Release 2026-03-16 23:09
Release 2026-03-16 23:09
- add @tanstack/intent AI agent skills for Router and Start (#6866) (940151cbed) by @tannerlinsley
- write static server function cache to correct output directory with Nitro (#6940) (d6371529b5) by @tannerlinsley
- @tanstack/react-router@1.167.4
- @tanstack/react-start@1.166.15
- @tanstack/react-start-client@1.166.13
- @tanstack/react-start-server@1.166.13
- @tanstack/router-cli@1.166.12
- @tanstack/router-core@1.167.4
- @tanstack/router-generator@1.166.12
- @tanstack/router-plugin@1.166.13
- @tanstack/router-vite-plugin@1.166.13
- @tanstack/solid-router@1.167.4
- @tanstack/solid-start@1.166.15
- @tanstack/solid-start-client@1.166.12
- @tanstack/solid-start-server@1.166.12
- @tanstack/start-client-core@1.166.12
- @tanstack/start-plugin-core@1.166.15
- @tanstack/start-server-core@1.166.12
- @tanstack/start-static-server-functions@1.166.14
- @tanstack/start-storage-context@1.166.12
- @tanstack/virtual-file-routes@1.161.7
- @tanstack/vue-router@1.167.4
- @tanstack/vue-start@1.166.15
- @tanstack/vue-start-client@1.166.12
- @tanstack/vue-start-server@1.166.12
v15.5.13
[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.
- fix: patch http-proxy to prevent request smuggling in rewrites (See: CVE-2026-29057)
Huge thanks to @ztanner for helping!
v16.1.7
[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.
- [Cache Components] Prevent streaming fetch calls from hanging in dev (#89194)
- Apply server actions transform to node_modules in route handlers (#89380)
- ensure
maxPostponedStateSizeis always respected (See: CVE-2026-27979) - feat(next/image): add lru disk cache and
images.maximumDiskCacheSize(See: CVE-2026-27980) - Allow blocking cross-site dev-only websocket connections from privacy-sensitive origins (See: CVE-2026-27977)
- Disallow Server Action submissions from privacy-sensitive contexts by default (See: CVE-2026-27978)
- fix: patch http-proxy to prevent request smuggling in rewrites (See: CVE-2026-29057)
Huge thanks to @unstubbable, @styfle, @eps1lon, and @ztanner for helping!
3.49.0 - 2026.03.16
- Changes v3.48.0...v3.49.0 (373 commits)
Iterator.rangeupdated following the actual spec version- Throw a
RangeErroronNaNstart/end/step - Allow
nullasoptionOrStep
- Throw a
- Improved accuracy of
Math.{ asinh, atanh }polyfills with big and small values - Improved accuracy of
Number.prototype.toExponentialpolyfills with big and small values - Improved performance of
atob,btoa,Uint8Array.fromHex,Uint8Array.prototype.setFromHex, andUint8Array.prototype.toHex, #1503, #1464, #1510, thanks @johnzhou721 - Minor performance optimization polyfills of methods from
Mapupsert proposal - Polyfills of methods from
Mapupsert proposal from the pure version made generic to make it work with polyfilled and native collections - Wrap
Symbol.forinSymbol.prototype.descriptionpolyfill for correct handling of empty string descriptions - Fixed a modern Safari bug in
Array.prototype.includeswith sparse arrays andfromIndex - Fixed one more case (
Iterator.prototype.take) of a V8 ~ Chromium < 126 bug - Forced replacement of
Iterator.{ concat, zip, zipKeyed }in the pure version for ensuring proper wrappedIteratorinstances as the result - Fixed proxying
.return()on exhausted iterator from some methods of iterator helpers polyfill to the underlying iterator - Fixed double
.return()calling in case of throwing error in this method in the internaliteratehelper that affected some polyfills - Fixed closing iterator on
IteratorValueerrors in the internaliteratehelper that affected some polyfills - Fixed iterator closing in
Array.frompolyfill on failure to create array property - Fixed order of arguments validation in
Array.fromAsyncpolyfill - Fixed a lack of counter validation on
MAX_SAFE_INTEGERinArray.fromAsyncpolyfill - Fixed order of arguments validation in
Array.prototype.flatpolyfill - Fixed handling strings as iterables in
Iterator.{ zip, zipKeyed }polyfills - Fixed some cases of iterators closing in
Iterator.{ zip, zipKeyed }polyfills - Fixed validation of iterators
.next()results an objects inIterator.{ zip, zipKeyed }polyfills - Fixed a lack of early error in
Iterator.concatpolyfill on primitive as an iterator - Fixed buffer mutation exposure in
Iterator.prototype.windowspolyfill - Fixed iterator closing in
Set.prototype.{ isDisjointFrom, isSupersetOf }polyfill - Fixed (updated following the final spec) one more case
Set.prototype.differencepolyfill with updatingthis - Fixed
DataView.prototype.setFloat16polyfill in (0, 1) range - Fixed order of arguments validation in
String.prototype.{ padStart, padEnd }polyfills - Fixed order of arguments validation in
String.prototype.{ startsWith, endsWith }polyfills - Fixed some cases of
Infinityhandling inString.prototype.substrpolyfill - Fixed
String.prototype.repeatpolyfill with a counter exceeding 2 ** 32 - Fixed some cases of chars case in
escapepolyfill - Fixed named backreferences in
RegExpNCG polyfill - Fixed some cases of
RegExpNCG polyfill in combination with other types of groups - Fixed some cases of
RegExpNCG polyfill in combination withdotAll - Fixed
String.prototype.replacewithstickypolyfill, #810, #1514 - Fixed
RegExpstickypolyfill with alternation - Fixed handling of some line terminators in case of
multiline+stickymode inRegExppolyfill - Fixed
.inputslicing on result object withRegExpstickymode polyfill - Fixed handling of empty groups with
globalandunicodemodes in polyfills - Fixed
URLSearchParam.prototype.deletepolyfill with duplicate key-value pairs - Fixed possible removal of unnecessary entries in
URLSearchParam.prototype.deletepolyfill with second argument - Fixed an error in some cases of non-special URLs without a path in the
URLpolyfill - Fixed some percent encode cases / character sets in the
URLpolyfill - Fixed parsing of non-IPv4 hosts ends in a number in the
URLpolyfill - Fixed some cases of
''andnullhost handling in theURLpolyfill - Fixed host parsing with
hostname = host:portin theURLpolyfill - Fixed host inheritance in some cases of file scheme in the
URLpolyfill - Fixed block of protocol change for file with empty host in the
URLpolyfill - Fixed invalid code points handling in UTF-8 decode in the
URLSearchParamspolyfill - Fixed some cases of serialization in
URLpolyfill (/.prefix for non-special URLs withnullhost and path starting with empty segment) - Fixed
URLpolyfill.origingetter withblobscheme - Fixed a lack of error in
URLSearchParams.prototype.setpolyfill on calling only with 1 argument - Fixed handling invalid UTF-8 continuation bytes in
URLSearchParamspolyfill - Fixed incomplete sequences with out-of-range continuation bytes handling in
URLSearchParamspolyfill - Fixed allowing unexpected symbols in scheme in the
URLpolyfill - Fixed repeated
ToPropertyKeycalling inReflect.{ get, set, deleteProperty }polyfills - Fixed
Reflect.setpolyfill with some descriptors cases - Fixed
Reflect.setpolyfill with some non-extensible receiver cases - Fixed the order of
Reflect.constructpolyfill arguments validation (observable only in the error message) - Fixed a lack of error in
Reflect.definePropertypolyfill with malformed descriptor - Fixed a lack of error in
JSON.parsepolyfill on unterminated object and array literals - Fixed a lack of error in
JSON.parsepolyfill on numbers with., but without a fraction part - Fixed a lack of error on
\u{}inString.dedentpolyfill - Fixed some cases of hex escaping in the end of string in
String.dedentpolyfill - Fixed
%AsyncFromSyncIteratorPrototype%to make it a little stricter - Fixed counter in some cases of some
AsyncIteratormethods - Fixed order of async iterators closing
- Fixed iterator closing in
AsyncIterator.prototype.flatMappolyfill - Fixed iterator closing in
AsyncIterator.prototype.mappolyfill on error in underlying iterator.next() - Fixed iterator closing in
AsyncIterator.prototype.takepolyfill withreturn: null - Fixed validation
.return()result as object inAsyncIterator.prototype.takepolyfill - Fixed a lack of error in
structuredClonepolyfill on attempt to transfer multiple objects, some of which are non-transferable - Fixed resizable
ArrayBuffertransferring wherenewByteLengthexceeds the originalmaxByteLength - Fixed possible loss of symbol enumerability in
Object.definePropertyinSymbolpolyfill - Fixed return value of
Object.definePropertyinSymbolpolyfill in Android ~ 2 - Fixed order of
%TypedArray%.fromarguments validation - Fixed a lack of error on passing an
ArrayBufferand a negative length to the%TypedArray%andDataViewconstructors polyfills - Fixed some cases of
@@toStringTagon%TypedArray%polyfill - Fixed some cases of
ToUint8Clampconversion - Fixed
NaNhandling inDate.prototype.setYearpolyfill - Fixed false positive on a
WeakMapvalidation in the pure version - Fixed some minor
{ Map, Set }.prototype.forEachmoments in the pure version - Fixed possible error in
Array.isTemplateObjectpolyfill on frozen array - Fixed semantics of
Observable.fromwith multiple subscriptions of the obsolete ECMAScriptObservableproposal polyfill - Fixed handling of ending zeroes in the fraction part in
Number.fromStringpolyfill - Fixed
esmodules: intersectoption ofcore-js-compat - Fixed a lack of
reactnativealias incore-js-compattypes - Fixed a minor logical bug in the debugging output of
core-js-builder - Fixed ignorance of the obsolete
blacklistoption ofcore-js-builder- it should be removed only in the next major release - In case of bugs in
String.prototype.{ match, matchAll, replace, split }in modern engines, adds,dandvflag support to polyfills of those methods - Just in case, added an extra input string validation to the polyfill of obsolete
Number.fromStringproposals - Simplified
iOSdetection - Many minor stylistic fixes and optimizations
- Compat data improvements:
Math.sumPrecisemarked as shipped in V8 ~ Chrome 147Iterator.concatmarked as shipped in V8 ~ Chrome 146Iterator.concatmarked as shipped in Safari 26.4- Because of a bug,
Array.prototype.includesmarked as not supported in modern Safari - Fixed compat data for
parseIntandparseFloat - Added Deno 2.6.7, 2.7.0 and 2.7.2 compat data mapping
- Added Electron 42 compat data mapping
- Added Opera for Android 95 and 96 compat data mapping
- Added Oculus Quest Browser 42 compat data mapping