Skip to content

chore(deps): bump the npm-dependencies group across 1 directory with 16 updates - #202

Merged
jorgenosberg merged 2 commits into
mainfrom
dependabot/npm_and_yarn/clients/tanstack-start/npm-dependencies-610ce36e60
Oct 12, 2026
Merged

jorgenosberg merged 2 commits into
mainfrom
dependabot/npm_and_yarn/clients/tanstack-start/npm-dependencies-610ce36e60

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 8, 2026

Copy link
Copy Markdown
Contributor

Bumps the npm-dependencies group with 16 updates in the /clients/tanstack-start directory:

Package From To
@auth0/auth0-server-js 1.14.0 1.16.0
@tanstack/react-query 5.103.2 5.104.0
@tanstack/react-router 1.170.39 1.170.41
@tanstack/react-start 1.168.58 1.168.60
@tanstack/router-core 1.171.32 1.171.34
@tanstack/router-plugin 1.168.40 1.168.42
lucide-react 1.47.0 1.49.0
maplibre-gl 6.10.0 6.11.2
srvx 1.0.3 1.0.5
@biomejs/biome 2.5.14 2.5.15
@tanstack/react-query-devtools 5.103.2 5.104.0
@types/node 26.6.2 26.6.4
@vitejs/plugin-react 6.1.1 6.1.2
jsdom 30.1.1 30.1.2
vite 8.3.1 8.3.2
vitest 5.0.0 5.0.3

Updates @auth0/auth0-server-js from 1.14.0 to 1.16.0

Commits
  • 7856a4a Release auth0-auth-js v1.16.0 (#288)
  • b4c6dcc feat(auth0-auth-js): add Session Transfer Ticket support to AnonymousSessionC...
  • 5cd1b54 fix(auth0-server-js): strip @​internal declarations from published types (SDK-...
  • 0d87aff Release auth0-server-js v1.15.0 (#285)
  • 7fd6317 feat(auth0-server-js): expose Experiment Center override params on Authorizat...
  • 11b4d96 feat(examples): add Enterprise Connect Express example (#259)
  • a91dbf9 Release auth0-server-js v1.14.0 (#282)
  • 3391d35 feat(auth0-server-js): add Enterprise Connect support (#258)
  • e8de286 docs: add layered CLAUDE.md/AGENTS.md agent guides (#272)
  • 4f41479 Release auth0-auth-js v1.15.0 (#273)
  • Additional commits viewable in compare view

Updates @tanstack/react-query from 5.103.2 to 5.104.0

Release notes

Sourced from @​tanstack/react-query's releases.

@​tanstack/react-query-devtools@​5.104.0

Minor Changes

Patch Changes

  • Updated dependencies [5279b05]:
    • @​tanstack/query-devtools@​5.104.0
    • @​tanstack/react-query@​5.104.0

@​tanstack/react-query-next-experimental@​5.104.0

Minor Changes

Patch Changes

  • Updated dependencies [5279b05]:
    • @​tanstack/react-query@​5.104.0

@​tanstack/react-query-persist-client@​5.104.0

Minor Changes

Patch Changes

  • Updated dependencies [5279b05]:
    • @​tanstack/react-query@​5.104.0
    • @​tanstack/query-persist-client-core@​5.104.0

@​tanstack/react-query@​5.104.0

Minor Changes

Patch Changes

  • Updated dependencies [5279b05]:
    • @​tanstack/query-core@​5.104.0

@​tanstack/react-query-devtools@​5.103.3

Patch Changes

@​tanstack/react-query-next-experimental@​5.103.3

... (truncated)

Changelog

Sourced from @​tanstack/react-query's changelog.

5.104.0

Minor Changes

Patch Changes

  • Updated dependencies [5279b05]:
    • @​tanstack/query-core@​5.104.0

5.103.3

Patch Changes

  • #11647 1c9693e - fix(codemods): avoid copying unnecessary files from codemods project
  • Updated dependencies []:
    • @​tanstack/query-core@​5.103.3
Commits
  • d4033eb ci: Version Packages (#11651)
  • 5279b05 chore(deps): update Vite from v6 to v8 (#11650)
  • fe053bf ci: Version Packages (#11612)
  • 1c9693e fix(codemods): update codemods build script (#11647)
  • f00aad6 chore(deps): update dev dependencies (#11640)
  • 2443290 test(*): rename 'console.error' spies to 'consoleErrorMock' (#11646)
  • fcab29f test({query-core,react-query,preact-query}): restore the previous 'isServer' ...
  • e8dacbe docs({react-query,preact-query,solid-query,svelte-query}/README): point the C...
  • 57f40eb chore(deps): update non-major dependencies (#11625)
  • 397ad07 test({query-core,react-query,preact-query,solid-query}): pass 'unhandledRejec...
  • Additional commits viewable in compare view

Updates @tanstack/react-router from 1.170.39 to 1.170.41

Release notes

Sourced from @​tanstack/react-router's releases.

@​tanstack/react-router@​1.170.41

Patch Changes

  • #8529 60b8ad1 - Compose only enabled route boundaries instead of rendering inactive wrapper components.

  • #8568 614bc27 - Update TanStack Store to 0.11.2 to prevent unrelated atom reads inside subscription observers from triggering extra notifications.

  • #8530 ff66a03 - Consolidate the root match context provider while preserving match context in the root shell.

  • #8522 863c8a7 - Reuse Link href classification and active/inactive results across location updates while preserving live history href formatting.

  • Updated dependencies [d521abd]:

    • @​tanstack/router-core@​1.171.34

@​tanstack/react-router@​1.170.40

Patch Changes

  • #8436 f5ffd38 - Skip unused Link preload cleanup when preloading is disabled and ignore queued viewport notifications after their effect has been cleaned up.

  • Updated dependencies [488d046, 0c1b5e3, 3cdd1af]:

    • @​tanstack/router-core@​1.171.33
Changelog

Sourced from @​tanstack/react-router's changelog.

1.170.41

Patch Changes

  • #8529 60b8ad1 - Compose only enabled route boundaries instead of rendering inactive wrapper components.

  • #8568 614bc27 - Update TanStack Store to 0.11.2 to prevent unrelated atom reads inside subscription observers from triggering extra notifications.

  • #8530 ff66a03 - Consolidate the root match context provider while preserving match context in the root shell.

  • #8522 863c8a7 - Reuse Link href classification and active/inactive results across location updates while preserving live history href formatting.

  • Updated dependencies [d521abd]:

    • @​tanstack/router-core@​1.171.34

1.170.40

Patch Changes

  • #8436 f5ffd38 - Skip unused Link preload cleanup when preloading is disabled and ignore queued viewport notifications after their effect has been cleaned up.

  • Updated dependencies [488d046, 0c1b5e3, 3cdd1af]:

    • @​tanstack/router-core@​1.171.33
Commits
  • 57e126e ci: Version Packages (#8531)
  • 614bc27 chore(deps): update TanStack Store to 0.11.2 (#8568)
  • 60b8ad1 perf(react-router): omit inactive route wrapper components (#8529)
  • 863c8a7 perf(react-router): reuse link selector results (#8522)
  • ff66a03 perf(react-router): consolidate root match provider (CodSpeed experiment) (#8...
  • f0e751d ci: Version Packages (#8497)
  • 763ac8b test(react-router): regression for #2072 router context invalidation (#8499)
  • f5ffd38 perf(router): skip unused link preload cleanup across adapters (#8436)
  • See full diff in compare view

Updates @tanstack/react-start from 1.168.58 to 1.168.60

Release notes

Sourced from @​tanstack/react-start's releases.

@​tanstack/react-start@​1.168.60

Patch Changes

@​tanstack/react-start@​1.168.59

Patch Changes

  • Updated dependencies [f5ffd38, 488d046, e81845f, 76a7c0b]:
    • @​tanstack/react-router@​1.170.40
    • @​tanstack/start-client-core@​1.170.33
    • @​tanstack/start-server-core@​1.169.38
    • @​tanstack/start-plugin-core@​1.171.48
    • @​tanstack/react-start-client@​1.168.38
    • @​tanstack/react-start-rsc@​0.1.58
    • @​tanstack/react-start-server@​1.167.45
Changelog

Sourced from @​tanstack/react-start's changelog.

1.168.60

Patch Changes

1.168.59

Patch Changes

  • Updated dependencies [f5ffd38, 488d046, e81845f, 76a7c0b]:
    • @​tanstack/react-router@​1.170.40
    • @​tanstack/start-client-core@​1.170.33
    • @​tanstack/start-server-core@​1.169.38
    • @​tanstack/start-plugin-core@​1.171.48
    • @​tanstack/react-start-client@​1.168.38
    • @​tanstack/react-start-rsc@​0.1.58
    • @​tanstack/react-start-server@​1.167.45
Commits

Updates @tanstack/router-core from 1.171.32 to 1.171.34

Release notes

Sourced from @​tanstack/router-core's releases.

@​tanstack/router-core@​1.171.34

Patch Changes

  • #8573 d521abd - Align server function request and response handling.

@​tanstack/router-core@​1.171.33

Patch Changes

  • #8297 488d046 - Update seroval and seroval-plugins from 1.6.2 to 1.6.7. This picks up the typed array length guard, the maxBase64Length and compactArrayBufferViews options, and the isStream export.

  • #8460 0c1b5e3 - Abort reserved loader generations with no remaining owners when invalidation removes them from discovery, ensuring their public abort signals are retired.

  • #8519 3cdd1af - Hand native scroll restoration back to the browser on pagehide, including entries entering BFCache, and reclaim manual restoration when a cached document resumes.

Changelog

Sourced from @​tanstack/router-core's changelog.

1.171.34

Patch Changes

  • #8573 d521abd - Align server function request and response handling.

1.171.33

Patch Changes

  • #8297 488d046 - Update seroval and seroval-plugins from 1.6.2 to 1.6.7. This picks up the typed array length guard, the maxBase64Length and compactArrayBufferViews options, and the isStream export.

  • #8460 0c1b5e3 - Abort reserved loader generations with no remaining owners when invalidation removes them from discovery, ensuring their public abort signals are retired.

  • #8519 3cdd1af - Hand native scroll restoration back to the browser on pagehide, including entries entering BFCache, and reclaim manual restoration when a cached document resumes.

Commits
  • 57e126e ci: Version Packages (#8531)
  • d521abd fix(start): align server function transport behavior (#8573)
  • 614bc27 chore(deps): update TanStack Store to 0.11.2 (#8568)
  • f0e751d ci: Version Packages (#8497)
  • 3cdd1af fix(router-core): restore native scroll restoration on reload (#8519)
  • 488d046 perf(router,start): update Seroval to 1.6.7 (#8297)
  • 0c1b5e3 fix(router-core): retire invalidated loader reservations (#8460)
  • faec323 fix(router-core): missing deepEqual signature changes in replace-equal-deep b...
  • See full diff in compare view

Updates @tanstack/router-plugin from 1.168.40 to 1.168.42

Release notes

Sourced from @​tanstack/router-plugin's releases.

@​tanstack/router-plugin@​1.168.42

Patch Changes

@​tanstack/router-plugin@​1.168.41

Patch Changes

Changelog

Sourced from @​tanstack/router-plugin's changelog.

1.168.42

Patch Changes

1.168.41

Patch Changes

Commits

Updates lucide-react from 1.47.0 to 1.49.0

Release notes

Sourced from lucide-react's releases.

Version 1.49.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.48.0...1.49.0

Version 1.48.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.47.0...1.48.0

Commits
  • e042fec fix(packages): declare @types/react as an optional peer dependency (#4892)
  • f06ac67 chore(typchecking): More typecheck jobs for all packages (#4885)
  • See full diff in compare view

Updates maplibre-gl from 6.10.0 to 6.11.2

Release notes

Sourced from maplibre-gl's releases.

v6.11.2

✨ Features and improvements

  • Improve rendering performance by uploading each tile's projection data once per frame instead of before every draw call (#8545) (by @​birkskyum)
  • Support multiple glyph variants in requests, caches, and atlases (#8488) (by @​NEKOYASAN)

🐞 Bug fixes

  • Fix Map#once(type, layerId, listener) unsubscribing on the first event that misses the layer instead of the first event that hits it (#8499) (by @​cherenkov)
  • Remove hillshade gradient toward the poles (#8551) (by @​birkskyum)
  • Fix camera settings being undone during camera movement with terrain or transformCameraUpdate (#8550) (by @​birkskyum)
  • Fix zooming and panning with the pointer above the horizon moving the map in the opposite direction (#8544) (by @​birkskyum)
  • Fix the camera jumping when a drag over terrain ends at a pitch above 84° (#8541) (by @​birkskyum)
  • Ease the center elevation over terrain during easeTo and flyTo instead of holding it and jumping when the animation ends (#8543) (by @​johncarmack1984)
  • Fix fitBounds and cameraForBounds throwing on the globe projection when the padding exceeds the viewport, instead of warning and returning undefined as on mercator (#8538) (by @​drakeo338)
  • Keep raster tiles sharp at a fractional devicePixelRatio, where the canvas covered a different number of device pixels than its backing store held and the compositor rescaled it (#1590) (by @​zdila)

v6.11.1

🐞 Bug fixes

  • Fix missing promoteId when merging queued updateData diffs in geojson source (#8500) (by @​cherenkov)
  • Sanitize attribution with an allow list of tags and attributes rather than a list of known-dangerous ones (#8532) (by @​HarelM)
  • Fix the camera jumping or bobbing around gestures over terrain, and ignoring terrain that loads after easeTo/flyTo (#8471) (by @​johncarmack1984)
  • Stop sending a vector tile to the worker when it was dropped while its request was being transformed or while the worker was still starting up, which left the parsed tile in the worker for the lifetime of the map (#8516) (by @​cherenkov)

v6.11.0

✨ Features and improvements

  • Fire a contextmenu map event on long press for touch devices (#373) (by @​kirthi-b)
  • Transition paint, light and sky properties that read global-state from the value they had when the state changes, where they snapped to the new value while holding idle for the transition duration (#8395) (by @​avosa)
  • Speed up cross-tile symbol matching for sources with promoteId by keying symbols on their feature id as well as their label (#8470, continues #7665) (by @​bradymadden97 and @​johncarmack1984)
  • Add Map#calculateAnchoredCameraOptions to calculate camera options that place a geographic anchor at a screen position without moving the map (#8288) (by @​xavierjs)
  • Skip the loaded-tile scan for constant symbol-height-offset layers when computing tile coverage (#8424) (by @​clement-igonet)
  • Type and document that an addProtocol handler may return an ImageBitmap or HTMLImageElement for an image resource, so decoded pixels are not encoded and decoded again (#8515) (by @​MannXo)

🐞 Bug fixes

  • Fade the globe atmosphere in with the camera's altitude, so the sky keeps the horizon until the atmosphere takes over from space (#8464) (by @​birkskyum)
  • Report worker script failures through the map error event (#8018) (by @​xavierjs)
  • Fix slow panning and zooming in Firefox on macOS since 6.8.0 (#8468) (by @​timsluis and @​birkskyum)
  • Keep source-specific tile LOD settings from changing internal terrain render-to-texture tile selection (#8048) (by @​DoFabien)
  • Fix map.setSky() silently keeping the old sky and firing no error event when the value included a -transition key (#8375) (by @​Yasser-Ameur)
  • Fix markers and popups misplaced after a projection change or by terrain that loads after the map settled. (#8433) (by @​patte)
  • Insert sanitized attribution HTML as DOM nodes instead of re-parsing a serialized string (#8528) (by @​cherenkov)
Changelog

Sourced from maplibre-gl's changelog.

6.11.2

✨ Features and improvements

  • Improve rendering performance by uploading each tile's projection data once per frame instead of before every draw call (#8545) (by @​birkskyum)
  • Support multiple glyph variants in requests, caches, and atlases (#8488) (by @​NEKOYASAN)

🐞 Bug fixes

  • Fix Map#once(type, layerId, listener) unsubscribing on the first event that misses the layer instead of the first event that hits it (#8499) (by @​cherenkov)
  • Remove hillshade gradient toward the poles (#8551) (by @​birkskyum)
  • Fix camera settings being undone during camera movement with terrain or transformCameraUpdate (#8550) (by @​birkskyum)
  • Fix zooming and panning with the pointer above the horizon moving the map in the opposite direction (#8544) (by @​birkskyum)
  • Fix the camera jumping when a drag over terrain ends at a pitch above 84° (#8541) (by @​birkskyum)
  • Ease the center elevation over terrain during easeTo and flyTo instead of holding it and jumping when the animation ends (#8543) (by @​johncarmack1984)
  • Fix fitBounds and cameraForBounds throwing on the globe projection when the padding exceeds the viewport, instead of warning and returning undefined as on mercator (#8538) (by @​drakeo338)
  • Keep raster tiles sharp at a fractional devicePixelRatio, where the canvas covered a different number of device pixels than its backing store held and the compositor rescaled it (#1590) (by @​zdila)

6.11.1

🐞 Bug fixes

  • Fix missing promoteId when merging queued updateData diffs in geojson source (#8500) (by @​cherenkov)
  • Sanitize attribution with an allow list of tags and attributes rather than a list of known-dangerous ones (#8532) (by @​HarelM)
  • Fix the camera jumping or bobbing around gestures over terrain, and ignoring terrain that loads after easeTo/flyTo (#8471) (by @​johncarmack1984)
  • Stop sending a vector tile to the worker when it was dropped while its request was being transformed or while the worker was still starting up, which left the parsed tile in the worker for the lifetime of the map (#8516) (by @​cherenkov)

6.11.0

✨ Features and improvements

  • Fire a contextmenu map event on long press for touch devices (#373) (by @​kirthi-b)
  • Transition paint, light and sky properties that read global-state from the value they had when the state changes, where they snapped to the new value while holding idle for the transition duration (#8395) (by @​avosa)
  • Speed up cross-tile symbol matching for sources with promoteId by keying symbols on their feature id as well as their label (#8470, continues #7665) (by @​bradymadden97 and @​johncarmack1984)
  • Add Map#calculateAnchoredCameraOptions to calculate camera options that place a geographic anchor at a screen position without moving the map (#8288) (by @​xavierjs)
  • Skip the loaded-tile scan for constant symbol-height-offset layers when computing tile coverage (#8424) (by @​clement-igonet)
  • Type and document that an addProtocol handler may return an ImageBitmap or HTMLImageElement for an image resource, so decoded pixels are not encoded and decoded again (#8515) (by @​MannXo)

🐞 Bug fixes

  • Fade the globe atmosphere in with the camera's altitude, so the sky keeps the horizon until the atmosphere takes over from space (#8464) (by @​birkskyum)
  • Report worker script failures through the map error event (#8018) (by @​xavierjs)
  • Fix slow panning and zooming in Firefox on macOS since 6.8.0 (#8468) (by @​timsluis and @​birkskyum)
  • Keep source-specific tile LOD settings from changing internal terrain render-to-texture tile selection (#8048) (by @​DoFabien)
  • Fix map.setSky() silently keeping the old sky and firing no error event when the value included a -transition key (#8375) (by @​Yasser-Ameur)
  • Fix markers and popups misplaced after a projection change or by terrain that loads after the map settled. (#8433) (by @​patte)
  • Insert sanitized attribution HTML as DOM nodes instead of re-parsing a serialized string (

…16 updates

Bumps the npm-dependencies group with 16 updates in the /clients/tanstack-start directory:

| Package | From | To |
| --- | --- | --- |
| [@auth0/auth0-server-js](https://github.com/auth0/auth0-auth-js) | `1.14.0` | `1.16.0` |
| [@tanstack/react-query](https://github.com/TanStack/query/tree/HEAD/packages/react-query) | `5.103.2` | `5.104.0` |
| [@tanstack/react-router](https://github.com/TanStack/router/tree/HEAD/packages/react-router) | `1.170.39` | `1.170.41` |
| [@tanstack/react-start](https://github.com/TanStack/router/tree/HEAD/packages/react-start) | `1.168.58` | `1.168.60` |
| [@tanstack/router-core](https://github.com/TanStack/router/tree/HEAD/packages/router-core) | `1.171.32` | `1.171.34` |
| [@tanstack/router-plugin](https://github.com/TanStack/router/tree/HEAD/packages/router-plugin) | `1.168.40` | `1.168.42` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.47.0` | `1.49.0` |
| [maplibre-gl](https://github.com/maplibre/maplibre-gl-js) | `6.10.0` | `6.11.2` |
| [srvx](https://github.com/h3js/srvx) | `1.0.3` | `1.0.5` |
| [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome) | `2.5.14` | `2.5.15` |
| [@tanstack/react-query-devtools](https://github.com/TanStack/query/tree/HEAD/packages/react-query-devtools) | `5.103.2` | `5.104.0` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.6.2` | `26.6.4` |
| [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) | `6.1.1` | `6.1.2` |
| [jsdom](https://github.com/jsdom/jsdom) | `30.1.1` | `30.1.2` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.3.1` | `8.3.2` |
| [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `5.0.0` | `5.0.3` |



Updates `@auth0/auth0-server-js` from 1.14.0 to 1.16.0
- [Release notes](https://github.com/auth0/auth0-auth-js/releases)
- [Commits](auth0/auth0-auth-js@auth0-auth-js-v1.14.0...auth0-auth-js-v1.16.0)

Updates `@tanstack/react-query` from 5.103.2 to 5.104.0
- [Release notes](https://github.com/TanStack/query/releases)
- [Changelog](https://github.com/TanStack/query/blob/main/packages/react-query/CHANGELOG.md)
- [Commits](https://github.com/TanStack/query/commits/@tanstack/react-query@5.104.0/packages/react-query)

Updates `@tanstack/react-router` from 1.170.39 to 1.170.41
- [Release notes](https://github.com/TanStack/router/releases)
- [Changelog](https://github.com/TanStack/router/blob/main/packages/react-router/CHANGELOG.md)
- [Commits](https://github.com/TanStack/router/commits/@tanstack/react-router@1.170.41/packages/react-router)

Updates `@tanstack/react-start` from 1.168.58 to 1.168.60
- [Release notes](https://github.com/TanStack/router/releases)
- [Changelog](https://github.com/TanStack/router/blob/main/packages/react-start/CHANGELOG.md)
- [Commits](https://github.com/TanStack/router/commits/@tanstack/react-start@1.168.60/packages/react-start)

Updates `@tanstack/router-core` from 1.171.32 to 1.171.34
- [Release notes](https://github.com/TanStack/router/releases)
- [Changelog](https://github.com/TanStack/router/blob/main/packages/router-core/CHANGELOG.md)
- [Commits](https://github.com/TanStack/router/commits/@tanstack/router-core@1.171.34/packages/router-core)

Updates `@tanstack/router-plugin` from 1.168.40 to 1.168.42
- [Release notes](https://github.com/TanStack/router/releases)
- [Changelog](https://github.com/TanStack/router/blob/main/packages/router-plugin/CHANGELOG.md)
- [Commits](https://github.com/TanStack/router/commits/@tanstack/router-plugin@1.168.42/packages/router-plugin)

Updates `lucide-react` from 1.47.0 to 1.49.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.49.0/packages/lucide-react)

Updates `maplibre-gl` from 6.10.0 to 6.11.2
- [Release notes](https://github.com/maplibre/maplibre-gl-js/releases)
- [Changelog](https://github.com/maplibre/maplibre-gl-js/blob/main/CHANGELOG.md)
- [Commits](maplibre/maplibre-gl-js@v6.10.0...v6.11.2)

Updates `srvx` from 1.0.3 to 1.0.5
- [Release notes](https://github.com/h3js/srvx/releases)
- [Changelog](https://github.com/h3js/srvx/blob/main/CHANGELOG.md)
- [Commits](h3js/srvx@v1.0.3...v1.0.5)

Updates `@biomejs/biome` from 2.5.14 to 2.5.15
- [Release notes](https://github.com/biomejs/biome/releases)
- [Changelog](https://github.com/biomejs/biome/blob/main/packages/@biomejs/biome/CHANGELOG.md)
- [Commits](https://github.com/biomejs/biome/commits/@biomejs/biome@2.5.15/packages/@biomejs/biome)

Updates `@tanstack/react-query-devtools` from 5.103.2 to 5.104.0
- [Release notes](https://github.com/TanStack/query/releases)
- [Changelog](https://github.com/TanStack/query/blob/main/packages/react-query-devtools/CHANGELOG.md)
- [Commits](https://github.com/TanStack/query/commits/@tanstack/react-query-devtools@5.104.0/packages/react-query-devtools)

Updates `@types/node` from 26.6.2 to 26.6.4
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `@vitejs/plugin-react` from 6.1.1 to 6.1.2
- [Release notes](https://github.com/vitejs/vite-plugin-react/releases)
- [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.1.2/packages/plugin-react)

Updates `jsdom` from 30.1.1 to 30.1.2
- [Release notes](https://github.com/jsdom/jsdom/releases)
- [Commits](jsdom/jsdom@v30.1.1...v30.1.2)

Updates `vite` from 8.3.1 to 8.3.2
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.3.2/packages/vite)

Updates `vitest` from 5.0.0 to 5.0.3
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.3/packages/vitest)

---
updated-dependencies:
- dependency-name: "@auth0/auth0-server-js"
  dependency-version: 1.16.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
- dependency-name: "@tanstack/react-query"
  dependency-version: 5.104.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
- dependency-name: "@tanstack/react-router"
  dependency-version: 1.170.41
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
- dependency-name: "@tanstack/react-start"
  dependency-version: 1.168.60
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
- dependency-name: "@tanstack/router-core"
  dependency-version: 1.171.34
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
- dependency-name: "@tanstack/router-plugin"
  dependency-version: 1.168.42
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
- dependency-name: lucide-react
  dependency-version: 1.49.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
- dependency-name: maplibre-gl
  dependency-version: 6.11.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
- dependency-name: srvx
  dependency-version: 1.0.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
- dependency-name: "@biomejs/biome"
  dependency-version: 2.5.15
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
- dependency-name: "@tanstack/react-query-devtools"
  dependency-version: 5.104.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
- dependency-name: "@types/node"
  dependency-version: 26.6.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
- dependency-name: "@vitejs/plugin-react"
  dependency-version: 6.1.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
- dependency-name: jsdom
  dependency-version: 30.1.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
- dependency-name: vite
  dependency-version: 8.3.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
- dependency-name: vitest
  dependency-version: 5.0.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Dependabot PR javascript Pull requests that update javascript code labels Oct 8, 2026
Copilot AI balanced review requested due to automatic review settings October 8, 2026 10:43
@dependabot dependabot Bot added dependencies Dependabot PR javascript Pull requests that update javascript code labels Oct 8, 2026

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Changes recommended

The router-core manifest update conflicts with the workspace override and stale lockfile importer.

1 open finding
What changed in this PR

Updates 16 runtime and development dependencies for the TanStack Start client.

Changes:

  • Bumps TanStack, Auth0, MapLibre, Vite, Vitest, and related packages.
  • Refreshes transitive dependency resolutions.
File Description
clients/​tanstack-start/​package.json Updates direct dependency versions.
clients/​tanstack-start/​pnpm-lock.yaml Updates resolved dependency versions and integrity data.
Files not reviewed (1)
  • clients/tanstack-start/pnpm-lock.yaml: Generated file

🧠 Review effort: Balanced


Give feedback about Copilot approvals in this survey to enter a drawing for a $150 gift card.

Comment thread clients/tanstack-start/package.json
@github-actions

Copy link
Copy Markdown

Docker Scan - Alert(s) found with threshold matching severity high

Results

  • critical: 0
  • high: 13
  • medium: 7
  • low: 4

Docker Scan Report can be found here

Allowlist

Use the allowlist if you want to ignore vulnerabilities that do not affect the repository.
See the Docker Scan documentation on how to use allowlist.

@jorgenosberg
jorgenosberg merged commit ee502de into main Oct 12, 2026
16 checks passed
@jorgenosberg
jorgenosberg deleted the dependabot/npm_and_yarn/clients/tanstack-start/npm-dependencies-610ce36e60 branch October 12, 2026 13:11
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Dependabot PR javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants