examples/react/bundling-repro/package.json (1)

18-26: Consider pinning @tanstack/ai-* packages to specific versions.

Using "latest" for these AI packages means builds are non-reproducible and could break unexpectedly when new versions are published. While acceptable for a repro/debugging example, consider pinning to specific versions if this example is used for CI or regression testing.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@examples/react/bundling-repro/package.json` around lines 18 - 26, The
package.json currently pins multiple `@tanstack/ai` packages to "latest" which
makes builds unreproducible; replace the "latest" specifiers for "@tanstack/ai",
"@tanstack/ai-anthropic", "@tanstack/ai-client", "@tanstack/ai-gemini",
"@tanstack/ai-ollama", "@tanstack/ai-openai", "@tanstack/ai-react",
"@tanstack/react-ai-devtools", and "@tanstack/react-devtools" with concrete
version numbers (choose a specific semver like "^X.Y.Z" or an exact "X.Y.Z") to
lock dependencies for CI/regression tests and update the lockfile accordingly.

.github/workflows/release.yml (1)

26-34: ⚠️ Potential issue | 🟠 Major

Pin GitHub Actions to immutable SHAs instead of mutable tags.

Line 26 and Line 34 still use mutable tags (v6.0.2, v1.7.0). Please pin to full commit SHAs (keep tag as inline comment) to reduce supply-chain risk. This also applies to matching checkout entries in .github/workflows/pr.yml.

#!/bin/bash
set -euo pipefail

echo "Mutable action refs in workflows:"
rg -nP '^\s*uses:\s*[^@]+@(?![0-9a-f]{40}\b)\S+' .github/workflows

echo
echo "Resolve immutable SHAs for tags touched here:"
for item in "actions/checkout v6.0.2" "changesets/action v1.7.0"; do
  repo=$(awk '{print $1}' <<<"$item")
  tag=$(awk '{print $2}' <<<"$item")
  sha=$(git ls-remote --refs --tags "https://github.com/${repo}.git" \
    "refs/tags/${tag}" "refs/tags/${tag}^{}" | awk 'END{print $1}')
  printf "%s@%s -> %s\n" "$repo" "$tag" "$sha"
done

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.github/workflows/release.yml around lines 26 - 34, Replace mutable action
refs with immutable commit SHAs: for each uses entry shown
(actions/checkout@v6.0.2 and changesets/action@v1.7.0, and any other mutable
refs like tanstack/config/.github/setup@main), resolve the tag to its full
40-char commit SHA (e.g., via git ls-remote or the repo's tags API) and update
the uses value to repo@<full-sha>, keeping the original tag as an inline comment
for readability; also mirror these exact SHA-pinned changes for the matching
checkout/uses entries in the pr.yml workflow so all workflow invocations use
immutable SHAs.

package.json (1)

62-65: ⚠️ Potential issue | 🟠 Major

Re-verify breaking config implications for upgraded @tanstack config packages.

Line 65 (@tanstack/vite-config@0.5.0) alongside Line 82 (vite@^7.3.1) may be incompatible depending on current config usage. Line 64 (@tanstack/typedoc-config@0.3.3) can also require doc pipeline adjustments. Please confirm required migrations are already applied before merge.

#!/bin/bash
set -euo pipefail

echo "1) Find usages of `@tanstack/vite-config` and old/new option names:"
rg -nP --type=ts --type=js --type=json \
  '@tanstack/vite-config|viteConfig|rolldownOptions|resolve\.tsconfigPaths'

echo
echo "2) Find typedoc config usage and possible output-casing assumptions:"
rg -nP --type=ts --type=js --type=json \
  '@tanstack/typedoc-config|typedoc|toLowerCase\(|lower-?case'

echo
echo "3) Show vite versions pinned across manifests:"
rg -nP '"vite"\s*:\s*"[^"]+"' --glob '**/package.json'

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@package.json` around lines 62 - 65, Upgrade of `@tanstack` packages may
introduce breaking config/name changes; re-verify and apply migrations for
`@tanstack/vite-config` (0.5.0) vs vite@^7.3.1 and `@tanstack/typedoc-config`
(0.3.3). Search the repo for usages of '@tanstack/vite-config', 'viteConfig',
'rollupOptions', and 'resolve.tsconfigPaths' and update any renamed options or
import paths in your Vite config (e.g., viteConfig-related exports), verify vite
plugin/api compatibility or pin/bump vite accordingly, and search for
'@tanstack/typedoc-config', 'typedoc' and any case-transforming assumptions
(toLowerCase / lower-case) to update the typedoc pipeline or output casing.
After making changes, run the project build/tests and lockfile update to ensure
no runtime errors and include migration notes in the PR.

examples/react/bundling-repro/package.json (1)

50-65: Consider adding a engines.node field to improve tooling compatibility.

The repository and all example packages lack Node version constraints. With Vite ^7.3.1 and Wrangler ^4.73.0 in bundling-repro, and no explicit Node version pinning in CI workflows (pr.yml, release.yml), adding engines.node to the root or example package.json files would make local and CI behavior more deterministic.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@examples/react/bundling-repro/package.json` around lines 50 - 65, Add an
engines.node field to the package.json (root or this example) to pin a supported
Node range for Vite and Wrangler; for example target the current LTS used by
those tools (e.g., Node 18.x — something like ">=18.16.0 <21") so local/dev/CI
environments are deterministic. Update the package.json containing Vite and
Wrangler (the file shown in the diff) to include that engines.node range, and
mirror that constraint in CI workflows (pr.yml, release.yml) or GitHub Actions
matrix so pipelines use a matching Node version; run the install/test matrix
locally or in CI to verify compatibility.

package.json (1)

62-65: ⚠️ Potential issue | 🟠 Major

Verify Vite version compatibility with @tanstack/vite-config 0.5.0.

The past review correctly identified that @tanstack/vite-config 0.5.0 requires Vite 8+ and drops support for Vite 6/7. However, this PR updates vite to ^7.3.1 (Line 82), which would be incompatible with @tanstack/vite-config 0.5.0.

Either:

1. Upgrade vite to ^8.x to match the requirements of @tanstack/vite-config 0.5.0, or
2. Pin @tanstack/vite-config to a version compatible with Vite 7 (e.g., 0.4.x)

Also applies to: 82-82

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@package.json` around lines 62 - 65, The package version mismatch:
"@tanstack/vite-config"@0.5.0 requires Vite 8+, but this PR sets "vite" to
"^7.3.1"; update package.json so versions are compatible by either (A) bumping
"vite" to a 8.x version (e.g., "^8.0.0") to match "@tanstack/vite-config"@0.5.0,
or (B) pinning "@tanstack/vite-config" to a Vite-7-compatible release (e.g.,
"0.4.x"); pick one approach and make the corresponding change to the dependency
entry for "vite" or "@tanstack/vite-config" so the two packages are aligned.