Bump the tanstack group across 1 directory with 5 updates - #645
Merged
Conversation
dependabot
Bot
added
dependencies
bgentry
reviewed
Aug 1, 2026
bgentry
left a comment
bgentry
left a comment
Contributor
There was a problem hiding this comment.
🤖 Codex review: Security review is clear, but compatibility verification found a generated-file blocker.
Upgrade
- TanStack group: five direct updates with ten total package version changes
- Reviewed head:
df818cf2bc7cb52590091f08835c32c091152387
Security review
- All 20 old/new registry tarballs match the lockfile SHA-512 values, npm metadata, registry signatures, and expected TanStack GitHub Actions SLSA attestations.
- The lockfile adds or removes no packages and introduces no lifecycle/bin/native/platform/non-registry/integrity churn.
- Actual Query and Router artifact diffs contain the expected fixes. Targeted scans found no new process execution, downloader, credential access, telemetry, dynamic evaluation, or external network behavior.
- Neither side falls in the exact compromised versions from GHSA-g7cv-rxg3-hmpx / CVE-2026-45321. This is not itself a security update.
Compatibility verification
npm ci— passed with zero audit vulnerabilities.npm audit signatures— 485 registry signatures and 179 attestations verified.npm run lint— passed.npm run test:once— 34 files and 229 tests passed.npm run build— passed.make test— passed across the root, Pro, and packager modules.- Required Go/JS CI and both public
riveruiarchitecture image builds passed. Theriverprouijob fails before build because Dependabot cannot assume the AWS OIDC role.
Blocking compatibility finding
- On the exact PR head,
npm run buildrewrites trackedsrc/routeTree.gen.tswith an 89-line insertion/89-line deletion deterministic ordering change from the upgraded router generator. The same build on the base head leaves the file clean. - Please regenerate and include the tracked route tree, or explicitly decide that leaving every post-merge build with a dirty generated file is acceptable. I have not approved or merged this head.
Residual risk
- Query Devtools contains large generated bundles that were source-delta and capability reviewed rather than manually audited byte-for-byte.
dependabot
Bot
changed the title
dependabot
Bot
force-pushed
the
dependabot/npm_and_yarn/tanstack-658c9bfbb0
branch
from
August 1, 2026 19:35
df818cf to
1985f76
Compare
Bumps the tanstack group with 5 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@tanstack/react-query](https://github.com/TanStack/query/tree/HEAD/packages/react-query) | `5.101.1` | `5.101.4` | | [@tanstack/react-router](https://github.com/TanStack/router/tree/HEAD/packages/react-router) | `1.170.16` | `1.170.18` | | [@tanstack/eslint-plugin-query](https://github.com/TanStack/query/tree/HEAD/packages/eslint-plugin-query) | `5.101.1` | `5.101.4` | | [@tanstack/react-query-devtools](https://github.com/TanStack/query/tree/HEAD/packages/react-query-devtools) | `5.101.1` | `5.101.4` | | [@tanstack/router-vite-plugin](https://github.com/TanStack/router/tree/HEAD/packages/router-vite-plugin) | `1.167.18` | `1.167.23` | Updates `@tanstack/react-query` from 5.101.1 to 5.101.4 - [Release notes](https://github.com/TanStack/query/releases) - [Changelog](https://github.com/TanStack/query/blob/main/packages/react-query/CHANGELOG.md) - [Commits](https://github.com/TanStack/query/commits/@tanstack/react-query@5.101.4/packages/react-query) Updates `@tanstack/react-router` from 1.170.16 to 1.170.18 - [Release notes](https://github.com/TanStack/router/releases) - [Changelog](https://github.com/TanStack/router/blob/main/packages/react-router/CHANGELOG.md) - [Commits](https://github.com/TanStack/router/commits/@tanstack/react-router@1.170.18/packages/react-router) Updates `@tanstack/eslint-plugin-query` from 5.101.1 to 5.101.4 - [Release notes](https://github.com/TanStack/query/releases) - [Changelog](https://github.com/TanStack/query/blob/main/packages/eslint-plugin-query/CHANGELOG.md) - [Commits](https://github.com/TanStack/query/commits/@tanstack/eslint-plugin-query@5.101.4/packages/eslint-plugin-query) Updates `@tanstack/react-query-devtools` from 5.101.1 to 5.101.4 - [Release notes](https://github.com/TanStack/query/releases) - [Changelog](https://github.com/TanStack/query/blob/main/packages/react-query-devtools/CHANGELOG.md) - [Commits](https://github.com/TanStack/query/commits/@tanstack/react-query-devtools@5.101.4/packages/react-query-devtools) Updates `@tanstack/router-vite-plugin` from 1.167.18 to 1.167.23 - [Release notes](https://github.com/TanStack/router/releases) - [Changelog](https://github.com/TanStack/router/blob/main/packages/router-vite-plugin/CHANGELOG.md) - [Commits](https://github.com/TanStack/router/commits/@tanstack/router-vite-plugin@1.167.23/packages/router-vite-plugin) --- updated-dependencies: - dependency-name: "@tanstack/eslint-plugin-query" dependency-version: 5.101.4 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: tanstack - dependency-name: "@tanstack/react-query" dependency-version: 5.101.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: tanstack - dependency-name: "@tanstack/react-query-devtools" dependency-version: 5.101.4 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: tanstack - dependency-name: "@tanstack/react-router" dependency-version: 1.170.18 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: tanstack - dependency-name: "@tanstack/router-vite-plugin" dependency-version: 1.167.23 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: tanstack ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
force-pushed
the
dependabot/npm_and_yarn/tanstack-658c9bfbb0
branch
from
August 1, 2026 19:40
1985f76 to
2d33603
Compare
bgentry
enabled auto-merge (squash)
August 1, 2026 19:47
bgentry
approved these changes
Aug 1, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the tanstack group with 5 updates in the / directory:
5.101.15.101.41.170.161.170.185.101.15.101.45.101.15.101.41.167.181.167.23Updates
@tanstack/react-queryfrom 5.101.1 to 5.101.4Release notes
Sourced from @tanstack/react-query's releases.
... (truncated)
Changelog
Sourced from @tanstack/react-query's changelog.
Commits
86bb8a6ci: Version Packages (#11094)181ea82ci: Version Packages (#11089)6d55b07test({react,preact}-query): use the '.then()' convention consistently (#11085)44f38dftest({react,preact,solid}-query/useInfiniteQuery): inline the shared 'fetchIt...d1558c1test({react,preact}-query/usePrefetchQuery): inline the 'generateQueryFn' fac...99690d1test({react,preact}-query/usePrefetchInfiniteQuery): inline single-use helper...10770f0test({react,preact}-query/usePrefetchInfiniteQuery): inline the shared 'Suspe...dbd5a86test({react,preact}-query/usePrefetchQuery): inline the shared 'Suspended' co...b955f60test({react,preact}-query/useSuspenseQuery): assert the 'loading' fallback is...b9c657etest({react,preact}-query/usePrefetchQuery): assert the 'Loading...' fallback...Updates
@tanstack/react-routerfrom 1.170.16 to 1.170.18Changelog
Sourced from @tanstack/react-router's changelog.
Commits
58c005fci: Version Packages (#7811)ecbbd9aci: Version Packages (#7676)Updates
@tanstack/eslint-plugin-queryfrom 5.101.1 to 5.101.4Release notes
Sourced from @tanstack/eslint-plugin-query's releases.
Changelog
Sourced from @tanstack/eslint-plugin-query's changelog.
Commits
86bb8a6ci: Version Packages (#11094)7ac45edfix(eslint-plugin-query): ignore call targets in exhaustive-deps (#11067)181ea82ci: Version Packages (#11089)610e8d1ci: Version Packages (#10996)Updates
@tanstack/react-query-devtoolsfrom 5.101.1 to 5.101.4Release notes
Sourced from @tanstack/react-query-devtools's releases.
Changelog
Sourced from @tanstack/react-query-devtools's changelog.
Commits
86bb8a6ci: Version Packages (#11094)181ea82ci: Version Packages (#11089)c476781test({react,preact}-query-devtools): assert the forwarded 'onClose' callback ...6a5bc45test(react-query-devtools): extract shared test setup into 'beforeEach' (#11026)cb115eatest(react-query-devtools/ReactQueryDevtools): add tests for forwarding optio...610e8d1ci: Version Packages (#10996)Updates
@tanstack/router-vite-pluginfrom 1.167.18 to 1.167.23Release notes
Sourced from @tanstack/router-vite-plugin's releases.
Changelog
Sourced from @tanstack/router-vite-plugin's changelog.
Commits
49bd9faci: Version Packages (#7857)62a191bci: Version Packages (#7846)604996dci: Version Packages (#7841)58c005fci: Version Packages (#7811)ecbbd9aci: Version Packages (#7676)