[0xpierre-dev]

🎯 Changes

Bumps devalue to ^5.9.3 in @tanstack/react-form-start.

getInternalTanStackCookie passes the cookie value to devalue.parse, and versions below 5.6.2 are affected by two denial of service advisories in parse (GHSA-g2pg-6438-jwpf, GHSA-vw5p-8cq8-m7mv). 5.9.3 also fixes three advisories in stringify/uneval and custom revivers (GHSA-j22f-vq7h-c4qm, GHSA-mcm9-63f2-9j32, GHSA-r9w8-h9r3-54w4).

Ran pnpm test:pr locally (Windows): all react-form-start targets pass. test:docs, test:knip and @tanstack/solid-form:test:lib fail, but they fail the same way on main here, so it looks like a Windows thing rather than this change.

Fresh installs already get a fixed version, but apps with an older lockfile can stay on an affected one, so this raises the minimum. Same kind of change as #1716. The Renovate PR #2123 touches this line too but only goes to ^5.7.1, and alpha already moved to ^6.0.0 in #2397, so this is for the current release line.

✅ Checklist

• I have followed the steps in the Contributing guide.
• I have tested code changes locally with pnpm test:pr, or these tests do not apply to this pull request.
• I fully understand the code in this pull request, including any code generated with AI assistance.

🚀 Release Impact

• This change affects published code, and I have generated a changeset.
• This change is docs/CI/dev-only (no release).

[coderabbitai]

No actionable comments were generated in the recent review.

Walkthrough

The devalue dependency range for @tanstack/react-form-start changes from ^5.3.2 to ^5.9.3. A Changeset requests a patch release and documents the stated advisories.

Changes: devalue dependency update

Layer / File(s)	Summary
Dependency range and release note packages/react-form-start/package.json, .changeset/react-form-start-devalue.md	The package manifest updates devalue to ^5.9.3. The Changeset requests a patch release and describes the stated advisories affecting devalue.parse.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Other

Possibly related PRs

• TanStack/form#2448: Changes the serialization side of the form-state cookie flow that devalue.parse reads.

Suggested reviewers: balastrong

Merge Risk: Minimal · up to 9bd74

The dependency bump has no identified merge-blocking issue. Proceed with normal release checks.

Pre-merge checks: 4

Check name	Status	Explanation
Title check		The title clearly describes the main change: raising the devalue dependency version in @tanstack/react-form-start.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Description check		The pull request description follows the required template. It explains the dependency update and security motivation, completes all checklist items, reports test results, and confirms that a changese…

Full details: Description check

Explanation

The pull request description follows the required template. It explains the dependency update and security motivation, completes all checklist items, reports test results, and confirms that a changeset was generated.

Finishing Touches

Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

Recent review info

Run configuration

• Source mode: Auto
• Repository: TanStack/form
• Branch: main
• File: .coderabbit.yaml
• Commit: eba4084
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: 471c179f-5113-455c-8a70-c8ed9438a1df

Commits

Reviewing files that changed from the base of the PR and between eba4084 and 9bd744d.

Files ignored due to path filters: 1

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

Files selected for processing: 2

• .changeset/react-form-start-devalue.md
• packages/react-form-start/package.json

Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 7 remain after this review.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	devalue@​5.9.4

View full report