TanStack/router @tanstack/start-server-core@1.169.41

on GitHub

Patch Changes

• #7588 94d6d8e - Return 400 Bad Request for malformed percent-encoded request pathnames before running server entry callbacks. Preserve valid encoded paths and query handling.

• #7588 94d6d8e - Reduce request middleware overhead, reuse loaded entries and transport header requirements, and avoid unnecessary URL normalization for server functions. Preserve response helper writes made during body cancellation and SSR cleanup.

  Avoid allocating absent middleware headers and reply context, and construct RPC redirects with their final response state. Preserve middleware accessor evaluation and the documented undefined value for absent sendContext.

  Reduce synchronous server-function response overhead while preserving cancellation cleanup and middleware response mutations.

• #7588 94d6d8e - Keep streaming a page when request middleware returns a response that reads the page body, such as a copy made through a wrapped global Response, a copy in Bun, or a body piped through a transform. Start now disposes a replaced page stream only when nothing reads it. transferResponseBodyOwnership is removed: return the derived response directly.

• #7588 94d6d8e - Let request middleware read the body of a HEAD response, and strip it when the response leaves the pipeline. Start no longer applies Content-Encoding, Content-Length, or other framing headers set through response helpers to error bodies and serialized server-function replies that it builds itself. A response that middleware assigns to result.response is now disposed when the middleware returns another response.

• #7588 94d6d8e - Remove the built-in useSession API. Applications choose a session library, such as iron-session, and save or destroy sessions explicitly before returning or redirecting. Connect a cookie adapter through getCookie and setCookie, or append serialized cookies with appendResponseHeader('set-cookie', cookie). Existing session cookies require a deliberate migration or signing in again with a new cookie name.

  createServerEntry keeps the complete callback, including custom error handling, inside the request context and converts errors that escape it. The built-in entry still converts errors automatically. Raw createStartHandler handlers now rethrow the original error. For custom reporting, catch inside createServerEntry, then rethrow for default conversion or return handleStartError(error) to preserve response-helper status, headers, and cookies. Return an explicit Response when choosing a custom error payload.

  Response helpers now apply consistently across server routes, SSR, server functions, redirects, errors, and middleware response replacements. Helper setters override returned values; cookie helpers preserve independent cookies and replace matching cookie identities. Use appendResponseHeader('set-cookie', cookie) when adding a serialized cookie without replacing other cookies. Changed responses receive copied headers and reuse the body stream, so applications should inspect the response returned by Start rather than relying on mutation of the original response.

• Updated dependencies [94d6d8e, 550f478, 94d6d8e]:

  • @tanstack/router-core@1.171.36
  • @tanstack/start-storage-context@1.167.38
  • @tanstack/start-client-core@1.170.36