Repository navigation
fix: patch TanStack Start server-function XSS - #42
Merged
Merged
Conversation
Pin patched Start and compatible router packages; guard all locked TanStack copies against CVE-2026-102989 and compromised releases. Co-Authored-By: songscriptCodex running gpt-6.1-sol <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
ⓘ Qodo reviews are paused because the subscription is no longer active. Ask your workspace admin to reactivate the subscription to resume reviews. Manage billing |
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fix CVE-2026-102989 / GHSA-qx66-fv34-fjm8, reflected XSS in TanStack Start server-function responses. Vercel rejected the existing dependency with:
Pin the lowest patched Start release and the router/plugin versions required by its published dependency graph:
An override removes the second vulnerable Start copy. Keep unrelated direct dependencies unchanged and preserve the binary lockfile format with bunfig.toml.
Add a lightweight CI guard for every locked Start/server-core copy and all 84 compromised releases from GHSA-g7cv-rxg3-hmpx.
Verification
Guard failed on the original lockfile (two vulnerable Start copies and server-core); passes on the updated lockfile.
Refreshed lockfile and
bun pm ls --all: each checked 33 TanStack package/version entries against all 84 malware versions; zero matches.Normal pre-commit hook: 17 test files / 204 tests passed,
tsc --noEmitpassed, docs.local guard passed. Hook isolation fix from fix: isolate guard fixtures from hook Git environment #41 is in the base.Shared Git configuration, root checkout HEAD and commit identity remained intact across the hook and push.
No local production build or dev server under host memory pressure. Vercel preview is READY at https://songscript-d66vj9ly3-etanheys-projects.vercel.app (deployment for this exact head). Authenticated Vercel CLI GETs returned HTTP 200 for
/and/song/j970fgzqbvcw8mr4szspbchc0x80wqfs, with SongScript HTML and no login/error markers. Public access redirects to Vercel authentication; its login-page 200 is not counted as app proof. No build rate limit on this PR.Size S: 115 added lines excluding the generated binary lockfile.
GitHub checks
tanstack-xss,No tracked docs.local, andVercelpassed on90f47034a426d413f9de071926ebc0bd14d1b5ee. Qodo reported its subscription inactive; no Qodo review was performed.Review ownership
Security lead routes the independent Claude review and Codex security scan. Worker does not merge. No review bots or local CodeRabbit pass requested by this worker under the host-pressure brief.
Loop-record: implementer=codex/gpt-6.1-sol effort=high reviewer=claude/opus-5.5/high (APPROVE) + codex-security scan gpt-6.1-sol/high (PASS; bun.lockb reviewed manually after the inventory dropped it) rounds=1/1 defects=0 role=worker
— songscriptCodex (worker) · codex/gpt-6.1-sol
Security lead: reviews in orchestrator docs.local/.../security/review-songscript-42-{claude,scan}.md. Non-blocking follow-ups rowed: behavioural XSS test, router-ssr-query/devtools skew, npm-alias gap, SHA-pin actions. Pre-existing Convex authz findings (songs.ts public mutations) opened as a separate security row.