[dependabot]

Bumps the npm_and_yarn group with 1 update in the / directory: @tanstack/start-server-core.

Updates @tanstack/start-server-core from 1.169.37 to 1.169.44

Release notes

Sourced from @​tanstack/start-server-core's releases.

@​tanstack/start-server-core@​1.169.44

Patch Changes

• #8212 18154b1 - Render generated script preloads (modulepreload, or preload as="script" for IIFE output) with fetchPriority="low" and forward it into static Early Hints, so they no longer compete with render-blocking stylesheets, fonts and images.

• Updated dependencies [18154b1]:

  • @​tanstack/router-core@​1.171.38
  • @​tanstack/start-client-core@​1.170.38
  • @​tanstack/start-storage-context@​1.167.40

@​tanstack/start-server-core@​1.169.43

Patch Changes

• #8710 71d9694 - Update fetchdts to ^0.2.0. The typed request and response header helpers keep the same header names and value types.

@​tanstack/start-server-core@​1.169.42

Patch Changes

• #8451 740b0ce - Skip request middleware bookkeeping when no request middleware is configured, and stop copying serialization adapters when the router adds none.

  Server route handlers and route middleware now receive the router's decoded pathname, the same one used for route matching. Characters that would change how the path is read, such as %2F, %3F, and %23, stay encoded.

• #8441 d6ba115 - Reuse the parsed request location during SSR instead of repeating input rewrites. Match server routes against the app router's parsed pathname while preserving encoded pathnames for server handlers and middleware.

• Updated dependencies [740b0ce, d6ba115]:

  • @​tanstack/start-storage-context@​1.167.39
  • @​tanstack/router-core@​1.171.37
  • @​tanstack/start-client-core@​1.170.37

@​tanstack/start-server-core@​1.169.41

Patch Changes

• #7588 94d6d8e - Return 400 Bad Request for malformed percent-encoded request pathnames before running server entry callbacks. Preserve valid encoded paths and query handling.

• #7588 94d6d8e - Reduce request middleware overhead, reuse loaded entries and transport header requirements, and avoid unnecessary URL normalization for server functions. Preserve response helper writes made during body cancellation and SSR cleanup.

  Avoid allocating absent middleware headers and reply context, and construct RPC redirects with their final response state. Preserve middleware accessor evaluation and the documented undefined value for absent sendContext.

  Reduce synchronous server-function response overhead while preserving cancellation cleanup and middleware response mutations.

• #7588 94d6d8e - Keep streaming a page when request middleware returns a response that reads the page body, such as a copy made through a wrapped global Response, a copy in Bun, or a body piped through a transform. Start now disposes a replaced page stream only when nothing reads it. transferResponseBodyOwnership is removed: return the derived response directly.

• #7588 94d6d8e - Let request middleware read the body of a HEAD response, and strip it when the response leaves the pipeline. Start no longer applies Content-Encoding, Content-Length, or other framing headers set through response helpers to error bodies and serialized server-function replies that it builds itself. A response that middleware assigns to result.response is now disposed when the middleware returns another response.

• #7588 94d6d8e - Remove the built-in useSession API. Applications choose a session library, such as iron-session, and save or destroy sessions explicitly before returning or redirecting. Connect a cookie adapter through getCookie and setCookie, or append serialized cookies with appendResponseHeader('set-cookie', cookie). Existing session cookies require a deliberate migration or signing in again with a new cookie name.

  createServerEntry keeps the complete callback, including custom error handling, inside the request context and converts errors that escape it. The built-in entry still converts errors automatically. Raw createStartHandler handlers now rethrow the original error. For custom reporting, catch inside createServerEntry, then rethrow for default conversion or return handleStartError(error) to preserve response-helper status, headers, and cookies. Return an explicit Response when choosing a custom error payload.

  Response helpers now apply consistently across server routes, SSR, server functions, redirects, errors, and middleware response replacements. Helper setters override returned values; cookie helpers preserve independent cookies and replace matching cookie identities. Use appendResponseHeader('set-cookie', cookie) when adding a serialized cookie without replacing other cookies. Changed responses receive copied headers and reuse the body stream, so applications should inspect the response returned by Start rather than relying on mutation of the original response.

... (truncated)

Changelog

Sourced from @​tanstack/start-server-core's changelog.

1.169.44

Patch Changes

• #8212 18154b1 - Render generated script preloads (modulepreload, or preload as="script" for IIFE output) with fetchPriority="low" and forward it into static Early Hints, so they no longer compete with render-blocking stylesheets, fonts and images.

• Updated dependencies [18154b1]:

  • @​tanstack/router-core@​1.171.38
  • @​tanstack/start-client-core@​1.170.38
  • @​tanstack/start-storage-context@​1.167.40

1.169.43

Patch Changes

• #8710 71d9694 - Update fetchdts to ^0.2.0. The typed request and response header helpers keep the same header names and value types.

1.169.42

Patch Changes

• #8451 740b0ce - Skip request middleware bookkeeping when no request middleware is configured, and stop copying serialization adapters when the router adds none.

  Server route handlers and route middleware now receive the router's decoded pathname, the same one used for route matching. Characters that would change how the path is read, such as %2F, %3F, and %23, stay encoded.

• #8441 d6ba115 - Reuse the parsed request location during SSR instead of repeating input rewrites. Match server routes against the app router's parsed pathname while preserving encoded pathnames for server handlers and middleware.

• Updated dependencies [740b0ce, d6ba115]:

  • @​tanstack/start-storage-context@​1.167.39
  • @​tanstack/router-core@​1.171.37
  • @​tanstack/start-client-core@​1.170.37

1.169.41

Patch Changes

• #7588 94d6d8e - Return 400 Bad Request for malformed percent-encoded request pathnames before running server entry callbacks. Preserve valid encoded paths and query handling.

• #7588 94d6d8e - Reduce request middleware overhead, reuse loaded entries and transport header requirements, and avoid unnecessary URL normalization for server functions. Preserve response helper writes made during body cancellation and SSR cleanup.

  Avoid allocating absent middleware headers and reply context, and construct RPC redirects with their final response state. Preserve middleware accessor evaluation and the documented undefined value for absent sendContext.

  Reduce synchronous server-function response overhead while preserving cancellation cleanup and middleware response mutations.

• #7588 94d6d8e - Keep streaming a page when request middleware returns a response that reads the page body, such as a copy made through a wrapped global Response, a copy in Bun, or a body piped through a transform. Start now disposes a replaced page stream only when nothing reads it. transferResponseBodyOwnership is removed: return the derived response directly.

• #7588 94d6d8e - Let request middleware read the body of a HEAD response, and strip it when the response leaves the pipeline. Start no longer applies Content-Encoding, Content-Length, or other framing headers set through response helpers to error bodies and serialized server-function replies that it builds itself. A response that middleware assigns to result.response is now disposed when the middleware returns another response.

• #7588 94d6d8e - Remove the built-in useSession API. Applications choose a session library, such as iron-session, and save or destroy sessions explicitly before returning or redirecting. Connect a cookie adapter through getCookie and setCookie, or append serialized cookies with appendResponseHeader('set-cookie', cookie). Existing session cookies require a deliberate migration or signing in again with a new cookie name.

... (truncated)

Commits

• caaf32d ci: Version Packages (#8733)
• 18154b1 perf: lower manifest script preload priority (#8212)
• 7a06725 chore(deps): upgrade Vitest to 5 and migrate benchmarks to the bench fixture ...
• 140efa4 ci: Version Packages (#8701)
• 71d9694 chore(deps): bump fetchdts to ^0.2.0 (#8710)
• 4ff63eb ci: Version Packages (#8700)
• 740b0ce perf: skip unused Start request setup (#8451)
• d6ba115 perf: reuse prepared SSR request locations (#8441)
• 80e2eab ci: Version Packages (#8661)
• 550f478 refactor(start)!: remove the deprecated inputValidator (#8694)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/@supabase/server@194

commit: 46d1490

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/@supabase/server@194

commit: 46d1490