[fehmer]

Summary

 // frontend/package.json
-  "@tanstack/solid-form": "1.33.0",
+  "@tanstack/solid-form": "1.33.5",

 // 6 call sites in modals/ (CustomText, ShareTestSettings, EditPreset, WordFilter x2, CustomTestDuration)
-  const formValues = form.useStore((s) => s.values);
+  const formValues = form.useSelector((s) => s.values);

Patch bump; the code change is the one the bump forces — useStore is deprecated as of 1.33.1 and the repo typecheck errors on deprecated, so all call sites move to the new useSelector (identical selector → signal signature).

Upstream 1.33.0 → 1.33.5 (diffed the published sources): useSelector added / useStore deprecated; SSR-safe formId fallback via createUniqueId(); form-core 1.33.5 — isValidating race fixed (pending-validations counter), form-level fieldErrors now applied for fields missing from fieldMeta, re-submission re-validates instead of early-returning (clears stale onBlur errors), deleteField no longer nukes sibling fields on prefix match.

Evidence

• Before: bumping alone fails typecheck — 6 x typescript(no-deprecated): useStore is deprecated. Use form.useSelector instead across the modals above.
  After: pnpm oxlint --type-aware --type-check clean; pnpm vitest run — 137 files, 2539 tests, all passing.
• Browser (dev server; running app provably on 1.33.5 — it imports @tanstack+solid-form@1.33.5 from the pnpm store, loaded module exports useSelector, forms carry cl-… createUniqueId form ids):
  • word filter modal: real typing into include drives the live preview re-filtering 133 → 200 → 1 words (the useSelector((s) => s.values) → debounce → preview chain); preset "apply" populates fields via setFieldValue; "set" submit runs the async submit, modal closes (verified), filtered words chain into the custom-text flow
  • test duration modal: typed 33 → apply → config.time 15 → 33, modal closes (verified), config restored afterwards
  • zero console errors across all of it

Merge Danger

Door: two-way — a dependency version bump; reverting restores 1.33.0 (upstream changes are additive/fix-level, no API removals).

Blast Radius: every form in the frontend (login/register, forgot password, profile, presets, quotes, custom text, settings modals). The upstream behaviour changes only alter edge-case validation (stale-error clearing, deleteField prefix fix, isValidating counter) — the full suite plus the two browser-driven forms cover the main paths.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​tanstack/​solid-form@​1.33.0 ⏵ 1.33.5	+12		+4	-1

View full report