Skip to content

chore(deps): update all non-major dependencies#290

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch
Open

chore(deps): update all non-major dependencies#290
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch

Conversation

@renovate

@renovate renovate Bot commented Dec 15, 2025

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence Type Update
@angular/build ^21.2.0^21.2.16 age confidence devDependencies patch
@angular/cli ^21.2.0^21.2.16 age confidence devDependencies patch
@angular/common (source) ^21.2.0^21.2.17 age confidence dependencies patch
@angular/compiler (source) ^21.2.0^21.2.17 age confidence dependencies patch
@angular/compiler-cli (source) ^21.2.0^21.2.17 age confidence devDependencies patch
@angular/core (source) ^21.2.0^21.2.17 age confidence devDependencies patch
@angular/core (source) ^21.2.0^21.2.17 age confidence dependencies patch
@angular/forms (source) ^21.2.0^21.2.17 age confidence dependencies patch
@angular/platform-browser (source) ^21.2.0^21.2.17 age confidence dependencies patch
@angular/router (source) ^21.2.0^21.2.17 age confidence dependencies patch
@biomejs/biome (source) 2.2.42.5.1 age confidence devDependencies minor
@changesets/cli (source) ^2.30.0^2.31.0 age confidence devDependencies patch
@cloudflare/vite-plugin (source) ^1.13.8^1.42.2 age confidence dependencies minor
@cloudflare/vite-plugin (source) ^1.13.8^1.42.2 age confidence devDependencies minor
@playwright/test (source) ^1.49.0^1.61.1 age confidence devDependencies patch
@preact/preset-vite ^2.10.3^2.10.5 age confidence devDependencies patch
@solid-primitives/event-listener (source) ^2.4.3^2.4.5 age confidence dependencies patch
@solid-primitives/keyboard (source) ^1.3.3^1.3.5 age confidence dependencies patch
@solid-primitives/resize-observer (source) ^2.1.3^2.1.5 age confidence dependencies patch
@solidjs/start (source) ^1.2.0^1.3.2 age confidence dependencies minor
@sveltejs/vite-plugin-svelte (source) ^6.0.0^6.2.4 age confidence devDependencies patch
@tailwindcss/vite (source) ^4.0.6^4.3.1 age confidence dependencies patch
@tanstack/eslint-config (source) 0.3.20.4.0 age confidence devDependencies minor
@tanstack/intent ^0.0.14^0.3.2 age confidence devDependencies minor
@tanstack/react-form (source) ^1.23.7^1.33.0 age confidence dependencies minor
@tanstack/react-form-devtools (source) ^0.1.7^0.2.29 age confidence devDependencies minor
@tanstack/react-query (source) ^5.90.1^5.101.1 age confidence dependencies minor
@tanstack/react-query-devtools (source) ^5.90.1^5.101.1 age confidence dependencies minor
@tanstack/react-router (source) ^1.132.0^1.170.16 age confidence dependencies minor
@tanstack/react-router-devtools (source) ^1.132.0^1.167.0 age confidence dependencies minor
@tanstack/react-router-ssr-query (source) ^1.131.7^1.167.1 age confidence dependencies minor
@tanstack/react-start (source) ^1.132.0^1.168.26 age confidence dependencies minor
@tanstack/react-store (source) ^0.9.0^0.11.0 age confidence dependencies minor
@tanstack/router-plugin (source) ^1.132.0^1.168.18 age confidence dependencies minor
@tanstack/solid-query (source) ^5.90.1^5.101.1 age confidence dependencies minor
@tanstack/solid-query-devtools (source) ^5.90.1^5.101.1 age confidence dependencies minor
@tanstack/solid-router (source) ^1.131.50^1.170.16 age confidence dependencies minor
@tanstack/solid-router-devtools (source) ^1.131.50^1.167.0 age confidence dependencies minor
@tanstack/store (source) ^0.9.0^0.11.0 age confidence dependencies minor
@tanstack/vite-config (source) 0.4.30.5.2 age confidence devDependencies minor
@tanstack/vue-query (source) ^5.90.5^5.101.1 age confidence dependencies minor
@tanstack/vue-query-devtools (source) ^6.1.0^6.1.35 age confidence dependencies patch
@testing-library/dom ^10.4.0^10.4.1 age confidence devDependencies patch
@testing-library/jest-dom ^6.8.0^6.9.1 age confidence devDependencies patch
@testing-library/react ^16.2.0^16.3.2 age confidence devDependencies patch
@types/picomatch (source) ^4.0.2^4.0.3 age confidence devDependencies patch
@types/react (source) ^19.2.0^19.2.17 age confidence devDependencies patch
@types/react (source) ^19.2.0^19.2.17 age confidence devDependencies patch
@types/react-dom (source) ^19.2.0^19.2.3 age confidence devDependencies patch
@vitejs/plugin-react (source) ^6.0.1^6.0.3 age confidence devDependencies patch
@vitejs/plugin-vue (source) ^6.0.1^6.0.7 age confidence devDependencies patch
actions/checkout v6.0.2v6.0.3 age confidence action patch
actions/dependency-review-action v4.3.1v4.9.0 age confidence action minor
axe-core (source) ^4.10.0^4.12.1 age confidence dependencies minor
changesets/action v1.7.0v1.9.0 age confidence action minor
dayjs (source) ^1.11.19^1.11.21 age confidence dependencies patch
drizzle-kit (source) ^0.31.4^0.31.10 age confidence devDependencies patch
drizzle-orm (source) ^0.45.0^0.45.2 age confidence devDependencies patch
eslint (source) ^9.36.0^9.39.4 age confidence devDependencies patch
eslint-plugin-react-hooks (source) ^7.0.1^7.1.1 age confidence devDependencies patch
eslint-plugin-unused-imports ^4.2.0^4.4.1 age confidence devDependencies patch
eslint-plugin-vue (source) ^10.5.1^10.9.2 age confidence devDependencies patch
goober ^2.1.16^2.1.19 age confidence dependencies patch
happy-dom ^20.0.0^20.10.6 age confidence devDependencies minor
jsdom ^27.0.0^27.4.0 age confidence devDependencies patch
knip (source) ^5.64.0^5.88.1 age confidence devDependencies patch
launch-editor ^2.11.1^2.14.1 age confidence dependencies minor
lucide-react (source) ^0.561.0^0.577.0 age confidence dependencies minor
magic-string ^0.30.0^0.30.21 age confidence dependencies patch
markdown-link-extractor ^4.0.2^4.0.3 age confidence devDependencies patch
ng-packagr ^21.2.0^21.2.5 age confidence devDependencies patch
nx (source) 22.1.322.7.6 age confidence devDependencies minor
oxc-parser (source) ^0.120.0^0.137.0 age confidence dependencies minor
pg (source) ^8.16.3^8.22.0 age confidence devDependencies minor
picomatch ^4.0.3^4.0.4 age confidence dependencies patch
pnpm (source) 11.1.111.9.0 age confidence packageManager minor
pnpm (source) >=11.0.0>=11.9.0 age confidence engines minor
preact (source) ^10.28.0^10.29.2 age confidence devDependencies patch
preact (source) ^10.28.0^10.29.2 age confidence dependencies patch
prettier (source) ^3.8.1^3.8.4 age confidence devDependencies patch
prettier-plugin-svelte ^3.4.1^3.5.2 age confidence devDependencies patch
publint (source) ^0.3.13^0.3.21 age confidence devDependencies patch
react (source) ^19.2.0^19.2.7 age confidence devDependencies patch
react (source) ^19.2.0^19.2.7 age confidence dependencies patch
react (source) ^19.2.0^19.2.7 age confidence dependencies patch
react-dom (source) ^19.2.0^19.2.7 age confidence devDependencies patch
react-dom (source) ^19.2.0^19.2.7 age confidence dependencies patch
react-dom (source) ^19.2.0^19.2.7 age confidence dependencies patch
rxjs (source) ~7.8.0~7.8.2 age confidence dependencies patch
sherif ^1.7.0^1.12.0 age confidence devDependencies minor
solid-js (source) ^1.9.9^1.9.13 age confidence devDependencies patch
solid-js (source) ^1.9.9^1.9.13 age confidence dependencies patch
solid-js (source) ^1.9.9^1.9.13 age confidence dependencies patch
sonda (source) 0.9.00.13.1 age confidence devDependencies minor
streamdown (source) ^1.6.5^1.6.11 age confidence dependencies patch
svelte (source) ^5.0.0^5.56.4 age confidence devDependencies minor
tailwind-merge ^3.0.2^3.6.0 age confidence dependencies patch
tailwindcss (source) ^4.0.6^4.3.1 age confidence dependencies patch
tinyglobby (source) ^0.2.15^0.2.17 age confidence devDependencies patch
tslib (source) ^2.3.0^2.8.1 age confidence devDependencies minor
tslib (source) ^2.3.0^2.8.1 age confidence dependencies patch
tsup (source) ^8.5.0^8.5.1 age confidence devDependencies patch
tw-animate-css ^1.3.6^1.4.0 age confidence dependencies patch
typescript (source) ~5.9.2~5.9.3 age confidence devDependencies patch
vinxi (source) ^0.5.8^0.5.11 age confidence dependencies patch
vite (source) ^8.0.0^8.1.0 age confidence devDependencies minor
vite-plugin-inspect 11.3.311.4.1 age confidence devDependencies minor
vite-plugin-mkcert ^1.17.8^1.17.12 age confidence devDependencies patch
vite-plugin-solid ^2.11.11^2.11.12 age confidence devDependencies patch
vite-tsconfig-paths ^6.0.2^6.1.1 age confidence dependencies patch
vitest (source) ^3.2.4^3.2.6 age confidence devDependencies patch
vue (source) ^3.5.22^3.5.38 age confidence devDependencies patch
vue (source) ^3.5.22^3.5.38 age confidence dependencies patch
web-vitals ^5.1.0^5.3.0 age confidence devDependencies minor
wrangler (source) ^4.40.3^4.104.0 age confidence devDependencies minor
ws ^8.18.3^8.21.0 age confidence dependencies minor
zizmorcore/zizmor-action v0.5.3v0.5.7 age confidence action patch
zod (source) ^4.3.5^4.4.3 age confidence dependencies patch
zustand ^5.0.8^5.0.14 age confidence dependencies patch

Release Notes

angular/angular-cli (@​angular/build)

v21.2.16

Compare Source

@​angular/cli
Commit Type Description
77c9047ac fix update pacote to 21.5.1
@​angular/ssr
Commit Type Description
d052e97da fix prioritize options over environment variables in AngularNodeAppEngine

v21.2.15

Compare Source

@​angular/cli
Commit Type Description
42ac0ed0f fix remove forceAuth and unscoped credential parsing
c7a7f1955 fix support registry metadata fetching under bun package manager

v21.2.14

Compare Source

@​angular/cli
Commit Type Description
aed448748 fix expand package groups for newly added peer dependencies in update schematic
@​angular/build
Commit Type Description
d46c082fb fix prevent esbuild service child process leakage

v21.2.13

Compare Source

@​angular-devkit/build-angular
Commit Type Description
[3c6d26a31](https://redirect.github.com/angular/angular-cli/commit

Note

PR body was truncated to here.


Configuration

📅 Schedule: (UTC)

  • Branch creation
    • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@changeset-bot

changeset-bot Bot commented Dec 15, 2025

Copy link
Copy Markdown

⚠️ No Changeset found

Latest commit: 346d88c

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@nx-cloud

nx-cloud Bot commented Dec 15, 2025

Copy link
Copy Markdown

🤖 Nx Cloud AI Fix Eligible

An automatically generated fix could have helped fix failing tasks for this run, but Self-healing CI is disabled for this workspace. Visit workspace settings to enable it and get automatic fixes in future runs.

To disable these notifications, a workspace admin can disable them in workspace settings.


View your CI Pipeline Execution ↗ for commit eef04b6

Command Status Duration Result
nx affected --targets=test:eslint,test:sherif,t... ❌ Failed 2m 56s View ↗
nx run-many --targets=build --exclude=examples/** ✅ Succeeded 39s View ↗

☁️ Nx Cloud last updated this comment at 2026-05-11 20:36:30 UTC

@pkg-pr-new

pkg-pr-new Bot commented Dec 15, 2025

Copy link
Copy Markdown
More templates

@tanstack/angular-devtools

npm i https://pkg.pr.new/@tanstack/angular-devtools@290

@tanstack/devtools

npm i https://pkg.pr.new/@tanstack/devtools@290

@tanstack/devtools-a11y

npm i https://pkg.pr.new/@tanstack/devtools-a11y@290

@tanstack/devtools-client

npm i https://pkg.pr.new/@tanstack/devtools-client@290

@tanstack/devtools-ui

npm i https://pkg.pr.new/@tanstack/devtools-ui@290

@tanstack/devtools-utils

npm i https://pkg.pr.new/@tanstack/devtools-utils@290

@tanstack/devtools-vite

npm i https://pkg.pr.new/@tanstack/devtools-vite@290

@tanstack/devtools-event-bus

npm i https://pkg.pr.new/@tanstack/devtools-event-bus@290

@tanstack/devtools-event-client

npm i https://pkg.pr.new/@tanstack/devtools-event-client@290

@tanstack/preact-devtools

npm i https://pkg.pr.new/@tanstack/preact-devtools@290

@tanstack/react-devtools

npm i https://pkg.pr.new/@tanstack/react-devtools@290

@tanstack/solid-devtools

npm i https://pkg.pr.new/@tanstack/solid-devtools@290

@tanstack/vue-devtools

npm i https://pkg.pr.new/@tanstack/vue-devtools@290

commit: 5aa3587

@renovate renovate Bot force-pushed the renovate/all-minor-patch branch 26 times, most recently from 8f5167e to 09c56be Compare December 20, 2025 17:05
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch 21 times, most recently from e861232 to 4b90eb1 Compare December 30, 2025 21:54
@coderabbitai

coderabbitai Bot commented Mar 13, 2026

Copy link
Copy Markdown

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

  • @coderabbitai resume to resume automatic reviews.
  • @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

  • ▶️ Resume reviews
  • 🔍 Trigger review
📝 Walkthrough

Walkthrough

Updated GitHub Actions workflows and bumped dependency/devDependency versions across root, packages, and example projects; no source code logic or exported API signatures were changed.

Changes

Cohort / File(s) Summary
GitHub Actions workflows
\.github/workflows/autofix.yml, \.github/workflows/pr.yml, \.github/workflows/release.yml
Bumped actions/checkout from v6.0.1v6.0.2. release.yml also updated changesets/action to v1.7.0 and added commit/title and GITHUB_TOKEN to the Run Changesets step.
Root workspace
package.json
Updated packageManager to pnpm@10.32.1 and bumped numerous devDependencies (changesets CLI, eslint, nx, typescript, vite, tooling configs, testing and linting tools).
Core devtools packages
packages/devtools/package.json, packages/devtools-ui/package.json, packages/devtools-utils/package.json, packages/devtools-vite/package.json, packages/event-bus/package.json
Runtime and tooling dependency bumps (solid-js, goober, dayjs, ws, tsup, vite-plugin-solid, Babel libs, launch-editor, etc.).
Framework-specific devtools
packages/preact-devtools/package.json, packages/react-devtools/package.json, packages/solid-devtools/package.json, packages/vue-devtools/package.json
Updated framework/runtime and tooling versions (preact, react, solid-js, vue, typings, Vite plugins, eslint plugin for Vue).
Examples — React
examples/react/.../package.json
Wide dependency upgrades across TanStack packages, React, react-dom, typings, Vite plugins and other tooling; consistent version bumps across many React examples (including specialized examples like drizzle, start, bundling-repro).
Examples — Solid / Preact / Vue
examples/solid/.../package.json, examples/preact/.../package.json, examples/vue/basic/package.json
Framework and tooling version bumps (solid-js, @solidjs/start, preact, vite, vite-plugin-solid, @vitejs/plugin-vue, @tanstack/vue-query, etc.).
Misc examples & smaller bumps
examples/preact/.../package.json, examples/.../*
Smaller dependency/devDependency increments in other example projects (zod, sonda, vite, vite plugins, sonda, tailwind-related, zustand, drizzle tooling).

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Poem

🐰 I hopped through versions, bright and quick,
nudged checkout, bumped a patch or tick.
Examples polished, workflows tuned,
tiny hops and changes pruned. 🥕

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Description check ⚠️ Warning PR description lacks required sections from template: missing 🎯 Changes details, incomplete ✅ Checklist, and no 🚀 Release Impact statement. Add detailed description of changes under '## 🎯 Changes', complete the checklist items with explicit selections, and specify release impact (whether changesets were generated or if this is dev-only).
✅ Passed checks (2 passed)
Check name Status Explanation
Title check ✅ Passed Title accurately describes the PR's primary objective: updating all non-major dependencies across the repository.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch renovate/all-minor-patch

Comment @coderabbitai help to get the list of available commands.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick comments (1)
examples/react/bundling-repro/package.json (1)

18-26: Consider pinning @tanstack/ai-* packages to specific versions.

Using "latest" for these AI packages means builds are non-reproducible and could break unexpectedly when new versions are published. While acceptable for a repro/debugging example, consider pinning to specific versions if this example is used for CI or regression testing.

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@examples/react/bundling-repro/package.json` around lines 18 - 26, The
package.json currently pins multiple `@tanstack/ai` packages to "latest" which
makes builds unreproducible; replace the "latest" specifiers for "@tanstack/ai",
"@tanstack/ai-anthropic", "@tanstack/ai-client", "@tanstack/ai-gemini",
"@tanstack/ai-ollama", "@tanstack/ai-openai", "@tanstack/ai-react",
"@tanstack/react-ai-devtools", and "@tanstack/react-devtools" with concrete
version numbers (choose a specific semver like "^X.Y.Z" or an exact "X.Y.Z") to
lock dependencies for CI/regression tests and update the lockfile accordingly.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In `@examples/react/bundling-repro/package.json`:
- Around line 18-26: The package.json currently pins multiple `@tanstack/ai`
packages to "latest" which makes builds unreproducible; replace the "latest"
specifiers for "@tanstack/ai", "@tanstack/ai-anthropic", "@tanstack/ai-client",
"@tanstack/ai-gemini", "@tanstack/ai-ollama", "@tanstack/ai-openai",
"@tanstack/ai-react", "@tanstack/react-ai-devtools", and
"@tanstack/react-devtools" with concrete version numbers (choose a specific
semver like "^X.Y.Z" or an exact "X.Y.Z") to lock dependencies for CI/regression
tests and update the lockfile accordingly.

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: de66d22c-d3cb-4f54-a7b2-387035694052

📥 Commits

Reviewing files that changed from the base of the PR and between a120650 and 11e75ba.

⛔ Files ignored due to path filters (1)
  • pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml
📒 Files selected for processing (26)
  • .github/workflows/autofix.yml
  • .github/workflows/pr.yml
  • .github/workflows/release.yml
  • examples/preact/basic/package.json
  • examples/preact/custom-devtools/package.json
  • examples/react/basic/package.json
  • examples/react/bundling-repro/package.json
  • examples/react/custom-devtools/package.json
  • examples/react/drizzle/package.json
  • examples/react/https/package.json
  • examples/react/start/package.json
  • examples/react/time-travel/package.json
  • examples/solid/basic/package.json
  • examples/solid/devtools-ui/package.json
  • examples/solid/start/package.json
  • examples/vue/basic/package.json
  • package.json
  • packages/devtools-ui/package.json
  • packages/devtools-utils/package.json
  • packages/devtools-vite/package.json
  • packages/devtools/package.json
  • packages/event-bus/package.json
  • packages/preact-devtools/package.json
  • packages/react-devtools/package.json
  • packages/solid-devtools/package.json
  • packages/vue-devtools/package.json

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Inline comments:
In @.github/workflows/release.yml:
- Line 26: Replace mutable action references like uses: actions/checkout@v6.0.2
with the immutable commit SHA form (e.g., uses:
actions/checkout@<FULL_COMMIT_SHA>) while preserving the human-friendly tag as a
trailing comment (e.g., # v6.0.2) to maintain readability; update the checkout
usages in the release workflow (the uses: actions/checkout entries) and apply
the same SHA-pinning pattern to the checkout actions referenced in pr.yml (the
uses: actions/checkout entries on the other specified lines).

In `@package.json`:
- Around line 62-65: The `@tanstack` package upgrades introduce breaking changes:
update our build/docs configs accordingly by (1) in typedoc-related code/configs
(search for any Typedoc config files or usages that expect lower-cased output)
remove or adjust any post-processing that lower-cases Typedoc output and ensure
templates/consumers accept the new casing produced by `@tanstack/typedoc-config`
v0.3.3, and (2) in vite.config.ts (look for references to viteConfig or imports
from `@tanstack/vite-config`) migrate the old viteConfig usage to the new shape:
upgrade to Vite 8+ if not already and replace viteConfig options with
rolldownOptions and use the new native resolve.tsconfigPaths behavior (update
imports, option names, and any tsconfig path resolution code). Make these
changes where viteConfig and Typedoc config objects are defined so the project
builds and docs generate correctly with the new `@tanstack` versions.

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 3e3729bd-9872-4d23-b9a5-164d848e5c26

📥 Commits

Reviewing files that changed from the base of the PR and between 11e75ba and b24a560.

⛔ Files ignored due to path filters (1)
  • pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml
📒 Files selected for processing (26)
  • .github/workflows/autofix.yml
  • .github/workflows/pr.yml
  • .github/workflows/release.yml
  • examples/preact/basic/package.json
  • examples/preact/custom-devtools/package.json
  • examples/react/basic/package.json
  • examples/react/bundling-repro/package.json
  • examples/react/custom-devtools/package.json
  • examples/react/drizzle/package.json
  • examples/react/https/package.json
  • examples/react/start/package.json
  • examples/react/time-travel/package.json
  • examples/solid/basic/package.json
  • examples/solid/devtools-ui/package.json
  • examples/solid/start/package.json
  • examples/vue/basic/package.json
  • package.json
  • packages/devtools-ui/package.json
  • packages/devtools-utils/package.json
  • packages/devtools-vite/package.json
  • packages/devtools/package.json
  • packages/event-bus/package.json
  • packages/preact-devtools/package.json
  • packages/react-devtools/package.json
  • packages/solid-devtools/package.json
  • packages/vue-devtools/package.json
🚧 Files skipped from review as they are similar to previous changes (17)
  • examples/react/time-travel/package.json
  • packages/preact-devtools/package.json
  • packages/devtools/package.json
  • packages/devtools-ui/package.json
  • packages/devtools-utils/package.json
  • packages/react-devtools/package.json
  • examples/solid/devtools-ui/package.json
  • packages/solid-devtools/package.json
  • .github/workflows/autofix.yml
  • examples/solid/basic/package.json
  • packages/vue-devtools/package.json
  • examples/react/basic/package.json
  • examples/vue/basic/package.json
  • examples/preact/basic/package.json
  • packages/devtools-vite/package.json
  • examples/preact/custom-devtools/package.json
  • examples/react/start/package.json

Comment thread .github/workflows/release.yml Outdated
Comment thread package.json Outdated
Comment on lines +62 to +65
"@tanstack/eslint-config": "0.4.0",
"@tanstack/intent": "^0.0.14",
"@tanstack/typedoc-config": "0.2.1",
"@tanstack/vite-config": "0.2.1",
"@testing-library/jest-dom": "^6.8.0",
"@tanstack/typedoc-config": "0.3.3",
"@tanstack/vite-config": "0.5.0",

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

🌐 Web query:

`What are the breaking changes (if any) between:

  1. @tanstack/eslint-config 0.3.2 -> 0.4.0
  2. @tanstack/typedoc-config 0.2.1 -> 0.3.3
  3. @tanstack/vite-config 0.2.1 -> 0.5.0
    Please cite official release notes/changelogs.`

💡 Result:

1) @tanstack/eslint-config 0.3.2 → 0.4.0

  • No explicit BREAKING change is called out in the release notes; the only noted change is: “update to @eslint/js v10”. [1]
  • However, the official docs for this config state you must have ESLint v9+ installed, which may be a practical breaking requirement if you were on ESLint 8. [2]

2) @tanstack/typedoc-config 0.2.1 → 0.3.3

  • Breaking change introduced in 0.3.0: upgrade to TypeDoc v0.28, and “typedoc output is no longer lower-cased” (marked BREAKING in the release notes). [3]
  • 0.3.3 is a patch release (“migrate to tsdown”) and does not list breaking changes. [4]

3) @tanstack/vite-config 0.2.1 → 0.5.0

  • 0.3.0: update to Vite v7 (major Vite bump; not labeled breaking in the release note, but it is a major underlying dependency change). [5]
  • 0.4.0: “support for bundling dependencies” (not labeled breaking). [6]
  • Breaking change in 0.5.0: “Bump to Vite 8 with Rolldown. Drops Vite 6/7 support. Switches to rolldownOptions and native resolve.tsconfigPaths.” [7]

Sources (official release notes/docs): GitHub Releases for TanStack/config and TanStack Config docs. [1][2][3][4][5][6][7]


Address breaking changes in upgraded @tanstack config packages before merge.

Lines 62–65 upgrade three @tanstack config packages with 0.x minor bumps that introduce breaking changes:

  • @tanstack/typedoc-config (0.2.1 → 0.3.3): Breaking change in 0.3.0 — "typedoc output is no longer lower-cased" (output format changed).
  • @tanstack/vite-config (0.2.1 → 0.5.0): Breaking change in 0.5.0 — drops support for Vite 6/7, requires Vite 8+, and switches configuration from viteConfig to rolldownOptions with native resolve.tsconfigPaths.

These upgrades require corresponding changes to the codebase configuration (especially vite.config.ts). Verify and apply necessary config adjustments before merging.

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@package.json` around lines 62 - 65, The `@tanstack` package upgrades introduce
breaking changes: update our build/docs configs accordingly by (1) in
typedoc-related code/configs (search for any Typedoc config files or usages that
expect lower-cased output) remove or adjust any post-processing that lower-cases
Typedoc output and ensure templates/consumers accept the new casing produced by
`@tanstack/typedoc-config` v0.3.3, and (2) in vite.config.ts (look for references
to viteConfig or imports from `@tanstack/vite-config`) migrate the old viteConfig
usage to the new shape: upgrade to Vite 8+ if not already and replace viteConfig
options with rolldownOptions and use the new native resolve.tsconfigPaths
behavior (update imports, option names, and any tsconfig path resolution code).
Make these changes where viteConfig and Typedoc config objects are defined so
the project builds and docs generate correctly with the new `@tanstack` versions.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

♻️ Duplicate comments (2)
.github/workflows/release.yml (1)

26-34: ⚠️ Potential issue | 🟠 Major

Pin GitHub Actions to immutable SHAs instead of mutable tags.

Line 26 and Line 34 still use mutable tags (v6.0.2, v1.7.0). Please pin to full commit SHAs (keep tag as inline comment) to reduce supply-chain risk. This also applies to matching checkout entries in .github/workflows/pr.yml.

#!/bin/bash
set -euo pipefail

echo "Mutable action refs in workflows:"
rg -nP '^\s*uses:\s*[^@]+@(?![0-9a-f]{40}\b)\S+' .github/workflows

echo
echo "Resolve immutable SHAs for tags touched here:"
for item in "actions/checkout v6.0.2" "changesets/action v1.7.0"; do
  repo=$(awk '{print $1}' <<<"$item")
  tag=$(awk '{print $2}' <<<"$item")
  sha=$(git ls-remote --refs --tags "https://github.com/${repo}.git" \
    "refs/tags/${tag}" "refs/tags/${tag}^{}" | awk 'END{print $1}')
  printf "%s@%s -> %s\n" "$repo" "$tag" "$sha"
done
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/release.yml around lines 26 - 34, Replace mutable action
refs with immutable commit SHAs: for each uses entry shown
(actions/checkout@v6.0.2 and changesets/action@v1.7.0, and any other mutable
refs like tanstack/config/.github/setup@main), resolve the tag to its full
40-char commit SHA (e.g., via git ls-remote or the repo's tags API) and update
the uses value to repo@<full-sha>, keeping the original tag as an inline comment
for readability; also mirror these exact SHA-pinned changes for the matching
checkout/uses entries in the pr.yml workflow so all workflow invocations use
immutable SHAs.
package.json (1)

62-65: ⚠️ Potential issue | 🟠 Major

Re-verify breaking config implications for upgraded @tanstack config packages.

Line 65 (@tanstack/vite-config@0.5.0) alongside Line 82 (vite@^7.3.1) may be incompatible depending on current config usage. Line 64 (@tanstack/typedoc-config@0.3.3) can also require doc pipeline adjustments. Please confirm required migrations are already applied before merge.

#!/bin/bash
set -euo pipefail

echo "1) Find usages of `@tanstack/vite-config` and old/new option names:"
rg -nP --type=ts --type=js --type=json \
  '@tanstack/vite-config|viteConfig|rolldownOptions|resolve\.tsconfigPaths'

echo
echo "2) Find typedoc config usage and possible output-casing assumptions:"
rg -nP --type=ts --type=js --type=json \
  '@tanstack/typedoc-config|typedoc|toLowerCase\(|lower-?case'

echo
echo "3) Show vite versions pinned across manifests:"
rg -nP '"vite"\s*:\s*"[^"]+"' --glob '**/package.json'
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@package.json` around lines 62 - 65, Upgrade of `@tanstack` packages may
introduce breaking config/name changes; re-verify and apply migrations for
`@tanstack/vite-config` (0.5.0) vs vite@^7.3.1 and `@tanstack/typedoc-config`
(0.3.3). Search the repo for usages of '@tanstack/vite-config', 'viteConfig',
'rollupOptions', and 'resolve.tsconfigPaths' and update any renamed options or
import paths in your Vite config (e.g., viteConfig-related exports), verify vite
plugin/api compatibility or pin/bump vite accordingly, and search for
'@tanstack/typedoc-config', 'typedoc' and any case-transforming assumptions
(toLowerCase / lower-case) to update the typedoc pipeline or output casing.
After making changes, run the project build/tests and lockfile update to ensure
no runtime errors and include migration notes in the PR.
🧹 Nitpick comments (1)
examples/react/bundling-repro/package.json (1)

50-65: Consider adding a engines.node field to improve tooling compatibility.

The repository and all example packages lack Node version constraints. With Vite ^7.3.1 and Wrangler ^4.73.0 in bundling-repro, and no explicit Node version pinning in CI workflows (pr.yml, release.yml), adding engines.node to the root or example package.json files would make local and CI behavior more deterministic.

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@examples/react/bundling-repro/package.json` around lines 50 - 65, Add an
engines.node field to the package.json (root or this example) to pin a supported
Node range for Vite and Wrangler; for example target the current LTS used by
those tools (e.g., Node 18.x — something like ">=18.16.0 <21") so local/dev/CI
environments are deterministic. Update the package.json containing Vite and
Wrangler (the file shown in the diff) to include that engines.node range, and
mirror that constraint in CI workflows (pr.yml, release.yml) or GitHub Actions
matrix so pipelines use a matching Node version; run the install/test matrix
locally or in CI to verify compatibility.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Duplicate comments:
In @.github/workflows/release.yml:
- Around line 26-34: Replace mutable action refs with immutable commit SHAs: for
each uses entry shown (actions/checkout@v6.0.2 and changesets/action@v1.7.0, and
any other mutable refs like tanstack/config/.github/setup@main), resolve the tag
to its full 40-char commit SHA (e.g., via git ls-remote or the repo's tags API)
and update the uses value to repo@<full-sha>, keeping the original tag as an
inline comment for readability; also mirror these exact SHA-pinned changes for
the matching checkout/uses entries in the pr.yml workflow so all workflow
invocations use immutable SHAs.

In `@package.json`:
- Around line 62-65: Upgrade of `@tanstack` packages may introduce breaking
config/name changes; re-verify and apply migrations for `@tanstack/vite-config`
(0.5.0) vs vite@^7.3.1 and `@tanstack/typedoc-config` (0.3.3). Search the repo for
usages of '@tanstack/vite-config', 'viteConfig', 'rollupOptions', and
'resolve.tsconfigPaths' and update any renamed options or import paths in your
Vite config (e.g., viteConfig-related exports), verify vite plugin/api
compatibility or pin/bump vite accordingly, and search for
'@tanstack/typedoc-config', 'typedoc' and any case-transforming assumptions
(toLowerCase / lower-case) to update the typedoc pipeline or output casing.
After making changes, run the project build/tests and lockfile update to ensure
no runtime errors and include migration notes in the PR.

---

Nitpick comments:
In `@examples/react/bundling-repro/package.json`:
- Around line 50-65: Add an engines.node field to the package.json (root or this
example) to pin a supported Node range for Vite and Wrangler; for example target
the current LTS used by those tools (e.g., Node 18.x — something like ">=18.16.0
<21") so local/dev/CI environments are deterministic. Update the package.json
containing Vite and Wrangler (the file shown in the diff) to include that
engines.node range, and mirror that constraint in CI workflows (pr.yml,
release.yml) or GitHub Actions matrix so pipelines use a matching Node version;
run the install/test matrix locally or in CI to verify compatibility.

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: e678879d-8d9a-43d3-ba5e-e0fa5aebf4bb

📥 Commits

Reviewing files that changed from the base of the PR and between b24a560 and d2763b0.

⛔ Files ignored due to path filters (1)
  • pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml
📒 Files selected for processing (26)
  • .github/workflows/autofix.yml
  • .github/workflows/pr.yml
  • .github/workflows/release.yml
  • examples/preact/basic/package.json
  • examples/preact/custom-devtools/package.json
  • examples/react/basic/package.json
  • examples/react/bundling-repro/package.json
  • examples/react/custom-devtools/package.json
  • examples/react/drizzle/package.json
  • examples/react/https/package.json
  • examples/react/start/package.json
  • examples/react/time-travel/package.json
  • examples/solid/basic/package.json
  • examples/solid/devtools-ui/package.json
  • examples/solid/start/package.json
  • examples/vue/basic/package.json
  • package.json
  • packages/devtools-ui/package.json
  • packages/devtools-utils/package.json
  • packages/devtools-vite/package.json
  • packages/devtools/package.json
  • packages/event-bus/package.json
  • packages/preact-devtools/package.json
  • packages/react-devtools/package.json
  • packages/solid-devtools/package.json
  • packages/vue-devtools/package.json
🚧 Files skipped from review as they are similar to previous changes (14)
  • examples/react/drizzle/package.json
  • examples/solid/start/package.json
  • packages/devtools-ui/package.json
  • packages/solid-devtools/package.json
  • examples/solid/basic/package.json
  • examples/vue/basic/package.json
  • packages/preact-devtools/package.json
  • packages/devtools/package.json
  • examples/react/https/package.json
  • examples/preact/custom-devtools/package.json
  • packages/event-bus/package.json
  • packages/devtools-vite/package.json
  • .github/workflows/autofix.yml
  • examples/react/custom-devtools/package.json

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

♻️ Duplicate comments (1)
package.json (1)

62-65: ⚠️ Potential issue | 🟠 Major

Verify Vite version compatibility with @tanstack/vite-config 0.5.0.

The past review correctly identified that @tanstack/vite-config 0.5.0 requires Vite 8+ and drops support for Vite 6/7. However, this PR updates vite to ^7.3.1 (Line 82), which would be incompatible with @tanstack/vite-config 0.5.0.

Either:

  1. Upgrade vite to ^8.x to match the requirements of @tanstack/vite-config 0.5.0, or
  2. Pin @tanstack/vite-config to a version compatible with Vite 7 (e.g., 0.4.x)

Also applies to: 82-82

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@package.json` around lines 62 - 65, The package version mismatch:
"@tanstack/vite-config"@0.5.0 requires Vite 8+, but this PR sets "vite" to
"^7.3.1"; update package.json so versions are compatible by either (A) bumping
"vite" to a 8.x version (e.g., "^8.0.0") to match "@tanstack/vite-config"@0.5.0,
or (B) pinning "@tanstack/vite-config" to a Vite-7-compatible release (e.g.,
"0.4.x"); pick one approach and make the corresponding change to the dependency
entry for "vite" or "@tanstack/vite-config" so the two packages are aligned.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Duplicate comments:
In `@package.json`:
- Around line 62-65: The package version mismatch: "@tanstack/vite-config"@0.5.0
requires Vite 8+, but this PR sets "vite" to "^7.3.1"; update package.json so
versions are compatible by either (A) bumping "vite" to a 8.x version (e.g.,
"^8.0.0") to match "@tanstack/vite-config"@0.5.0, or (B) pinning
"@tanstack/vite-config" to a Vite-7-compatible release (e.g., "0.4.x"); pick one
approach and make the corresponding change to the dependency entry for "vite" or
"@tanstack/vite-config" so the two packages are aligned.

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 03c422c2-f992-4780-bceb-2f7fb298b00e

📥 Commits

Reviewing files that changed from the base of the PR and between d2763b0 and 7f1f126.

⛔ Files ignored due to path filters (1)
  • pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml
📒 Files selected for processing (29)
  • .github/workflows/autofix.yml
  • .github/workflows/pr.yml
  • .github/workflows/release.yml
  • examples/preact/basic/package.json
  • examples/preact/custom-devtools/package.json
  • examples/react/a11y-devtools/package.json
  • examples/react/basic/package.json
  • examples/react/bundling-repro/package.json
  • examples/react/custom-devtools/package.json
  • examples/react/drizzle/package.json
  • examples/react/https/package.json
  • examples/react/start/package.json
  • examples/react/time-travel/package.json
  • examples/solid/a11y-devtools/package.json
  • examples/solid/basic/package.json
  • examples/solid/devtools-ui/package.json
  • examples/solid/start/package.json
  • examples/vue/basic/package.json
  • package.json
  • packages/devtools-a11y/package.json
  • packages/devtools-ui/package.json
  • packages/devtools-utils/package.json
  • packages/devtools-vite/package.json
  • packages/devtools/package.json
  • packages/event-bus/package.json
  • packages/preact-devtools/package.json
  • packages/react-devtools/package.json
  • packages/solid-devtools/package.json
  • packages/vue-devtools/package.json
🚧 Files skipped from review as they are similar to previous changes (13)
  • packages/devtools-vite/package.json
  • packages/event-bus/package.json
  • packages/devtools-utils/package.json
  • packages/vue-devtools/package.json
  • examples/react/start/package.json
  • examples/solid/devtools-ui/package.json
  • examples/solid/start/package.json
  • examples/react/https/package.json
  • packages/devtools/package.json
  • examples/react/drizzle/package.json
  • examples/solid/basic/package.json
  • examples/preact/basic/package.json
  • packages/devtools-ui/package.json

@github-actions

github-actions Bot commented Mar 17, 2026

Copy link
Copy Markdown
Contributor

🚀 Changeset Version Preview

3 package(s) bumped directly, 11 bumped as dependents.

🟨 Minor bumps

Package Version Reason
@tanstack/devtools-utils 0.4.0 → 0.5.0 Changeset

🟩 Patch bumps

Package Version Reason
@tanstack/devtools-ui 0.5.1 → 0.5.2 Changeset
@tanstack/devtools-vite 0.6.0 → 0.6.1 Changeset
@tanstack/angular-devtools 0.0.3 → 0.0.4 Dependent
@tanstack/devtools 0.12.1 → 0.12.2 Dependent
@tanstack/devtools-a11y 0.1.2 → 0.1.3 Dependent
@tanstack/devtools-example-angular-a11y-devtools 0.0.2 → 0.0.3 Dependent
@tanstack/devtools-example-angular-basic 0.0.2 → 0.0.3 Dependent
@tanstack/devtools-example-angular-panel 0.0.2 → 0.0.3 Dependent
@tanstack/devtools-example-angular-with-devtools 0.0.2 → 0.0.3 Dependent
@tanstack/preact-devtools 0.10.4 → 0.10.5 Dependent
@tanstack/react-devtools 0.10.4 → 0.10.5 Dependent
@tanstack/solid-devtools 0.8.4 → 0.8.5 Dependent
@tanstack/vue-devtools 0.2.18 → 0.2.19 Dependent

@coderabbitai

coderabbitai Bot commented Apr 21, 2026

Copy link
Copy Markdown

Only repository collaborators, contributors, or members can run CodeRabbit commands.

@renovate

renovate Bot commented May 12, 2026

Copy link
Copy Markdown
Contributor Author

⚠️ Artifact update problem

Renovate failed to update artifacts related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: pnpm-lock.yaml

<--- Last few GCs --->

[1754:0x44d40000]   147564 ms: Scavenge (interleaved) 1480.3 (1487.9) -> 1479.0 (1488.9) MB, pooled: 0 MB, 48.17 / 0.00 ms  (average mu = 0.379, current mu = 0.390) allocation failure; 
[1754:0x44d40000]   148904 ms: Mark-Compact (reduce) 1484.9 (1493.1) -> 1478.3 (1483.4) MB, pooled: 0 MB, 84.27 / 0.05 ms  (+ 1148.9 ms in 62 steps since start of marking, biggest step 31.3 ms, walltime since start of marking 1340 ms) (average mu = 0.358,
FATAL ERROR: Ineffective mark-compacts near heap limit Allocation failed - JavaScript heap out of memory
----- Native stack trace -----

 1: 0xf49c57 node::OOMErrorHandler(char const*, v8::OOMDetails const&) [/opt/containerbase/tools/node/24.8.0/bin/node]
 2: 0x13a6050 v8::Utils::ReportOOMFailure(v8::internal::Isolate*, char const*, v8::OOMDetails const&) [/opt/containerbase/tools/node/24.8.0/bin/node]
 3: 0x13a613f v8::internal::V8::FatalProcessOutOfMemory(v8::internal::Isolate*, char const*, v8::OOMDetails const&) [/opt/containerbase/tools/node/24.8.0/bin/node]
 4: 0x163ec25  [/opt/containerbase/tools/node/24.8.0/bin/node]
 5: 0x163ec52  [/opt/containerbase/tools/node/24.8.0/bin/node]
 6: 0x163ef4a v8::internal::Heap::RecomputeLimits(v8::internal::GarbageCollector, v8::base::TimeTicks) [/opt/containerbase/tools/node/24.8.0/bin/node]
 7: 0x164f46a  [/opt/containerbase/tools/node/24.8.0/bin/node]
 8: 0x1653810  [/opt/containerbase/tools/node/24.8.0/bin/node]
 9: 0x20e6641  [/opt/containerbase/tools/node/24.8.0/bin/node]
/usr/local/bin/node: line 18:  1754 Aborted                 /opt/containerbase/tools/node/24.8.0/bin/node "$@"

File name: examples/solid/start/pnpm-lock.yaml
Scope: all 46 workspace projects
? Verifying lockfile against supply-chain policies (2103 entries)...
../../..                                 | Progress: resolved 1, reused 0, downloaded 0, added 0
../../..                                 | Progress: resolved 40, reused 0, downloaded 0, added 0
../../..                                 | Progress: resolved 53, reused 0, downloaded 0, added 0
../../..                                 | Progress: resolved 54, reused 0, downloaded 0, added 0
../../..                                 | Progress: resolved 56, reused 0, downloaded 0, added 0
../../..                                 | Progress: resolved 57, reused 0, downloaded 0, added 0
../../..                                 | Progress: resolved 60, reused 0, downloaded 0, added 0
../../..                                 | Progress: resolved 72, reused 0, downloaded 0, added 0
../../..                                 | Progress: resolved 90, reused 0, downloaded 0, added 0
../../..                                 | Progress: resolved 93, reused 0, downloaded 5, added 0
../../..                                 | Progress: resolved 95, reused 0, downloaded 8, added 0
../../..                                 | Progress: resolved 95, reused 0, downloaded 9, added 0
../../..                                 | Progress: resolved 96, reused 0, downloaded 9, added 0
../../..                                 | Progress: resolved 104, reused 0, downloaded 9, added 0
../../..                                 | Progress: resolved 110, reused 0, downloaded 9, added 0
../../..                                 | Progress: resolved 118, reused 0, downloaded 9, added 0
../../..                                 | Progress: resolved 132, reused 0, downloaded 9, added 0
../../..                                 | Progress: resolved 134, reused 0, downloaded 9, added 0
../../..                                 | Progress: resolved 135, reused 0, downloaded 9, added 0
[WARN] Request took 10056ms: https://registry.npmjs.org/@tailwindcss%2Fvite
../../..                                 | Progress: resolved 136, reused 0, downloaded 9, added 0
../../..                                 | Progress: resolved 251, reused 0, downloaded 9, added 0
../../..                                 | Progress: resolved 406, reused 0, downloaded 9, added 0
../../..                                 | Progress: resolved 519, reused 0, downloaded 9, added 0
[WARN] Request took 10801ms: https://registry.npmjs.org/@tanstack%2Frouter-plugin
../../..                                 | Progress: resolved 582, reused 0, downloaded 9, added 0
../../..                                 | Progress: resolved 657, reused 0, downloaded 9, added 0
../../..                                 | Progress: resolved 674, reused 0, downloaded 9, added 0
[WARN] Request took 11901ms: https://registry.npmjs.org/@tanstack%2Freact-start
../../..                                 | Progress: resolved 678, reused 0, downloaded 9, added 0
../../..                                 | Progress: resolved 679, reused 0, downloaded 9, added 0
../../..                                 | Progress: resolved 680, reused 0, downloaded 9, added 0
../../..                                 | Progress: resolved 681, reused 0, downloaded 9, added 0
[WARN] Request took 15330ms: https://registry.npmjs.org/@tanstack%2Freact-router
../../..                                 | Progress: resolved 682, reused 0, downloaded 9, added 0
[WARN] Request took 15086ms: https://registry.npmjs.org/@nx%2Fnx-freebsd-x64
../../..                                 | Progress: resolved 683, reused 0, downloaded 9, added 0
[WARN] Request took 15786ms: https://registry.npmjs.org/rolldown
../../..                                 | Progress: resolved 684, reused 0, downloaded 9, added 0
[WARN] Request took 14918ms: https://registry.npmjs.org/@babel%2Fruntime
[WARN] Request took 17545ms: https://registry.npmjs.org/@nx%2Fnx-linux-arm-gnueabihf
../../..                                 | Progress: resolved 688, reused 0, downloaded 9, added 0
[WARN] Request took 11923ms: https://registry.npmjs.org/drizzle-kit
[WARN] Request took 18440ms: https://registry.npmjs.org/@nx%2Fnx-linux-arm64-gnu
../../..                                 | Progress: resolved 689, reused 0, downloaded 9, added 0
[WARN] Request took 20219ms: https://registry.npmjs.org/typescript-eslint
../../..                                 | Progress: resolved 690, reused 0, downloaded 9, added 0
[WARN] Request took 18381ms: https://registry.npmjs.org/@cloudflare%2Funenv-preset
[WARN] Request took 15777ms: https://registry.npmjs.org/@eslint-react%2Feff
[WARN] Request took 12009ms: https://registry.npmjs.org/lucide-react
../../..                                 | Progress: resolved 692, reused 0, downloaded 9, added 0
[WARN] Request took 20001ms: https://registry.npmjs.org/openai
../../..                                 | Progress: resolved 693, reused 0, downloaded 9, added 0
[WARN] Request took 20050ms: https://registry.npmjs.org/@tailwindcss%2Foxide
../../..                                 | Progress: resolved 694, reused 0, downloaded 9, added 0
[WARN] Request took 21069ms: https://registry.npmjs.org/use-sync-external-store
../../..                                 | Progress: resolved 695, reused 0, downloaded 9, added 0
[WARN] Request took 40547ms: https://registry.npmjs.org/@playwright%2Ftest
[WARN] Request took 16467ms: https://registry.npmjs.org/react
[WARN] Request took 16565ms: https://registry.npmjs.org/react-dom
[WARN] Request took 24877ms: https://registry.npmjs.org/scheduler
../../..                                 | Progress: resolved 696, reused 0, downloaded 9, added 0
[WARN] Request took 26669ms: https://registry.npmjs.org/miniflare
../../..                                 | Progress: resolved 697, reused 0, downloaded 9, added 0
[WARN] Request took 27380ms: https://registry.npmjs.org/rollup
../../..                                 | Progress: resolved 698, reused 0, downloaded 9, added 0
[WARN] Request took 25197ms: https://registry.npmjs.org/@eslint-react%2Fshared
../../..                                 | Progress: resolved 699, reused 0, downloaded 9, added 0
[WARN] Request took 26170ms: https://registry.npmjs.org/eslint-plugin-react-hooks-extra
[WARN] Request took 26288ms: https://registry.npmjs.org/eslint-plugin-react-web-api
[WARN] Request took 27055ms: https://registry.npmjs.org/eslint-plugin-react-x
../../..                                 | Progress: resolved 702, reused 0, downloaded 9, added 0
[WARN] Request took 42048ms: https://registry.npmjs.org/@types%2Fnode
[WARN] Request took 28274ms: https://registry.npmjs.org/eslint-plugin-react-debug
../../..                                 | Progress: resolved 703, reused 0, downloaded 9, added 0
[WARN] Request took 28625ms: https://registry.npmjs.org/eslint-plugin-react-dom
[WARN] Request took 28664ms: https://registry.npmjs.org/eslint-plugin-react-naming-convention
../../..                                 | Progress: resolved 705, reused 0, downloaded 9, added 0
[WARN] Request took 10717ms: https://registry.npmjs.org/svelte
[WARN] Request took 29968ms: https://registry.npmjs.org/@typescript-eslint%2Ftype-utils
[WARN] Request took 30900ms: https://registry.npmjs.org/@typescript-eslint%2Futils
../../..                                 | Progress: resolved 707, reused 0, downloaded 9, added 0
[WARN] Request took 20800ms: https://registry.npmjs.org/typescript
[WARN] Request took 32282ms: https://registry.npmjs.org/@typescript-eslint%2Ftypes
../../..                                 | Progress: resolved 708, reused 0, downloaded 9, added 0
[WARN] Request took 32398ms: https://registry.npmjs.org/@typescript-eslint%2Fscope-manager
../../..                                 | Progress: resolved 709, reused 0, downloaded 9, added 0
[WARN] Request took 36906ms: https://registry.npmjs.org/playwright
../../..                                 | Progress: resolved 711, reused 0, downloaded 9, added 0
../../..                                 | Progress: resolved 791, reused 0, downloaded 9, added 0
../../..                                 | Progress: resolved 867, reused 0, downloaded 9, added 0
../../..                                 | Progress: resolved 920, reused 0, downloaded 9, added 0
../../..                                 | Progress: resolved 934, reused 0, downloaded 9, added 0
../../..                                 | Progress: resolved 936, reused 0, downloaded 9, added 0
../../..                                 | Progress: resolved 992, reused 0, downloaded 9, added 0
../../..                                 | Progress: resolved 1025, reused 0, downloaded 9, added 0
../../..                                 | Progress: resolved 1104, reused 0, downloaded 9, added 0
../../..                                 | Progress: resolved 1158, reused 0, downloaded 9, added 0
../../..                                 | Progress: resolved 1162, reused 0, downloaded 9, added 0
../../..                                 | Progress: resolved 1208, reused 0, downloaded 9, added 0
../../..                                 | Progress: resolved 1258, reused 0, downloaded 9, added 0
[WARN] GET https://registry.npmjs.org/drizzle-orm error (23). Will retry in 10 seconds. 2 retries left.
../../..                                 | Progress: resolved 1307, reused 0, downloaded 9, added 0
[WARN] Request took 18208ms: https://registry.npmjs.org/@eslint-react%2Fast
../../..                                 | Progress: resolved 1348, reused 0, downloaded 9, added 0
[WARN] Request took 18579ms: https://registry.npmjs.org/@eslint-react%2Fvar
../../..                                 | Progress: resolved 1351, reused 0, downloaded 9, added 0
[WARN] Request took 18401ms: https://registry.npmjs.org/react-is
[WARN] Request took 22287ms: https://registry.npmjs.org/@eslint-react%2Fcore
../../..                                 | Progress: resolved 1354, reused 0, downloaded 9, added 0
[WARN] Request took 16013ms: https://registry.npmjs.org/electron-to-chromium
../../..                                 | Progress: resolved 1356, reused 0, downloaded 9, added 0
[WARN] Request took 11643ms: https://registry.npmjs.org/hono
../../..                                 | Progress: resolved 1358, reused 0, downloaded 9, added 0
[WARN] Request took 27092ms: https://registry.npmjs.org/@typescript-eslint%2Fvisitor-keys
../../..                                 | Progress: resolved 1359, reused 0, downloaded 9, added 0
[WARN] Request took 27214ms: https://registry.npmjs.org/@typescript-eslint%2Fparser
../../..                                 | Progress: resolved 1360, reused 0, downloaded 9, added 0
[WARN] Request took 31152ms: https://registry.npmjs.org/@typescript-eslint%2Ftypescript-estree
../../..                                 | Progress: resolved 1361, reused 0, downloaded 9, added 0
[WARN] Request took 33529ms: https://registry.npmjs.org/playwright-core
../../..                                 | Progress: resolved 1362, reused 0, downloaded 9, added 0
[WARN] Request took 32170ms: https://registry.npmjs.org/@typescript-eslint%2Feslint-plugin
../../..                                 | Progress: resolved 1367, reused 0, downloaded 9, added 0
../../..                                 | Progress: resolved 1457, reused 0, downloaded 9, added 0
../../..                                 | Progress: resolved 1499, reused 0, downloaded 9, added 0
../../..                                 | Progress: resolved 1574, reused 0, downloaded 9, added 0
../../..                                 | Progress: resolved 1665, reused 0, downloaded 10, added 0
../../..                                 | Progress: resolved 1764, reused 0, downloaded 10, added 0
../../..                                 | Progress: resolved 1886, reused 0, downloaded 10, added 0
../../..                                 | Progress: resolved 1927, reused 0, downloaded 10, added 0
[WARN] Request took 23371ms: https://registry.npmjs.org/drizzle-orm
✗ Lockfile failed supply-chain policy check (2103 entries in 2m 8.2s)
[ERR_PNPM_TRUST_DOWNGRADE] 5 lockfile entries failed verification:
  chokidar@4.0.3 High-risk trust downgrade for "chokidar@4.0.3" (possible package takeover)
  semver@5.7.2 High-risk trust downgrade for "semver@5.7.2" (possible package takeover)
  semver@6.3.1 High-risk trust downgrade for "semver@6.3.1" (possible package takeover)
  undici-types@6.21.0 High-risk trust downgrade for "undici-types@6.21.0" (possible package takeover)
  vite@6.4.1 High-risk trust downgrade for "vite@6.4.1" (possible package takeover)

The lockfile contains entries that the active policies reject. This can mean the lockfile is stale, or that someone committed a lockfile that bypassed the policy locally — inspect recent changes to pnpm-lock.yaml before trusting it. If the changes look expected, run "pnpm clean --lockfile" and then "pnpm install" to rebuild from a fresh resolution. Alternatively, relax the policy that flagged them.

File name: examples/react/a11y-devtools/pnpm-lock.yaml
Scope: all 46 workspace projects
? Verifying lockfile against supply-chain policies (2103 entries)...
../../..                                 | Progress: resolved 1, reused 0, downloaded 0, added 0
../../..                                 | Progress: resolved 41, reused 0, downloaded 0, added 0
../../..                                 | Progress: resolved 53, reused 0, downloaded 0, added 0
../../..                                 | Progress: resolved 54, reused 0, downloaded 0, added 0
../../..                                 | Progress: resolved 56, reused 0, downloaded 0, added 0
../../..                                 | Progress: resolved 57, reused 0, downloaded 0, added 0
../../..                                 | Progress: resolved 61, reused 0, downloaded 0, added 0
../../..                                 | Progress: resolved 69, reused 0, downloaded 0, added 0
../../..                                 | Progress: resolved 82, reused 0, downloaded 0, added 0
../../..                                 | Progress: resolved 91, reused 0, downloaded 6, added 0
../../..                                 | Progress: resolved 95, reused 0, downloaded 8, added 0
../../..                                 | Progress: resolved 95, reused 0, downloaded 9, added 0
../../..                                 | Progress: resolved 96, reused 0, downloaded 9, added 0
../../..                                 | Progress: resolved 101, reused 0, downloaded 9, added 0
../../..                                 | Progress: resolved 109, reused 0, downloaded 9, added 0
../../..                                 | Progress: resolved 118, reused 0, downloaded 9, added 0
../../..                                 | Progress: resolved 131, reused 0, downloaded 9, added 0
../../..                                 | Progress: resolved 134, reused 0, downloaded 9, added 0
../../..                                 | Progress: resolved 135, reused 0, downloaded 9, added 0
../../..                                 | Progress: resolved 136, reused 0, downloaded 9, added 0
../../..                                 | Progress: resolved 315, reused 0, downloaded 9, added 0
../../..                                 | Progress: resolved 423, reused 0, downloaded 9, added 0
../../..                                 | Progress: resolved 474, reused 0, downloaded 9, added 0
../../..                                 | Progress: resolved 553, reused 0, downloaded 9, added 0
../../..                                 | Progress: resolved 602, reused 0, downloaded 9, added 0
../../..                                 | Progress: resolved 686, reused 0, downloaded 9, added 0
../../..                                 | Progress: resolved 693, reused 0, downloaded 9, added 0
../../..                                 | Progress: resolved 709, reused 0, downloaded 9, added 0
../../..                                 | Progress: resolved 713, reused 0, downloaded 9, added 0
../../..                                 | Progress: resolved 758, reused 0, downloaded 9, added 0
../../..                                 | Progress: resolved 808, reused 0, downloaded 9, added 0
../../..                                 | Progress: resolved 869, reused 0, downloaded 9, added 0
../../..                                 | Progress: resolved 905, reused 0, downloaded 9, added 0
../../..                                 | Progress: resolved 1015, reused 0, downloaded 9, added 0
../../..                                 | Progress: resolved 1068, reused 0, downloaded 9, added 0
../../..                                 | Progress: resolved 1137, reused 0, downloaded 9, added 0
../../..                                 | Progress: resolved 1193, reused 0, downloaded 9, added 0
../../..                                 | Progress: resolved 1246, reused 0, downloaded 9, added 0
../../..                                 | Progress: resolved 1337, reused 0, downloaded 9, added 0
../../..                                 | Progress: resolved 1338, reused 0, downloaded 9, added 0
../../..                                 | Progress: resolved 1360, reused 0, downloaded 9, added 0
../../..                                 | Progress: resolved 1363, reused 0, downloaded 9, added 0
../../..                                 | Progress: resolved 1364, reused 0, downloaded 9, added 0
../../..                                 | Progress: resolved 1432, reused 0, downloaded 9, added 0
../../..                                 | Progress: resolved 1553, reused 0, downloaded 9, added 0
../../..                                 | Progress: resolved 1600, reused 0, downloaded 10, added 0
../../..                                 | Progress: resolved 1652, reused 0, downloaded 10, added 0
../../..                                 | Progress: resolved 1738, reused 0, downloaded 10, added 0
../../..                                 | Progress: resolved 1753, reused 0, downloaded 10, added 0
../../..                                 | Progress: resolved 1823, reused 0, downloaded 10, added 0
✗ Lockfile failed supply-chain policy check (2103 entries in 1m 24.2s)
[ERR_PNPM_TRUST_DOWNGRADE] 5 lockfile entries failed verification:
  chokidar@4.0.3 High-risk trust downgrade for "chokidar@4.0.3" (possible package takeover)
  semver@5.7.2 High-risk trust downgrade for "semver@5.7.2" (possible package takeover)
  semver@6.3.1 High-risk trust downgrade for "semver@6.3.1" (possible package takeover)
  undici-types@6.21.0 High-risk trust downgrade for "undici-types@6.21.0" (possible package takeover)
  vite@6.4.1 High-risk trust downgrade for "vite@6.4.1" (possible package takeover)

The lockfile contains entries that the active policies reject. This can mean the lockfile is stale, or that someone committed a lockfile that bypassed the policy locally — inspect recent changes to pnpm-lock.yaml before trusting it. If the changes look expected, run "pnpm clean --lockfile" and then "pnpm install" to rebuild from a fresh resolution. Alternatively, relax the policy that flagged them.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants