringSensitive)