V0 by bart-krakowski · Pull Request #42 · TanStack/time

bart-krakowski · 2026-08-21T23:32:42Z

No description provided.

- Fix sherif: sort dependencies alphabetically, align solid-js and @eslint-react/eslint-plugin versions - Add missing devDependencies (@vitejs/plugin-react to react-time-devtools) - Fix solid-time-devtools JSX build by using pre-compiled solid template - Fix vitest configs: remove references to non-existent test-setup.ts files - Fix time package test:lib: add --passWithNoTests flag - Configure react-time-devtools tsdown with jsx: 'automatic' - Update knip.json to ignore intentional template dependencies - Remove unused test-setup.ts files - Remove unused React imports from examples

Meerge branch 'alpha' of github.com:TanStack/time into alpha

coderabbitai · 2026-08-21T23:32:51Z

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: a2391e3e-c446-405a-a1ce-e4b79f71b1f5

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

socket-security · 2026-08-21T23:33:33Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@tanstack/typedoc-config@0.3.3
	happy-dom@20.11.6
	@radix-ui/react-label@2.1.8
	@tanstack/react-store@0.8.0
	@tanstack/react-virtual@3.13.24
	@tanstack/solid-store@0.8.0
	class-variance-authority@0.7.1
	@changesets/changelog-github@0.7.0
	@radix-ui/react-slot@1.2.4
	@tanstack/react-query-devtools@5.102.0
	@tanstack/store@0.8.0
	vite@7.3.1
	@radix-ui/react-dialog@1.1.15
	nx@22.7.8
	@radix-ui/react-tooltip@1.2.8
	@tanstack/devtools-utils@0.4.0
	@radix-ui/react-scroll-area@1.2.10
	@radix-ui/react-select@2.2.6
	rolldown-plugin-solid@0.2.1
	@base-ui/react@1.3.0
	@types/react-dom@19.2.3
	@tanstack/devtools-ui@0.5.1
	@tanstack/react-router-devtools@1.167.1
	postcss@8.5.6
	tinyglobby@0.2.15
	@types/react@19.2.13
	vitest@4.1.11
	premove@4.0.0
	clsx@2.1.1
	@faker-js/faker@10.3.0
	lucide-react@1.8.0
	markdown-link-extractor@4.0.3
	@fontsource-variable/geist@5.2.8
See 35 more rows in the dashboard

View full report

socket-security · 2026-08-21T23:33:35Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Obfuscated code: npm `@noble/hashes` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → `npm/shadcn@4.19.0` → `npm/@noble/hashes@1.8.0` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@noble/hashes@1.8.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `@noble/hashes` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → `npm/shadcn@4.19.0` → `npm/@noble/hashes@1.8.0` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@noble/hashes@1.8.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		High CVE: npm `brace-expansion`: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation CVE: GHSA-rgw5-rvv9-x895 brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation (HIGH) Affected versions: < 1.1.18; >= 2.0.0 < 2.1.4; >= 3.0.0 < 3.0.6; >= 4.0.0 < 5.0.9 Patched version: 5.0.9 From: pnpm-lock.yaml → `npm/nx@22.7.8` → `npm/shadcn@4.19.0` → `npm/brace-expansion@5.0.8` ℹ Read more on: This package \| This alert \| What is a CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/brace-expansion@5.0.8`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `formatly` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → `npm/knip@5.88.1` → `npm/formatly@0.3.0` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/formatly@0.3.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		High CVE: npm `js-yaml`: YAML merge-key chains can force quadratic CPU consumption CVE: GHSA-52cp-r559-cp3m js-yaml: YAML merge-key chains can force quadratic CPU consumption (HIGH) Affected versions: >= 3.0.0 < 3.15.0; >= 4.0.0 < 4.3.0 Patched version: 3.15.0 From: pnpm-lock.yaml → `npm/@changesets/cli@2.29.8` → `npm/js-yaml@3.14.2` ℹ Read more on: This package \| This alert \| What is a CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/js-yaml@3.14.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		High CVE: npm `js-yaml`: YAML merge-key chains can force quadratic CPU consumption CVE: GHSA-52cp-r559-cp3m js-yaml: YAML merge-key chains can force quadratic CPU consumption (HIGH) Affected versions: >= 3.0.0 < 3.15.0; >= 4.0.0 < 4.3.0 Patched version: 4.3.0 From: pnpm-lock.yaml → `npm/shadcn@4.19.0` → `npm/@changesets/cli@2.29.8` → `npm/js-yaml@4.1.1` ℹ Read more on: This package \| This alert \| What is a CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/js-yaml@4.1.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		High CVE: npm `minimatch` ReDoS: nested () extglobs generate catastrophically backtracking regular expressions CVE:* GHSA-23c5-xmqv-rm74 minimatch ReDoS: nested () extglobs generate catastrophically backtracking regular expressions (HIGH) Affected versions:* >= 10.0.0 < 10.2.3; >= 9.0.0 < 9.0.7; >= 8.0.0 < 8.0.6; >= 7.0.0 < 7.4.8; >= 6.0.0 < 6.2.2; >= 5.0.0 < 5.1.8; >= 4.0.0 < 4.2.5; < 3.1.4 Patched version: 9.0.7 From: pnpm-lock.yaml → `npm/@tanstack/typedoc-config@0.3.3` → `npm/minimatch@9.0.5` ℹ Read more on: This package \| This alert \| What is a CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/minimatch@9.0.5`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		High CVE: npm `minimatch` has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments CVE: GHSA-7r86-cg39-jmmj minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments (HIGH) Affected versions: >= 10.0.0 < 10.2.3; >= 9.0.0 < 9.0.7; >= 8.0.0 < 8.0.6; >= 7.0.0 < 7.4.8; >= 6.0.0 < 6.2.2; >= 5.0.0 < 5.1.8; >= 4.0.0 < 4.2.5; < 3.1.3 Patched version: 9.0.7 From: pnpm-lock.yaml → `npm/@tanstack/typedoc-config@0.3.3` → `npm/minimatch@9.0.5` ℹ Read more on: This package \| This alert \| What is a CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/minimatch@9.0.5`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		High CVE: npm `minimatch` has a ReDoS via repeated wildcards with non-matching literal in pattern CVE: GHSA-3ppc-4f35-3m26 minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern (HIGH) Affected versions: >= 10.0.0 < 10.2.1; >= 9.0.0 < 9.0.6; >= 8.0.0 < 8.0.5; >= 7.0.0 < 7.4.7; >= 6.0.0 < 6.2.1; >= 5.0.0 < 5.1.7; >= 4.0.0 < 4.2.4; < 3.1.3 Patched version: 9.0.6 From: pnpm-lock.yaml → `npm/@tanstack/typedoc-config@0.3.3` → `npm/minimatch@9.0.5` ℹ Read more on: This package \| This alert \| What is a CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/minimatch@9.0.5`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		High CVE: Picomatch has a ReDoS vulnerability via extglob quantifiers CVE: GHSA-c2c7-rcm5-vvqj Picomatch has a ReDoS vulnerability via extglob quantifiers (HIGH) Affected versions: >= 4.0.0 < 4.0.4; >= 3.0.0 < 3.0.2; < 2.3.2 Patched version: 2.3.2 From: pnpm-lock.yaml → `npm/knip@5.88.1` → `npm/shadcn@4.19.0` → `npm/@changesets/cli@2.29.8` → `npm/picomatch@2.3.1` ℹ Read more on: This package \| This alert \| What is a CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/picomatch@2.3.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		High CVE: Picomatch has a ReDoS vulnerability via extglob quantifiers CVE: GHSA-c2c7-rcm5-vvqj Picomatch has a ReDoS vulnerability via extglob quantifiers (HIGH) Affected versions: >= 4.0.0 < 4.0.4; >= 3.0.0 < 3.0.2; < 2.3.2 Patched version: 4.0.4 From: pnpm-lock.yaml → `npm/vite@7.3.1` → `npm/knip@5.88.1` → `npm/vitest@4.1.11` → `npm/tinyglobby@0.2.15` → `npm/picomatch@4.0.3` ℹ Read more on: This package \| This alert \| What is a CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/picomatch@4.0.3`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		High CVE: PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure CVE: GHSA-r28c-9q8g-f849 PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure (HIGH) Affected versions: < 8.5.18 Patched version: 8.5.18 From: examples/react/calendar/package.json → `npm/postcss@8.5.6` ℹ Read more on: This package \| This alert \| What is a CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/postcss@8.5.6`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		High CVE: PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments CVE: GHSA-6g55-p6wh-862q PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments (HIGH) Affected versions: < 8.5.12 Patched version: 8.5.12 From: examples/react/calendar/package.json → `npm/postcss@8.5.6` ℹ Read more on: This package \| This alert \| What is a CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/postcss@8.5.6`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		High CVE: Rollup 4 has Arbitrary File Write via Path Traversal CVE: GHSA-mw96-cpmx-2vgc Rollup 4 has Arbitrary File Write via Path Traversal (HIGH) Affected versions: < 2.80.0; >= 3.0.0 < 3.30.0; >= 4.0.0 < 4.59.0 Patched version: 4.59.0 From: pnpm-lock.yaml → `npm/vite@7.3.1` → `npm/rollup@4.57.1` ℹ Read more on: This package \| This alert \| What is a CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/rollup@4.57.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		High CVE: npm `vite`: `server.fs.deny` bypass on Windows alternate paths CVE: GHSA-fx2h-pf6j-xcff vite: `server.fs.deny` bypass on Windows alternate paths (HIGH) Affected versions: >= 8.0.0 < 8.0.16; >= 7.0.0 < 7.3.5; < 6.4.3 Patched version: 7.3.5 From: examples/react/calendar/package.json → `npm/vite@7.3.1` ℹ Read more on: This package \| This alert \| What is a CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/vite@7.3.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		High CVE: Vite: `server.fs.deny` bypassed with queries CVE: GHSA-v2wj-q39q-566r Vite: `server.fs.deny` bypassed with queries (HIGH) Affected versions: >= 8.0.0 < 8.0.5; >= 7.1.0 < 7.3.2 Patched version: 7.3.2 From: examples/react/calendar/package.json → `npm/vite@7.3.1` ℹ Read more on: This package \| This alert \| What is a CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/vite@7.3.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		High CVE: Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket CVE: GHSA-p9ff-h696-f583 Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket (HIGH) Affected versions: >= 8.0.0 < 8.0.5; >= 7.0.0 < 7.3.2; >= 6.0.0 < 6.4.2 Patched version: 7.3.2 From: examples/react/calendar/package.json → `npm/vite@7.3.1` ℹ Read more on: This package \| This alert \| What is a CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/vite@7.3.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Low adoption: npm `@rolldown/binding-android-arm-eabi` Location: Package overview From: pnpm-lock.yaml → `npm/tsdown@0.22.14` → `npm/rolldown-plugin-solid@0.2.1` → `npm/@rolldown/binding-android-arm-eabi@1.2.5` ℹ Read more on: This package \| This alert \| What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@rolldown/binding-android-arm-eabi@1.2.5`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Low adoption: npm `rolldown-plugin-solid` Location: Package overview From: packages/time-devtools/package.json → `npm/rolldown-plugin-solid@0.2.1` ℹ Read more on: This package \| This alert \| What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/rolldown-plugin-solid@0.2.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Deprecated by its maintainer: npm `tsconfck` with reason "unmaintained" Reason: unmaintained From: pnpm-lock.yaml → `npm/vite-tsconfig-paths@6.1.1` → `npm/tsconfck@3.1.6` ℹ Read more on: This package \| This alert \| What is a deprecated package? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Research the state of the package and determine if there are non-deprecated versions that can be used, or if it should be replaced with a new, supported solution. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/tsconfck@3.1.6`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Deprecated by its maintainer: npm `whatwg-encoding` Reason: Use @exodus/bytes instead for a more spec-conformant and faster implementation From: pnpm-lock.yaml → `npm/markdown-link-extractor@4.0.3` → `npm/whatwg-encoding@3.1.1` ℹ Read more on: This package \| This alert \| What is a deprecated package? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Research the state of the package and determine if there are non-deprecated versions that can be used, or if it should be replaced with a new, supported solution. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/whatwg-encoding@3.1.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

pkg-pr-new · 2026-08-21T23:33:36Z

@tanstack/react-time

npm i https://pkg.pr.new/TanStack/time/@tanstack/react-time@42

@tanstack/react-time-devtools

npm i https://pkg.pr.new/TanStack/time/@tanstack/react-time-devtools@42

@tanstack/solid-time

npm i https://pkg.pr.new/TanStack/time/@tanstack/solid-time@42

@tanstack/solid-time-devtools

npm i https://pkg.pr.new/TanStack/time/@tanstack/solid-time-devtools@42

@tanstack/time

npm i https://pkg.pr.new/TanStack/time/@tanstack/time@42

@tanstack/time-devtools

npm i https://pkg.pr.new/TanStack/time/@tanstack/time-devtools@42

commit: 9b3b67e

bart-krakowski and others added 30 commits January 19, 2026 22:29

chore: project setup

f47a864

chore: project setup

82adbc1

ci: apply automated fixes

f0f9bac

feat: base

b9bdb1b

ci: apply automated fixes

450aae7

feat: parse

6a75f09

feat: withDateOperation HOF and startOf util

757a936

Merge branch 'alpha' of github.com:TanStack/time into alpha

fe2566d

ci: apply automated fixes

7ba3389

feat: endOf util

017176d

Merge branch 'alpha' of github.com:TanStack/time into alpha

64deac8

ci: apply automated fixes

7dfbee8

feat: returnFormat option

cf47080

feat: utils

bb3ba6d

Merge branch 'alpha' of github.com:TanStack/time into alpha

de59d60

ci: apply automated fixes

37e74a4

feat: utils

c3a958a

feat: utils

a010e7e

ci: apply automated fixes

35e7ec8

feat: date comparition utils

68abe50

ci: apply automated fixes

e56eab8

feat: date comparition utils

b13de3b

ci: apply automated fixes

843002b

refactor: date comparition utils

c468624

refactor: date comparition utils

808726b

ci: apply automated fixes

4ae20c4

feat: format util

12998a3

feat: format util

f3a70ee

ci: apply automated fixes

deb652e

autofix-ci Bot and others added 16 commits August 14, 2026 08:42

ci: apply automated fixes

80ebf12

feat: filtering and dnd

0e333cf

ci: apply automated fixes

ce9ced0

chore: update devtools

7435637

fix(time): notify store subscribers on setResources/setEvents

30cb645

Merge branch 'alpha' of github.com:TanStack/time into alpha

f164af0

ci: apply automated fixes

4ae30de

feat(time): add eventMoveFeature for drag-to-move

ed7a5e8

Merge branch 'alpha' of github.com:TanStack/time into alpha

38cb416

Meerge branch 'alpha' of github.com:TanStack/time into alpha

ci: apply automated fixes

cd03431

feat(time): add eventMoveFeature for drag-to-move

f3e61b2

Merge branch 'alpha' of github.com:TanStack/time into alpha

b9fec9d

feat(devtools): unify styling

fec70d2

ci: apply automated fixes

0aa9ac3

fix: virtualization example

d4c4ea7

fix: virtualization example

6979b75

bart-krakowski and others added 10 commits August 23, 2026 00:10

chore: update devtools

3ad9abc

chore: update deps

6d71922

chore: update deps

474c06f

ci: apply automated fixes

8dd4199

chore: update deps

a78a6f2

Merge branch 'v0' of github.com:TanStack/time into v0

bd773cc

ci: apply automated fixes

0ea8595

chore: update deps

5bd7ff2

Merge branch 'v0' of github.com:TanStack/time into v0

2d1ca60

ci: apply automated fixes

9b3b67e

Navigation Menu

Uh oh!

V0 - #42

V0#42
bart-krakowski wants to merge 250 commits into
alphafrom
v0

bart-krakowski commented Aug 21, 2026

Uh oh!

coderabbitai Bot commented Aug 21, 2026 •

edited

Loading

Review skipped

Uh oh!

socket-security Bot commented Aug 21, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Aug 21, 2026 •

edited

Loading

Uh oh!

pkg-pr-new Bot commented Aug 21, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

bart-krakowski commented Aug 21, 2026

Uh oh!

coderabbitai Bot commented Aug 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

socket-security Bot commented Aug 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Aug 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pkg-pr-new Bot commented Aug 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

coderabbitai Bot commented Aug 21, 2026 •

edited

Loading

socket-security Bot commented Aug 21, 2026 •

edited

Loading

socket-security Bot commented Aug 21, 2026 •

edited

Loading

pkg-pr-new Bot commented Aug 21, 2026 •

edited

Loading