# What changed in @tanstack/react-start

> 26 changes in @tanstack/react-start 1 from its official release notes, upgrade guides and advisories: 8 breaking, 1 deprecations, 2 security, 2 new APIs and options. Each one cited. Sources checked 2026-10-24. HTML: https://unstale.sh/npm/@tanstack/react-start/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## @tanstack/react-start 1

### Breaking changes

- The deprecated `.inputValidator()` is removed; use `.validator()` with the same validator. (1.169.0) — [release notes](https://github.com/TanStack/router/releases/tag/%40tanstack/react-start%401.169.0)
- The deprecated `.inputValidator()` is removed; use `.validator()` with the same validator. (1.169.0) — [release notes](https://github.com/TanStack/router/releases/tag/%40tanstack/react-start%401.169.0)
- Raw handlers now rethrow the original error; custom reporting can catch inside `createServerEntry` and rethrow or return `handleStartError(error)`. (1.169.0) — [release notes](https://github.com/TanStack/router/releases/tag/%40tanstack/react-start%401.169.0)
- Changed responses receive copied headers and reuse the body stream, so inspect the response returned by Start rather than relying on mutation of the original. (1.169.0) — [release notes](https://github.com/TanStack/router/releases/tag/%40tanstack/react-start%401.169.0)
- This API is removed; return the derived response directly. (1.169.0) — [release notes](https://github.com/TanStack/router/releases/tag/%40tanstack/react-start%401.169.0)
- The built-in session API is removed. Choose a session library and explicitly save or destroy sessions; existing session cookies require deliberate migration or signing in again with a new cookie name. (1.169.0) — [release notes](https://github.com/TanStack/router/releases/tag/%40tanstack/react-start%401.169.0)
- Vite builds now require Vite 8; Vite 7 is no longer supported. (1.169.0) — [release notes](https://github.com/TanStack/router/releases/tag/%40tanstack/react-start%401.169.0)
- The script callback context exposes only kind: 'script' and url; script format handling is internal to manifest rendering. (1.168.11) — [release notes](https://github.com/TanStack/router/releases/tag/%40tanstack/react-start%401.168.11)

### Security

- TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses (1.168.56) — [security advisory](https://github.com/advisories/GHSA-QX66-FV34-FJM8)
- Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys (1.168.7) — [security advisory](https://github.com/advisories/GHSA-G7CV-RXG3-HMPX)

### Deprecations

- Deprecates inputValidator() and emits compiler warnings for remaining uses. (1.168.25) — [release notes](https://github.com/TanStack/router/releases/tag/%40tanstack/react-start%401.168.25)

### New APIs and options

- Adds validator() as the canonical server function and middleware validator method. (1.168.25) — [release notes](https://github.com/TanStack/router/releases/tag/%40tanstack/react-start%401.168.25)
- Adds RSC support for Rsbuild. (1.168.18) — [release notes](https://github.com/TanStack/router/releases/tag/%40tanstack/react-start%401.168.18)

### Performance

- Re-exported from framework client Hydrate-only subpaths so root package imports avoid pulling in the client hydration entry. (1.168.14) — [release notes](https://github.com/TanStack/router/releases/tag/%40tanstack/react-start%401.168.14)

### Behavior and default changes

- TanStack Start is stable; release-candidate users should follow the migration guide to upgrade. (1.169.0) — [release notes](https://github.com/TanStack/router/releases/tag/%40tanstack/react-start%401.169.0)

### Tooling

- TanStack Start now supports Vite's bundled dev mode, using the bundled dev client entry, pointing server requests at the latest client build output, and preserving import protection. (1.168.12) — [release notes](https://github.com/TanStack/router/releases/tag/%40tanstack/react-start%401.168.12)
- Client output supports module format by default and IIFE format for classic script environments. (1.168.11) — [release notes](https://github.com/TanStack/router/releases/tag/%40tanstack/react-start%401.168.11)

### Fixes and other changes

- The complete callback, including custom error handling, runs inside the request context, and errors that escape it are converted. (1.169.0) — [release notes](https://github.com/TanStack/router/releases/tag/%40tanstack/react-start%401.169.0)
- Start keeps streaming a page when request middleware returns a response that reads the page body, disposing of a replaced stream only when nothing reads it. (1.169.0) — [release notes](https://github.com/TanStack/router/releases/tag/%40tanstack/react-start%401.169.0)
- Helpers apply consistently across routes, SSR, server functions, redirects, errors, and middleware replacements; setters override returned values, and cookie helpers preserve independent cookies while replacing matching identities. (1.169.0) — [release notes](https://github.com/TanStack/router/releases/tag/%40tanstack/react-start%401.169.0)
- Primitive values thrown from beforeLoad error handling are now preserved. (1.168.17) — [release notes](https://github.com/TanStack/router/releases/tag/%40tanstack/react-start%401.168.17)
- Matching TanStack Start dev server packages prevent fresh installs from pairing a plugin and server runtime with incompatible injected head script imports. (1.168.13) — [release notes](https://github.com/TanStack/router/releases/tag/%40tanstack/react-start%401.168.13)
- Vite and Rsbuild resolve the adapter module through the package empty-adapter fallback when no serialization adapters are configured; Vite dev also uses clean runtime-specific virtual module IDs to avoid reverse proxy failures. (1.168.13) — [release notes](https://github.com/TanStack/router/releases/tag/%40tanstack/react-start%401.168.13)
- Script asset cross-origin configuration now uses the script key. (1.168.11) — [release notes](https://github.com/TanStack/router/releases/tag/%40tanstack/react-start%401.168.11)
- Restoring modules from Rspack's persistent cache no longer loses server function registrations on warm restarts. (1.168.11) — [release notes](https://github.com/TanStack/router/releases/tag/%40tanstack/react-start%401.168.11)
- Explicitly re-exports public API names from @tanstack/start-client-core at link time, so their getters are available before import bodies run and avoid a partial facade during cold-start SSR. (1.168.10) — [release notes](https://github.com/TanStack/router/releases/tag/%40tanstack/react-start%401.168.10)