chore: solid router v2 pre main sync (#7517)

* fix: republish react-start-rsc dependency chain

* ci: changeset release

* chore: sync published start package versions

* ci: changeset release

* fix publishing

* ci: changeset release

* fix

* ci: apply automated fixes

* ci: changeset release

* refactor: switch router stores to atom get/set API (#7150)

* ci: changeset release

* refactor: shorten internal router store names (#7152)

* ci: changeset release

* chore(types): re-export SearchMiddleware type from react-router (#7087)

* fix(start-plugin-core): reuse deduped server function ids across compilers (#7153)

* ci: changeset release

* fix(router-core): avoid false notFound matches for proxied loader data (#7156)

* fix(router-core): avoid false notFound matches for proxied loader data

* test(react-start): cover proxied loader data notFound regression

* test(react-start): move notFound regression to rsc direct loader

* chore: add changeset

* ci: changeset release

* fix: reduce start SSR manifest asset duplication (#7157)

Co-authored-by: schiller-manuel <schiller-manuel@users.noreply.github.com>
Co-authored-by: nx-cloud[bot] <71083854+nx-cloud[bot]@users.noreply.github.com>

* ci: changeset release

* docs: fix file extension syntax for prefix/suffix routing examples (#7149)

docs: fix file-based routing examples with literal dots

* chore: bump to h3 v2 rc.20 (#7140)

* ci: changeset release

* chore: stabilize tests (#7159)

* chore: add vite 8 to peer deps (#7160)

Co-authored-by: schiller-manuel <6340397+schiller-manuel@users.noreply.github.com>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: nx-cloud[bot] <71083854+nx-cloud[bot]@users.noreply.github.com>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>

* ci: changeset release

* chore(start-server-core): remove unnecessary `any` in `getRequestHeaders` (#7164)

* fix(router-generator): harden route file transform rewrites (#7167)

* fix docs (#7168)

* ci: changeset release

* fix(router-plugin): update vite-plugin-solid peer dependency to support version 3.0.0-0 (#7170)

* ci: changeset release

* fix(router-generator): normalize virtual physical subtree paths (#7169)

Co-authored-by: schiller-manuel <6340397+schiller-manuel@users.noreply.github.com>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>

* ci: changeset release

* fix: unify virtual module handling for Start Vite plugins (#7178)

Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
Co-authored-by: CodeRabbit <noreply@coderabbit.ai>
Co-authored-by: schiller-manuel <schiller-manuel@users.noreply.github.com>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Co-authored-by: nx-cloud[bot] <71083854+nx-cloud[bot]@users.noreply.github.com>

* ci: changeset release

* fix: add react-server server export for react-start (#7180)

* ci: changeset release

* fix(docs): correct server function name in example (#7173)

* fix react server exports for start and react-router (#7183)

Co-authored-by: nx-cloud[bot] <71083854+nx-cloud[bot]@users.noreply.github.com>

* chore: stabilize tests (#7185)

* ci: changeset release

* fix(router-core): avoid intermediate success state for async notFound (#7184)

* ci: changeset release

* Add a React Start server-components skill (#7181)

Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>

* chore: add sharding for playwright tests (#7187)

* add sharding

* fix dependnancy

* fix playwright shard port reuse

* full bust

* throw more runners into this run

* try to throw money at it and see the effect

* tune

* fix react-router shared route css persistence on nav (#7186)

Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>

* ci: changeset release

* chore: stabilize test (#7192)

* fix(start): include Vite style.css when cssCodeSplit is disabled (#7191)

Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>

* ci: changeset release

* chore: bump solid-js override 1.9.12 (#7202)

* chore: bump query override to 5.99.0 (#7203)

* fix(solid-router): use keyed Show in Outlet to fix child route rendering with useQuery (#7204)

* ci: changeset release

* docs(start): fix authenticated routes doc URL (#7214)

* chore(deps): vitest 4.1.4 (#7212)

* stabilize rsc tests (#7217)

* fix(react-router): prevent webpack static analysis of React.use with let binding (#7182)

* ci: changeset release

* stabilize test (#7220)

* chore: unify react-start basic e2e mode projects (#7206)

* feat(nx): support rsbuild in Playwright inference (#7221)

* test(e2e-rsc): migrate to playwrightModes and dynamic inferred dist (#7222)

* fix(nx): align playwright mode build target naming (#7223)

* docs(start): add missing space after comma in 'Handling requests with a body' (#7234)

* update intent workflow (#7243)

* rsbuild plugin (#7228)

Co-authored-by: neverland <chenjiahan.jait@bytedance.com>
Co-authored-by: Keven Arroyo <dake.3601@gmail.com>

* ci: changeset release

* fix: Split Start plugin core (#7249)

* ci: changeset release

* update intent workflow (#7244)

* fix: asset sorting (#7251)

* ci: changeset release

* chore(deps): update Rsbuild related deps to v2.0.1 (#7245)

* fix actions again? (#7252)

* inline css (#7253)

* ci: changeset release

* fix: do not import 'react-refresh/runtime' (#7255)

Co-authored-by: nx-cloud[bot] <71083854+nx-cloud[bot]@users.noreply.github.com>

* ci: changeset release

* chore(examples): checkin git outdated route-tree files for react and solid examples (#7257)

* add new bundlesize measurements for rsbuild (#7256)

Co-authored-by: nx-cloud[bot] <71083854+nx-cloud[bot]@users.noreply.github.com>

* refactor(router-plugin): upgrade unplugin to `v3` (#7258)

* refactor(router-plugin): upgrade unplugin to `v3`

* refactor(start-client-core): use a more explicit typing to `CustomFetch` type

* chore(examples): runtime enforce for needing the `VITE_CONVEX_URL`

* ci: changeset release

* fix: issue 7240 causing fouc (#7250)

* fix: server middleware type in solid-router (#7260)

* replace tsx by jiti (#7261)

Co-authored-by: nx-cloud[bot] <71083854+nx-cloud[bot]@users.noreply.github.com>

* ci: changeset release

* docs: Fix server function middleware prop (#7262)

* feat(query): add support for custom dehydrate and hydrate options in SSR integration (#7246)

Co-authored-by: schiller-manuel <6340397+schiller-manuel@users.noreply.github.com>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>

* ci: changeset release

* fix: use loader data goes undefined (#7265)

* fix: streaming when using Await component (#7264)

* ci: changeset release

* fix(solid-start): bundle solid-query packages during SSR to fix duplicate QueryClientContext (#6151) (#7267)

* ci: changeset release

* fix(solid-router): hydration mismatch for ssr='data-only' with pendingComponent (#7266)

* docs(router): fix typo in doc (#7268)

* ci: changeset release

* fix(router-core): wildcard nodes respect DFS priority like other nodes in route matching (#7273)

* ci: changeset release

* fix(solid-router): enable route component HMR for Solid

* ci: apply automated fixes

* Revert "ci: apply automated fixes"

This reverts commit 7122f28.

* Revert "fix(solid-router): enable route component HMR for Solid"

This reverts commit b86b061.

* fix(react-start-rsc): re-export renderable types from public entries (#7278)

* fix(react-start-rsc): re-export renderable types from public entries

* changeset - patch

* ci: changeset release

* fix: disabled topLevelVar (#7293)

Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>

* ci: changeset release

* fix: fix exports for react-start so useServerFn is available with RSC (#7292)

Co-authored-by: nx-cloud[bot] <71083854+nx-cloud[bot]@users.noreply.github.com>

* feat: match params (#7263)

* ci: changeset release

* fix(start-plugin-core): sort server fn manifest entries for deterministic build output (#7287)

Co-authored-by: Dor Alagem <doralagem@MacBook-Pro-sl-Dor.local>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Co-authored-by: Manuel Schiller <meisterpink@gmail.com>

* docs: remove redundant code example from query integration doc (#7298)

* ci: changeset release

* fix: Ignore fully type-only imports and re-exports when collecting im… (#7305)

Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>

* ci: changeset release

* feat: `strict: false` for server functions (#7277)

* feat: `strict: false` for server functions

Add a `strict` option to `createServerFn` for type-level server function serialization checks

* feat: `strict: false` for server functions [Self-Healing CI Rerun]

---------

Co-authored-by: nx-cloud[bot] <71083854+nx-cloud[bot]@users.noreply.github.com>

* ci: changeset release

* fix: parse params union inference (#7306)

* ci: changeset release

* feat: rsc css (#7310)

Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>

* ci: changeset release

* fix(router-plugin): isolate route metadata per plugin instance (#7313)

* ci: changeset release

* docs: Improve key differences b/w Start Server Functions and Next.js Server Actions (#7312)

* fix(deps): move fetchdts from devDependencies to dependencies (#7317)

* Revise bug report template for clarity and requirements

Updated the bug report template to clarify the requirements for a reproducer project and modified some labels and descriptions for better clarity.

* ci: changeset release

* chore: fix duplicate "the" typo across router packages (#7323)

* feat: early hints (#7324)

* ci: changeset release

* feat: Link header (#7327)

Co-authored-by: nx-cloud[bot] <71083854+nx-cloud[bot]@users.noreply.github.com>

* ci: changeset release

* docs(skills): address 8 agent failure modes from user feedback (#7314)

* docs(skills): address 8 agent failure modes from external feedback

Adds new start-core/auth-server-primitives skill (sessions, cookies,
OAuth+PKCE, password-reset enumeration defense, CSRF, rate limiting,
session rotation) and updates 8 existing skills + matching docs to fix
patterns where agents produce insecure or wrong-framework output.

Skill changes:
- new: start-core/auth-server-primitives (server half of auth)
- router-core/auth-and-guards: route guard != RPC guard
- start-core/server-functions: wrong import path, RPC auth required,
  Cache-Control public is a cross-tenant leak, wrong-framework patterns
- start-core/middleware: wrong import path, sendContext shape vs access
  (3-layer wrong/still-wrong/correct), authMiddleware framing
- start-core/execution-model: file markers (server-only/client-only),
  module-level process.env is undefined under Worker SSR
- start-core/deployment: cloudflare env-at-request-time
- router-core/ssr: wrong file structures (next.js, react-router-dom)
- router-core/type-safety: wrong-framework imports + structures

Docs updated to mirror each skill change so source-of-truth and the
intent-indexed skill stay in sync. New authentication-server-primitives
guide is the long-form companion to the new skill.

intent validate: 30 skill files pass (was 29).

* ci: apply automated fixes

* docs(skills): address coderabbit review feedback

- Fix internal docs links to use correct relative paths instead of an
  absolute /start/latest/... URL and missing one ../ segment
- Remove blank line inside auth-and-guards blockquote (markdownlint MD028)
- Restore overload pattern in type-safety ValidateNavigateOptions and
  ValidateRedirectOptions examples; the casts I had introduced stripped
  generic context and contradicted the skill's own no-cast rule
- Add db.sessions.revokeAllForUser before create in login rotation
  snippets so the example matches the prose
- Soften useServerFn guidance: it's required only when the server
  function throws redirect/notFound; plain-data calls work directly and
  via useMutation/useQuery

* ci: apply automated fixes

* docs(skills): compress type-safety to stay under 500-line cap

Prettier's autofix expanded my single-line overload signatures across
multiple lines, pushing the file over the 500-line limit. Drop the
redundant fetchOrRedirect example (same pattern as useDelayedNavigate)
and describe ValidateRedirectOptions usage in prose instead.

* docs(skills): CSRF origin check should compare full origin, not host alone

Comparing only new URL(origin).host against APP_HOST silently accepts a
mismatched scheme — http://example.com would pass a check meant for
https://example.com. Compare the full origin (scheme + host + port)
against APP_ORIGIN instead. Same fix in skill and docs.

* docs(skills): make useDelayedNavigate callback truly return void

The callback returned the result of setTimeout (a timer handle), not
void as the public overload's return type implied. Wrap in a block so
the example matches the declared return type.

Skipped the related nitpick to add a separate redirect example — the
existing prose already describes the same overload pattern, and a
duplicate example would push the file close to the 500-line cap that
prettier autofix has been bumping us against.

* docs(skills): fix two real bugs in auth-server-primitives examples

1. Cookie parser truncated values containing '='. Signed cookies, JWTs,
   and base64-padded values all use '='. Use indexOf to split on the
   FIRST '=' only.

2. Login example short-circuited verifyPasswordHash on user-not-found,
   contradicting the prose's "same time, same error" claim — the
   no-user branch returned instantly while wrong-password spent ~100ms
   hashing, leaking account existence over the wire. Always verify
   against a hash; use a precomputed DUMMY_PASSWORD_HASH when the user
   is missing, then combine with the user-exists bit for the final ok.

Same fixes in the SKILL.md and the docs companion.

* docs(skills): address manuel's review on react-specific guides

- middleware.md, server-functions.md: drop cross-framework <framework>
  placeholders; this is the React-specific guide, just say
  @tanstack/react-start
- execution-model.md: drop the same trailing line about solid-start /
  vue-start paths
- hosting.md: remove the Cloudflare env-handling subsection — the
  general per-request rule lives in environment-variables.md and
  doesn't need to be repeated under a specific host
- environment-variables.md: mention the cloudflare:workers env binding
  as the canonical Cloudflare way to read env (including module scope),
  per Manuel's link to the Cloudflare docs
- deployment skill: same upgrade — show the cloudflare:workers env
  pattern alongside the per-request handler approach

* docs(skills): drop redundant server-only marker in session example

The file already imports from @tanstack/react-start/server, which is
on import protection's default client-deny specifier list. The
side-effect marker is redundant — drop it. Same fix in skill and docs.

* docs(skills): drop wrong-import-path mistakes — TS already catches them

Manuel pointed out that TypeScript catches both common wrong paths:
'@tanstack/react-router' has no exported member createServerFn /
createMiddleware, and '@tanstack/start' is "Cannot find module". Skill
space is precious; the items don't earn their slot if tsc handles them.

Removed:
- Common Mistake "Wrong import path" from server-functions and
  middleware skills (renumbered the remaining mistakes)
- The matching top-of-file CRITICAL line in both skills
- The "Import path" callouts in the middleware and server-functions
  docs

---------

Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>

* remove old intent artifacts (#7333)

* fix(start-server-core): fall back to GET handler for HEAD requests (RFC 9110 §9.3.2) (#7325)

Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>

* ci: changeset release

* test: add reproducer for #2514 (#7336)

* test: reproducer for #2547 (#7337)

* fix: fix plain TypeScript parser handling (#7342)

* ci: changeset release

* fix: disable rsbuild server compression (#7348)

* fix: update deps (#7340)

* ci: changeset release

* update bundlesize benchmark (#7356)

* fix: Bump jiti to 2.7.0 (#7355)

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: schiller-manuel <6340397+schiller-manuel@users.noreply.github.com>

* ci: apply automated fixes

* ci: changeset release

* Document server function strict serialization options (#7358)

* Document server function strict option

Agent-Logs-Url: https://github.com/TanStack/router/sessions/8deabe7a-7412-455e-9111-97a13cb4582e

Co-authored-by: schiller-manuel <6340397+schiller-manuel@users.noreply.github.com>

* Refine strict docs wording

Agent-Logs-Url: https://github.com/TanStack/router/sessions/e2857d6e-314e-496c-b99b-78c207c28c77

Co-authored-by: schiller-manuel <6340397+schiller-manuel@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: schiller-manuel <6340397+schiller-manuel@users.noreply.github.com>

* feat(start): CSRF middleware (#7373)

* fix(router-core): fix missing closing paren in CSS.supports check for view transition types (#7369)

* fix: fix jiti usage for tsconfig paths (#7382)

* Enable jiti tsconfig path aliases

Agent-Logs-Url: https://github.com/TanStack/router/sessions/0a481c9b-eb97-4543-acc5-71d43b97d386

Co-authored-by: schiller-manuel <6340397+schiller-manuel@users.noreply.github.com>

* Use fixture for jiti tsconfig aliases

Agent-Logs-Url: https://github.com/TanStack/router/sessions/182b9baa-9e54-4813-a322-c33a1da5417d

Co-authored-by: schiller-manuel <6340397+schiller-manuel@users.noreply.github.com>

* Track fixture path alias helper

Agent-Logs-Url: https://github.com/TanStack/router/sessions/182b9baa-9e54-4813-a322-c33a1da5417d

Co-authored-by: schiller-manuel <6340397+schiller-manuel@users.noreply.github.com>

* Add router-generator changeset

Agent-Logs-Url: https://github.com/TanStack/router/sessions/ab1a42cc-7326-4e36-a656-f01179221cee

Co-authored-by: schiller-manuel <6340397+schiller-manuel@users.noreply.github.com>

* Format virtual config fixture

Agent-Logs-Url: https://github.com/TanStack/router/sessions/22194166-b3a7-431e-b723-ad594d4b0405

Co-authored-by: schiller-manuel <6340397+schiller-manuel@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: schiller-manuel <6340397+schiller-manuel@users.noreply.github.com>

* Update bundle-size.yml

* Update labeler.yml

* Update bundle-size.yml

* ci: add pinGitHubActionDigests (#7387)

* chore(deps): pin dependencies (#7388)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

* minor semver bump to all packages (#7395)

* ci: zizmor (#7389)

* chore(pnpm): update pnpm to v11 (#7392)

* chore: add CODEOWNERS file (#7394)

* chore: add CODEOWNERS file

* chore: add Nx and NPMRC

* Update .github/CODEOWNERS

---------

Co-authored-by: Nicolas Beaussart <nic.beaussart@gmail.com>

* fix: revert plugin changes, createCsrfMiddleware compilation, fix HMR tests (#7400)

Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Co-authored-by: Manuel Schiller <manuel.schiller@caligano.de>

* ci: align release workflow to query (#7404)

* ci: Version Packages (#7405)

ci: changeset release

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

* feat(start): add inline CSS runtime controls and asset URL templates (#7380)

* ci: Version Packages (#7407)

* fix: Fix literal underscore paths under pathless layouts (#7408)

* ci: Version Packages (#7409)

ci: changeset release

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

* feat(router-core): params.priority route option as tie breaker in matching algorithm (#7411)

Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>

* ci: Version Packages (#7413)

* fix(router-core): hydrate before initial client route match (#7416)

* ci: Version Packages (#7417)

* fix(router-plugin): detect typed root route context for HMR (#7420)

* ci: Version Packages (#7421)

* fix: fix route mismatch warnings and HMR route indexes (#7422)

Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>

* ci: Version Packages (#7423)

* security: stricter pnpm config blockExoticSubdeps & trustPolicy (#7425)

* docs(start): use router package for module declaration to type the request context (#7427)

* feat: deferred hydration (#7362)

* feat: deferred hydration

* fix

* tests

* solid tests

* Changes before error encountered

Agent-Logs-Url: https://github.com/TanStack/router/sessions/5263c469-75c2-4470-bd4c-86f9b43964f4

Co-authored-by: schiller-manuel <6340397+schiller-manuel@users.noreply.github.com>

* chore: address hydration review follow-ups

Agent-Logs-Url: https://github.com/TanStack/router/sessions/16e27113-ff01-4de8-aded-b9be9f6dd4ff

Co-authored-by: schiller-manuel <6340397+schiller-manuel@users.noreply.github.com>

* fix(start-client-core): correct import order in hydrateStart.ts

Co-authored-by: schiller-manuel <schiller-manuel@users.noreply.github.com>

* chore: remove tracked nx self-healing artifacts

Agent-Logs-Url: https://github.com/TanStack/router/sessions/95750760-1348-437c-8f73-cc45e899003a

Co-authored-by: schiller-manuel <6340397+schiller-manuel@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: schiller-manuel <6340397+schiller-manuel@users.noreply.github.com>
Co-authored-by: nx-cloud[bot] <71083854+nx-cloud[bot]@users.noreply.github.com>
Co-authored-by: schiller-manuel <schiller-manuel@users.noreply.github.com>

* chore: update @swc/core in example/react/quickstart-webpack-file-based (#7434)

* chore: update @swc/core in example/react/quickstart-webpack-file-based

* chore: update @swc/core in example/react/quickstart-webpack-file-based [Self-Healing CI Rerun]

---------

Co-authored-by: nx-cloud[bot] <71083854+nx-cloud[bot]@users.noreply.github.com>

* docs(start): compare deferred hydration to Astro islands (#7438)

Adds a short mental-model section answering the common question
about how TanStack Start's deferred hydration relates to Astro
islands.

* docs(start): compare deferred hydration to React selective hydration (#7442)

Adds a short comparison section answering the common question about how
TanStack Start's deferred hydration relates to React 18's selective
hydration. The framing: selective hydration controls the order of
inevitable hydration work; deferred hydration controls whether and when
that work happens at all.

* chore: update chokidar to v5 (#7439)

* chore: update @rolldown/pluginutils to 1.0.1 (#7440)

* chore: update zod to v4.4.3 (#7441)

* chore: update zod to v4.4.3

* fix(start): preserve route path defaults

* fix(examples): resolve zod 4 build failures

* chore: update express and webpack-dev-server (#7443)

* chore: update express to v5.2.1

* chore: update webpack-dev-server to v5.2.4

* ci: Version Packages (#7435)

ci: changeset release

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

* chore: ignore nx generated folders (#7451)

* perf: optimize and test rewrite (#7448)

optimize and test rewrite

* fix: fix scroll restoration issues (#7447)

Co-authored-by: nx-cloud[bot] <71083854+nx-cloud[bot]@users.noreply.github.com>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>

* ci: Version Packages (#7452)

* fix: Fix escaped underscore index route generation (#7453)

* ci: Version Packages (#7454)

* ci: fix release notes diff range after Release PR flow (#7456)

* fix(start): explicitly re-export public API to survive SSR cold-start cycle (#7466)

* fix: Fix hash scrolling with `resetScroll={false}` (#7464)

Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>

* chore: enforce pnpm 11 (#7465)

* ci: Version Packages (#7467)

* chore: only run autofix on PRs (#7469)

* feat(start): support rsbuild iife client output (#7477)

* ci: Version Packages (#7478)

* fix: bundled dev support for vite (#7482)

* ci: Version Packages (#7483)

* fix(start): avoid encoded virtual adapter ids in vite dev (#7484)

* fix release (#7487)

* ci: Version Packages (#7485)

* chore: migrate changesets changelog generator (#7490)

* fix: Fix Hydrate re-exports to avoid circular HMR updates (#7492)

* ci: Version Packages (#7493)

* fix(start): emit boot-sibling chunks as scripts for IIFE entries (#7501)

Co-authored-by: Keven Arroyo <kevenarroyo@microsoft.com>

* ci: Version Packages (#7502)

* chore: stabilize tests (#7503)

Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>

* fix: fix streaming (#7497)

* ci: Version Packages (#7504)

ci: changeset release

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

* ci: update all actions (#7506)

* ci: update all actions

* disable package manager cache

* fix: fix primitive beforeLoad errors (#7505)

* fix: fix primitive beforeLoad errors

* ci: apply automated fixes

---------

Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>

* ci: Version Packages (#7508)

* feat(rsbuild): add RSC support (#7509)

Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>

* ci: Version Packages (#7513)

* fix(solid): resolve Solid 2 merge issues

* ci: apply automated fixes

* use v2 query

* fix solid v2 imports

* solid v2 port of new e2e

* solid v2

* nxignore solid v1 peer deps

* use "@rsbuild/plugin-solid": "^2.0.0-beta.0",

* fix hydrationscript

* add nohydration

* remove early return

* fix: solid-start hydration

* fix: update createEffect to return true for hydration signals

* remove nxignore

* add back nxignore for 3rdparty deps

* $_TSR stub to fix serialization tests

* Revert "$_TSR stub to fix serialization tests"

This reverts commit ef802e9.

* fix: update solid selective ssr links

* fix: stream solid Await fallback

* align solid-start basic by removing test:e2e

* remove unusese build:prerender build:spa

* fix: clean up solid hydrate fallback dom

* fix: resolve solid wrapper children

* fix: stabilize serialization stream e2e test

* fix: keep SSR globals through document parse

* html standard mode

* clean

* fix: pass solid ssr manifest

* use await fallback

---------

Co-authored-by: Tanner Linsley <tannerlinsley@gmail.com>
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Co-authored-by: Manuel Schiller <manuel.schiller@caligano.de>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Co-authored-by: Flo <fpellet@ensc.fr>
Co-authored-by: James Howard <james@reetgood.co.uk>
Co-authored-by: schiller-manuel <schiller-manuel@users.noreply.github.com>
Co-authored-by: nx-cloud[bot] <71083854+nx-cloud[bot]@users.noreply.github.com>
Co-authored-by: Mohamed Khaled <mohamedkhaled012@yahoo.com>
Co-authored-by: Birk Skyum <74932975+birkskyum@users.noreply.github.com>
Co-authored-by: schiller-manuel <6340397+schiller-manuel@users.noreply.github.com>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Ulrich Stark <github@ustark.de>
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
Co-authored-by: CodeRabbit <noreply@coderabbit.ai>
Co-authored-by: MoonBrillante <32852571+MoonBrillante@users.noreply.github.com>
Co-authored-by: Coding Cossack <108333654+CodingCossack@users.noreply.github.com>
Co-authored-by: Nicolas Beaussart <nic.beaussart@gmail.com>
Co-authored-by: Pavan Shinde <pavann97@gmail.com>
Co-authored-by: mixelburg <52622705+mixelburg@users.noreply.github.com>
Co-authored-by: Mukunda Rao Katta <mukunda.vjcs6@gmail.com>
Co-authored-by: Sarah Gerrard <gerrardsarah@gmail.com>
Co-authored-by: neverland <chenjiahan.jait@bytedance.com>
Co-authored-by: Keven Arroyo <dake.3601@gmail.com>
Co-authored-by: Sean Cassiere <33615041+SeanCassiere@users.noreply.github.com>
Co-authored-by: Abhishek Raj <abhi@raj.me>
Co-authored-by: Dominik Dorfmeister 🔮 <office@dorfmeister.cc>
Co-authored-by: Birk Skyum <birk.skyum@pm.me>
Co-authored-by: Keven Arroyo <kevenarroyo@microsoft.com>
Co-authored-by: Dor Alagem <dor3382@gmail.com>
Co-authored-by: Dor Alagem <doralagem@MacBook-Pro-sl-Dor.local>
Co-authored-by: Manuel Schiller <meisterpink@gmail.com>
Co-authored-by: Franklin Shera <fshera96@gmail.com>
Co-authored-by: Tom Smithhisler <tomsmithhisler@gmail.com>
Co-authored-by: dfedoryshchev <64079946+dfedoryshchev@users.noreply.github.com>
Co-authored-by: Sarah Gerrard <hello@sarahgerrard.me>
Co-authored-by: Zelys <zelys@dfkhelper.com>
Co-authored-by: Shkumbin Hasani <34962865+shkumbinhasani@users.noreply.github.com>
Co-authored-by: Lachlan Collins <1667261+lachlancollins@users.noreply.github.com>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: Harry Whorlow <79278353+harry-whorlow@users.noreply.github.com>
Co-authored-by: Corbin Crutchley <git@crutchcorn.dev>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Author: 37 people

.changeset/config.json

@@ -1,8 +1,8 @@
 {
   "$schema": "https://unpkg.com/@changesets/config@3.1.2/schema.json",
   "changelog": [
-    "@svitejs/changesets-changelog-github-compact",
-    { "repo": "TanStack/router" }
+    "@changesets/changelog-github",
+    { "repo": "TanStack/router", "disableThanks": true }
   ],
   "commit": false,
   "access": "public",

.github/workflows/autofix.yml

@@ -2,8 +2,6 @@ name: autofix.ci # needed to securely identify the workflow
 
 on:
   pull_request:
-  push:
-    branches: [main, alpha, beta]
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.number || github.ref }}
@@ -29,6 +27,6 @@ jobs:
       - name: Generate labeler config
         run: pnpm labeler-generate
       - name: Apply fixes
-        uses: autofix-ci/action@635ffb0c9798bd160680f18fd73371e355b85f27
+        uses: autofix-ci/action@c5b2d67aa2274e7b5a18224e8171550871fc7e4a # v1.3.4
         with:
           commit-message: 'ci: apply automated fixes'

.github/workflows/bundle-size.yml

@@ -126,7 +126,7 @@ jobs:
       - name: Measure Bundle Size
         run: pnpm nx run @benchmarks/bundle-size:build --outputStyle=stream --skipRemoteCache
       - name: Publish Benchmark Dashboard
-        uses: benchmark-action/github-action-benchmark@4bdcce38c94cec68da58d012ac24b7b1155efe8b # v1.20.7
+        uses: benchmark-action/github-action-benchmark@52576c92bccf6ac60c8223ec7eb2565637cae9ba # v1.22.1
         with:
           tool: customSmallerIsBetter
           name: Bundle Size (gzip)

.github/workflows/check-skills.yml

@@ -45,14 +45,15 @@ jobs:
       contents: read
     steps:
       - name: Checkout
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
 
       - name: Setup Node
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: 20
+          node-version: 24
+          package-manager-cache: false
 
       - name: Install intent
         run: npm install -g @tanstack/intent
@@ -69,15 +70,16 @@ jobs:
       pull-requests: write
     steps:
       - name: Checkout
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
           persist-credentials: true # review job pushes a generated branch
 
       - name: Setup Node
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: 20
+          node-version: 24
+          package-manager-cache: false
 
       - name: Install intent
         run: npm install -g @tanstack/intent

.github/workflows/client-nav-benchmarks.yml

@@ -48,7 +48,7 @@ jobs:
 
       - name: Run ${{ matrix.benchmark }}:${{ matrix.framework }} CodSpeed benchmark
         continue-on-error: true
-        uses: CodSpeedHQ/action@3194d9a39c4d46684cb44bf7207fc56626aad8fd # v4.15.1
+        uses: CodSpeedHQ/action@9d332c4d90b43981c3e55ae8e38e68709996240f # v4.17.0
         with:
           mode: simulation
           run: WITH_INSTRUMENTATION=1 pnpm nx run @benchmarks/${{ matrix.benchmark }}:test:perf:${{ matrix.framework }}

.github/workflows/labeler.yml

@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Labeller
-        uses: actions/labeler@634933edcd8ababfe52f92936142cc22ac488b1b # v6.0.1
+        uses: actions/labeler@f27b608878404679385c85cfa523b85ccb86e213 # v6.1.0
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
           configuration-path: labeler-config.yml

.github/workflows/notify-playbooks.yml

@@ -31,7 +31,7 @@ jobs:
       - name: Setup Tools
         uses: TanStack/config/.github/setup@e4b48f16568324f76f467aa4c2aac2f05db632c3 # main
       - name: Get base and head commits for `nx affected`
-        uses: nrwl/nx-set-shas@3e9ad7370203c1e93d109be57f3b72eb0eb511b1 # v4.4.0
+        uses: nrwl/nx-set-shas@afb73a62d26e41464e9254689e1fd6122ee683c1 # v5.0.1
         with:
           main-branch-name: main
       - name: Run Checks

.github/workflows/pr.yml

@@ -19,7 +19,7 @@ jobs:
           persist-credentials: false
 
       - name: Run zizmor
-        uses: zizmorcore/zizmor-action@b1d7e1fb5de872772f31590499237e7cce841e8e # v0.5.3
+        uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d # v0.5.6
         with:
           advanced-security: false
           annotations: true