security: stricter pnpm config blockExoticSubdeps & trustPolicy by Sheraff · Pull Request #10719 · TanStack/query

Sheraff · 2026-05-17T14:05:26Z

Summary

Enable pnpm's no-downgrade trust policy.
Block exotic transitive dependencies with blockExoticSubdeps.
Remove the redundant danielroe/provenance-action downgrade CI job.

pnpm 11 compatibility is expected via #10699, which will be merged separately.

Summary by CodeRabbit

Chores
- Added version preview information to pull requests for improved visibility into upcoming version changes.
- Updated workspace configuration with enhanced dependency management policies for better security and consistency.

coderabbitai · 2026-05-17T14:05:34Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 56de6f07-532b-4ac5-96ac-4fe78174fc9e

📥 Commits

Reviewing files that changed from the base of the PR and between 98fd431 and 6756022.

📒 Files selected for processing (2)

.github/workflows/pr.yml
pnpm-workspace.yaml

💤 Files with no reviewable changes (1)

.github/workflows/pr.yml

📝 Walkthrough

Walkthrough

This PR updates repository configuration across two systems: the CI workflow replaces the provenance job with a version-preview job for displaying changeset information, and the pnpm workspace configuration adds dependency integrity constraints via blockExoticSubdeps and trustPolicy settings.

Changes

Repository Configuration Updates

Layer / File(s)	Summary
CI Workflow: version-preview job replacement `.github/workflows/pr.yml`	The `provenance` job is removed and replaced with a new `version-preview` job that runs the changeset-preview action with pull request and issue write permissions for displaying version-related preview information.
pnpm workspace dependency policies `pnpm-workspace.yaml`	Workspace-level pnpm configuration adds `blockExoticSubdeps: true` and `trustPolicy: 'no-downgrade'` to enforce dependency integrity constraints across the monorepo.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Poem

🐰 A rabbit hops through config files so neat,
Removing provenance, version-preview's sweet,
Dependencies guarded with trust and care,
Workspace integrity blooms everywhere!

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The PR description clearly summarizes the changes but does not follow the required template structure with mandatory sections like checklist and release impact.	Restructure the description to include the required template sections: Changes section, Checklist with contributing guide and test confirmations, and Release Impact declaration.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title directly addresses the main changes: enabling stricter pnpm security configuration with blockExoticSubdeps and trustPolicy settings.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

nx-cloud · 2026-05-17T14:05:56Z

🤖 Nx Cloud AI Fix Eligible

An automatically generated fix could have helped fix failing tasks for this run, but Self-healing CI is disabled for this workspace. Visit workspace settings to enable it and get automatic fixes in future runs.

_{To disable these notifications, a workspace admin can disable them in workspace settings.}

View your CI Pipeline Execution ↗ for commit 6756022

Command	Status	Duration	Result
`nx affected --targets=test:sherif,test:knip,tes...`	❌ Failed	4m 25s	View ↗
`nx run-many --target=build --exclude=examples/*...`	✅ Succeeded	1m 56s	View ↗

☁️ Nx Cloud last updated this comment at 2026-05-22 16:26:28 UTC

pkg-pr-new · 2026-05-17T14:08:49Z

More templates

@tanstack/angular-query-experimental

npm i https://pkg.pr.new/@tanstack/angular-query-experimental@10719

@tanstack/eslint-plugin-query

npm i https://pkg.pr.new/@tanstack/eslint-plugin-query@10719

@tanstack/lit-query

npm i https://pkg.pr.new/@tanstack/lit-query@10719

@tanstack/preact-query

npm i https://pkg.pr.new/@tanstack/preact-query@10719

@tanstack/preact-query-devtools

npm i https://pkg.pr.new/@tanstack/preact-query-devtools@10719

@tanstack/preact-query-persist-client

npm i https://pkg.pr.new/@tanstack/preact-query-persist-client@10719

@tanstack/query-async-storage-persister

npm i https://pkg.pr.new/@tanstack/query-async-storage-persister@10719

@tanstack/query-broadcast-client-experimental

npm i https://pkg.pr.new/@tanstack/query-broadcast-client-experimental@10719

@tanstack/query-core

npm i https://pkg.pr.new/@tanstack/query-core@10719

@tanstack/query-devtools

npm i https://pkg.pr.new/@tanstack/query-devtools@10719

@tanstack/query-persist-client-core

npm i https://pkg.pr.new/@tanstack/query-persist-client-core@10719

@tanstack/query-sync-storage-persister

npm i https://pkg.pr.new/@tanstack/query-sync-storage-persister@10719

@tanstack/react-query

npm i https://pkg.pr.new/@tanstack/react-query@10719

@tanstack/react-query-devtools

npm i https://pkg.pr.new/@tanstack/react-query-devtools@10719

@tanstack/react-query-next-experimental

npm i https://pkg.pr.new/@tanstack/react-query-next-experimental@10719

@tanstack/react-query-persist-client

npm i https://pkg.pr.new/@tanstack/react-query-persist-client@10719

@tanstack/solid-query

npm i https://pkg.pr.new/@tanstack/solid-query@10719

@tanstack/solid-query-devtools

npm i https://pkg.pr.new/@tanstack/solid-query-devtools@10719

@tanstack/solid-query-persist-client

npm i https://pkg.pr.new/@tanstack/solid-query-persist-client@10719

@tanstack/svelte-query

npm i https://pkg.pr.new/@tanstack/svelte-query@10719

@tanstack/svelte-query-devtools

npm i https://pkg.pr.new/@tanstack/svelte-query-devtools@10719

@tanstack/svelte-query-persist-client

npm i https://pkg.pr.new/@tanstack/svelte-query-persist-client@10719

@tanstack/vue-query

npm i https://pkg.pr.new/@tanstack/vue-query@10719

@tanstack/vue-query-devtools

npm i https://pkg.pr.new/@tanstack/vue-query-devtools@10719

commit: 6756022

security: stricter pnpm config blockExoticSubdeps & trustPolicy
f9b44c2

Sheraff requested a review from a team as a code owner May 17, 2026 14:05

Merge branch 'main' into stricter-pnpm-deps-config
6756022

TkDodo approved these changes May 22, 2026
View reviewed changes

TkDodo merged commit f0865fd into TanStack:mainMay 22, 2026
9 of 10 checks passed

coderabbitaiBot mentioned this pull request Jun 24, 2026
chore: update pnpm to 11.9.0 #10978
Merged

Navigation Menu

Uh oh!

Uh oh!

security: stricter pnpm config blockExoticSubdeps & trustPolicy - #10719

security: stricter pnpm config blockExoticSubdeps & trustPolicy#10719
TkDodo merged 2 commits into
TanStack:mainfrom
Sheraff:stricter-pnpm-deps-config

Sheraff commented May 17, 2026•
edited by coderabbitai Bot
Loading

Uh oh!

coderabbitaiBot commented May 17, 2026•
edited
Loading

Walkthrough

Changes

Estimated code review effort

Poem

❌ Failed checks (1 warning)

Uh oh!

nx-cloudBot commented May 17, 2026•
edited
Loading

Uh oh!

pkg-pr-newBot commented May 17, 2026•
edited
Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Uh oh!

Conversation

Sheraff commented May 17, 2026• edited by coderabbitai BotLoading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Summary by CodeRabbit

Uh oh!

coderabbitaiBot commented May 17, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Poem

❌ Failed checks (1 warning)

Uh oh!

nx-cloudBot commented May 17, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🤖 Nx Cloud AI Fix Eligible

Uh oh!

pkg-pr-newBot commented May 17, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Sheraff commented May 17, 2026•
edited by coderabbitai Bot
Loading

coderabbitaiBot commented May 17, 2026•
edited
Loading

nx-cloudBot commented May 17, 2026•
edited
Loading

pkg-pr-newBot commented May 17, 2026•
edited
Loading