chore: merge main into solid-query-v6-pre by brenelz · Pull Request #12603 · TanStack/query

brenelz · 2026-11-15T04:23:26Z

🎯 Changes

Merges main (56d98b0) into solid-query-v6-pre. This needs a merge commit, not a squash, so the history from main is kept.

The three Solid packages keep the v6 implementation and tests. From main they take:

the tsdown build, with a small rolldown plugin that runs the Solid 2 compiler (@solidjs/babel-plugin) in place of unplugin-solid
the oxlint and oxfmt setup and the TypeScript 5.7 to 7.1 type-test matrix
the explicit index exports, the initialData overload fixes, the fetchStatus/status filter omissions and the useMutationState select generics
the devtools ./production entry, theme passthrough and panel height

Resolution choices worth a look:

The devtools keep the v6 clientOnly wrapper and lazy imports instead of the NODE_ENV gate from fix(solid-query-devtools): replace 'clientOnly' with a 'process.env.NODE_ENV' gate to fix hydration mismatch #12524. Solid 2 DOM templates throw when the module is imported on the server, so a static import breaks SSR.
useQueryClientResolver (fix(solid-query): resolve query client outside memos #10571), fix(solid-query): subscribe to the new observer when the queryClient changes #11920 and fix(solid-query): useBaseQuery SSR cleanup #11628 are not carried over, because v6 rewrote the code they change. The v6 aggregate hooks do not resubscribe when a custom queryClient accessor changes; the test from fix(solid-query): resolve query client outside memos #10571 is skipped with a note.
mutate accepts no argument when TVariables includes undefined, following feat(query-core): make MutateFunction optional undefinable-variables #8737.
@solidjs/web is declared as a peer of the devtools and persist-client packages, which knip's strict pass requires. This overlaps fix(solid-query-devtools): declare the Web peer and public JSX return type #12160.
The pending tidy-query-exports changeset is limited to the Solid packages, because this branch is in changesets pre mode.
The Solid examples are the v5 examples from main and resolve @tanstack/solid-query 5.x from npm. integrations/solid/vite is ported to Solid 2; the astro-7 and solid-start-2 integrations skip build and type checks until those frameworks support Solid 2.
The lockfile stays on Solid 2.0.0-rc.13 and @solidjs/vite-plugin 3.0.0-next.46.

A second commit applies the lint rules from main to the v6 tests and adds the JSDoc tags those rules require on the v6 source.

Verified locally for @tanstack/solid-query, @tanstack/solid-query-devtools, @tanstack/solid-query-persist-client and @tanstack/query-integration-solid-vite:

pnpm exec nx run-many --targets=compile,test:types,test:lib,build,test:build,test:oxlint --projects=<the four projects> --skip-nx-cache
pnpm run test:knip
pnpm run test:sherif
pnpm run test:docs

pnpm run test:pr for the whole repository was not run locally.

✅ Checklist

I have followed the steps in the Contributing guide.
I have tested code changes locally with pnpm run test:pr, or these tests do not apply to this pull request.
I have followed the AI contribution policy and fully understand the code in this pull request, including any code generated with AI assistance.

🚀 Release Impact

This change affects published code, and I have generated a changeset.
This change is docs/CI/dev-only (no release).

🤖 Generated with Claude Code

…ers' option to 'persistFilters' internally to avoid shadowing (TanStack#12290)

…bserver' in 'trackResult' to 'resultObserver' to avoid shadowing (TanStack#12291)

…eates keys for both queries and mutations (TanStack#12293) * test(*): rename the 'queryKey' test helper to 'createKey' since it creates keys for both queries and mutations * test(query-test-utils/createKey): change the key prefix from 'query_' to 'key-' since it is also used for mutation keys

…ation' to avoid shadowing the 'select' parameter (TanStack#12294)

…r' to avoid shadowing the returned 'error' (TanStack#12295)

…teQueries' comment (TanStack#12296)

…' in the 'vue-demi' mock (TanStack#12297)

…switch test titles (TanStack#12298)

…ith notes explaining why the state counts differ from react (TanStack#12300)

…ryState' from a tagged query key (TanStack#11921) * fix(vue-query/queryClient): infer the data and error types of 'getQueryState' from a tagged query key * docs(vue-query): regenerate reference docs for 'getQueryState' overloads

…advances to the 'queryFn' sleep of 10ms (TanStack#12305)

…ch' (TanStack#12306)

… removed in the Vite 8 update (TanStack#12307)

…anges to the devtools instance after mount (TanStack#12308)

…' with 'enabled: false' and 'skipToken', and undefined 'initialData' (TanStack#12309)

…em' so the theme chosen in the devtools settings applies when the prop is omitted (TanStack#12313)

… so the theme chosen in the devtools settings applies when the prop is omitted (TanStack#12312)

…m' so the theme chosen in the devtools settings applies when the prop is omitted (TanStack#12310)

…eme selected in the devtools Settings menu (TanStack#12314)

…' to the devtools so removing it falls back to the theme selected in the devtools Settings menu (TanStack#12315)

Bump vitest and @vitest/coverage-istanbul to 5.0.5 (root and query-test-utils) and @vitest/eslint-plugin to 1.6.28. Vitest 5's typecheck collector treats any name ending in Test as a test function, so notifyManagerTest in query-core/src/__tests__/notifyManager.test-d.tsx was renamed to localNotifyManager. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

… and 'hideDisabledQueries' options (TanStack#12316)

…toolsPanel' (TanStack#12320)

…tate' rule in the bare 'oxlint-disable-next-line' comment (TanStack#12323)

…ssary 'QueryObserverOptions' assertion and its 'oxlint-disable' comment (TanStack#12324)

…cript/no-unnecessary-type-assertion' is disabled for the 'refetch' wrapper (TanStack#12329)

…ypescript/no-unnecessary-condition' is disabled for the 'client' checks (TanStack#12328)

…ypescript/no-unnecessary-condition' is disabled for the 'importKind' check (TanStack#12327)

…Unicode lowercasing fixtures to clear 'cspell' warnings (TanStack#12549)

…lue' to 'material' to match the signal type (TanStack#12550)

…arch, and panel 'style' default for every adapter (TanStack#12546) * docs(framework/*/devtools): describe the filter scope toggle and data search for every adapter * docs({react,preact,solid,vue}-query-devtools): describe that the panel fills its container height by default * docs(framework/*/devtools): describe that the 'Key' filter scope matches the query hash, or the mutation key and submission time

…t matches instead of the row text (TanStack#12551)

@returns

…'s, and readonly 'state' in every '@returns' (TanStack#12548) * docs(vue-query/useQuery): describe 'state' in the '@returns' of the 'Defined' and fallback overloads * docs(vue-query/useQuery): describe 'state' as readonly in every '@returns' * docs(vue-query/useQuery): describe the result 'status' and the derived boolean 'ref's in every '@returns'

…lain boolean, and the '(query) => boolean' callback (TanStack#12547) * docs(vue-query): describe that 'enabled' passes the '(query) => boolean' callback through untracked * docs(vue-query): describe that a plain boolean 'enabled' isn't tracked and that 'enabled' callbacks need a required 'query' parameter * docs(vue-query): align the 'VueQueryEnabledOption' and 'UseInfiniteQueryOptions' JSDoc with the 'enabled' behavior * docs(vue-query): rewrap the 'enabled' paragraphs and describe 'UseInfiniteQueryOptions' with its type parameters * docs(vue-query): describe the 'TData' default in the 'QueryOptions' and 'UseQueryOptions' type parameters

… example (TanStack#12578)

…dd the missing 'vite.config.ts' so '@vitejs/plugin-react' is loaded (TanStack#12579)

…e> Example' and remove scaffold leftovers (TanStack#12580)

…includeResolutionSettings' and exclusion pruning (TanStack#12582) * chore(*): update pnpm to v12.18.0 and enable 'autoDedupe' * chore(pnpm-workspace.yaml): enable 'lockfile.includeResolutionSettings' so installs reuse the deduplicated lockfile * chore(pnpm-workspace.yaml): enable 'minimumReleaseAgeExcludePrune' and 'trustPolicyExcludePrune' to drop stale exclusions

…act Router in the scroll restoration examples (TanStack#12584)

…xample titles, and rename examples to '<feature>-<framework>' (TanStack#12583) * docs(examples): describe each example in its README with a summary, the framework it is built with, how it works and the npm commands * docs(examples): add the framework or router to the README heading and page title of examples that have variants * docs(examples/react): rename the Next.js examples to '<feature>-nextjs-<pages|app>-router' * docs(examples/react): update package names, docs links and labels, and the lockfile for the renamed Next.js examples * docs(examples): rename 'svelte/sveltekit', 'solid/solid-start-streaming' and 'angular/router' to '<feature>-<framework>' * docs(examples): correct README details on staleness, hydration, 'hasMore', streaming and dependent queries, and prefetch on 'focusin' in 'vue/prefetching-nuxt4'

* refactor: make query exports explicit * chore: exclude private package from changeset * refactor: preserve persistence core star re-exports * chore: require explicit exports with lint

…text', 'FallbackProps' and 'ErrorBoundaryProps' re-exports reported by knip (TanStack#12590)

…s/tailwind' with Tailwind CSS v4 via '@tailwindcss/vite', and align it with the current Astro template (TanStack#12585)

…xample (TanStack#12592)

… and 'test:types' so 'vue-demi-switch' does not race with vue example tasks (TanStack#12596)

…h', mock interceptors and 'tsconfig' across the examples (TanStack#12593)

@returns

…tatus' is 'error', 'success' or 'pending', and that 'data' is 'undefined' when 'select' throws with 'initialData' (TanStack#12601) * docs({react,preact,vue,solid,svelte,angular}-query): describe when 'status' is 'error', 'success' or 'pending' in the 'useQuery' '@returns' * docs({react,preact,vue,solid,svelte,angular}-query): describe 'status' by the query's current error, and note that 'data' is 'undefined' when 'select' throws on its first call with 'initialData'

Brings main (56d98b0) into solid-query-v6-pre (6bab31b). The three Solid packages keep the v6 implementation and tests. From main they take the tsdown build (with a rolldown plugin that runs the Solid 2.0 compiler in place of unplugin-solid), oxlint and oxfmt configs, the TS 5.7 to 7.1 type-test matrix, the explicit index exports, the initialData overload fixes, the fetchStatus/status filter omissions, the useMutationState select generics, and the devtools './production' entry, theme passthrough and panel height. The devtools keep the v6 clientOnly wrapper and lazy imports instead of main's NODE_ENV gate: Solid 2 DOM templates throw when the module is imported on the server, so a static import breaks SSR. The './production' entry uses the same wrapper. Not carried over from main because v6 rewrote the code they touch: useQueryClientResolver (TanStack#10571), the observer resubscribe order (TanStack#11920) and the useBaseQuery SSR cleanup (TanStack#11628). Solid examples and the new Astro and SolidStart integrations stay on main's v5 code. Examples resolve @tanstack/solid-query 5.x from the registry; the two integrations skip build and type checks until those frameworks support Solid 2. integrations/solid/vite is ported to Solid 2. main's pending tidy-query-exports changeset is limited to the Solid packages, because this branch is in changesets pre mode and would otherwise version the other packages as rc prereleases. The lockfile holds Solid at 2.0.0-rc.13 and @solidjs/vite-plugin at 3.0.0-next.46, the versions solid-query-v6-pre already resolved.

…tests Applies the test-style rules main introduced (typed mocks, strict equality, query() instead of prefetchQuery, describe wrappers) to the v6 tests and adds the JSDoc tags the jsdoc rules require on the v6 source. Three assertions on store-proxy data keep toEqual with a lint exemption, because toStrictEqual throws on the proxy.

changeset-bot · 2026-11-15T04:23:32Z

🦋 Changeset detected

Latest commit: e938b42

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 3 packages

Name	Type
@tanstack/solid-query	Patch
@tanstack/solid-query-persist-client	Patch
@tanstack/solid-query-devtools	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

coderabbitai · 2026-11-15T04:23:36Z

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

socket-security · 2026-11-15T04:24:51Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance
	eslint@9.39.4 ⏵ 9.39.5
	@size-limit/preset-small-lib@12.0.1 ⏵ 14.0.0				⁺⁸
	next@16.2.2 ⏵ 16.4.4	^-2	⁺⁷⁵	⁺¹
	@tanstack/typedoc-config@0.3.1 ⏵ 0.3.5	⁺²¹		⁺²	⁺¹
	@tanstack/solid-query-persist-client@5.107.1
	next@16.2.2 ⏵ 15.5.28	⁺²	⁺⁷⁵	⁺¹
	@tanstack/solid-virtual@3.13.52
	@tanstack/eslint-config@0.3.2 ⏵ 0.4.0			⁺²	^-2
	nx@22.1.3 ⏵ 23.2.1	⁺¹¹	⁺³¹
	@tanstack/solid-query-devtools@5.107.1
	@zag-js/preact@1.46.0
	@types/express@5.0.6
	@sveltejs/adapter-auto@6.1.1 ⏵ 7.0.1
	@types/compression@1.8.1
	@typescript-eslint/parser@8.58.1 ⏵ 8.72.0			⁺¹
	@babel/preset-typescript@7.28.5 ⏵ 7.29.7
	unplugin-solid@2.0.0
	@changesets/cli@2.30.0 ⏵ 3.0.3	⁺²		^-25	⁺¹
	@angular/platform-browser@20.3.18 ⏵ 22.2.4				^-1
	typescript-eslint@8.58.1 ⏵ 8.70.1			⁺¹
	@oxc-project/runtime@0.151.0
	@types/react-dom@19.2.3 ⏵ 19.3.0	⁺¹		⁺¹
	@react-navigation/native@6.1.18 ⏵ 7.5.1			⁺¹	⁺⁴⁸
	@typescript-eslint/rule-tester@8.58.1 ⏵ 8.72.0			⁺¹
	@react-navigation/stack@6.4.1 ⏵ 7.12.1	⁺¹			⁺⁵⁰
	@angular/compiler-cli@20.3.18 ⏵ 22.2.4			⁺¹	^-1
	@vueuse/core@15.0.0
	@babel/preset-env@7.29.2 ⏵ 7.29.7			⁺¹
	@sveltejs/package@2.5.7 ⏵ 2.5.8				^-2
	@angular/router@20.3.18 ⏵ 22.2.4		⁺²²		^-1
	@tanstack/svelte-pacer@0.2.0
	@tanstack/vue-pacer@0.2.0
See 122 more rows in the dashboard

View full report

socket-security · 2026-11-15T04:24:54Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Priority	Alert (click "▶" to expand/collapse)	Action
	High CVE: Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection CVE: GHSA-m8m8-qj5v-23w3 Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection (HIGH) Affected versions: >= 1.15.2 < 1.20.0 Patched version: 1.20.0 From: package.json → `npm/nx@23.2.1` → `npm/axios@1.18.1` ℹ Read more on: This package \| This alert \| What is a CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/axios@1.18.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	High CVE: Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF CVE: GHSA-r4gj-5m52-g5wh Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF (HIGH) Affected versions: >= 1.17.0 < 1.20.0 Patched version: 1.20.0 From: package.json → `npm/nx@23.2.1` → `npm/axios@1.18.1` ℹ Read more on: This package \| This alert \| What is a CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/axios@1.18.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	High CVE: Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS) CVE: GHSA-c29m-xwm3-cm6r Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS) (HIGH) Affected versions: >= 1.16.1 < 1.20.0 Patched version: 1.20.0 From: package.json → `npm/nx@23.2.1` → `npm/axios@1.18.1` ℹ Read more on: This package \| This alert \| What is a CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/axios@1.18.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	High CVE: Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location CVE: GHSA-mghh-pgcx-3jjj Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location (HIGH) Affected versions: >= 1.15.0 < 1.20.0 Patched version: 1.20.0 From: package.json → `npm/nx@23.2.1` → `npm/axios@1.18.1` ℹ Read more on: This package \| This alert \| What is a CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/axios@1.18.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	High CVE: Axios: Prototype Pollution Gadget in npm `axios` toFormData Options CVE: GHSA-x97p-jq2g-jp4f Axios: Prototype Pollution Gadget in axios toFormData Options (HIGH) Affected versions: >= 0.28.0 < 0.34.0; >= 1.15.1 < 1.20.0 Patched version: 1.20.0 From: package.json → `npm/nx@23.2.1` → `npm/axios@1.18.1` ℹ Read more on: This package \| This alert \| What is a CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/axios@1.18.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	High CVE: npm `follow-redirects`: Cross-realm sensitiveHeaders arrays are discarded and custom credentials can follow redirects CVE: GHSA-mrwp-f3q8-3g9p follow-redirects: Cross-realm sensitiveHeaders arrays are discarded and custom credentials can follow redirects (HIGH) Affected versions: >= 1.16.0 < 1.16.2 Patched version: 1.16.2 From: package.json → `npm/nx@23.2.1` → `npm/follow-redirects@1.16.0` ℹ Read more on: This package \| This alert \| What is a CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/follow-redirects@1.16.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	High CVE: npm `follow-redirects` array-form headers bypass cross-origin credential stripping CVE: GHSA-q3jh-wrc6-jgq8 follow-redirects array-form headers bypass cross-origin credential stripping (HIGH) Affected versions: >= 1.16.0 < 1.16.1 Patched version: 1.16.1 From: package.json → `npm/nx@23.2.1` → `npm/follow-redirects@1.16.0` ℹ Read more on: This package \| This alert \| What is a CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/follow-redirects@1.16.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	High CVE: npm `follow-redirects` sensitiveHeaders regex escaping can expose credential headers CVE: GHSA-8r9p-f939-6h3c follow-redirects sensitiveHeaders regex escaping can expose credential headers (HIGH) Affected versions: >= 1.16.0 < 1.16.1 Patched version: 1.16.1 From: package.json → `npm/nx@23.2.1` → `npm/follow-redirects@1.16.0` ℹ Read more on: This package \| This alert \| What is a CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/follow-redirects@1.16.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Low adoption: npm `@tanstack/preact-pacer` Location: Package overview From: examples/preact/algolia/package.json → `npm/@tanstack/preact-pacer@0.24.2` ℹ Read more on: This package \| This alert \| What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@tanstack/preact-pacer@0.24.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Low adoption: npm `unplugin-solid` Location: Package overview From: packages/query-devtools/package.json → `npm/unplugin-solid@2.0.0` ℹ Read more on: This package \| This alert \| What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/unplugin-solid@2.0.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Publisher changed: npm `@harperfast/extended-iterable` is now published by ethan_arrowood Author: ethan_arrowood From: examples/angular/auto-refetching/package.json → `npm/@angular/build@22.2.5` → `npm/@harperfast/extended-iterable@1.0.5` ℹ Read more on: This package \| This alert \| What is unstable ownership? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Try to reduce the number of authors you depend on to reduce the risk to malicious actors gaining access to your supply chain. Packages should remove inactive collaborators with publishing rights from packages on npm. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@harperfast/extended-iterable@1.0.5`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn

View full report

nx-cloud · 2026-11-15T04:25:46Z

View your CI Pipeline Execution ↗ for commit e938b42

Command	Status	Duration	Result
`nx affected --targets=test:sherif,test:knip,tes...`	✅ Succeeded	8m 54s	View ↗
`nx run-many --target=build --exclude=examples/*...`	✅ Succeeded	2m 17s	View ↗

☁️ Nx Cloud last updated this comment at 2026-11-15 04:35:36 UTC

pkg-pr-new · 2026-11-15T04:27:09Z

More templates

@tanstack/angular-query-experimental

npm i https://pkg.pr.new/@tanstack/angular-query-experimental@12603

@tanstack/eslint-plugin-query

npm i https://pkg.pr.new/@tanstack/eslint-plugin-query@12603

@tanstack/lit-query

npm i https://pkg.pr.new/@tanstack/lit-query@12603

@tanstack/preact-query

npm i https://pkg.pr.new/@tanstack/preact-query@12603

@tanstack/preact-query-devtools

npm i https://pkg.pr.new/@tanstack/preact-query-devtools@12603

@tanstack/preact-query-persist-client

npm i https://pkg.pr.new/@tanstack/preact-query-persist-client@12603

@tanstack/query-async-storage-persister

npm i https://pkg.pr.new/@tanstack/query-async-storage-persister@12603

@tanstack/query-broadcast-client-experimental

npm i https://pkg.pr.new/@tanstack/query-broadcast-client-experimental@12603

@tanstack/query-core

npm i https://pkg.pr.new/@tanstack/query-core@12603

@tanstack/query-devtools

npm i https://pkg.pr.new/@tanstack/query-devtools@12603

@tanstack/query-persist-client-core

npm i https://pkg.pr.new/@tanstack/query-persist-client-core@12603

@tanstack/query-sync-storage-persister

npm i https://pkg.pr.new/@tanstack/query-sync-storage-persister@12603

@tanstack/react-query

npm i https://pkg.pr.new/@tanstack/react-query@12603

@tanstack/react-query-devtools

npm i https://pkg.pr.new/@tanstack/react-query-devtools@12603

@tanstack/react-query-next-experimental

npm i https://pkg.pr.new/@tanstack/react-query-next-experimental@12603

@tanstack/react-query-persist-client

npm i https://pkg.pr.new/@tanstack/react-query-persist-client@12603

@tanstack/solid-query

npm i https://pkg.pr.new/@tanstack/solid-query@12603

@tanstack/solid-query-devtools

npm i https://pkg.pr.new/@tanstack/solid-query-devtools@12603

@tanstack/solid-query-persist-client

npm i https://pkg.pr.new/@tanstack/solid-query-persist-client@12603

@tanstack/svelte-query

npm i https://pkg.pr.new/@tanstack/svelte-query@12603

@tanstack/svelte-query-devtools

npm i https://pkg.pr.new/@tanstack/svelte-query-devtools@12603

@tanstack/svelte-query-persist-client

npm i https://pkg.pr.new/@tanstack/svelte-query-persist-client@12603

@tanstack/vue-query

npm i https://pkg.pr.new/@tanstack/vue-query@12603

@tanstack/vue-query-devtools

npm i https://pkg.pr.new/@tanstack/vue-query-devtools@12603

commit: e938b42

sukvvon and others added 30 commits October 23, 2026 12:21

refactor(query-persist-client-core/createPersister): rename the 'filt…

51e627f

…ers' option to 'persistFilters' internally to avoid shadowing (TanStack#12290)

refactor(lit-query/createQueriesController): rename the per-result 'o…

1117bdd

…bserver' in 'trackResult' to 'resultObserver' to avoid shadowing (TanStack#12291)

test(*/useMutationState): rename the built 'mutation' to 'existingMut…

86b9f20

…ation' to avoid shadowing the 'select' parameter (TanStack#12294)

test(*/useQuery): rename the 'throwOnError' callback parameter to 'er…

6bdeb13

…r' to avoid shadowing the returned 'error' (TanStack#12295)

docs(vue-query/queryClient): remove the author tag from the 'invalida…

75b5b6c

…teQueries' comment (TanStack#12296)

test(vue-query/useQueryClient): use named imports and 'importOriginal…

8c3c31a

…' in the 'vue-demi' mock (TanStack#12297)

test(lit-query): replace 'reparent' with 'reconnect' in the provider …

91b7e3b

…switch test titles (TanStack#12298)

chore(oxlint.config): add 'netinfo' to the cspell words (TanStack#12299)

6580131

test(solid-query/suspense): replace the 'TODO(lukemurray)' comments w…

0ab7c5f

…ith notes explaining why the state counts differ from react (TanStack#12300)

ci: apply automated fixes

4ed6095

test(solid-query/useInfiniteQuery): match the 'skipToken' test timer …

e1547fd

…advances to the 'queryFn' sleep of 10ms (TanStack#12305)

test(svelte-query-devtools): extract shared test setup into 'beforeEa…

bdd5031

…ch' (TanStack#12306)

chore(vue-query-devtools/package.json): restore the 'test:lib' script…

7a10cda

… removed in the Vite 8 update (TanStack#12307)

test(vue-query-devtools/devtools): add tests for forwarding option ch…

394ea29

…anges to the devtools instance after mount (TanStack#12308)

test(vue-query/queryOptions): add type tests for 'useQueries', 'query…

86740ae

…' with 'enabled: false' and 'skipToken', and undefined 'initialData' (TanStack#12309)

fix(svelte-query-devtools): stop defaulting the 'theme' prop to 'syst…

aff30e3

…em' so the theme chosen in the devtools settings applies when the prop is omitted (TanStack#12313)

fix(vue-query-devtools): stop defaulting the 'theme' prop to 'system'…

a282bf8

… so the theme chosen in the devtools settings applies when the prop is omitted (TanStack#12312)

fix(solid-query-devtools): stop defaulting the 'theme' prop to 'syste…

f232b75

…m' so the theme chosen in the devtools settings applies when the prop is omitted (TanStack#12310)

docs(*-devtools): describe how the 'theme' prop interacts with the th…

a5d5e00

…eme selected in the devtools Settings menu (TanStack#12314)

fix(angular-query-experimental/withDevtools): forward an unset 'theme…

9e42537

…' to the devtools so removing it falls back to the theme selected in the devtools Settings menu (TanStack#12315)

feat(angular-query-experimental/injectDevtoolsPanel): add the 'theme'…

8f9dfcb

… and 'hideDisabledQueries' options (TanStack#12316)

docs(angular/devtools): add an 'Embedded Mode' section for 'injectDev…

6c3cc51

…toolsPanel' (TanStack#12320)

test(preact-query/ErrorBoundary): name the 'react/no-did-update-set-s…

715574d

…tate' rule in the bare 'oxlint-disable-next-line' comment (TanStack#12323)

refactor(angular-query-experimental/injectQueries): remove the unnece…

faa41e9

…ssary 'QueryObserverOptions' assertion and its 'oxlint-disable' comment (TanStack#12324)

chore(angular-query-experimental/createBaseQuery): explain why 'types…

42ae5ca

…cript/no-unnecessary-type-assertion' is disabled for the 'refetch' wrapper (TanStack#12329)

chore(lit-query/{QueryClientProvider,BaseController}): explain why 't…

016b83e

…ypescript/no-unnecessary-condition' is disabled for the 'client' checks (TanStack#12328)

chore(eslint-plugin-query/detect-react-query-imports): explain why 't…

0c5ec06

…ypescript/no-unnecessary-condition' is disabled for the 'importKind' check (TanStack#12327)

sukvvon and others added 24 commits November 7, 2026 17:33

test(query-devtools/Explorer): replace 'İstanbul' with 'İpek' in the …

9705a4c

…Unicode lowercasing fixtures to clear 'cspell' warnings (TanStack#12549)

test(query-devtools/Explorer): rename the 'city' key passed to 'setVa…

ef6f3e0

…lue' to 'material' to match the signal type (TanStack#12550)

docs(framework/*/devtools): describe the 'Key' filter scope by what i…

5174c71

…t matches instead of the row text (TanStack#12551)

ci: apply automated fixes

8f6da1e

docs(examples): use the TanStack Query emblem as the favicon in every…

792f820

… example (TanStack#12578)

docs(examples/react/{basic-graphql-request,contacts-react-router}): a…

e55c775

…dd the missing 'vite.config.ts' so '@vitejs/plugin-react' is loaded (TanStack#12579)

docs(examples): unify page titles to 'TanStack <Framework> Query <Nam…

78a970a

…e> Example' and remove scaffold leftovers (TanStack#12580)

docs(react/guides/scroll-restoration): list TanStack Router before Re…

33aba0b

…act Router in the scroll restoration examples (TanStack#12584)

docs: expand agent contribution guidance (TanStack#12586)

10123d9

refactor: make query exports explicit (TanStack#12587)

b160291

* refactor: make query exports explicit * chore: exclude private package from changeset * refactor: preserve persistence core star re-exports * chore: require explicit exports with lint

ci: apply automated fixes

9b528b5

test(preact-query/ErrorBoundary): remove the unused 'ErrorBoundaryCon…

aa7990f

…text', 'FallbackProps' and 'ErrorBoundaryProps' re-exports reported by knip (TanStack#12590)

docs(examples/solid): rename 'astro' to 'ssr-astro', replace '@astroj…

7b3a72e

…s/tailwind' with Tailwind CSS v4 via '@tailwindcss/vite', and align it with the current Astro template (TanStack#12585)

docs(examples): use each framework's template '.gitignore' in every e…

19f555c

…xample (TanStack#12592)

chore(vue-query/package.json): set 'parallelism: false' on 'test:lib'…

2c1e767

… and 'test:types' so 'vue-demi-switch' does not race with vue example tasks (TanStack#12596)

docs(examples/angular): align 'angular.json', root components, 'OnPus…

36dd792

…h', mock interceptors and 'tsconfig' across the examples (TanStack#12593)

Navigation Menu

Repository navigation

chore: merge main into solid-query-v6-pre - #12603

chore: merge main into solid-query-v6-pre#12603
brenelz wants to merge 1148 commits into
TanStack:solid-query-v6-prefrom
brenelz:merge-main-into-solid-query-v6-pre

brenelz commented Nov 15, 2026

Uh oh!

changeset-bot Bot commented Nov 15, 2026

Uh oh!

coderabbitai Bot commented Nov 15, 2026

Draft PR not reviewed

Uh oh!

socket-security Bot commented Nov 15, 2026

Uh oh!

socket-security Bot commented Nov 15, 2026

Uh oh!

nx-cloud Bot commented Nov 15, 2026 •

edited

Loading

Uh oh!

pkg-pr-new Bot commented Nov 15, 2026

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

18 participants

Conversation

brenelz commented Nov 15, 2026

🎯 Changes

✅ Checklist

🚀 Release Impact

Uh oh!

changeset-bot Bot commented Nov 15, 2026

🦋 Changeset detected

Uh oh!

coderabbitai Bot commented Nov 15, 2026

Draft PR not reviewed

Uh oh!

socket-security Bot commented Nov 15, 2026

Uh oh!

socket-security Bot commented Nov 15, 2026

Uh oh!

nx-cloud Bot commented Nov 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pkg-pr-new Bot commented Nov 15, 2026

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

18 participants

nx-cloud Bot commented Nov 15, 2026 •

edited

Loading