Repository navigation
chore(tanstack-react-start): Update TanStack Start for CVE-2026-102989 (Core 2) - #10262
Conversation
…(Core 2) Backport of #10018 to release/core-2. Bump the TanStack Start and Router dev and integration-template pins from 1.157.16 to the patched versions. Pin the root prettier to the version core-2 already resolves, since the new TanStack tree would otherwise dedupe it to a newer release. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
🦋 Changeset detectedLatest commit: bd2eeed The changes in this PR will be included in the next version bump. This PR includes changesets to release 1 package
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configuration
You can disable this status message by setting the Use the checkbox below for a quick retry:
Comment |
…atch Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@clerk/agent-toolkit
@clerk/astro
@clerk/backend
@clerk/chrome-extension
@clerk/clerk-js
@clerk/dev-cli
@clerk/elements
@clerk/clerk-expo
@clerk/expo-passkeys
@clerk/express
@clerk/fastify
@clerk/localizations
@clerk/nextjs
@clerk/nuxt
@clerk/clerk-react
@clerk/react-router
@clerk/remix
@clerk/shared
@clerk/tanstack-react-start
@clerk/testing
@clerk/themes
@clerk/types
@clerk/upgrade
@clerk/vue
commit: |
…ackport-tanstack-start-cve-core-2
Description
Backport of #10018 to
release/core-2. Vercel now refuses to build@tanstack/react-startbelow 1.168.60 (CVE-2026-102989), and core-2 still pins 1.157.16, so theclerk-js-sandboxpreview fails on every core-2 PR.This bumps the dev and integration-template pins to
@tanstack/react-start1.168.60 and@tanstack/react-router1.170.41 (devtools 1.167.1), the same versions main uses. The^1.157.0peer range is unchanged, so nothing changes for people installing@clerk/tanstack-react-start.Core-2 jumps further than main did (1.157 → 1.168), and the new TanStack tree would have deduped the root
prettierfrom 3.6.2 to 3.9.10. The rootprettieris pinned to 3.6.2 so formatting across the repo stays put, the same way #10018 pinned it on main. Main'sminimumReleaseAgeExcludeentries aren't needed here: all three versions are more than two weeks old.Checklist
pnpm testruns as expected.pnpm buildruns as expected.Type of change
🤖 Generated with Claude Code