# What changed in @tanstack/start-static-server-functions

> 2 changes in @tanstack/start-static-server-functions 1 from its official release notes, upgrade guides and advisories: 2 security. Each one cited. Sources checked 2026-10-19. HTML: https://unstale.sh/npm/@tanstack/start-static-server-functions/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## @tanstack/start-static-server-functions 1

### Security

- TanStack Start - Server Core: Inbound server-function request deserialization could invoke a sibling client-referenced server function (1.167.30) — [security advisory](https://github.com/advisories/GHSA-9M65-766C-R333)
- Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys (1.167.10) — [security advisory](https://github.com/advisories/GHSA-G7CV-RXG3-HMPX)