🏝️ + ▲ = 🚀 TanStack and @Vercel are officially teaming up! We’re working together to make Vercel a first-class home for TanStack Start with better support for deploying and running anything you can dream up with TanStack on Vercel. Start here! 👇

Your context window is fixed. Your chat is not. 📉 TanStack AI shrinks what the model sees and leaves your transcript alone allowing for infinite compacting chats. You pick your compaction strategy! npm i @tanstack/ai-compaction

TanStack AI now supports @Lovable AI Gateway. 🔑 Six modalities, one adapter shape: chat → lovableText image → lovableImage video → lovableVideo embed → lovableEmbedding speech → lovableSpeech transcribe → lovableTranscription npm i @tanstack/ai-lovable

Stop paying for your users' tokens. 💸 Headless BYOK just landed in TanStack AI: users bring their own API key, it never touches your server, and 15 provider adapters got a /byok entry in one pass. Two calls to wire up. 🔑

After almost a year of active development, we're proud to announce that TanStack AI goes into RC! 🔥 We've done a lot of work to get it to a state we're proud of and consider stable and production ready. Read all about it here:

WebSockets just landed in TanStack AI. 🚀 One socket for the whole conversation. Full-duplex. And if it drops mid-stream, the client reopens at the last offset and replays only the gap, no second model call. Works on Node (`ws`) and Cloudflare (`toWebSocketResponse`)

router.navigate() looks like one async operation, but inside TanStack Router, four lifetimes decide which work continues, which navigation may publish, how each route attempt resolves, and whether the framework actually rendered it. New from @ChaponFlo:

SECURITY ADVISORY — TanStack npm packages A supply-chain compromise affecting 42 @tanstack/* packages (84 versions total) was published to npm earlier today at approximately 19:20 and 19:26 UTC. Two malicious versions per package. Status: ACTIVE — packages are deprecated, npm security engaged, publish path being shut down. Severity: HIGH — payload exfiltrates AWS, GCP, Kubernetes, and Vault credentials, GitHub tokens, .npmrc contents, and SSH keys. If you installed any @tanstack/* package between 19:20 and 19:30 UTC today, treat the host as potentially compromised: • Rotate cloud, GitHub, and SSH credentials immediately • Audit cloud audit logs for the last several hours • Pin to a prior known-good version and reinstall from a clean lockfile Detection — the malicious manifest contains: "optionalDependencies": { "@tanstack/setup": "github:tanstack/router#79ac49ee#..." } Any version with this entry is compromised. The payload is delivered via a git-resolved optionalDependency whose prepare script runs router_init.js (~2.3 MB, smuggled into each tarball at the package root). Unpublish is blocked by npm policy for most affected packages due to existing third-party dependents. All 84 versions are being deprecated with a SECURITY warning, and npm security has been engaged to pull tarballs at the registry level. Full technical breakdown, complete package and version list, and rolling status updates: Credit to the security researcher for responsible disclosure.