Bump the tanstack group across 1 directory with 6 updates - #678
Merged
Conversation
dependabot
Bot
added
dependencies
bgentry
approved these changes
Sep 1, 2026
bgentry
left a comment
bgentry
left a comment
Contributor
There was a problem hiding this comment.
🤖 Codex review: Approved after dependency security and compatibility review.
Upgrade
- TanStack group: 6 direct updates (
@tanstack/react-query,
@tanstack/react-router,@tanstack/eslint-plugin-query, both devtools,
and@tanstack/router-vite-plugin) - Reviewed head:
c459aa734d506221c5d88d2582611f507a65ce61
Security review
- Compared both canonical npm artifacts for all 6 direct and 10 transitive
version pairs. All computed SHA-512 values match the lockfile and registry;
there are no additions/removals, integrity rewrites, non-registry sources,
lifecycle-hook or bin changes, or native/platform additions. - TanStack artifacts retain canonical repositories and trusted-publishing SLSA
provenance. Static source/bundle review found no malware indicators, new
credential or filesystem-secret reads, subprocess execution, telemetry, or
outbound network behavior. - This is a routine update, not a confirmed security update. The old and new
versions are outside the affected ranges of the relevant TanStack and
Seroval advisories.
Compatibility verification
npm ci— passednpm run lint— passednpm run test:once— passed (34 files, 233 tests)npm run build— passednpm run build-storybook— passed- Route generation left tracked files unchanged. GitHub's JavaScript build,
tests, lint, release, Go matrix, and public image builds are also green. - The River Pro image failure is the queue-wide Dependabot credential failure;
it occurs before code affected by this npm-only PR.
Residual risk
- Low:
serovalandseroval-pluginslack npm provenance and stop shipping
source in1.6.4; their readable bundles, ownership, and canonical sources
were inspected. Router-core has substantial coherent runtime refactoring,
so the full tests and production/Storybook builds are the main compatibility
evidence.
Bumps the tanstack group with 6 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@tanstack/react-query](https://github.com/TanStack/query/tree/HEAD/packages/react-query) | `5.101.4` | `5.102.4` | | [@tanstack/react-router](https://github.com/TanStack/router/tree/HEAD/packages/react-router) | `1.170.18` | `1.170.32` | | [@tanstack/eslint-plugin-query](https://github.com/TanStack/query/tree/HEAD/packages/eslint-plugin-query) | `5.101.4` | `5.102.4` | | [@tanstack/react-query-devtools](https://github.com/TanStack/query/tree/HEAD/packages/react-query-devtools) | `5.101.4` | `5.102.4` | | [@tanstack/react-router-devtools](https://github.com/TanStack/router/tree/HEAD/packages/react-router-devtools) | `1.167.0` | `1.167.1` | | [@tanstack/router-vite-plugin](https://github.com/TanStack/router/tree/HEAD/packages/router-vite-plugin) | `1.167.23` | `1.167.35` | Updates `@tanstack/react-query` from 5.101.4 to 5.102.4 - [Release notes](https://github.com/TanStack/query/releases) - [Changelog](https://github.com/TanStack/query/blob/main/packages/react-query/CHANGELOG.md) - [Commits](https://github.com/TanStack/query/commits/@tanstack/react-query@5.102.4/packages/react-query) Updates `@tanstack/react-router` from 1.170.18 to 1.170.32 - [Release notes](https://github.com/TanStack/router/releases) - [Changelog](https://github.com/TanStack/router/blob/main/packages/react-router/CHANGELOG.md) - [Commits](https://github.com/TanStack/router/commits/@tanstack/react-router@1.170.32/packages/react-router) Updates `@tanstack/eslint-plugin-query` from 5.101.4 to 5.102.4 - [Release notes](https://github.com/TanStack/query/releases) - [Changelog](https://github.com/TanStack/query/blob/main/packages/eslint-plugin-query/CHANGELOG.md) - [Commits](https://github.com/TanStack/query/commits/@tanstack/eslint-plugin-query@5.102.4/packages/eslint-plugin-query) Updates `@tanstack/react-query-devtools` from 5.101.4 to 5.102.4 - [Release notes](https://github.com/TanStack/query/releases) - [Changelog](https://github.com/TanStack/query/blob/main/packages/react-query-devtools/CHANGELOG.md) - [Commits](https://github.com/TanStack/query/commits/@tanstack/react-query-devtools@5.102.4/packages/react-query-devtools) Updates `@tanstack/react-router-devtools` from 1.167.0 to 1.167.1 - [Release notes](https://github.com/TanStack/router/releases) - [Changelog](https://github.com/TanStack/router/blob/main/packages/react-router-devtools/CHANGELOG.md) - [Commits](https://github.com/TanStack/router/commits/@tanstack/react-router-devtools@1.167.1/packages/react-router-devtools) Updates `@tanstack/router-vite-plugin` from 1.167.23 to 1.167.35 - [Release notes](https://github.com/TanStack/router/releases) - [Changelog](https://github.com/TanStack/router/blob/main/packages/router-vite-plugin/CHANGELOG.md) - [Commits](https://github.com/TanStack/router/commits/@tanstack/router-vite-plugin@1.167.35/packages/router-vite-plugin) --- updated-dependencies: - dependency-name: "@tanstack/eslint-plugin-query" dependency-version: 5.102.3 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: tanstack - dependency-name: "@tanstack/react-query" dependency-version: 5.102.3 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: tanstack - dependency-name: "@tanstack/react-query-devtools" dependency-version: 5.102.3 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: tanstack - dependency-name: "@tanstack/react-router" dependency-version: 1.170.32 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: tanstack - dependency-name: "@tanstack/react-router-devtools" dependency-version: 1.167.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: tanstack - dependency-name: "@tanstack/router-vite-plugin" dependency-version: 1.167.35 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: tanstack ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
changed the title
dependabot
Bot
force-pushed
the
dependabot/npm_and_yarn/tanstack-3b8977d4d8
branch
from
September 2, 2026 02:07
c459aa7 to
bb9af28
Compare
bgentry
approved these changes
Sep 2, 2026
bgentry
left a comment
bgentry
left a comment
Contributor
There was a problem hiding this comment.
🤖 Codex review: Approved after dependency security and compatibility review.
Upgrade
@tanstack/react-query:5.101.4→5.102.4@tanstack/react-router:1.170.18→1.170.32@tanstack/eslint-plugin-query:5.101.4→5.102.4@tanstack/react-query-devtools:5.101.4→5.102.4@tanstack/react-router-devtools:1.167.0→1.167.1@tanstack/router-vite-plugin:1.167.23→1.167.35- Reviewed head:
bb9af288edddba9f92793266b0f8139faffeffc2
Security review
- Reused the exact-version artifact, integrity, provenance, advisory, and source-diff evidence from the prior review; the Dependabot rebase retains the same six direct updates and reviewed artifact identities.
- Reviewed the current-head delta and lockfile graph. The expected TanStack transitives update, with no new lifecycle scripts, non-registry URLs, weak integrity values, native payloads, or unexplained package families.
- No blocking supply-chain or security issue was identified.
Compatibility verification
- GitHub CI: Go lint and all Go 1.26/1.27 × PostgreSQL 16/17/18 jobs — passed.
- GitHub CI: JS lint, JS build/test, and release — passed.
- Public
riveruiimage builds for linux/amd64 and linux/arm64, plus manifest merge — passed.
Residual risk
- The private
riverprouiimage workflow still cannot assume its OIDC role: arm64 failed, amd64 was cancelled, and the downstream Pro manifest jobs were skipped. This is the known release-workflow gap rather than evidence of dependency incompatibility.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Rebasing might not happen immediately, so don't worry if this takes some time.
Note: if you make any changes to this PR yourself, they will take precedence over the rebase.
Bumps the tanstack group with 6 updates in the / directory:
5.101.45.102.41.170.181.170.325.101.45.102.45.101.45.102.41.167.01.167.11.167.231.167.35Updates
@tanstack/react-queryfrom 5.101.4 to 5.102.4Changelog
Sourced from @tanstack/react-query's changelog.
... (truncated)
Commits
51f12dbci: Version Packages (#11294)730b3aaci: Version Packages (#11276)388bbafci: Version Packages (#11265)bc423b3ci: Version Packages (#11261)be1352btest(*): add adapter-level type coverage for optional undefinable mutate vari...5743468ci: Version Packages (#11206)2215bb0fix(query-core): makeMutateFunctionoptional undefinable-variables (#8737)d156adctest: transition tests (#11246)37127dbfix/11018 (#11245)e674826React: update usePrefetchQuery to use new methods, plus react adaptor tests a...Updates
@tanstack/react-routerfrom 1.170.18 to 1.170.32Release notes
Sourced from @tanstack/react-router's releases.
Changelog
Sourced from @tanstack/react-router's changelog.
... (truncated)
Commits
a5a5bacci: Version Packages (#8133)cb281d7fix(router-core): preserve context during reloads (#8130)4fcbcdeci: Version Packages (#8119)a78f2afci: Version Packages (#8079)63d2cc9fix(router-core): remove navigation rollback (#8092)5d3785dfix(router-core): preserve pending UI across retained routes (#8084)f97188fchore: localize package dependencies (#8078)f75cadaperf(react-router): direct export of CatchBoundary class component, remove fu...11dfc93ci: Version Packages (#8075)0fdf9ffperf: inline isCtrlKey utility inside all Link components (#8073)Updates
@tanstack/eslint-plugin-queryfrom 5.101.4 to 5.102.4Changelog
Sourced from @tanstack/eslint-plugin-query's changelog.
Commits
51f12dbci: Version Packages (#11294)730b3aaci: Version Packages (#11276)388bbafci: Version Packages (#11265)bc423b3ci: Version Packages (#11261)5743468ci: Version Packages (#11206)267154cchore: tsup -> tsdown (#11222)8582702refactor(eslint-plugin-query): remove unused ast-utils helpers (#11115)279bb55chore: update to ts 7 and move cut-off to 5.6 (#11212)3bc8edffix(eslint-plugin-query): avoid prototype property false-positives in no-unst...Updates
@tanstack/react-query-devtoolsfrom 5.101.4 to 5.102.4Changelog
Sourced from @tanstack/react-query-devtools's changelog.
Commits
51f12dbci: Version Packages (#11294)730b3aaci: Version Packages (#11276)388bbafci: Version Packages (#11265)bc423b3ci: Version Packages (#11261)5743468ci: Version Packages (#11206)267154cchore: tsup -> tsdown (#11222)279bb55chore: update to ts 7 and move cut-off to 5.6 (#11212)Updates
@tanstack/react-router-devtoolsfrom 1.167.0 to 1.167.1Changelog
Sourced from @tanstack/react-router-devtools's changelog.
Commits
704145cci: Version Packages (#7946)b5e540ddocs: use the dynamic README header endpoint (#7940)88f366achore: migrate to typescript 7 (#7887)Updates
@tanstack/router-vite-pluginfrom 1.167.23 to 1.167.35Release notes
Sourced from @tanstack/router-vite-plugin's releases.
Changelog
Sourced from @tanstack/router-vite-plugin's changelog.
... (truncated)
Commits
a5a5bacci: Version Packages (#8133)4fcbcdeci: Version Packages (#8119)a78f2afci: Version Packages (#8079)f97188fchore: localize package dependencies (#8078)11dfc93ci: Version Packages (#8075)53b63cfci: Version Packages (#8052)e15bda5ci: Version Packages (#8040)91a848eci: Version Packages (#8021)6f8f534ci: Version Packages (#8011)995bd97ci: Version Packages (#7993)