Upgrade TanStack Start for CVE-2026-102989

[RhysSullivan]

Patches the TanStack Start reflected XSS in server-function responses (advisory).

• @tanstack/react-start catalog ^1.167.16 → ^1.168.60 (lock 1.167.64 → 1.168.60; @tanstack/start-server-core 1.167.30 → 1.169.39)
• @tanstack/react-router catalog ^1.168.10 → ^1.170.41 (react-start pins it exactly)
• OrgSlugGate: the router renamed RouteMatch.globalNotFound to _notFound; updated the not-found check.
• Route trees (cloud, self-host, Cloudflare, app, react): regenerated by the newer route generator (ordering only; check:routes passes).
• Lockfile generated with the repo-pinned bun 1.3.11. That pulls in some in-range transitive bumps (babel, vitest 4.1.5 → 4.1.11, and others).

Verified: typecheck, lint, format:check, test (one flaky sdk test passes on rerun; the router test fix is in #2161), cloud build, and e2e/scenarios/org-slug-routing.test.ts on the cloud and self-host targets. Merging auto-deploys cloud. Verify that deployment after merge.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	executor-cloud	b0dbbf6	Sep 30 2026, 06:47 PM

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	executor-marketing	b0dbbf6	Commit Preview URL Branch Preview URL	Sep 30 2026, 06:46 PM

[github-actions]

Cloudflare preview

Torn down — the PR is closed.

[pkg-pr-new]

Open in StackBlitz

@executor-js/cli

npm i https://pkg.pr.new/@executor-js/cli@2160

@executor-js/config

npm i https://pkg.pr.new/@executor-js/config@2160

@executor-js/execution

npm i https://pkg.pr.new/@executor-js/execution@2160

@executor-js/sdk

npm i https://pkg.pr.new/@executor-js/sdk@2160

@executor-js/codemode-core

npm i https://pkg.pr.new/@executor-js/codemode-core@2160

@executor-js/runtime-quickjs

npm i https://pkg.pr.new/@executor-js/runtime-quickjs@2160

@executor-js/plugin-file-secrets

npm i https://pkg.pr.new/@executor-js/plugin-file-secrets@2160

@executor-js/plugin-graphql

npm i https://pkg.pr.new/@executor-js/plugin-graphql@2160

@executor-js/plugin-keychain

npm i https://pkg.pr.new/@executor-js/plugin-keychain@2160

@executor-js/plugin-mcp

npm i https://pkg.pr.new/@executor-js/plugin-mcp@2160

@executor-js/plugin-onepassword

npm i https://pkg.pr.new/@executor-js/plugin-onepassword@2160

@executor-js/plugin-openapi

npm i https://pkg.pr.new/@executor-js/plugin-openapi@2160

executor

npm i https://pkg.pr.new/executor@2160

commit: b0dbbf6