[WIP] [v2] Add Octane adapter for TanStack Form by crutchcorn · Pull Request #2413 · TanStack/form

crutchcorn · 2026-09-30T21:01:28Z

WIP

coderabbitai · 2026-09-30T21:01:37Z

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

nx-cloud · 2026-09-30T21:01:55Z

🤖 Nx Cloud AI Fix Eligible

An automatically generated fix could have helped fix failing tasks for this run, but Self-healing CI is disabled for this workspace. Visit workspace settings to enable it and get automatic fixes in future runs.

_{To disable these notifications, a workspace admin can disable them in workspace settings.}

View your CI Pipeline Execution ↗ for commit cf32578

Command	Status	Duration	Result
`nx affected --targets=test:sherif,test:knip,tes...`	❌ Failed	3m 40s	View ↗
`nx run-many --target=build --exclude=examples/**`	✅ Succeeded	20s	View ↗

☁️ Nx Cloud last updated this comment at 2026-10-09 23:46:12 UTC

github-actions · 2026-09-30T21:02:30Z

🚀 Changeset Version Preview

7 package(s) bumped directly, 7 bumped as dependents.

🟨 Minor bumps

Package	Version	Reason
`@tanstack/form-core`	2.0.0-alpha.2 → 2.0.0-alpha.3	Changeset
`@tanstack/lit-form`	2.0.0-alpha.2 → 2.0.0-alpha.3	Changeset
`@tanstack/preact-form`	2.0.0-alpha.2 → 2.0.0-alpha.3	Changeset
`@tanstack/react-form`	2.0.0-alpha.2 → 2.0.0-alpha.3	Changeset
`@tanstack/solid-form`	2.0.0-alpha.2 → 2.0.0-alpha.3	Changeset
`@tanstack/svelte-form`	2.0.0-alpha.2 → 2.0.0-alpha.3	Changeset
`@tanstack/vue-form`	2.0.0-alpha.2 → 2.0.0-alpha.3	Changeset
`@tanstack/angular-form`	2.0.0-alpha.2 → 2.0.0-alpha.3	Dependent
`@tanstack/react-form-nextjs`	2.0.0-alpha.2 → 2.0.0-alpha.3	Dependent
`@tanstack/react-form-start`	2.0.0-alpha.2 → 2.0.0-alpha.3	Dependent

🟩 Patch bumps

Package	Version	Reason
`@tanstack/form-devtools`	1.0.0-alpha.2 → 1.0.0-alpha.3	Dependent
`@tanstack/octane-form`	1.30.5 → 1.30.6-alpha.0	Dependent
`@tanstack/react-form-devtools`	1.0.0-alpha.2 → 1.0.0-alpha.3	Dependent
`@tanstack/solid-form-devtools`	1.0.0-alpha.2 → 1.0.0-alpha.3	Dependent

pkg-pr-new · 2026-09-30T21:04:44Z

More templates

@tanstack/angular-form

npm i https://pkg.pr.new/TanStack/form/@tanstack/angular-form@2413

@tanstack/form-core

npm i https://pkg.pr.new/TanStack/form/@tanstack/form-core@2413

@tanstack/form-devtools

npm i https://pkg.pr.new/TanStack/form/@tanstack/form-devtools@2413

@tanstack/lit-form

npm i https://pkg.pr.new/TanStack/form/@tanstack/lit-form@2413

@tanstack/octane-form

npm i https://pkg.pr.new/TanStack/form/@tanstack/octane-form@2413

@tanstack/preact-form

npm i https://pkg.pr.new/TanStack/form/@tanstack/preact-form@2413

@tanstack/react-form

npm i https://pkg.pr.new/TanStack/form/@tanstack/react-form@2413

@tanstack/react-form-devtools

npm i https://pkg.pr.new/TanStack/form/@tanstack/react-form-devtools@2413

@tanstack/react-form-nextjs

npm i https://pkg.pr.new/TanStack/form/@tanstack/react-form-nextjs@2413

@tanstack/react-form-start

npm i https://pkg.pr.new/TanStack/form/@tanstack/react-form-start@2413

@tanstack/solid-form

npm i https://pkg.pr.new/TanStack/form/@tanstack/solid-form@2413

@tanstack/solid-form-devtools

npm i https://pkg.pr.new/TanStack/form/@tanstack/solid-form-devtools@2413

@tanstack/svelte-form

npm i https://pkg.pr.new/TanStack/form/@tanstack/svelte-form@2413

@tanstack/vue-form

npm i https://pkg.pr.new/TanStack/form/@tanstack/vue-form@2413

commit: cf32578

socket-security · 2026-09-30T21:22:43Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@tanstack/octane-store@0.12.3
	@tsrx/eslint-plugin@0.4.12
	@tsrx/typescript-plugin@0.4.6
	@octanejs/testing-library@0.1.55
	octane@0.2.16
	ts-node@10.9.2
	env-cmd@11.0.0
	ts-patch@3.3.0
	@playwright/test@1.63.0

View full report

socket-security · 2026-09-30T21:22:45Z

Caution

Review the following alerts detected in dependencies.

According to your organization's Security Policy, you must resolve all "Block" alerts before proceeding. It is recommended to resolve "Warn" alerts too. Learn more about Socket for GitHub.

Priority	Alert (click "▶" to expand/collapse)	Action
	Critical CVE: Tinypool: Prototype Pollution Gadget to RCE in run() options CVE: GHSA-85c8-ppgw-ccpr Tinypool: Prototype Pollution Gadget to RCE in run() options (CRITICAL) Affected versions: < 2.1.2 Patched version: 2.1.2 From: pnpm-lock.yaml → `npm/octane@0.2.16` → `npm/tinypool@2.1.0` ℹ Read more on: This package \| This alert \| What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/tinypool@2.1.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Block
	Critical CVE: Tinypool: Prototype Pollution gadget in worker options leads to Remote Code Execution CVE: GHSA-5gmw-xhrv-c9v3 Tinypool: Prototype Pollution gadget in worker options leads to Remote Code Execution (CRITICAL) Affected versions: < 2.1.1 Patched version: 2.1.1 From: pnpm-lock.yaml → `npm/octane@0.2.16` → `npm/tinypool@2.1.0` ℹ Read more on: This package \| This alert \| What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/tinypool@2.1.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Block
	Low adoption: npm `@tanstack/octane-store` Location: Package overview From: packages/octane-form/package.json → `npm/@tanstack/octane-store@0.12.3` ℹ Read more on: This package \| This alert \| What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@tanstack/octane-store@0.12.3`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Low adoption: npm `@tsrx/oxc` Location: Package overview From: pnpm-lock.yaml → `npm/octane@0.2.16` → `npm/@tsrx/oxc@0.13.0` ℹ Read more on: This package \| This alert \| What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@tsrx/oxc@0.13.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Low adoption: npm `@tsrx/oxc-darwin-arm64` Location: Package overview From: pnpm-lock.yaml → `npm/octane@0.2.16` → `npm/@tsrx/oxc-darwin-arm64@0.13.0` ℹ Read more on: This package \| This alert \| What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@tsrx/oxc-darwin-arm64@0.13.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Low adoption: npm `@tsrx/oxc-darwin-x64` Location: Package overview From: pnpm-lock.yaml → `npm/octane@0.2.16` → `npm/@tsrx/oxc-darwin-x64@0.13.0` ℹ Read more on: This package \| This alert \| What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@tsrx/oxc-darwin-x64@0.13.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Low adoption: npm `@tsrx/oxc-linux-arm64-gnu` Location: Package overview From: pnpm-lock.yaml → `npm/octane@0.2.16` → `npm/@tsrx/oxc-linux-arm64-gnu@0.13.0` ℹ Read more on: This package \| This alert \| What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@tsrx/oxc-linux-arm64-gnu@0.13.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Low adoption: npm `@tsrx/oxc-linux-arm64-musl` Location: Package overview From: pnpm-lock.yaml → `npm/octane@0.2.16` → `npm/@tsrx/oxc-linux-arm64-musl@0.13.0` ℹ Read more on: This package \| This alert \| What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@tsrx/oxc-linux-arm64-musl@0.13.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Low adoption: npm `@tsrx/oxc-linux-x64-gnu` Location: Package overview From: pnpm-lock.yaml → `npm/octane@0.2.16` → `npm/@tsrx/oxc-linux-x64-gnu@0.13.0` ℹ Read more on: This package \| This alert \| What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@tsrx/oxc-linux-x64-gnu@0.13.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Low adoption: npm `@tsrx/oxc-linux-x64-musl` Location: Package overview From: pnpm-lock.yaml → `npm/octane@0.2.16` → `npm/@tsrx/oxc-linux-x64-musl@0.13.0` ℹ Read more on: This package \| This alert \| What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@tsrx/oxc-linux-x64-musl@0.13.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Low adoption: npm `@tsrx/oxc-win32-arm64-msvc` Location: Package overview From: pnpm-lock.yaml → `npm/octane@0.2.16` → `npm/@tsrx/oxc-win32-arm64-msvc@0.13.0` ℹ Read more on: This package \| This alert \| What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@tsrx/oxc-win32-arm64-msvc@0.13.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Low adoption: npm `@tsrx/oxc-win32-x64-msvc` Location: Package overview From: pnpm-lock.yaml → `npm/octane@0.2.16` → `npm/@tsrx/oxc-win32-x64-msvc@0.13.0` ℹ Read more on: This package \| This alert \| What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@tsrx/oxc-win32-x64-msvc@0.13.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn

View full report

# Conflicts: # knip.json

changeset-bot · 2026-10-09T23:41:35Z

⚠️ No Changeset found

Latest commit: cf32578

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

chore: initial scaffolding of Octane project

af85056

ci: apply automated fixes and generate docs

e283883

Merge branch 'alpha' into v2-octane

cf32578

# Conflicts: # knip.json

Navigation Menu

Repository navigation

[WIP] [v2] Add Octane adapter for TanStack Form - #2413

[WIP] [v2] Add Octane adapter for TanStack Form#2413
crutchcorn wants to merge 3 commits into
alphafrom
v2-octane

crutchcorn commented Sep 30, 2026

Uh oh!

coderabbitai Bot commented Sep 30, 2026 •

edited

Loading

Draft PR not reviewed

Uh oh!

nx-cloud Bot commented Sep 30, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Sep 30, 2026

Uh oh!

pkg-pr-new Bot commented Sep 30, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Sep 30, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Sep 30, 2026 •

edited

Loading

Uh oh!

changeset-bot Bot commented Oct 9, 2026

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

crutchcorn commented Sep 30, 2026

Uh oh!

coderabbitai Bot commented Sep 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Draft PR not reviewed

Uh oh!

nx-cloud Bot commented Sep 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🤖 Nx Cloud AI Fix Eligible

Uh oh!

github-actions Bot commented Sep 30, 2026

🚀 Changeset Version Preview

🟨 Minor bumps

🟩 Patch bumps

Uh oh!

pkg-pr-new Bot commented Sep 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Sep 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Sep 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

changeset-bot Bot commented Oct 9, 2026

⚠️ No Changeset found

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

coderabbitai Bot commented Sep 30, 2026 •

edited

Loading

nx-cloud Bot commented Sep 30, 2026 •

edited

Loading

pkg-pr-new Bot commented Sep 30, 2026 •

edited

Loading

socket-security Bot commented Sep 30, 2026 •

edited

Loading

socket-security Bot commented Sep 30, 2026 •

edited

Loading