npm / @tanstack/solid-start
@tanstack/solid-start
What changed in @tanstack/solid-start 1, from its official release notes, upgrade guides and advisories. Sources checked 2026-11-15.
5 breaking2 security1 behavior and defaults5 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli init@tanstack/solid-start 113 changes
Breaking changes 5
The optional peer requirement is now ^2.0.5, whose compression keeps SSR response headers intact.
The deprecated
.inputValidator()methods are removed fromcreateServerFnandcreateMiddleware; use.validator()with the same validator.The API is removed; return the derived response directly.
The built-in session API is removed. Applications choose a session library and explicitly save or destroy sessions before returning or redirecting.
Vite builds now require Vite 8; Vite 7 is no longer supported.
Security 2
TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses
Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys
Behavior and default changes 1
TanStack Start is stable; release-candidate users should follow the migration guide to upgrade.
Fixes and other changes 5
The Rsbuild plugin preserves the app's server.compress setting instead of always setting it to false; compression remains off by default.
The complete callback, including custom error handling, runs inside the request context, and errors escaping it are converted.
Raw handlers now rethrow the original error; custom reporting can catch inside
createServerEntryand rethrow or returnhandleStartError(error).Start keeps streaming a page when request middleware returns a response that reads its body, disposing a replaced page stream only when nothing reads it.
Response helpers apply consistently across routes, SSR, server functions, redirects, errors, and middleware replacements; changed responses copy headers and reuse the body stream.