Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/autofix.yml
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v6.0.1
uses: actions/checkout@v6.0.2
- name: Setup Tools
uses: tanstack/config/.github/setup@main
- name: Fix formatting
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/pr.yml
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v6.0.1
uses: actions/checkout@v6.0.2
with:
fetch-depth: 0
- name: Setup Tools
Expand All @@ -39,7 +39,7 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v6.0.1
uses: actions/checkout@v6.0.2
with:
fetch-depth: 0
- name: Setup Tools
Expand All @@ -53,7 +53,7 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v6.0.1
uses: actions/checkout@v6.0.2
with:
fetch-depth: 0
- name: Check Provenance
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/release.yml
Original file line number Diff line number Diff line change
Expand Up @@ -23,15 +23,15 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v6.0.1
uses: actions/checkout@v6.0.2
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "Unpinned GitHub Actions references in workflows:"
rg -nP '^\s*uses:\s*[^@]+@(?![0-9a-f]{40}\b)\S+' .github/workflows

echo
echo "Resolve immutable SHAs for tags touched in this PR:"
for item in "actions/checkout v6.0.2" "changesets/action v1.7.0"; do
  repo=$(awk '{print $1}' <<<"$item")
  tag=$(awk '{print $2}' <<<"$item")
  sha=$(git ls-remote --refs --tags "https://github.com/${repo}.git" \
        "refs/tags/${tag}" "refs/tags/${tag}^{}" | awk 'END{print $1}')
  printf "%s@%s -> %s\n" "$repo" "$tag" "$sha"
done

Repository: TanStack/devtools

Length of output: 1721


Pin GitHub Actions to immutable commit SHAs.

Lines 26 and 34 use mutable version tags. Pinning to full commit SHAs improves CI integrity and provenance; keep the tag as a trailing comment for readability. Apply the same pattern to all checkout actions in .github/workflows/pr.yml (lines 26, 42, and 56).

Suggested changes
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
...
-        uses: changesets/action@v1.7.0
+        uses: changesets/action@e87c8ed249971350e47fab7515075f44eb134e5b # v1.7.0
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
uses: actions/checkout@v6.0.2
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/release.yml at line 26, Replace mutable action references
like uses: actions/checkout@v6.0.2 with the immutable commit SHA form (e.g.,
uses: actions/checkout@<FULL_COMMIT_SHA>) while preserving the human-friendly
tag as a trailing comment (e.g., # v6.0.2) to maintain readability; update the
checkout usages in the release workflow (the uses: actions/checkout entries) and
apply the same SHA-pinning pattern to the checkout actions referenced in pr.yml
(the uses: actions/checkout entries on the other specified lines).

with:
fetch-depth: 0
- name: Setup Tools
uses: tanstack/config/.github/setup@main
- name: Run Tests
run: pnpm run test:ci
- name: Run Changesets (version or publish)
uses: changesets/action@v1.5.3
uses: changesets/action@v1.7.0
with:
version: pnpm run changeset:version
publish: pnpm run changeset:publish
Expand Down
10 changes: 5 additions & 5 deletions examples/preact/basic/package.json
Original file line number Diff line number Diff line change
Expand Up @@ -12,15 +12,15 @@
"@tanstack/devtools-client": "0.0.6",
"@tanstack/devtools-event-client": "0.4.3",
"@tanstack/preact-devtools": "workspace:*",
"preact": "^10.28.0",
"zod": "^4.3.5"
"preact": "^10.29.0",
"zod": "^4.3.6"
},
"devDependencies": {
"@preact/preset-vite": "^2.10.2",
"@preact/preset-vite": "^2.10.3",
"@tanstack/devtools-ui": "0.5.0",
"@tanstack/devtools-vite": "0.5.5",
"sonda": "0.9.0",
"vite": "^7.1.7",
"sonda": "0.11.1",
"vite": "^7.3.1",
"vite-plugin-inspect": "11.3.3"
},
"browserslist": {
Expand Down
6 changes: 3 additions & 3 deletions examples/preact/custom-devtools/package.json
Original file line number Diff line number Diff line change
Expand Up @@ -11,11 +11,11 @@
"dependencies": {
"@tanstack/devtools-event-client": "0.4.3",
"@tanstack/preact-devtools": "workspace:*",
"preact": "^10.28.0"
"preact": "^10.29.0"
},
"devDependencies": {
"@preact/preset-vite": "^2.10.2",
"vite": "^7.1.7"
"@preact/preset-vite": "^2.10.3",
"vite": "^7.3.1"
},
"browserslist": {
"production": [
Expand Down
12 changes: 6 additions & 6 deletions examples/react/a11y-devtools/package.json
Original file line number Diff line number Diff line change
Expand Up @@ -11,14 +11,14 @@
"dependencies": {
"@tanstack/devtools-a11y": "workspace:*",
"@tanstack/react-devtools": "^0.9.13",
"react": "^19.2.0",
"react-dom": "^19.2.0"
"react": "^19.2.4",
"react-dom": "^19.2.4"
},
"devDependencies": {
"@types/react": "^19.2.0",
"@types/react-dom": "^19.2.0",
"@vitejs/plugin-react": "^5.0.4",
"vite": "^7.1.7"
"@types/react": "^19.2.14",
"@types/react-dom": "^19.2.3",
"@vitejs/plugin-react": "^5.2.0",
"vite": "^7.3.1"
},
"browserslist": {
"production": [
Expand Down
28 changes: 14 additions & 14 deletions examples/react/basic/package.json
Original file line number Diff line number Diff line change
Expand Up @@ -12,24 +12,24 @@
"@tanstack/devtools-client": "0.0.6",
"@tanstack/devtools-event-client": "0.4.3",
"@tanstack/react-devtools": "^0.9.13",
"@tanstack/react-form": "^1.23.7",
"@tanstack/react-query": "^5.90.1",
"@tanstack/react-query-devtools": "^5.90.1",
"@tanstack/react-router": "^1.132.0",
"@tanstack/react-router-devtools": "^1.132.0",
"react": "^19.2.0",
"react-dom": "^19.2.0",
"zod": "^4.3.5"
"@tanstack/react-form": "^1.28.5",
"@tanstack/react-query": "^5.90.21",
"@tanstack/react-query-devtools": "^5.91.3",
"@tanstack/react-router": "^1.167.0",
"@tanstack/react-router-devtools": "^1.166.7",
"react": "^19.2.4",
"react-dom": "^19.2.4",
"zod": "^4.3.6"
},
"devDependencies": {
"@tanstack/devtools-ui": "0.5.0",
"@tanstack/devtools-vite": "0.5.5",
"@tanstack/react-form-devtools": "^0.1.7",
"@types/react": "^19.2.0",
"@types/react-dom": "^19.2.0",
"@vitejs/plugin-react": "^5.0.4",
"sonda": "0.9.0",
"vite": "^7.1.7",
"@tanstack/react-form-devtools": "^0.2.18",
"@types/react": "^19.2.14",
"@types/react-dom": "^19.2.3",
"@vitejs/plugin-react": "^5.2.0",
"sonda": "0.11.1",
"vite": "^7.3.1",
"vite-plugin-inspect": "11.3.3"
},
"browserslist": {
Expand Down
60 changes: 30 additions & 30 deletions examples/react/bundling-repro/package.json
Original file line number Diff line number Diff line change
Expand Up @@ -13,8 +13,8 @@
"deploy": "npm run build && wrangler deploy"
},
"dependencies": {
"@cloudflare/vite-plugin": "^1.13.8",
"@tailwindcss/vite": "^4.0.6",
"@cloudflare/vite-plugin": "^1.28.0",
"@tailwindcss/vite": "^4.2.1",
"@tanstack/ai": "latest",
"@tanstack/ai-anthropic": "latest",
"@tanstack/ai-client": "latest",
Expand All @@ -24,44 +24,44 @@
"@tanstack/ai-react": "latest",
"@tanstack/react-ai-devtools": "latest",
"@tanstack/react-devtools": "latest",
"@tanstack/react-query": "^5.90.1",
"@tanstack/react-query-devtools": "^5.90.1",
"@tanstack/react-router": "^1.132.0",
"@tanstack/react-router-devtools": "^1.132.0",
"@tanstack/react-router-ssr-query": "^1.131.7",
"@tanstack/react-start": "^1.132.0",
"@tanstack/react-store": "^0.9.0",
"@tanstack/router-plugin": "^1.132.0",
"@tanstack/store": "^0.9.0",
"@tanstack/react-query": "^5.90.21",
"@tanstack/react-query-devtools": "^5.91.3",
"@tanstack/react-router": "^1.167.0",
"@tanstack/react-router-devtools": "^1.166.7",
"@tanstack/react-router-ssr-query": "^1.166.7",
"@tanstack/react-start": "^1.166.11",
"@tanstack/react-store": "^0.9.2",
"@tanstack/router-plugin": "^1.166.9",
"@tanstack/store": "^0.9.2",
"class-variance-authority": "^0.7.1",
"clsx": "^2.1.1",
"highlight.js": "^11.11.1",
"lucide-react": "^0.561.0",
"react": "^19.2.0",
"react-dom": "^19.2.0",
"streamdown": "^1.6.5",
"tailwind-merge": "^3.0.2",
"tailwindcss": "^4.0.6",
"tw-animate-css": "^1.3.6",
"vite-tsconfig-paths": "^6.0.2",
"zod": "^4.3.5"
"lucide-react": "^0.577.0",
"react": "^19.2.4",
"react-dom": "^19.2.4",
"streamdown": "^1.6.11",
"tailwind-merge": "^3.5.0",
"tailwindcss": "^4.2.1",
"tw-animate-css": "^1.4.0",
"vite-tsconfig-paths": "^6.1.1",
"zod": "^4.3.6"
},
"devDependencies": {
"@biomejs/biome": "2.2.4",
"@biomejs/biome": "2.4.7",
"@tanstack/devtools-event-client": "latest",
"@tanstack/devtools-vite": "0.5.5",
"@testing-library/dom": "^10.4.0",
"@testing-library/react": "^16.2.0",
"@testing-library/dom": "^10.4.1",
"@testing-library/react": "^16.3.2",
"@types/node": "^22.15.2",
"@types/react": "^19.2.0",
"@types/react-dom": "^19.2.0",
"@vitejs/plugin-react": "^5.0.4",
"@types/react": "^19.2.14",
"@types/react-dom": "^19.2.3",
"@vitejs/plugin-react": "^5.2.0",
"babel-plugin-react-compiler": "^1.0.0",
"jsdom": "^27.0.0",
"typescript": "~5.9.2",
"vite": "^7.1.7",
"jsdom": "^27.4.0",
"typescript": "~5.9.3",
"vite": "^7.3.1",
"vitest": "^3.2.4",
"web-vitals": "^5.1.0",
"wrangler": "^4.40.3"
"wrangler": "^4.73.0"
}
}
12 changes: 6 additions & 6 deletions examples/react/custom-devtools/package.json
Original file line number Diff line number Diff line change
Expand Up @@ -11,14 +11,14 @@
"dependencies": {
"@tanstack/devtools-event-client": "0.4.3",
"@tanstack/react-devtools": "^0.9.13",
"react": "^19.2.0",
"react-dom": "^19.2.0"
"react": "^19.2.4",
"react-dom": "^19.2.4"
},
"devDependencies": {
"@types/react": "^19.2.0",
"@types/react-dom": "^19.2.0",
"@vitejs/plugin-react": "^5.0.4",
"vite": "^7.1.7"
"@types/react": "^19.2.14",
"@types/react-dom": "^19.2.3",
"@vitejs/plugin-react": "^5.2.0",
"vite": "^7.3.1"
},
"browserslist": {
"production": [
Expand Down
24 changes: 12 additions & 12 deletions examples/react/drizzle/package.json
Original file line number Diff line number Diff line change
Expand Up @@ -9,22 +9,22 @@
},
"dependencies": {
"@tanstack/react-devtools": "^0.9.13",
"@tanstack/react-router": "^1.132.0",
"@tanstack/react-router-devtools": "^1.132.0",
"@tanstack/react-start": "^1.132.0",
"react": "^19.2.0",
"react-dom": "^19.2.0"
"@tanstack/react-router": "^1.167.0",
"@tanstack/react-router-devtools": "^1.166.7",
"@tanstack/react-start": "^1.166.11",
"react": "^19.2.4",
"react-dom": "^19.2.4"
},
"devDependencies": {
"@tanstack/devtools-vite": "0.5.5",
"@types/node": "^22.15.2",
"@types/react": "^19.2.0",
"@types/react-dom": "^19.2.0",
"drizzle-kit": "^0.31.4",
"drizzle-orm": "^0.44.5",
"pg": "^8.16.3",
"typescript": "~5.9.2",
"vite": "^7.1.7",
"@types/react": "^19.2.14",
"@types/react-dom": "^19.2.3",
"drizzle-kit": "^0.31.9",
"drizzle-orm": "^0.45.1",
"pg": "^8.20.0",
"typescript": "~5.9.3",
"vite": "^7.3.1",
"vite-plugin-inspect": "11.3.3"
}
}
24 changes: 12 additions & 12 deletions examples/react/https/package.json
Original file line number Diff line number Diff line change
Expand Up @@ -11,23 +11,23 @@
"dependencies": {
"@tanstack/devtools-event-client": "0.4.3",
"@tanstack/react-devtools": "^0.9.13",
"@tanstack/react-query": "^5.90.1",
"@tanstack/react-query-devtools": "^5.90.1",
"@tanstack/react-router": "^1.132.0",
"@tanstack/react-router-devtools": "^1.132.0",
"react": "^19.2.0",
"react-dom": "^19.2.0",
"zod": "^4.3.5"
"@tanstack/react-query": "^5.90.21",
"@tanstack/react-query-devtools": "^5.91.3",
"@tanstack/react-router": "^1.167.0",
"@tanstack/react-router-devtools": "^1.166.7",
"react": "^19.2.4",
"react-dom": "^19.2.4",
"zod": "^4.3.6"
},
"devDependencies": {
"@tanstack/devtools-ui": "0.5.0",
"@tanstack/devtools-vite": "0.5.5",
"@types/react": "^19.2.0",
"@types/react-dom": "^19.2.0",
"@vitejs/plugin-react": "^5.0.4",
"vite": "^7.1.7",
"@types/react": "^19.2.14",
"@types/react-dom": "^19.2.3",
"@vitejs/plugin-react": "^5.2.0",
"vite": "^7.3.1",
"vite-plugin-inspect": "11.3.3",
"vite-plugin-mkcert": "^1.17.8"
"vite-plugin-mkcert": "^1.17.10"
},
"browserslist": {
"production": [
Expand Down
38 changes: 19 additions & 19 deletions examples/react/start/package.json
Original file line number Diff line number Diff line change
Expand Up @@ -9,32 +9,32 @@
"test": "vitest run"
},
"dependencies": {
"@tailwindcss/vite": "^4.0.6",
"@tailwindcss/vite": "^4.2.1",
"@tanstack/devtools-event-client": "workspace:*",
"@tanstack/react-devtools": "^0.9.13",
"@tanstack/react-router": "^1.132.0",
"@tanstack/react-router-devtools": "^1.132.0",
"@tanstack/react-router-ssr-query": "^1.131.7",
"@tanstack/react-start": "^1.132.0",
"@tanstack/router-plugin": "^1.132.0",
"lucide-react": "^0.561.0",
"@tanstack/react-router": "^1.167.0",
"@tanstack/react-router-devtools": "^1.166.7",
"@tanstack/react-router-ssr-query": "^1.166.7",
"@tanstack/react-start": "^1.166.11",
"@tanstack/router-plugin": "^1.166.9",
"lucide-react": "^0.577.0",
"nitro": "latest",
"react": "^19.2.0",
"react-dom": "^19.2.0",
"tailwindcss": "^4.0.6",
"vite-tsconfig-paths": "^6.0.2"
"react": "^19.2.4",
"react-dom": "^19.2.4",
"tailwindcss": "^4.2.1",
"vite-tsconfig-paths": "^6.1.1"
},
"devDependencies": {
"@tanstack/devtools-vite": "0.5.5",
"@testing-library/dom": "^10.4.0",
"@testing-library/react": "^16.2.0",
"@testing-library/dom": "^10.4.1",
"@testing-library/react": "^16.3.2",
"@types/node": "^22.15.2",
"@types/react": "^19.2.0",
"@types/react-dom": "^19.2.0",
"@vitejs/plugin-react": "^5.0.4",
"jsdom": "^27.0.0",
"typescript": "~5.9.2",
"vite": "^7.1.7",
"@types/react": "^19.2.14",
"@types/react-dom": "^19.2.3",
"@vitejs/plugin-react": "^5.2.0",
"jsdom": "^27.4.0",
"typescript": "~5.9.3",
"vite": "^7.3.1",
"vitest": "^3.2.4",
"web-vitals": "^5.1.0"
}
Expand Down
Loading
Loading