From 8df33ba271a237fdbe484285d820fbb638de7986 Mon Sep 17 00:00:00 2001 From: Sarah Soutoul Date: Tue, 6 Oct 2026 14:34:13 -0600 Subject: [PATCH 1/5] fix(tanstack-react-start): require CSRF-capable Start version --- .changeset/tanstack-start-csrf-minimum.md | 5 +++++ packages/tanstack-react-start/package.json | 2 +- 2 files changed, 6 insertions(+), 1 deletion(-) create mode 100644 .changeset/tanstack-start-csrf-minimum.md diff --git a/.changeset/tanstack-start-csrf-minimum.md b/.changeset/tanstack-start-csrf-minimum.md new file mode 100644 index 00000000000..d951d88f2de --- /dev/null +++ b/.changeset/tanstack-start-csrf-minimum.md @@ -0,0 +1,5 @@ +--- +'@clerk/tanstack-react-start': patch +--- + +Require `@tanstack/react-start` 1.168.0 or later so apps can use the documented CSRF middleware alongside Clerk middleware. diff --git a/packages/tanstack-react-start/package.json b/packages/tanstack-react-start/package.json index 47f9164f764..040c3ecd7eb 100644 --- a/packages/tanstack-react-start/package.json +++ b/packages/tanstack-react-start/package.json @@ -91,7 +91,7 @@ }, "peerDependencies": { "@tanstack/react-router": "^1.168.10", - "@tanstack/react-start": "^1.167.17", + "@tanstack/react-start": "^1.168.0", "react": "catalog:peer-react", "react-dom": "catalog:peer-react" }, From 670945c79d6ec80a18a0f5db2b7c576dd6b73ab1 Mon Sep 17 00:00:00 2001 From: Sarah Soutoul Date: Tue, 6 Oct 2026 14:55:35 -0600 Subject: [PATCH 2/5] fix(tanstack-react-start): align router peer with Start --- .changeset/tanstack-start-csrf-minimum.md | 4 ++-- packages/tanstack-react-start/package.json | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.changeset/tanstack-start-csrf-minimum.md b/.changeset/tanstack-start-csrf-minimum.md index d951d88f2de..295c2c7fb73 100644 --- a/.changeset/tanstack-start-csrf-minimum.md +++ b/.changeset/tanstack-start-csrf-minimum.md @@ -1,5 +1,5 @@ --- -'@clerk/tanstack-react-start': patch +'@clerk/tanstack-react-start': minor --- -Require `@tanstack/react-start` 1.168.0 or later so apps can use the documented CSRF middleware alongside Clerk middleware. +Require `@tanstack/react-start` 1.168.0 or later and `@tanstack/react-router` 1.170.0 or later. Update both packages together to keep server functions protected by the documented CSRF middleware alongside Clerk middleware. diff --git a/packages/tanstack-react-start/package.json b/packages/tanstack-react-start/package.json index 040c3ecd7eb..698a4581909 100644 --- a/packages/tanstack-react-start/package.json +++ b/packages/tanstack-react-start/package.json @@ -90,7 +90,7 @@ "esbuild-plugin-file-path-extensions": "^2.1.4" }, "peerDependencies": { - "@tanstack/react-router": "^1.168.10", + "@tanstack/react-router": "^1.170.0", "@tanstack/react-start": "^1.168.0", "react": "catalog:peer-react", "react-dom": "catalog:peer-react" From e69e0193bc1e667e379a9b145a97851f25153c4e Mon Sep 17 00:00:00 2001 From: Michael Novotny Date: Wed, 7 Oct 2026 11:40:59 -0500 Subject: [PATCH 3/5] docs(tanstack-react-start): explain CSRF setup in changeset and update README prerequisites Co-Authored-By: Claude Opus 5.5 --- .changeset/tanstack-start-csrf-minimum.md | 17 ++++++++++++++++- packages/tanstack-react-start/README.md | 4 ++-- 2 files changed, 18 insertions(+), 3 deletions(-) diff --git a/.changeset/tanstack-start-csrf-minimum.md b/.changeset/tanstack-start-csrf-minimum.md index 295c2c7fb73..22b771bc8a6 100644 --- a/.changeset/tanstack-start-csrf-minimum.md +++ b/.changeset/tanstack-start-csrf-minimum.md @@ -2,4 +2,19 @@ '@clerk/tanstack-react-start': minor --- -Require `@tanstack/react-start` 1.168.0 or later and `@tanstack/react-router` 1.170.0 or later. Update both packages together to keep server functions protected by the documented CSRF middleware alongside Clerk middleware. +Raise the minimum supported peer dependencies to `@tanstack/react-start@^1.168.0` and `@tanstack/react-router@^1.170.0`. Start 1.168.0 is the first version that exports `createCsrfMiddleware()`. + +TanStack Start skips its default CSRF protection for server functions when your app has a `src/start.ts`, which `clerkMiddleware()` requires. Register `createCsrfMiddleware()` before `clerkMiddleware()` to restore it: + +```ts +import { createCsrfMiddleware, createStart } from '@tanstack/react-start'; +import { clerkMiddleware } from '@clerk/tanstack-react-start/server'; + +const csrfMiddleware = createCsrfMiddleware({ + filter: (context) => context.handlerType === 'serverFn', +}); + +export const startInstance = createStart(() => ({ + requestMiddleware: [csrfMiddleware, clerkMiddleware()], +})); +``` diff --git a/packages/tanstack-react-start/README.md b/packages/tanstack-react-start/README.md index c812aa77537..9e2dc87cba2 100644 --- a/packages/tanstack-react-start/README.md +++ b/packages/tanstack-react-start/README.md @@ -31,8 +31,8 @@ ### Prerequisites -- TanStack Start `^1.157.0` or later -- TanStack Router `^1.157.0` or later +- TanStack Start `^1.168.0` or later +- TanStack Router `^1.170.0` or later - React 18 or later - Node.js `>=20.9.0` or later - An existing Clerk application. [Create your account for free](https://dashboard.clerk.com/sign-up?utm_source=github&utm_medium=clerk_tanstack_react_start). From 0d57a810b397f0cfc2f8e595f592f06f34533916 Mon Sep 17 00:00:00 2001 From: Michael Novotny Date: Wed, 7 Oct 2026 11:55:11 -0500 Subject: [PATCH 4/5] docs(tanstack-react-start): use ctx in changeset CSRF filter Co-Authored-By: Claude Opus 5.5 --- .changeset/tanstack-start-csrf-minimum.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.changeset/tanstack-start-csrf-minimum.md b/.changeset/tanstack-start-csrf-minimum.md index 22b771bc8a6..7a382cef0a3 100644 --- a/.changeset/tanstack-start-csrf-minimum.md +++ b/.changeset/tanstack-start-csrf-minimum.md @@ -11,7 +11,7 @@ import { createCsrfMiddleware, createStart } from '@tanstack/react-start'; import { clerkMiddleware } from '@clerk/tanstack-react-start/server'; const csrfMiddleware = createCsrfMiddleware({ - filter: (context) => context.handlerType === 'serverFn', + filter: (ctx) => ctx.handlerType === 'serverFn', }); export const startInstance = createStart(() => ({ From 82c225778c564e026033c8afea1f0591dc4d6be5 Mon Sep 17 00:00:00 2001 From: Michael Novotny Date: Wed, 7 Oct 2026 13:38:07 -0500 Subject: [PATCH 5/5] fix(tanstack-react-start): require Start 1.168.10 and match the documented start.ts example Co-Authored-By: Claude Opus 5.5 --- .changeset/tanstack-start-csrf-minimum.md | 12 +++++++----- packages/tanstack-react-start/README.md | 4 ++-- packages/tanstack-react-start/package.json | 4 ++-- 3 files changed, 11 insertions(+), 9 deletions(-) diff --git a/.changeset/tanstack-start-csrf-minimum.md b/.changeset/tanstack-start-csrf-minimum.md index 7a382cef0a3..a4746ad845d 100644 --- a/.changeset/tanstack-start-csrf-minimum.md +++ b/.changeset/tanstack-start-csrf-minimum.md @@ -2,19 +2,21 @@ '@clerk/tanstack-react-start': minor --- -Raise the minimum supported peer dependencies to `@tanstack/react-start@^1.168.0` and `@tanstack/react-router@^1.170.0`. Start 1.168.0 is the first version that exports `createCsrfMiddleware()`. +Raise the minimum supported peer dependencies to `@tanstack/react-start@^1.168.10` and `@tanstack/react-router@^1.170.7`. Start 1.168.10 is the first version where importing `createCsrfMiddleware()` works reliably during Vite SSR. TanStack Start skips its default CSRF protection for server functions when your app has a `src/start.ts`, which `clerkMiddleware()` requires. Register `createCsrfMiddleware()` before `clerkMiddleware()` to restore it: ```ts -import { createCsrfMiddleware, createStart } from '@tanstack/react-start'; import { clerkMiddleware } from '@clerk/tanstack-react-start/server'; +import { createCsrfMiddleware, createStart } from '@tanstack/react-start'; const csrfMiddleware = createCsrfMiddleware({ filter: (ctx) => ctx.handlerType === 'serverFn', }); -export const startInstance = createStart(() => ({ - requestMiddleware: [csrfMiddleware, clerkMiddleware()], -})); +export const startInstance = createStart(() => { + return { + requestMiddleware: [csrfMiddleware, clerkMiddleware()], + }; +}); ``` diff --git a/packages/tanstack-react-start/README.md b/packages/tanstack-react-start/README.md index 9e2dc87cba2..f5e48ff6d1f 100644 --- a/packages/tanstack-react-start/README.md +++ b/packages/tanstack-react-start/README.md @@ -31,8 +31,8 @@ ### Prerequisites -- TanStack Start `^1.168.0` or later -- TanStack Router `^1.170.0` or later +- TanStack Start `^1.168.10` or later +- TanStack Router `^1.170.7` or later - React 18 or later - Node.js `>=20.9.0` or later - An existing Clerk application. [Create your account for free](https://dashboard.clerk.com/sign-up?utm_source=github&utm_medium=clerk_tanstack_react_start). diff --git a/packages/tanstack-react-start/package.json b/packages/tanstack-react-start/package.json index 698a4581909..37d46b81ddd 100644 --- a/packages/tanstack-react-start/package.json +++ b/packages/tanstack-react-start/package.json @@ -90,8 +90,8 @@ "esbuild-plugin-file-path-extensions": "^2.1.4" }, "peerDependencies": { - "@tanstack/react-router": "^1.170.0", - "@tanstack/react-start": "^1.168.0", + "@tanstack/react-router": "^1.170.7", + "@tanstack/react-start": "^1.168.10", "react": "catalog:peer-react", "react-dom": "catalog:peer-react" },