From c7f66040790d020e6869f2ca1374f133cb1b5801 Mon Sep 17 00:00:00 2001 From: Nandan Bhat Date: Wed, 23 Sep 2026 21:45:31 +0530 Subject: [PATCH 1/2] fix(deps): require @tanstack/start-server-core ^1.169.8 for the /request-response subpath --- README.md | 1 + package.json | 4 ++-- src/server/cookie-handler.ts | 7 +++++-- 3 files changed, 8 insertions(+), 4 deletions(-) diff --git a/README.md b/README.md index 8be919c..f94a1cf 100644 --- a/README.md +++ b/README.md @@ -35,6 +35,7 @@ This SDK relies on the following peer dependencies, which you install in your ow | `react-dom` | `^18.0.0` or `^19.0.0` | | `@tanstack/react-router` | `^1.0.0` | | `@tanstack/react-start` | `^1.0.0` | +| `@tanstack/start-server-core` | `^1.169.8` | ## Package structure diff --git a/package.json b/package.json index 504a757..407c016 100644 --- a/package.json +++ b/package.json @@ -65,14 +65,14 @@ "peerDependencies": { "@tanstack/react-router": "^1.0.0", "@tanstack/react-start": "^1.0.0", - "@tanstack/start-server-core": "^1.0.0", + "@tanstack/start-server-core": "^1.169.8", "react": "^18.0.0 || ^19.0.0", "react-dom": "^18.0.0 || ^19.0.0" }, "devDependencies": { "@tanstack/react-router": "^1.0.0", "@tanstack/react-start": "^1.0.0", - "@tanstack/start-server-core": "^1.0.0", + "@tanstack/start-server-core": "^1.169.8", "@testing-library/react": "^16.0.0", "@types/node": "^26.3.0", "@types/react": "^19.0.0", diff --git a/src/server/cookie-handler.ts b/src/server/cookie-handler.ts index 61432dd..7cedb33 100644 --- a/src/server/cookie-handler.ts +++ b/src/server/cookie-handler.ts @@ -7,8 +7,11 @@ // during dependency optimization. The roots also drag in the SSR renderer // (renderRouterToString → react-dom/server), which would bloat a client bundle that // transitively reaches this module and break hydration. The `/request-response` -// subpath exposes the same helpers with neither problem — and start-server-core is a -// direct dependency of @tanstack/react-start, so it is always present. +// subpath exposes the same helpers with neither problem, but it is only exported by +// @tanstack/start-server-core >= 1.169.8 (it is absent through 1.169.7) — the floor pinned in +// package.json peerDependencies/devDependencies. @tanstack/react-start bundles core +// transitively, but only at a version that satisfies that floor, so do not assume an +// already-installed core is new enough. import { getCookie, getCookies, From 59b38ee99af5b8d32133dbc840f347613a99c3ae Mon Sep 17 00:00:00 2001 From: Nandan Bhat Date: Wed, 23 Sep 2026 22:27:24 +0530 Subject: [PATCH 2/2] review: address self review findings --- README.md | 8 +++++++- src/server/cookie-handler.ts | 9 +++++---- 2 files changed, 12 insertions(+), 5 deletions(-) diff --git a/README.md b/README.md index f94a1cf..95d1d18 100644 --- a/README.md +++ b/README.md @@ -27,7 +27,7 @@ with the rest of the Auth0 ecosystem. npm install @auth0/auth0-tanstack-start-react ``` -This SDK relies on the following peer dependencies, which you install in your own app: +This SDK relies on the following peer dependencies: | Package | Version | | --- | --- | @@ -37,6 +37,12 @@ This SDK relies on the following peer dependencies, which you install in your ow | `@tanstack/react-start` | `^1.0.0` | | `@tanstack/start-server-core` | `^1.169.8` | +You install `react`, `react-dom`, `@tanstack/react-router`, and `@tanstack/react-start` in your own +app. `@tanstack/start-server-core` usually comes in through `@tanstack/react-start`, so you rarely +install it directly, but this SDK imports from it directly and needs at least `1.169.8`. If your +`@tanstack/react-start` resolves an older `@tanstack/start-server-core`, add +`@tanstack/start-server-core@^1.169.8` to your app. + ## Package structure The SDK is one package with seven entry points. Each entry point is tree-shakeable, and the bundle diff --git a/src/server/cookie-handler.ts b/src/server/cookie-handler.ts index 7cedb33..3609fd2 100644 --- a/src/server/cookie-handler.ts +++ b/src/server/cookie-handler.ts @@ -8,10 +8,11 @@ // (renderRouterToString → react-dom/server), which would bloat a client bundle that // transitively reaches this module and break hydration. The `/request-response` // subpath exposes the same helpers with neither problem, but it is only exported by -// @tanstack/start-server-core >= 1.169.8 (it is absent through 1.169.7) — the floor pinned in -// package.json peerDependencies/devDependencies. @tanstack/react-start bundles core -// transitively, but only at a version that satisfies that floor, so do not assume an -// already-installed core is new enough. +// @tanstack/start-server-core 1.169.8 and later (it is absent through 1.169.7). That is +// the floor pinned in package.json peerDependencies and devDependencies. +// @tanstack/react-start pins core transitively at an exact version, and older +// react-start releases pin a core below this floor, so do not assume an already-installed +// core is new enough. import { getCookie, getCookies,