# What changed in @tanstack/solid-start

> 13 changes in @tanstack/solid-start 1 from its official release notes, upgrade guides and advisories: 5 breaking, 2 security. Each one cited. Sources checked 2026-11-15. HTML: https://unstale.sh/npm/@tanstack/solid-start/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## @tanstack/solid-start 1

### Breaking changes

- The optional peer requirement is now ^2.0.5, whose compression keeps SSR response headers intact. (1.169.5) — [release notes](https://github.com/TanStack/router/releases/tag/%40tanstack/solid-start%401.169.5)
- The deprecated `.inputValidator()` methods are removed from `createServerFn` and `createMiddleware`; use `.validator()` with the same validator. (1.169.0) — [release notes](https://github.com/TanStack/router/releases/tag/%40tanstack/solid-start%401.169.0)
- The API is removed; return the derived response directly. (1.169.0) — [release notes](https://github.com/TanStack/router/releases/tag/%40tanstack/solid-start%401.169.0)
- The built-in session API is removed. Applications choose a session library and explicitly save or destroy sessions before returning or redirecting. (1.169.0) — [release notes](https://github.com/TanStack/router/releases/tag/%40tanstack/solid-start%401.169.0)
- Vite builds now require Vite 8; Vite 7 is no longer supported. (1.169.0) — [release notes](https://github.com/TanStack/router/releases/tag/%40tanstack/solid-start%401.169.0)

### Security

- TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses (1.168.56) — [security advisory](https://github.com/advisories/GHSA-QX66-FV34-FJM8)
- Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys (1.168.7) — [security advisory](https://github.com/advisories/GHSA-G7CV-RXG3-HMPX)

### Behavior and default changes

- TanStack Start is stable; release-candidate users should follow the migration guide to upgrade. (1.169.0) — [release notes](https://github.com/TanStack/router/releases/tag/%40tanstack/solid-start%401.169.0)

### Fixes and other changes

- The Rsbuild plugin preserves the app's server.compress setting instead of always setting it to false; compression remains off by default. (1.169.5) — [release notes](https://github.com/TanStack/router/releases/tag/%40tanstack/solid-start%401.169.5)
- The complete callback, including custom error handling, runs inside the request context, and errors escaping it are converted. (1.169.0) — [release notes](https://github.com/TanStack/router/releases/tag/%40tanstack/solid-start%401.169.0)
- Raw handlers now rethrow the original error; custom reporting can catch inside `createServerEntry` and rethrow or return `handleStartError(error)`. (1.169.0) — [release notes](https://github.com/TanStack/router/releases/tag/%40tanstack/solid-start%401.169.0)
- Start keeps streaming a page when request middleware returns a response that reads its body, disposing a replaced page stream only when nothing reads it. (1.169.0) — [release notes](https://github.com/TanStack/router/releases/tag/%40tanstack/solid-start%401.169.0)
- Response helpers apply consistently across routes, SSR, server functions, redirects, errors, and middleware replacements; changed responses copy headers and reuse the body stream. (1.169.0) — [release notes](https://github.com/TanStack/router/releases/tag/%40tanstack/solid-start%401.169.0)