Skip to content

fix(deps): update tanstack-router monorepo - #3

Merged
rishitank merged 1 commit into
mainfrom
renovate/tanstack-router-monorepo
Oct 12, 2026
Merged

fix(deps): update tanstack-router monorepo#3
rishitank merged 1 commit into
mainfrom
renovate/tanstack-router-monorepo

Conversation

@renovate

@renovate renovate Bot commented Sep 28, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
@tanstack/react-router (source) 1.170.18 → 1.170.41 age confidence
@tanstack/react-start (source) 1.168.32 → 1.168.60 age confidence
@tanstack/router-plugin (source) 1.168.23 → 1.168.42 age confidence

Release Notes

TanStack/router (@​tanstack/react-router)

v1.170.41

Compare Source

Patch Changes

  • #​8529 60b8ad1 - Compose only enabled route boundaries instead of rendering inactive wrapper components.

  • #​8568 614bc27 - Update TanStack Store to 0.11.2 to prevent unrelated atom reads inside subscription observers from triggering extra notifications.

  • #​8530 ff66a03 - Consolidate the root match context provider while preserving match context in the root shell.

  • #​8522 863c8a7 - Reuse Link href classification and active/inactive results across location updates while preserving live history href formatting.

  • Updated dependencies [d521abd]:

v1.170.40

Compare Source

Patch Changes

v1.170.39

Compare Source

Patch Changes
  • #​8435 73bfc15 - Avoid hydration-triggered rerenders for links that do not compare URL hashes while preserving hash-sensitive active state and ClientOnly behavior.

v1.170.38

Compare Source

Patch Changes

v1.170.37

Compare Source

Patch Changes

  • #​8418 e561fa1 - deepEqual now takes its flags as positional arguments — deepEqual(a, b, partial?, explicitUndefined?) — instead of an options object. The router's hot callers (Link option stabilization and active-state checks, matchRoute) no longer allocate an options object per comparison, and the comparator reads two booleans instead of a polymorphic object. explicitUndefined replaces ignoreUndefined: false. deepEqual is an internal helper; it stays exported for compatibility of two-argument calls.

  • #​8419 a1c8d1a - resolvePath (internal helper) now takes positional arguments — resolvePath(base, to, trailingSlash?, cache?) — so buildLocation and matchRoute no longer allocate an options object per path resolution.

  • #​8204 cbbfbe3 - Stream large deferred SSR hydration payloads through a backpressure-aware router transport, fail known setup errors before response creation, and close cancelled or expired transforms safely.

    Start now cancels discarded middleware and HEAD response bodies, including plain streams and derived branches.

    Server-function raw streams share one ordered response. Arbitrary or sequential consumption can require potentially unbounded buffering of unread data on the client. Cancelling one raw stream discards it locally, while aborting the whole call cancels the response and server work. Consume streams concurrently, cancel unused streams promptly, or use separate calls when independent backpressure is required. A raw stream that exceeds its unread-byte limit now fails alone; sibling streams and the JSON result keep flowing.

    The JSON wire shape of a RawStream server-function argument changed. Clients and servers must run matching versions for requests that pass a RawStream.

    The frame-protocol constants (FRAME_TYPE_*, MAX_FRAME_PAYLOAD_SIZE, MAX_FRAMED_STREAMS) moved from the @tanstack/start-client-core root to the @tanstack/start-client-core/client-rpc subpath.

    Router requests whose Accept header allows neither text/html nor */* now receive 406 Not Acceptable instead of 500.

    Framework adapters share the body <Scripts> composition (getSsrBodyScriptParts, composeSsrBodyScripts) and the eager HTML response wrapper (renderSsrHtmlResponse) from @tanstack/router-core.

    Solid SSR now emits one document type and renders late lazy errors through route boundaries. A Solid <Await> without a fallback no longer holds the streamed shell; it renders inside the nearest <Suspense> boundary like React and Vue, and now renders falsy resolved values.

    Static server functions decode cached RawStream values with the client deserializer plugins.

    SSR Query integrations now keep request cleanup and stream ownership aligned with the router lifecycle.

  • #​8420 8e164d2 - useLinkProps no longer calls through an internal wrapper. The host element Link renders on is an @internal overload parameter that is stripped from the published declarations, so the public useLinkProps(options, forwardedRef?) signature is unchanged.

  • Updated dependencies [bc80866, e561fa1, cbbfbe3, a1c8d1a, cbbfbe3, a0b2ad9, 1ca361b]:

v1.170.36

Compare Source

Patch Changes

  • #​8390 b747fb8 - Keep the Link location cache out of server bundles: buildLocation only creates, reads and writes it when isServer is false. Render React Links on the server without the extra prop copies and the forwarded-ref hook. Link SSR rendering is 20-40% faster in the Link benchmarks and the React Start SSR request loop about 7% faster.

    React activeProps and inactiveProps now follow one precedence rule on every link, including links whose destination is blocked for using a disallowed scheme: state props override element props, ref and event handlers, while href, disabled and target stay controlled by the router. Previously a blocked link ignored a ref or handler from its inactive props.

    React Link and useLinkProps split router options from element props with one key set on the client and the server. Element props pass through as given: external links forward them verbatim, falsy values included, and useLinkProps now returns children for router-controlled links as it already did for external ones.

  • #​8324 6387d58 - Reuse hydration snapshot getters to avoid unnecessary store-instance effect updates when Links and other hydration-aware components rerender.

  • #​8318 9b2adaf - Allow active and inactive Link props to override base element props in React and Solid while preserving class/style merging. Keep React's href, target, and disabled values controlled by routing options. Preserve Vue object and nested-array class bindings, including reactive updates and server rendering, without mutating cached bindings during VNode normalization.

  • #​8327 634da91 - Make pathParamsAllowedCharacters initialization-only. Configure it when creating the router; changing allowed characters requires a new router instance. Remove decoder-update bookkeeping and decoder-change checks from route-owned path caches.

  • #​8370 e9396c9 - Stop exporting the internal isPlainObject and isPlainArray helpers.

  • #​8324 6387d58 - Avoid a redundant prop copy when rendering native Links while preserving custom-component props and the public hook result.

  • #​8252 7e349c3 - Reduce the bundle cost of shared Link pathname interpolation while preserving its rendering performance. Reuse one interpolation pass for pathname and optional metadata, keep the bounded cache on the router, and simplify React Link active-state and prop merging.

  • #​8370 e9396c9 - Reuse built locations for Links whose destination does not depend on the current location. buildLocation keeps the result per options object when the build never read the current location, and the React Link passes one stable options object per instance, so navigations resolve unchanged Links with a lookup instead of a full build. The per-route pathname interpolation cache this replaces is removed. Link params, search and activeOptions are compared by value on render, so inline object literals with unchanged contents keep reusing the Link's location. Pass a new object to change a destination; like any other React prop, an object mutated in place is not re-read.

  • Updated dependencies [d76a332, b747fb8, 6cfb1e8, 700a714, 700a714, 8fff7fa, f021f6d, ae68535, 7e349c3, 873c830, 7e349c3, 634da91, e9396c9, 634da91, f151ab0, bc57fa3, 9872d2a, d76a332, 634da91, 634da91, 7e349c3, 9448caa, e9396c9, 700a714, 634da91, 634da91]:

v1.170.35

Compare Source

Patch Changes
  • #​7824 8c43c71 - Upgrade TanStack Store to 0.11 and migrate router subscriptions to useSelector, preserving selector comparisons and Vue subscription cleanup.

v1.170.34

Compare Source

Patch Changes

  • #​8279 aee42c6 - Avoid allocating event-handler arrays and wrapper functions for links without user-supplied event handlers.

  • #​8308 9c1871c - Validate navigation and redirect destinations, keep ambiguous relative URLs on the current origin, and constrain prerender requests and output paths. Prevent redirect headers from appearing in serialized server function response bodies.

    Preserve native form HTTP redirects, route error handling and masks for document redirects, and per-navigation destinations for shared loader redirects. Avoid redundant origin parsing and reduce link styling and server-rendering work. Configured origins must already be normalized.

    Keep blocked-link inactive props consistent during React hydration, honor explicit redirect Location headers before checking route options, and refresh Vue link state when destinations become internal. Reuse the protocol-relative URL check while parsing redirect schemes once.

    Reduce React link bundle size by sharing pathname comparisons, state-prop selection, and element creation.

    Share normalized pathname comparisons in Solid and Vue links to reduce bundle size.

  • #​8311 9aec5a7 - React Links resolve state props without temporary class-name arrays or unnecessary style copies.

  • Updated dependencies [f9836f1, 9c1871c, 9871c06, 0654c0a]:

v1.170.33

Compare Source

Patch Changes

  • #​8165 2f20c00 - Exclude structural descendants below error and not-found boundaries from route lifecycle callbacks. Preserve lifecycle membership through invalidation, hydration, background reloads, and superseded navigation publication.

  • #​8209 28a5e45 - Preserve falsy thrown values in React and Vue error boundaries. Type React and Vue boundary error components and onCatch callbacks as unknown. Solid boundary errors remain typed as Error; SSR now wraps non-Error loader errors to match Solid’s native boundary behavior, preserving the original value in cause. Router state and loader onError values are unchanged.

    When upgrading React or Vue, narrow boundary errors (for example, with error instanceof Error) before reading message or stack. ErrorComponentProps<TError> remains available for values narrowed to a specific error type. Route onError types are unchanged.

  • #​8161 f0b5eda - Retain successful not-found matches as terminal shared boundaries during client navigation, preserving route context while the destination loads.

  • #​8251 0497cae - Use URL.canParse for absolute URL checks in links, navigation, redirects, and build configuration. Preserve a URL constructor fallback for older browsers.

  • #​8169 0caf6b9 - Fix route-scoped useMatch, useSearch, and useParams APIs to forward the shouldThrow option and preserve optional return types when shouldThrow: false.

  • #​8257 cf166d1 - Fix repeated innerHTML writes for unchanged styles and data scripts during React re-renders. This prevents unnecessary CSS parsing and Trusted Types errors during client navigation.

  • Updated dependencies [edf0e16, 2f20c00, 28a5e45, 08eff50, 216c0c4, 2f91503, f0b5eda, 50eafca, 0497cae, ee28348, 9035abc, c18e690]:

v1.170.32

Compare Source

Patch Changes

v1.170.31

Compare Source

Patch Changes

v1.170.30

Compare Source

Patch Changes

v1.170.29

Compare Source

Patch Changes

v1.170.28

Compare Source

Patch Changes

  • #​8055 0c25a7b - Avoid wrapping root components that may render the HTML document in a Suspense boundary during SSR and hydration.

  • #​8054 31882c7 - Reuse resolved lazy route components when revisiting code-split routes, preventing unnecessary pending UI.

  • Updated dependencies [31882c7]:

v1.170.27

Compare Source

Patch Changes

v1.170.26

Compare Source

Patch Changes

  • #​8045 f500760 - Warn when an Outlet is rendered inside a pending, error, or not-found component.

  • #​8043 1aafca9 - remove the undocumented Link isTransitioning state and data-transitioning attribute

  • #​8044 aa10b65 - Apply preloadDelay to viewport link preloading and cancel pending preloads when links leave the viewport.

  • Updated dependencies [7e93431]:

v1.170.25

Compare Source

Patch Changes

v1.170.24

Compare Source

Patch Changes

v1.170.23

Compare Source

Patch Changes
  • #​7952 95dec51 - bail out of Link re-renders when the resolved href and active state are unchanged

v1.170.22

Compare Source

Patch Changes

v1.170.21

Compare Source

Patch Changes

  • #​7961 697ebb6 - Prevent a blank frame before zero-delay initial pending UI by using a
    component-scoped React transition for match publication. Pending timing,
    boundary selection, and rendered matches continue to come from the router
    core.

  • #​7970 2435885 - createFileRoute does not rely on FileRoute class

  • #​7971 86bf510 - clean intersection observer options in link component

  • #​7967 6aefb33 - Preserve path params in their raw string form while matching routes so structured values returned by params.parse produce stable match IDs and do not reuse stale loader data.

    RouterCore.getMatchedRoutes() now returns [matchedRoutes, rawParams, foundRoute] instead of an object.

  • Updated dependencies [84db4a8, 9cac62a, 6aefb33]:

v1.170.20

Compare Source

Patch Changes

v1.170.19

Compare Source

Patch Changes

  • #​7805 45c4ad8 - Rewrite match loading around a lane-based scheduler that tracks each navigation, preload, and background reload as an ordered unit of work. This fixes pending/redirect/retry state leaking between overlapping navigations, restores correct SSR status codes for redirects, errors, and not-found responses, and closes hydration gaps where the client re-ran work the server had already completed.

    • Invalidation now retires matching active preloads so older speculative loader results cannot become fresh cache data after invalidation.
    • Route headers() now only runs on the server, matching the documented behavior — it is no longer invoked during client-side asset projection.
    • The documented default gcTime and preloadGcTime now match the existing runtime default of 5 minutes (300_000).

    Removed / changed exported internals

    • RouterState no longer includes loadedAt, isTransitioning, statusCode, or redirect. Use match.updatedAt in place of loadedAt; subscribe to router.state.status / router.state.isLoading in place of isTransitioning; server response status and redirect handling are now internal to the server loader and are no longer exposed on router.state.
    • RouteMatch.fetchCount has been removed, with no replacement — it was purely informational.
    • RouteMatch.status no longer includes 'redirected' (it remains 'pending' | 'success' | 'error' | 'notFound') — redirected matches are dropped from the match list instead of being rendered.
    • RouteMatch.globalNotFound has been renamed and privatized to the internal _notFound field. Use match.status === 'notFound' instead.
    • The exported React, Solid, and Vue Match components now accept routeId instead of matchId.
    • The exported RouterStores adapter contract now uses route-keyed presentation stores: matchesId is replaced by ids, matchStores by byRoute, and getRouteMatchStore() by getMatchStore(). The separate loadedAt, isLoading, isTransitioning, statusCode, and redirect stores have been removed, along with the pending/cache stores and their setters. StoreConfig.init has also been removed. Read application-facing state from router.state; preload and cache coordination are now internal.
    • Removed RouterCore members getMatch(), updateMatch(), cancelMatch(), and cancelMatches() — read matches from router.state.matches (e.g. router.state.matches.find((m) => m.id === id)); there is no replacement for mutating or cancelling an individual in-flight match from outside the router.
    • Removed RouterCore.hasNotFoundMatch() — use router.state.matches.some((m) => m.status === 'notFound').
    • Removed RouterCore.looseRoutesById — use routesById.
    • Removed RouterCore.isPrerendering(), RouterCore.isViewTransitionTypesSupported, and RouterCore.viewTransitionPromise, with no replacement.
    • Removed RouterCore.getParsedLocationHref() and RouterCore.clearExpiredCache(), with no replacement — expired cache entries are now reconciled automatically as part of match commit.
    • Removed RouterCore.latestLoadPromise and RouterCore.beforeLoad(), with no replacement.
    • RouterCore.commitLocationPromise and RouterCore.pendingBuiltLocation have been replaced by the internal _commitPromise and _pendingLocation fields.
    • Removed the exported GetMatchFn and UpdateMatchFn types, along with the methods they typed.
    • Removed the standalone getMatchedRoutes() export from @tanstack/router-core — use the router.getMatchedRoutes() instance method instead.
    • RouterCore.loadRouteChunk() no longer accepts an array of component types as its second argument. One-argument usage is unchanged; the optional second argument is now 'errorComponent', 'notFoundComponent', or false for internal boundary loading.
    • Removed Redirect.redirectHandled, which was internal redirect bookkeeping.
    • MatchRoutesOpts.preload and MatchRoutesOpts.dest have been removed.
    • StartTransitionFn is now (fn, expected) => Promise<boolean> (previously (fn) => void). This only affects custom framework adapters that implement startTransition.

  • Updated dependencies [45c4ad8]:

TanStack/router (@​tanstack/react-start)

v1.168.60

Compare Source

Patch Changes

v1.168.59

Compare Source

Patch Changes

v1.168.58

Compare Source

Patch Changes

v1.168.57

Compare Source

Patch Changes

v1.168.56

Compare Source

Patch Changes

v1.168.55

Compare Source

Patch Changes

v1.168.54

Compare Source

Patch Changes

v1.168.53

Compare Source

Patch Changes

v1.168.52

Compare Source

Patch Changes

v1.168.51

Compare Source

Patch Changes

v1.168.50

Compare Source

Patch Changes

v1.168.49

Compare Source

Patch Changes

❗ Important

✂ PR body was truncated to here.

Configuration

📅 Schedule: (in timezone Europe/London)

  • Branch creation
    • Between 12:00 AM and 06:59 AM, only on Monday (* 0-6 * * 1)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@coderabbitai

coderabbitai Bot commented Sep 28, 2026 •
edited
Loading

Copy link
Copy Markdown

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration
  • Configuration used: Organization UI
  • Review profile: ASSERTIVE
  • Plan: Advanced
  • Run ID: a7176fbc-793b-4243-8020-17d73764a17b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@renovate
renovate Bot force-pushed the renovate/tanstack-router-monorepo branch from d028be8 to 4c87f30 Compare October 3, 2026 12:15
@github-actions

github-actions Bot commented Oct 3, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

🔦 Lighthouse CI

URL Performance Accessibility Best Practices SEO
http://127.0.0.1:4173/ 🟠 65 🟢 100 🟢 100 🟢 100

This repo’s lighthouserc assertions can fail this check.

@rishitank rishitank mentioned this pull request Oct 8, 2026
Merged
rishitank added a commit that referenced this pull request Oct 8, 2026
@rishitank @claude
perf: slim Motion via LazyMotion, load the report on demand; type the…
fcbf2df 
… root error boundary from the router

Lighthouse performance on main sits at 0.63-0.77 on hosted runners, driven
by Total Blocking Time from JS boot. Two contained cuts to first-load JS:

- Motion: every component now renders `m.*` inside
  <LazyMotion features={domAnimation} strict> (root route) instead of
  `motion.*`, which bundles every feature (layout, drag, projection).
  Features stay synchronous: an async load re-rendered every animated
  element when it arrived and measured worse.
- The finished report (ScoreRing, PreviewCards, FixList, ResultActions)
  moves to src/components/AuditReport.tsx and loads with React.lazy; the
  scoring code (lib/analysis) is imported in the mutation. A check
  fetches both in parallel with the audit request.

First-load JS: 198.6 KB -> ~171 KB gzip. Local Lighthouse (mobile preset,
20x CPU to approximate the runner, 5 interleaved runs each): median
performance 0.83 -> 0.90, TBT 439 -> 254 ms.

Also: ErrorComponent takes the router's ErrorComponentProps. TanStack
Router 1.170.41 (Renovate #3) types `error` as unknown, which broke
typecheck at __root.tsx:111; the body already handled non-Error values.
Verified to typecheck against both 1.170.18 and 1.170.41.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012rYJxu978iUSGFZ1UuqTsi
rishitank added a commit that referenced this pull request Oct 8, 2026
@rishitank @claude
perf: wire LazyMotion and the lazy report into the routes; type the r…
46ebc68 
…oot error boundary

Second half of fcbf2df (the push was split): src/routes/__root.tsx wraps
the outlet in <LazyMotion features={domAnimation} strict> and types
ErrorComponent with the router's ErrorComponentProps (fixes the TanStack
Router 1.170.41 typecheck failure in Renovate #3); src/routes/index.tsx
renders m.* and loads AuditReport and lib/analysis on demand;
src/components/PreviewCards.tsx renders m.*.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012rYJxu978iUSGFZ1UuqTsi
rishitank added a commit that referenced this pull request Oct 8, 2026
@rishitank @claude
fix(router): type the root error boundary from the router; wrap the o…
049e2c9 
…utlet in LazyMotion

Last part of the split push (fcbf2df, 46ebc68): src/routes/__root.tsx.

- ErrorComponent takes the router's ErrorComponentProps. TanStack Router
  1.170.41 (Renovate #3) types `error` as unknown, which broke typecheck
  at __root.tsx:111; the body already handled non-Error values. Checked
  to typecheck against both 1.170.18 and 1.170.41.
- <LazyMotion features={domAnimation} strict> around the outlet, so the
  m.* components animate with only the features the app uses.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012rYJxu978iUSGFZ1UuqTsi
rishitank added a commit that referenced this pull request Oct 9, 2026
@rishitank @claude @github-actions
ci: add runtime gate, security scan, workflow lint and house Renovate…
3317fe7 
… preset (#11)

* ci: add runtime gate, security scan, workflow lint and house Renovate preset

- runtime.yml: builds with bun and serves the built worker with
  `wrangler dev` on 4173 (the lighthouserc command), then crawls it in a
  real browser via the shared runtime gate
- security.yml: osv-scanner (reads bun.lock) and gitleaks via the shared
  workflow; no native audit, since npm audit cannot read bun.lock
- workflows-lint.yml: actionlint over .github/workflows
- ci.yml: pin the shared lighthouse-ci workflow to @v1 instead of @main,
  like every other shared workflow call
- renovate.json: extend github>rishitank/.github:node instead of
  config:recommended
- .github/runtime-gate.md: hints for the AI explorer

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012rYJxu978iUSGFZ1UuqTsi

* ci: pin runtime-gate to 8040381 (operates every safe control)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012rYJxu978iUSGFZ1UuqTsi

* ci: pin runtime-gate to 8e8a197 (fills and submits forms)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012rYJxu978iUSGFZ1UuqTsi

* ci: correct the runtime.yml form comment; regenerate bun.lock on a runner

- runtime.yml: the comment said the crawler never submits the URL form.
  Since runtime-gate 8e8a197 it does: it fills the field with
  https://example.com and submits, so the crawl runs one real audit and
  the worker fetches that URL live from the runner.
- deps-refresh-once.yml (one-shot, deleted in the next commit): regenerates
  bun.lock with bun 1.3.13 (the version ci.yml pins) within the ranges
  package.json already declares. osv-scanner flags 16 advisories, all
  transitive: seroval 1.5.6 (critical), shell-quote 1.10.0, nanoid 3.3.16,
  js-yaml 4.3.0, brace-expansion 1.1.16 and 5.0.8, source-map-js 1.2.1.
  Every patched version is inside its parent's range, but bun cannot move
  a transitive dep alone: `bun update <pkg>` adds it as a direct dependency,
  flat overrides cannot serve brace-expansion's two majors, and any edit
  to bun.lock makes bun re-resolve the whole tree anyway. package.json is
  unchanged, so the exact pins (TanStack, vite, nitro, rolldown) hold.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012rYJxu978iUSGFZ1UuqTsi

* ci(deps-refresh-once): fix the commit step

`git add -A -- . ':(exclude)node_modules'` exits 1 when node_modules is
gitignored ("paths are ignored"), so the refreshed lockfile could not be
committed. Add everything and unstage node_modules and this file instead.

One-shot file; deleted in the next commit.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012rYJxu978iUSGFZ1UuqTsi

* chore(deps): refresh lockfile to pick up patched versions

Ran on a runner by the one-shot deps-refresh-once workflow: rm bun.lock && bun install --lockfile-only

* ci: remove the one-shot deps-refresh-once workflow

It regenerated bun.lock in 90bba3b (bun 1.3.13, ranges unchanged):
seroval/seroval-plugins 1.6.8, shell-quote 1.12.0, nanoid 3.3.20,
js-yaml 4.3.2, brace-expansion 1.1.21 and 5.0.12, source-map-js 1.2.2.
This commit is what runs CI against the refreshed lockfile.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012rYJxu978iUSGFZ1UuqTsi

* ci(lighthouse): 5 runs, assert on the median run, performance score advisory

Lighthouse scores swing from run to run on shared hosted runners, and this
job is strict, so a noisy run turns the PR red. LHCI's default assertion
aggregation is "optimistic" (the best value per assertion across runs).

- collect.numberOfRuns: 3 -> 5.
- assert.aggregationMethod: "median-run". It is a top-level assert option
  in @lhci/cli 0.14 (assertions.js applies it to every assertion that does
  not set its own), so each budget is checked against the run LHCI picks
  as most representative.
- categories:performance: error -> warn, minScore 0.9 unchanged. The
  category score is the noisiest number on a hosted runner.
  Accessibility, best-practices, SEO and the CLS budget stay `error`.

The shared lighthouse-ci.yml runs plain `lhci autorun`, so nothing on the
command line overrides these values.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012rYJxu978iUSGFZ1UuqTsi

* ci(lighthouse): aggregate with "median", not "median-run"

"median-run" does not do what it says for category scores. In @lhci/cli
0.14 (unchanged on main), `categories:*` assertions are scored across
every run, not just the representative one, and getValueForAggregationMethod
has no "median-run" branch, so it falls through to Math.max: the same as
"optimistic". The previous commit's run shows it: performance asserted
0.66 from runs 0.66/0.65/0.66/0.65/0.60, whose median is 0.65.

"median" takes the median of the 5 values for category and audit
assertions (CLS included) alike. Reproduced locally against @lhci/utils
0.14.0. Levels and thresholds are unchanged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012rYJxu978iUSGFZ1UuqTsi

* ci(runtime-gate): move to runtime-gate v4 (signed-in crawl, recorded flows, coverage)

Repin runtime-gate.yml to f1ad747 and add the weekly/manual flows job
(runtime-gate-flows.yml), starting runtime.yml on the flows PR (ci.yml has
no workflow_dispatch). No sign-in inputs: the app is a single public page
with no accounts.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012rYJxu978iUSGFZ1UuqTsi

* ci(runtime-gate): move to runtime-gate v4.1

v4.1 signs in before the signed-out crawl, accepts a login-check page with a
change-password form, and no longer re-posts forms through browser history.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012rYJxu978iUSGFZ1UuqTsi

* perf: slim Motion via LazyMotion, load the report on demand; type the root error boundary from the router

Lighthouse performance on main sits at 0.63-0.77 on hosted runners, driven
by Total Blocking Time from JS boot. Two contained cuts to first-load JS:

- Motion: every component now renders `m.*` inside
  <LazyMotion features={domAnimation} strict> (root route) instead of
  `motion.*`, which bundles every feature (layout, drag, projection).
  Features stay synchronous: an async load re-rendered every animated
  element when it arrived and measured worse.
- The finished report (ScoreRing, PreviewCards, FixList, ResultActions)
  moves to src/components/AuditReport.tsx and loads with React.lazy; the
  scoring code (lib/analysis) is imported in the mutation. A check
  fetches both in parallel with the audit request.

First-load JS: 198.6 KB -> ~171 KB gzip. Local Lighthouse (mobile preset,
20x CPU to approximate the runner, 5 interleaved runs each): median
performance 0.83 -> 0.90, TBT 439 -> 254 ms.

Also: ErrorComponent takes the router's ErrorComponentProps. TanStack
Router 1.170.41 (Renovate #3) types `error` as unknown, which broke
typecheck at __root.tsx:111; the body already handled non-Error values.
Verified to typecheck against both 1.170.18 and 1.170.41.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012rYJxu978iUSGFZ1UuqTsi

* perf: wire LazyMotion and the lazy report into the routes; type the root error boundary

Second half of fcbf2df (the push was split): src/routes/__root.tsx wraps
the outlet in <LazyMotion features={domAnimation} strict> and types
ErrorComponent with the router's ErrorComponentProps (fixes the TanStack
Router 1.170.41 typecheck failure in Renovate #3); src/routes/index.tsx
renders m.* and loads AuditReport and lib/analysis on demand;
src/components/PreviewCards.tsx renders m.*.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012rYJxu978iUSGFZ1UuqTsi

* fix(router): type the root error boundary from the router; wrap the outlet in LazyMotion

Last part of the split push (fcbf2df, 46ebc68): src/routes/__root.tsx.

- ErrorComponent takes the router's ErrorComponentProps. TanStack Router
  1.170.41 (Renovate #3) types `error` as unknown, which broke typecheck
  at __root.tsx:111; the body already handled non-Error values. Checked
  to typecheck against both 1.170.18 and 1.170.41.
- <LazyMotion features={domAnimation} strict> around the outlet, so the
  m.* components animate with only the features the app uses.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012rYJxu978iUSGFZ1UuqTsi

* ci: pin shared workflows to the v1 commit; document advisory performance budget

Address CodeRabbit review on #11:
- ci.yml, security.yml, workflows-lint.yml: pin the shared reusable
  workflows to 5c644123 (the commit v1 points at) with a `# v1` comment,
  instead of the mutable tag. The house Renovate preset
  (helpers:pinGitHubActionDigests) keeps the digest current.
- README and the ci.yml comment said a performance score below 90 fails
  the build; lighthouserc.json makes it a warning. Make the docs say what
  the config does.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012rYJxu978iUSGFZ1UuqTsi

* ci: delete a PR's head branch after it merges, with an allowlist

GitHub has no account-wide setting for this, the per-repo toggle deletes
every merged head branch, and Free-plan private repos cannot protect
long-lived branches such as develop. This self-contained workflow runs
on merged same-repo PRs and deletes the head branch unless it is the
default branch, one of main/master/develop/staging/test/gh-pages/
deploy-*/release/*, or the base of another open PR. A branch that is
already gone counts as success.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012rYJxu978iUSGFZ1UuqTsi

* ci(branch-cleanup): only delete the merged commit; keep heads of open PRs

From CodeRabbit review: keep the branch when another open PR uses it as
its head; read the branch's current SHA first and keep it if it moved
past the merged PR head (REST has no conditional delete, so only the
instant between read and DELETE is unguarded); comment each permission.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012rYJxu978iUSGFZ1UuqTsi

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
@renovate
renovate Bot force-pushed the renovate/tanstack-router-monorepo branch from 4c87f30 to d0324db Compare October 9, 2026 16:44
@renovate renovate Bot added the dependencies label Oct 9, 2026
@renovate renovate Bot changed the title Update tanstack-router monorepo fix(deps): update tanstack-router monorepo Oct 9, 2026
@github-actions

github-actions Bot commented Oct 9, 2026

Copy link
Copy Markdown
Contributor

🧪 Runtime gate

✅ Runtime crawl: no runtime errors

1 page(s) opened in a real browser (desktop + phone), safe controls exercised, forms tried with dummy data, links followed client-side, missing-route probe run. 15s.

Coverage: 1/1 routes · 2/3 controls operated · 1/1 forms submitted · 39% of the app's own JavaScript executed

Against the default branch: routes ±0, controls ±0, JS −0.3 pts.

No visual changes against the last default-branch run.

Pages visited
Page Status ms Controls operated Forms submitted Problems
/ 200 5220 2/3 1/1 0

⏭️ AI explorer skipped

No GEMINI_API_KEY secret is available to this run, so the Gemini explorer did not run. The deterministic crawl above still gates the change.

Screenshots, diffs and the app log: runtime-gate artifact.

@rishitank
rishitank merged commit bcbe293 into main Oct 12, 2026
10 checks passed
@rishitank
rishitank deleted the renovate/tanstack-router-monorepo branch October 12, 2026 07:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@rishitank