npm / @tanstack/react-start
@tanstack/react-start
What changed in @tanstack/react-start 1, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-24.
8 breaking2 security1 deprecations2 new APIs and options1 performance1 behavior and defaults2 tooling9 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli init@tanstack/react-start 126 changes
Breaking changes 8
The deprecated
.inputValidator()is removed; use.validator()with the same validator.The deprecated
.inputValidator()is removed; use.validator()with the same validator.Raw handlers now rethrow the original error; custom reporting can catch inside
createServerEntryand rethrow or returnhandleStartError(error).Changed responses receive copied headers and reuse the body stream, so inspect the response returned by Start rather than relying on mutation of the original.
This API is removed; return the derived response directly.
The built-in session API is removed. Choose a session library and explicitly save or destroy sessions; existing session cookies require deliberate migration or signing in again with a new cookie name.
Vite builds now require Vite 8; Vite 7 is no longer supported.
The script callback context exposes only kind: 'script' and url; script format handling is internal to manifest rendering.
Security 2
TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses
Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys
Deprecations 1
Deprecates inputValidator() and emits compiler warnings for remaining uses.
New APIs and options 2
Adds validator() as the canonical server function and middleware validator method.
Adds RSC support for Rsbuild.
Performance 1
Re-exported from framework client Hydrate-only subpaths so root package imports avoid pulling in the client hydration entry.
Behavior and default changes 1
TanStack Start is stable; release-candidate users should follow the migration guide to upgrade.
Tooling 2
TanStack Start now supports Vite's bundled dev mode, using the bundled dev client entry, pointing server requests at the latest client build output, and preserving import protection.
Client output supports module format by default and IIFE format for classic script environments.
Fixes and other changes 9
The complete callback, including custom error handling, runs inside the request context, and errors that escape it are converted.
Start keeps streaming a page when request middleware returns a response that reads the page body, disposing of a replaced stream only when nothing reads it.
Helpers apply consistently across routes, SSR, server functions, redirects, errors, and middleware replacements; setters override returned values, and cookie helpers preserve independent cookies while replacing matching identities.
Primitive values thrown from beforeLoad error handling are now preserved.
Matching TanStack Start dev server packages prevent fresh installs from pairing a plugin and server runtime with incompatible injected head script imports.
Vite and Rsbuild resolve the adapter module through the package empty-adapter fallback when no serialization adapters are configured; Vite dev also uses clean runtime-specific virtual module IDs to avoid reverse proxy failures.
Script asset cross-origin configuration now uses the script key.
Restoring modules from Rspack's persistent cache no longer loses server function registrations on warm restarts.
Explicitly re-exports public API names from @tanstack/start-client-core at link time, so their getters are available before import bodies run and avoid a partial facade during cold-start SSR.