TanStack Start 1.0 is officially stable! 🎉 A full-stack web framework for React and Solid, already used to build millions of apps, from Fortune 500 companies to your favorite tools and weekend projects. tanstack.com/start

TanStack Start's security fix for CVE-2026-102989 is now available. Please upgrade and redeploy affected apps. Thanks to Lovable for helping us discover and fix it. tanstack.com/blog/tanstack-s…

🌴Announcing TanStack Table V9🌴 Now Stable! After more than two years of development, TanStack Table V9 lays a new foundation for years to come, with a tree-shakable plugin architecture, state management powered by TanStack Store, new features, major performance improvements, hundreds of bug fixes, and more.

New in TanStack Router: more control over dynamic route params. Use params.parse to accept or skip a candidate, with priority for overlapping dynamic params.

After a very thorough 3 day full security sweep and hardening process, we'd like to issue an official all clear ✅ on TanStack repo and package security. Full details have been updated in our post-mortem and security followup blog (linked below). TL;DR: - Only the Router/Start repo was affected. 42 monorepo packages, 2 versions per package. These were promptly deprecated within the hour and removed by NPM shortly after - All other repos and packages were unaffected and remain secure including: Query, DB, Store, AI, Table, Form, HotKeys, Virtual, Pacer, Config, Devtools, CLI, Intent, etc. - All available and published versions of every TanStack package are safe to download, including TanStack Router/Start. tanstack.com/blog/npm-supply… tanstack.com/blog/incident-f…

"Hardening TanStack After the npm Compromise", a followup to yesterday's post-mortem. tanstack.com/blog/incident-f…

SECURITY ADVISORY — TanStack npm packages A supply-chain compromise affecting 42 @tanstack/* packages (84 versions total) was published to npm earlier today at approximately 19:20 and 19:26 UTC. Two malicious versions per package. Status: ACTIVE — packages are deprecated, npm security engaged, publish path being shut down. Severity: HIGH — payload exfiltrates AWS, GCP, Kubernetes, and Vault credentials, GitHub tokens, .npmrc contents, and SSH keys. If you installed any @tanstack/* package between 19:20 and 19:30 UTC today, treat the host as potentially compromised: • Rotate cloud, GitHub, and SSH credentials immediately • Audit cloud audit logs for the last several hours • Pin to a prior known-good version and reinstall from a clean lockfile Detection — the malicious manifest contains: "optionalDependencies": { "@tanstack/setup": "github:tanstack/router#79ac49ee..." } Any version with this entry is compromised. The payload is delivered via a git-resolved optionalDependency whose prepare script runs router_init.js (~2.3 MB, smuggled into each tarball at the package root). Unpublish is blocked by npm policy for most affected packages due to existing third-party dependents. All 84 versions are being deprecated with a SECURITY warning, and npm security has been engaged to pull tarballs at the registry level. Full technical breakdown, complete package and version list, and rolling status updates: github.com/TanStack/router/i… Credit to the security researcher for responsible disclosure.