Merge branch 'main' into fix-duplicate-mock-sponsors

Author: MoonBrillante

.agents/index.md

@@ -5,9 +5,9 @@ TanStack.com marketing site built with TanStack Start.
 ## Essentials
 
 - Package manager: `pnpm`
-- Run `pnpm test` before commits or after significant code changes, not after every tiny edit
-- Smoke tests live outside the default `pnpm test` path and are reserved for commit-hook validation
-- Don't run builds after every change. This is a visual site; assume changes work unless reported otherwise.
+- Run `pnpm test` before commits not after every tiny edit
+- Don't run builds or tests after every change. This is a visual site; assume changes work unless reported otherwise.
+- Rely on `tsc` or your built-in LSP integration (hopefully you have this)
 - **Typesafety is paramount.** Never cast types; fix at source instead. See [typescript.md](./typescript.md).
 
 ## Topic Guides

.github/workflows/autofix.yml

@@ -18,11 +18,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v5.0.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
+          persist-credentials: false
       - name: Setup Tools
-        uses: tanstack/config/.github/setup@main
+        uses: tanstack/config/.github/setup@e4b48f16568324f76f467aa4c2aac2f05db632c3 # main
       - name: Fix formatting
         run: pnpm format
       - name: Apply fixes

.github/workflows/pr.yml

@@ -3,17 +3,21 @@ name: PR
 on:
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   pr:
     name: PR
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v5.0.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
+          persist-credentials: false
       - name: Setup Tools
-        uses: tanstack/config/.github/setup@main
+        uses: tanstack/config/.github/setup@e4b48f16568324f76f467aa4c2aac2f05db632c3 # main
       - name: Run Build
         run: pnpm build
       - name: Run Tests

.github/workflows/update-tanstack-deps.yml

@@ -10,17 +10,20 @@ jobs:
   update-deps:
     name: Update TanStack Dependencies
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     steps:
       - name: Git Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
-          token: ${{ secrets.GITHUB_TOKEN }}
+          # This scheduled job commits dependency updates back to the branch.
+          persist-credentials: true
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4.4.0
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version-file: .nvmrc
           cache: pnpm

.github/workflows/zizmor.yml

@@ -0,0 +1,25 @@
+name: GitHub Actions Security Analysis
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: ['**']
+
+permissions: {}
+
+jobs:
+  zizmor:
+    name: Run zizmor
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Run zizmor
+        uses: zizmorcore/zizmor-action@b1d7e1fb5de872772f31590499237e7cce841e8e # v0.5.3
+        with:
+          advanced-security: false
+          annotations: true

README.md

@@ -27,8 +27,6 @@ This starts your app in development mode, rebuilding assets on file changes.
 
 The documentation for all TanStack projects (except `React Charts`) is hosted on [tanstack.com](https://tanstack.com). In production, doc pages are fetched from GitHub. In development, they're read from your local file system.
 
-Pre-commit hooks run smoke tests against these docs, so you'll need sibling repos cloned for commits to pass.
-
 Create a `tanstack` parent directory and clone this repo alongside the projects:
 
 ```sh

docs-info.md

@@ -204,6 +204,36 @@ becomes
 npm <command> <package>
 ```
 
+### Bundler tabs
+
+Bundler tabs render a compact tab row (like package-manager tabs) but accept rich markdown content per bundler (like the framework component). The user's bundler choice is persisted to `localStorage` and synced across every bundler tab block on the page.
+
+Inside `variant="bundler"`, each top-level heading whose text matches a known bundler starts a new section, and the following nodes (prose, code blocks, etc.) become that bundler's panel. The transformer uses the largest heading level present in the block, so `# Vite` / `# Rsbuild` and `## Vite` / `## Rsbuild` both work — just be consistent within a single block.
+
+````md
+<!-- ::start:tabs variant="bundler" -->
+
+# Vite
+
+```ts title="vite.config.ts"
+import { defineConfig } from 'vite'
+
+export default defineConfig({})
+```
+
+# Rsbuild
+
+```ts title="rsbuild.config.ts"
+import { defineConfig } from '@rsbuild/cli'
+
+export default defineConfig({})
+```
+
+<!-- ::end:tabs -->
+````
+
+Supported bundlers: `vite`, `rsbuild`. Heading text is matched case-insensitively. Both sections should be defined; if the user's selected bundler isn't present in a particular block, the first defined panel is shown as a fallback.
+
 ## Framework component
 
 Framework blocks let one markdown source contain React, Solid, or other framework-specific content. Internally, the transformer looks for h1 headings inside the framework block and treats each `# Heading` as a framework section boundary. It then stores framework metadata and rewrites the block into separate framework panels.

docs/partner-placement.md

@@ -0,0 +1,70 @@
+# Partner Placement
+
+Partner placement is split into three separate decisions:
+
+- **Eligibility:** whether a partner can appear for a surface, category, library, feature, or user context.
+- **Tier:** the partner's commercial/display tier, which controls visual treatment and relative access to surfaces.
+- **Order:** the sequence used inside a surface once eligible partners are known.
+
+The order policy should be explicit per surface. Avoid treating the partner array order or legacy score as the policy itself.
+
+## Order Strategies
+
+### `static-curated`
+
+Use for surfaces where the order is editorially or commercially curated and should remain stable. These surfaces can preserve the existing order, use partner seniority, or use private commercial priority when seniority is unavailable.
+
+Do not expose private commercial criteria in client-facing field names, comments, or API responses. If a private priority is required, keep the public/client value generic, such as `placementPriority` or an already-resolved ordered list.
+
+### `tier-rotated`
+
+Use for visible partner surfaces where partners in the same tier should cycle over time. Tier order remains fixed, but partners inside the same tier are selected with weighted-random ordering for each loaded app session and surface.
+
+The root loader creates the session seed, so SSR and hydration receive the same value through loader data. Client placement hooks read the root loader data directly and do not refresh it during normal navigation. Each surface combines its stable surface id with the session seed; avoid runtime-generated component ids in the seed because they can diverge across server and client rendering. Partners default to equal probability within their tier; a future `placementWeight` can bias same-tier odds without changing the ordering API.
+
+### `contextual-recommendation`
+
+Use when a surface behaves like a product recommendation or builder suggestion. Product fit should be established before commercial weighting affects order. This strategy currently preserves the legacy tier/priority behavior while giving recommendation surfaces a separate policy label.
+
+### `machine-readable`
+
+Use for AI- or crawler-facing outputs such as `llms.txt` and JSON feeds. These should be deterministic and relevance-first. Do not rotate them merely for logo fairness unless the downstream behavior has been designed and disclosed as such.
+
+## Reserved Rules
+
+Reserved rules should be narrow. For example, Cloudflare is reserved as the first deployment/hosting partner in any list that contains Cloudflare and other deployment partners. That should not imply Cloudflare is globally first across every partner surface; non-deployment partners can still appear before Cloudflare when the surface is mixed-category.
+
+Deployment action buttons are a deployment-only surface. Cloudflare remains first when present. Tier order is still preserved, and providers within the same tier can rotate by session.
+
+## Current Surfaces
+
+- Partner directory: `tier-rotated` for active partners, `static-curated` for previous partners.
+- Partner grids and embeds: `tier-rotated`.
+- Docs and blog rails: `tier-rotated`.
+- Mobile docs strip: `tier-rotated`.
+- Builder feature picker and starter partner suggestions: `contextual-recommendation`.
+- Deploy action buttons: `tier-rotated` with deployment provider tiers preserved.
+- `llms.txt` and `/api/data/partners`: `machine-readable`.
+
+## Analytics
+
+Partner impression and click events should include:
+
+- `partner_id`
+- `placement`
+- `slot_index`
+- `partner_tier`
+- `order_strategy`
+- `rotation_seed` when the strategy rotates
+
+This lets reporting distinguish partner performance from placement policy and makes under/over-exposure easier to debug.
+
+## Contract Language
+
+Suggested external framing:
+
+> Partner tiers determine eligibility, visual treatment, reporting, and relative access to surfaces. Placement within the same tier may rotate or be curated depending on the surface. Some placements may include explicitly reserved rules for product, infrastructure, legal, or strategic reasons.
+
+For AI-assisted selection:
+
+> AI-assisted partner selection prioritizes user need and capability fit first. Partner tier may influence selection only among qualified options.

netlify.toml

@@ -2,7 +2,7 @@
 NODE_OPTIONS = "--max-old-space-size=4096"
 
 [build]
-command = "vite build && cp src/instrument.server.mjs dist/server"
+command = "vite build --logLevel warn && cp src/instrument.server.mjs dist/server"
 publish = "dist/client"
 
 [functions]

package.json

@@ -3,13 +3,13 @@
   "private": true,
   "sideEffects": false,
   "repository": "https://github.com/TanStack/tanstack.com.git",
-  "packageManager": "pnpm@10.33.0+sha512.10568bb4a6afb58c9eb3630da90cc9516417abebd3fabbe6739f0ae795728da1491e9db5a544c76ad8eb7570f5c4bb3d6c637b2cb41bfdcdb47fa823c8649319",
+  "packageManager": "pnpm@11.1.0",
   "type": "module",
   "scripts": {
     "dev": "pnpm run with-env vite dev",
     "with-env": "dotenv -e .env.local",
     "dev:frontend": "pnpm run with-env vite dev",
-    "build": "vite build",
+    "build": "vite build --logLevel warn",
     "start": "vite start",
     "start:prod": "pnpm run with-env node scripts/run-built-server.mjs",
     "content:build": "node scripts/build-content-collections.mjs",
@@ -21,17 +21,17 @@
     "db:studio": "drizzle-kit studio",
     "docs:webhooks:plan": "tsx scripts/sync-docs-webhooks.ts --dry-run",
     "docs:webhooks:sync": "tsx scripts/sync-docs-webhooks.ts",
-    "husky": "pnpm run format && pnpm run test && pnpm run test:smoke",
+    "husky": "pnpm run format && pnpm run test",
     "pretest": "pnpm run content:build",
     "test": "run-p test:tsc test:lint",
     "test:tsc": "tsc",
     "test:lint": "pnpm run lint",
-    "test:smoke": "tsx tests/smoke.ts",
-    "test:e2e": "playwright test",
     "prepare": "husky"
   },
   "dependencies": {
+    "@fingerprintjs/fingerprintjs-pro-react": "^2.7.1",
     "@floating-ui/react": "^0.27.19",
+    "@kapaai/react-sdk": "^0.9.10",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@netlify/functions": "^5.1.5",
     "@netlify/vite-plugin-tanstack-start": "^1.3.2",
@@ -52,20 +52,20 @@
     "@takumi-rs/core": "^1.1.2",
     "@takumi-rs/helpers": "^1.1.2",
     "@takumi-rs/image-response": "^1.1.2",
-    "@tanstack/ai": "^0.10.2",
-    "@tanstack/ai-anthropic": "^0.7.3",
-    "@tanstack/ai-client": "^0.7.9",
-    "@tanstack/ai-openai": "^0.7.4",
-    "@tanstack/create": "^0.63.4",
-    "@tanstack/pacer": "^0.20.1",
-    "@tanstack/react-hotkeys": "^0.9.1",
-    "@tanstack/react-pacer": "^0.21.1",
-    "@tanstack/react-query": "^5.96.2",
-    "@tanstack/react-router": "1.168.24",
-    "@tanstack/react-router-devtools": "1.166.13",
-    "@tanstack/react-router-ssr-query": "1.166.12",
-    "@tanstack/react-start": "1.167.49",
-    "@tanstack/react-start-server": "1.166.43",
+    "@tanstack/ai": "^0.20.1",
+    "@tanstack/ai-anthropic": "^0.10.1",
+    "@tanstack/ai-client": "^0.11.3",
+    "@tanstack/ai-openai": "^0.9.5",
+    "@tanstack/create": "^0.68.0",
+    "@tanstack/pacer": "^0.21.1",
+    "@tanstack/react-hotkeys": "^0.10.0",
+    "@tanstack/react-pacer": "^0.22.1",
+    "@tanstack/react-query": "^5.100.11",
+    "@tanstack/react-router": "1.170.7",
+    "@tanstack/react-router-devtools": "1.167.0",
+    "@tanstack/react-router-ssr-query": "1.167.0",
+    "@tanstack/react-start": "1.168.10",
+    "@tanstack/react-start-client": "1.168.2",
     "@tanstack/react-table": "^8.21.3",
     "@types/d3": "^7.4.3",
     "@uploadthing/react": "^7.3.3",
@@ -81,15 +81,19 @@
     "diff": "^8.0.4",
     "discord-interactions": "^4.4.0",
     "drizzle-orm": "^0.45.2",
+    "encoding-sniffer": "^0.2.1",
     "gray-matter": "^4.0.3",
     "hast-util-is-element": "^3.0.0",
     "hast-util-to-string": "^3.0.1",
+    "iconv-lite": "^0.7.2",
     "jszip": "^3.10.1",
     "lru-cache": "^11.2.7",
     "lucide-react": "^1.7.0",
     "maath": "^0.10.8",
     "match-sorter": "^8.2.0",
     "mermaid": "^11.14.0",
+    "parse5": "^7.3.0",
+    "parse5-parser-stream": "^7.1.2",
     "postgres": "^3.4.8",
     "react": "19.2.3",
     "react-colorful": "^5.6.1",
@@ -108,6 +112,7 @@
     "remove-markdown": "^0.6.3",
     "resend": "^6.10.0",
     "shiki": "^4.0.2",
+    "streamdown": "^2.5.0",
     "tailwind-merge": "^3.5.0",
     "tar-stream": "^3.1.8",
     "three": "^0.183.2",
@@ -124,12 +129,11 @@
   "devDependencies": {
     "@content-collections/core": "^0.14.3",
     "@content-collections/vite": "^0.2.9",
-    "@playwright/test": "^1.59.0",
     "@shikijs/transformers": "^4.0.2",
-    "@tanstack/devtools-vite": "^0.6.0",
-    "@tanstack/react-devtools": "^0.10.2",
-    "@tanstack/react-query-devtools": "^5.99.0",
-    "@tanstack/redact": "^0.0.6",
+    "@tanstack/devtools-vite": "^0.7.0",
+    "@tanstack/react-devtools": "^0.10.5",
+    "@tanstack/react-query-devtools": "^5.100.11",
+    "@tanstack/redact": "^0.0.17",
     "@types/hast": "^3.0.4",
     "@types/node": "^25.5.0",
     "@types/pg": "^8.20.0",
@@ -150,23 +154,9 @@
     "tailwindcss": "^4.2.2",
     "tsx": "^4.21.0",
     "typescript": "^6.0.2",
-    "vite": "^8.0.3"
+    "vite": "^8.0.13"
   },
   "engines": {
     "node": ">=22.0.0"
-  },
-  "pnpm": {
-    "overrides": {
-      "cross-spawn": ">=6.0.6",
-      "glob": ">=10.5.0",
-      "node-forge": ">=1.3.2",
-      "jws": ">=3.2.3",
-      "qs": ">=6.14.1",
-      "tunnel-rat>zustand": "5.0.12",
-      "js-yaml": "^3.14.2",
-      "minimatch@3.1.5>brace-expansion": "1.1.12",
-      "minimatch@5.1.9>brace-expansion": "2.0.3",
-      "minimatch@10.2.5>brace-expansion": "5.0.5"
-    }
   }
 }