Skip to content

chore(tanstack-react-start): Update TanStack Start for CVE-2026-102989 (Core 2) - #10262

Merged
dstaley merged 4 commits into
release/core-2from
manovotny/backport-tanstack-start-cve-core-2
Oct 15, 2026
Merged

dstaley merged 4 commits into
release/core-2from
manovotny/backport-tanstack-start-cve-core-2

Conversation

@manovotny

Copy link
Copy Markdown
Contributor

Description

Backport of #10018 to release/core-2. Vercel now refuses to build @tanstack/react-start below 1.168.60 (CVE-2026-102989), and core-2 still pins 1.157.16, so the clerk-js-sandbox preview fails on every core-2 PR.

This bumps the dev and integration-template pins to @tanstack/react-start 1.168.60 and @tanstack/react-router 1.170.41 (devtools 1.167.1), the same versions main uses. The ^1.157.0 peer range is unchanged, so nothing changes for people installing @clerk/tanstack-react-start.

Core-2 jumps further than main did (1.157 → 1.168), and the new TanStack tree would have deduped the root prettier from 3.6.2 to 3.9.10. The root prettier is pinned to 3.6.2 so formatting across the repo stays put, the same way #10018 pinned it on main. Main's minimumReleaseAgeExclude entries aren't needed here: all three versions are more than two weeks old.

Checklist

  • pnpm test runs as expected.
  • pnpm build runs as expected.
  • (If applicable) JSDoc comments have been added or updated for any package exports
  • (If applicable) Documentation has been updated

Type of change

  • 🐛 Bug fix
  • 🌟 New feature
  • 🔨 Breaking change
  • 📖 Refactoring / dependency upgrade / documentation
  • other:

🤖 Generated with Claude Code

…(Core 2)

Backport of #10018 to release/core-2. Bump the TanStack Start and Router
dev and integration-template pins from 1.157.16 to the patched versions.
Pin the root prettier to the version core-2 already resolves, since the
new TanStack tree would otherwise dedupe it to a newer release.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@changeset-bot

changeset-bot Bot commented Oct 15, 2026 •

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: bd2eeed

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package
Name Type
@clerk/tanstack-react-start Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@vercel

vercel Bot commented Oct 15, 2026 •

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
clerk-js-sandbox Ready Ready Preview Oct 15, 2026 5:49pm UTC
swingset Error Error Oct 15, 2026 5:49pm UTC

Request Review

@coderabbitai

coderabbitai Bot commented Oct 15, 2026 •

Copy link
Copy Markdown
Contributor

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration
  • Configuration used: Repository: clerk/javascript/.coderabbit.yaml
  • Review profile: CHILL
  • Plan: Team
  • Run ID: 72c5d1ec-5008-495d-b37b-9962f068869e

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Comment @coderabbitai help to get the list of available commands.

Comment thread .changeset/tanstack-start-security-update-core-2.md
…atch

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@pkg-pr-new

pkg-pr-new Bot commented Oct 15, 2026 •

Copy link
Copy Markdown

Open in StackBlitz

@clerk/agent-toolkit

npm i https://pkg.pr.new/@clerk/agent-toolkit@10262

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@10262

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@10262

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@10262

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@10262

@clerk/dev-cli

npm i https://pkg.pr.new/@clerk/dev-cli@10262

@clerk/elements

npm i https://pkg.pr.new/@clerk/elements@10262

@clerk/clerk-expo

npm i https://pkg.pr.new/@clerk/clerk-expo@10262

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@10262

@clerk/express

npm i https://pkg.pr.new/@clerk/express@10262

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@10262

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@10262

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@10262

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@10262

@clerk/clerk-react

npm i https://pkg.pr.new/@clerk/clerk-react@10262

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@10262

@clerk/remix

npm i https://pkg.pr.new/@clerk/remix@10262

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@10262

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@10262

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@10262

@clerk/themes

npm i https://pkg.pr.new/@clerk/themes@10262

@clerk/types

npm i https://pkg.pr.new/@clerk/types@10262

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@10262

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@10262

commit: bd2eeed

@dstaley
dstaley merged commit 8ce5872 into release/core-2 Oct 15, 2026
103 of 112 checks passed
@dstaley
dstaley deleted the manovotny/backport-tanstack-start-cve-core-2 branch October 15, 2026 18:18

This branch had an error being deployed

1 failed and 1 active deployments
Preview – clerk-js-sandbox — bd2eeed6 Deployed Oct 15, 2026 by vercel[bot]
Preview – swingset — bd2eeed6 Deployed Oct 15, 2026 by vercel[bot]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants