chore: refresh Start example dependencies by tannerlinsley · Pull Request #1592 · TanStack/ai

tannerlinsley · 2026-10-01T18:18:39Z

Refresh the Start dependencies in the private example apps, test apps, and React app generator. React apps use Start 1.168.60. The Solid app uses Start 1.168.57.

🎯 Changes

Align Router and plugin versions with Start, then refresh the lockfile and generated route trees.
Remove 15 as any casts from code-mode route IDs. The current route compiler requires string literals. These code-mode route IDs remain unchanged.
Remove the unused legacy @tanstack/start dependency from the test panel.
Preserve the original Vertex SDK peer resolution, so its mocks use the same SDK module as Gemini.

Docs and a changeset do not apply. This update changes private apps and generator dependencies, with no published API change.

✅ Checklist

I have followed the steps in the Contributing guide.
I have tested code changes locally with pnpm run test:pr.
I fully understand the code in this pull request, including generated code.
Docs: this change is not user-facing.
Changeset: this PR does not change a published package.

🚀 Release Impact

This change affects published code, and I have generated a changeset.
This change is docs/CI/dev-only (no release).

Testing

Commands run: Frozen install and pnpm test:pr passed on October 3 with Node 24.15.0 after merging current main. All 412 tasks passed, including app builds, type checks, docs checks, and the declaration scan. The chat route tree includes the new upstream auth callback. Published package files match main.

Earlier checks passed: root build, all 19 changed app builds, and the uncached Vertex unit suite. Three local Chromium checks passed with mock providers: OpenAI streaming chat, OpenAI-compatible streaming chat, and server message IDs. The previous head also passed the full browser suite in CI. Current-head Test, E2E and Coverage checks passed. The browser suite had 773 passed and 15 skipped. CodeRabbit reported no actionable findings. Live model calls were not run locally.

Manual test:

Use Node 24 and run pnpm install --frozen-lockfile at the root.
Run pnpm --filter ts-react-chat build.
Run pnpm --filter ts-code-mode-web build.
Run pnpm test:pr.

Test path: The changed example and test apps use the updated dependencies. Their existing build commands reproduce the route compilation checks.

Risk / rollback

Dependency updates can affect private app builds or hydration. Revert this PR to restore the previous manifests, lockfile, and generated route trees.

CI follow-up

Current main includes the upstream OpenCode test stability fix from #1596. The coverage gate remains unchanged and passed in CI.

Summary by CodeRabbit

Updates
- Updated router and application framework versions across examples, test projects, and the React app template.
- Refreshed generated route listings and ordering across several examples and test projects, with most route paths and behavior unchanged.
- Improved route path typing in several TypeScript examples by using route paths directly.
- Updated a Solid example’s guitar route to use a trailing slash.

socket-security · 2026-10-01T18:20:02Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/@tanstack/solid-router@1.141.1 ⏵ 1.170.38	⁺¹¹		⁺⁴
	npm/@tanstack/solid-start@1.141.1 ⏵ 1.168.57	⁺²⁰		⁺⁶

View full report

coderabbitai · 2026-10-01T18:20:32Z

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: TanStack/ai/.coderabbit.yaml
Review profile: CHILL
Plan: Advanced
Run ID: 0740f8fa-e227-4b99-9c08-19642d54fe16

📥 Commits

Reviewing files that changed from the base of the PR and between fe6456b and 6a83a61.

⛔ Files ignored due to path filters (1)

pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (1)

examples/ts-react-chat/src/routeTree.gen.ts

🚧 Files skipped from review as they are similar to previous changes (1)

examples/ts-react-chat/src/routeTree.gen.ts

Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 7 remain after this review.

📝 Walkthrough

Walkthrough

Example and test manifests, plus the React app template, update TanStack Router dependency ranges. Generated route trees are reordered, code-mode route declarations remove as any casts, and the Solid example’s guitars index full path gains a trailing slash. The React chat route tree removes four root-level generation route entries.

Changes

Router package and route metadata refresh

Layer / File(s)	Summary
Update TanStack Router package ranges `examples/react//package.json`, `examples/sandbox-/package.json`, `examples/ts-/package.json`, `testing//package.json`, `tools/workspace-plugin/src/generators/react-app/files/package.json`	Manifests update TanStack Router-related dependency ranges. The testing panel manifest also removes `@tanstack/start`.
Refresh generated route trees `examples/sandbox-web/src/routeTree.gen.ts`, `examples/ts-code-mode-web/src/routeTree.gen.ts`, `examples/ts-react-chat/src/routeTree.gen.ts`, `examples/ts-react-search/src/routeTree.gen.ts`, `examples/ts-react-ui-chatbot/src/routeTree.gen.ts`, `examples/ts-solid-chat/src/routeTree.gen.ts`, `testing/panel/src/routeTree.gen.ts`	Generated route imports, registrations, and type metadata are reordered. The React chat route tree removes four root-level generation route entries. The Solid example’s guitars index full path gains a trailing slash; its route path remains unchanged.
Use literal route paths `examples/ts-code-mode-web/src/routes/_banking-demo/`, `examples/ts-code-mode-web/src/routes/_database-demo/`, `examples/ts-code-mode-web/src/routes/_execute-prompt/`, `examples/ts-code-mode-web/src/routes/_reporting/`	Route declarations pass their existing path literals to `createFileRoute` without `as any` casts.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~12 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to 6a83a

The generation routes remain available, and no issue in the selected change currently blocks merging.

Security Architecture Review

Security architecture risk: 🔵 Low · up to fe645

Reviewed changes preserve route identities and parent relationships. No introduced security issue was identified, but runtime behavior after the dependency upgrade has not been fully verified.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

inferred — The potential exposure follows applications adopting the refreshed framework baseline, including generated React apps. The supplied evidence does not establish their deployment environments, authentication requirements, tenant boundaries, or downstream credentials, so effective production attack scope remains unresolved.

Trust Boundaries and Controls

observed — The Solid route continues to inherit from rootRouteImport and remains attached through the existing root-child assembly. Its generated metadata correction does not change that ownership relationship; it does not independently prove the adequacy of authentication or authorization controls.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 4 functions across 22 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: refreshing dependencies for the Start examples. It is concise and specific.
Description check	✅ Passed	The description covers the changes, checklist, release impact, testing, risks, and CI follow-up. It explains why docs and a changeset do not apply.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

Commit to this branch
Create a new PR

🧪 Generate unit tests (beta)

Commit to this branch
Create a new PR

Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

nx-cloud · 2026-10-01T18:20:33Z

View your CI Pipeline Execution ↗ for commit 6a83a61

Command	Status	Duration	Result
`nx run-many --targets=build --exclude=examples/...`	✅ Succeeded	1m 42s	View ↗

☁️ Nx Cloud last updated this comment at 2026-10-03 15:14:16 UTC

pkg-pr-new · 2026-10-01T18:24:10Z

Open in StackBlitz

@tanstack/ai

npm i https://pkg.pr.new/TanStack/ai/@tanstack/ai@1592

@tanstack/ai-acp

npm i https://pkg.pr.new/TanStack/ai/@tanstack/ai-acp@1592

@tanstack/ai-angular

npm i https://pkg.pr.new/TanStack/ai/@tanstack/ai-angular@1592

@tanstack/ai-anthropic

npm i https://pkg.pr.new/TanStack/ai/@tanstack/ai-anthropic@1592

@tanstack/ai-bedrock

npm i https://pkg.pr.new/TanStack/ai/@tanstack/ai-bedrock@1592

@tanstack/ai-byteplus

npm i https://pkg.pr.new/TanStack/ai/@tanstack/ai-byteplus@1592

@tanstack/ai-claude-code

npm i https://pkg.pr.new/TanStack/ai/@tanstack/ai-claude-code@1592

@tanstack/ai-client

npm i https://pkg.pr.new/TanStack/ai/@tanstack/ai-client@1592

@tanstack/ai-cloudflare

npm i https://pkg.pr.new/TanStack/ai/@tanstack/ai-cloudflare@1592

@tanstack/ai-code-mode

npm i https://pkg.pr.new/TanStack/ai/@tanstack/ai-code-mode@1592

@tanstack/ai-code-mode-snippets

npm i https://pkg.pr.new/TanStack/ai/@tanstack/ai-code-mode-snippets@1592

@tanstack/ai-codex

npm i https://pkg.pr.new/TanStack/ai/@tanstack/ai-codex@1592

@tanstack/ai-cohere

npm i https://pkg.pr.new/TanStack/ai/@tanstack/ai-cohere@1592

@tanstack/ai-compaction

npm i https://pkg.pr.new/TanStack/ai/@tanstack/ai-compaction@1592

@tanstack/ai-devtools-core

npm i https://pkg.pr.new/TanStack/ai/@tanstack/ai-devtools-core@1592

@tanstack/ai-durable-stream

npm i https://pkg.pr.new/TanStack/ai/@tanstack/ai-durable-stream@1592

@tanstack/ai-elevenlabs

npm i https://pkg.pr.new/TanStack/ai/@tanstack/ai-elevenlabs@1592

@tanstack/ai-event-client

npm i https://pkg.pr.new/TanStack/ai/@tanstack/ai-event-client@1592

@tanstack/ai-fal

npm i https://pkg.pr.new/TanStack/ai/@tanstack/ai-fal@1592

@tanstack/ai-gemini

npm i https://pkg.pr.new/TanStack/ai/@tanstack/ai-gemini@1592

@tanstack/ai-grok

npm i https://pkg.pr.new/TanStack/ai/@tanstack/ai-grok@1592

@tanstack/ai-grok-build

npm i https://pkg.pr.new/TanStack/ai/@tanstack/ai-grok-build@1592

@tanstack/ai-groq

npm i https://pkg.pr.new/TanStack/ai/@tanstack/ai-groq@1592

@tanstack/ai-isolate-cloudflare

npm i https://pkg.pr.new/TanStack/ai/@tanstack/ai-isolate-cloudflare@1592

@tanstack/ai-isolate-daytona

npm i https://pkg.pr.new/TanStack/ai/@tanstack/ai-isolate-daytona@1592

@tanstack/ai-isolate-node

npm i https://pkg.pr.new/TanStack/ai/@tanstack/ai-isolate-node@1592

@tanstack/ai-isolate-quickjs

npm i https://pkg.pr.new/TanStack/ai/@tanstack/ai-isolate-quickjs@1592

@tanstack/ai-isolate-quickjs-bun

npm i https://pkg.pr.new/TanStack/ai/@tanstack/ai-isolate-quickjs-bun@1592

@tanstack/ai-llmgateway

npm i https://pkg.pr.new/TanStack/ai/@tanstack/ai-llmgateway@1592

@tanstack/ai-lovable

npm i https://pkg.pr.new/TanStack/ai/@tanstack/ai-lovable@1592

@tanstack/ai-mcp

npm i https://pkg.pr.new/TanStack/ai/@tanstack/ai-mcp@1592

@tanstack/ai-memory

npm i https://pkg.pr.new/TanStack/ai/@tanstack/ai-memory@1592

@tanstack/ai-mistral

npm i https://pkg.pr.new/TanStack/ai/@tanstack/ai-mistral@1592

@tanstack/ai-octane

npm i https://pkg.pr.new/TanStack/ai/@tanstack/ai-octane@1592

@tanstack/ai-ollama

npm i https://pkg.pr.new/TanStack/ai/@tanstack/ai-ollama@1592

@tanstack/ai-ollaya

npm i https://pkg.pr.new/TanStack/ai/@tanstack/ai-ollaya@1592

@tanstack/ai-openai

npm i https://pkg.pr.new/TanStack/ai/@tanstack/ai-openai@1592

@tanstack/ai-opencode

npm i https://pkg.pr.new/TanStack/ai/@tanstack/ai-opencode@1592

@tanstack/ai-openrouter

npm i https://pkg.pr.new/TanStack/ai/@tanstack/ai-openrouter@1592

@tanstack/ai-perplexity

npm i https://pkg.pr.new/TanStack/ai/@tanstack/ai-perplexity@1592

@tanstack/ai-persistence

npm i https://pkg.pr.new/TanStack/ai/@tanstack/ai-persistence@1592

@tanstack/ai-preact

npm i https://pkg.pr.new/TanStack/ai/@tanstack/ai-preact@1592

@tanstack/ai-react

npm i https://pkg.pr.new/TanStack/ai/@tanstack/ai-react@1592

@tanstack/ai-react-ui

npm i https://pkg.pr.new/TanStack/ai/@tanstack/ai-react-ui@1592

@tanstack/ai-reactor

npm i https://pkg.pr.new/TanStack/ai/@tanstack/ai-reactor@1592

@tanstack/ai-remix

npm i https://pkg.pr.new/TanStack/ai/@tanstack/ai-remix@1592

@tanstack/ai-sandbox

npm i https://pkg.pr.new/TanStack/ai/@tanstack/ai-sandbox@1592

@tanstack/ai-sandbox-blaxel

npm i https://pkg.pr.new/TanStack/ai/@tanstack/ai-sandbox-blaxel@1592

@tanstack/ai-sandbox-boxd

npm i https://pkg.pr.new/TanStack/ai/@tanstack/ai-sandbox-boxd@1592

@tanstack/ai-sandbox-cloudflare

npm i https://pkg.pr.new/TanStack/ai/@tanstack/ai-sandbox-cloudflare@1592

@tanstack/ai-sandbox-daytona

npm i https://pkg.pr.new/TanStack/ai/@tanstack/ai-sandbox-daytona@1592

@tanstack/ai-sandbox-docker

npm i https://pkg.pr.new/TanStack/ai/@tanstack/ai-sandbox-docker@1592

@tanstack/ai-sandbox-e2b

npm i https://pkg.pr.new/TanStack/ai/@tanstack/ai-sandbox-e2b@1592

@tanstack/ai-sandbox-local-process

npm i https://pkg.pr.new/TanStack/ai/@tanstack/ai-sandbox-local-process@1592

@tanstack/ai-sandbox-sprites

npm i https://pkg.pr.new/TanStack/ai/@tanstack/ai-sandbox-sprites@1592

@tanstack/ai-sandbox-upstash-box

npm i https://pkg.pr.new/TanStack/ai/@tanstack/ai-sandbox-upstash-box@1592

@tanstack/ai-sandbox-vercel

npm i https://pkg.pr.new/TanStack/ai/@tanstack/ai-sandbox-vercel@1592

@tanstack/ai-skills

npm i https://pkg.pr.new/TanStack/ai/@tanstack/ai-skills@1592

@tanstack/ai-solid

npm i https://pkg.pr.new/TanStack/ai/@tanstack/ai-solid@1592

@tanstack/ai-solid-ui

npm i https://pkg.pr.new/TanStack/ai/@tanstack/ai-solid-ui@1592

@tanstack/ai-svelte

npm i https://pkg.pr.new/TanStack/ai/@tanstack/ai-svelte@1592

@tanstack/ai-typesafe

npm i https://pkg.pr.new/TanStack/ai/@tanstack/ai-typesafe@1592

@tanstack/ai-utils

npm i https://pkg.pr.new/TanStack/ai/@tanstack/ai-utils@1592

@tanstack/ai-vercel-gateway

npm i https://pkg.pr.new/TanStack/ai/@tanstack/ai-vercel-gateway@1592

@tanstack/ai-vertex

npm i https://pkg.pr.new/TanStack/ai/@tanstack/ai-vertex@1592

@tanstack/ai-vue

npm i https://pkg.pr.new/TanStack/ai/@tanstack/ai-vue@1592

@tanstack/ai-vue-ui

npm i https://pkg.pr.new/TanStack/ai/@tanstack/ai-vue-ui@1592

@tanstack/ai-worldlabs

npm i https://pkg.pr.new/TanStack/ai/@tanstack/ai-worldlabs@1592

@tanstack/openai-base

npm i https://pkg.pr.new/TanStack/ai/@tanstack/openai-base@1592

@tanstack/preact-ai-devtools

npm i https://pkg.pr.new/TanStack/ai/@tanstack/preact-ai-devtools@1592

@tanstack/react-ai-devtools

npm i https://pkg.pr.new/TanStack/ai/@tanstack/react-ai-devtools@1592

@tanstack/solid-ai-devtools

npm i https://pkg.pr.new/TanStack/ai/@tanstack/solid-ai-devtools@1592

@tanstack/svelte-ai-devtools

npm i https://pkg.pr.new/TanStack/ai/@tanstack/svelte-ai-devtools@1592

commit: 6a83a61

github-actions · 2026-10-01T18:28:01Z

Thanks for the PR, @tannerlinsley! 🙌 @AlemTuzlak will take a look.

Automated pre-review checks

✅ CI pending
✅ No merge conflicts
✅ Changeset present
✅ E2E test changes included

_{Automated triage — a human review follows.}

changeset-bot · 2026-10-03T15:10:05Z

⚠️ No Changeset found

Latest commit: 6a83a61

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

chore: refresh Start example dependencies

eaef9a3

ci: apply automated fixes

fe6456b

github-actions Bot assigned AlemTuzlak Oct 1, 2026

github-actions Bot requested a review from AlemTuzlak October 1, 2026 18:27

github-actions Bot added the waiting-on: maintainer The ball is in the maintainers’ court label Oct 1, 2026

AlemTuzlak approved these changes Oct 1, 2026

View reviewed changes

github-actions Bot added waiting-on: author Waiting for the author to respond or update merge-conflicts Conflicts with the base branch — needs a rebase and removed waiting-on: maintainer The ball is in the maintainers’ court labels Oct 2, 2026

chore: merge current main into Start example update

6a83a61

tannerlinsley enabled auto-merge (squash) October 3, 2026 15:28

tannerlinsley merged commit 632fd80 into main Oct 3, 2026
10 of 11 checks passed

tannerlinsley deleted the chore/start-example-dependencies branch October 3, 2026 15:31

Navigation Menu

Repository navigation

chore: refresh Start example dependencies - #1592

chore: refresh Start example dependencies#1592
tannerlinsley merged 3 commits into
mainfrom
chore/start-example-dependencies

tannerlinsley commented Oct 1, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Oct 1, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Oct 1, 2026 •

edited

Loading

Walkthrough

Changes

❌ Failed checks (1 warning)

Uh oh!

nx-cloud Bot commented Oct 1, 2026 •

edited

Loading

Uh oh!

pkg-pr-new Bot commented Oct 1, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 1, 2026

Uh oh!

changeset-bot Bot commented Oct 3, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

tannerlinsley commented Oct 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🎯 Changes

✅ Checklist

🚀 Release Impact

Testing

Risk / rollback

CI follow-up

Summary by CodeRabbit

Uh oh!

socket-security Bot commented Oct 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot commented Oct 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Security Architecture Review

❌ Failed checks (1 warning)

Uh oh!

nx-cloud Bot commented Oct 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pkg-pr-new Bot commented Oct 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 1, 2026

Uh oh!

changeset-bot Bot commented Oct 3, 2026

⚠️ No Changeset found

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

tannerlinsley commented Oct 1, 2026 •

edited

Loading

socket-security Bot commented Oct 1, 2026 •

edited

Loading

coderabbitai Bot commented Oct 1, 2026 •

edited

Loading

nx-cloud Bot commented Oct 1, 2026 •

edited

Loading

pkg-pr-new Bot commented Oct 1, 2026 •

edited

Loading