{"slug": "tanstack", "name": "TanStack", "category": "dev-libs", "category_name": "Libraries and frameworks", "description": "", "recommenders": 4, "commenters": 12, "warners": 5, "score": -0.216, "rising": 0.02, "first": "2025-12-01", "latest": "2026-08-29", "why": "Astro and Tanstack are probably the best full-stack routers these days", "why_is_quote": true, "has_verdict": false, "sentiment": {"recommend": 4, "neutral": 3, "compare": 0, "warn": 5}, "spark": [0, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 0], "listed": true, "loved": [], "caveat": "", "short_quote": "Astro and Tanstack are probably the best full-stack routers these days", "kind": "", "icon": true, "domain": null, "github_repo": null, "official_url": "https://tanstack.com/", "pricing": "", "aliases": ["TanStack"], "verdict": null, "praise": [{"label": "", "summary": "", "quotes": [{"id": 791761476, "item_id": 49485092, "url": "https://news.ycombinator.com/item?id=49485092", "by": "perardi", "date": "2026-08-28", "version": null, "stance": "recommend", "quote": "Zustand and TanStack and Vite", "excerpt": "I agree. We are moving away from HTMX at work, to React. (After we moved away from Angular. That was\u2026a choice\u2026that I didn\u2019t make.) Here\u2019s the thing: there\u2019s still a place for HTMX. Lots of places. But \u201cbuilding an SPA but not actually and SPA\u201d is not a lane for HTMX. Nor do they promote HTMX for that purpose. Really quite the opposite. Different tools for different jobs. (Me? I honestly love React, just a more minima", "context": "", "use_case": "React stack", "switched_from": "", "story": "Htmx 4.0"}, {"id": 771476225, "item_id": 48217264, "url": "https://news.ycombinator.com/item?id=48217264", "by": "chrisweekly", "date": "2026-05-20", "version": null, "stance": "recommend", "quote": "VoidZero (and TanStack, FWIW) are a breath of fresh air", "excerpt": "I mostly agree. But without argument, I can point out that a modern webapp requires tooling for capabilities like testing, linting, formatting, and bundling. Vite (and its ecosystem) has proven its mettle, and when it comes to being able to understand your dependencies, I'll take fewer, and simpler, and way faster, and more coherent, and more independent of misaligned corporate influence, every time. It's not even a ", "context": "", "use_case": "", "switched_from": "", "story": "Node.js 26.0.0 (Now with Temporal)"}, {"id": 746349617, "item_id": 46646851, "url": "https://news.ycombinator.com/item?id=46646851", "by": "mpeg", "date": "2026-01-16", "version": null, "stance": "recommend", "quote": "Astro and Tanstack are probably the best full-stack routers these days", "excerpt": "This is cool, I use astro when I just want to spin up a quick site without having to fight the framework (looking at you, Nextjs) and the main thing I disliked was the initiatives around paid extras they had going Astro and Tanstack are probably the best full-stack routers these days, and Astro wins in terms of the wide support for almost any client-side tech", "context": "", "use_case": "full-stack routing", "switched_from": "", "story": "Astro Joining Cloudflare"}]}], "caveats": [{"label": "", "summary": "", "quotes": [{"id": 791899282, "item_id": 49493705, "url": "https://news.ycombinator.com/item?id=49493705", "by": "_the_inflator", "date": "2026-08-29", "version": null, "stance": "warn", "quote": "I stopped using TanStack because it got to meta for me and AI as well.", "excerpt": "Serious question: how widespread and actually used in production is Zod? Honestly, it made things worse for me. JavaScript isn\u2019t a statistical typed language and TypeScript already is something, where due to compiler issues I just use \u201cany\u201d. Zod has its conventions and JavaScript ain\u2019t Java. So Zod is also hard to read and debug. It is type conversion to type conversion - bloat, not JavaScript. Even Pydantic looks ta", "context": "", "use_case": "", "switched_from": "TanStack", "story": "Zod v4.5 adds schema compilation (3-9x faster validation)"}, {"id": 771465841, "item_id": 48216615, "url": "https://news.ycombinator.com/item?id=48216615", "by": "vldszn", "date": "2026-05-20", "version": null, "stance": "warn", "quote": "supply-chain compromise on Tanstack, which leaked their GitHub credentials through the GitHub CLI (gh)", "excerpt": "Per security advisory on GitHub: Root Cause One of our developers was compromised by a recent supply-chain compromise on Tanstack, which leaked their GitHub credentials through the GitHub CLI (gh). This allowed the attacker to run workflows on our GitHub repository as a contributor. More links: https://github.com/nrwl/nx-console/security/advisories/GHSA-c9j4-9m59-847w https://www.stepsecurity.io/blog/nx-console-vs-co", "context": "", "use_case": "", "switched_from": "", "story": "Nx Console VS Code extension was the initial access vector in the GitHub breach"}, {"id": 771058960, "item_id": 48191185, "url": "https://news.ycombinator.com/item?id=48191185", "by": "darkwi11ow", "date": "2026-05-19", "version": null, "stance": "warn", "quote": "Last week when Tanstack got compromised", "excerpt": "I use Tanstack in my projects. Last week when Tanstack got compromised, it was only my laziness that saved me -- was thinking about doing pnpm upgrade but got lazy and played some dota... Finished game was just going to pnpm upgrade, opened hacker news and boom! news hit. Since then, I had set up libvirt/qemu based VM with another Linux running in it specifically for development. Now I run all of docker, kubernetes, ", "context": "", "use_case": "", "switched_from": "", "story": "Mini Shai-Hulud Strikes Again: 314 npm Packages Compromised"}, {"id": 769684384, "item_id": 48105274, "url": "https://news.ycombinator.com/item?id=48105274", "by": "d3ng", "date": "2026-05-12", "version": null, "stance": "warn", "quote": "TanStack messed this up in the way they explicitly cache.", "excerpt": "I take the above back. TanStack messed this up in the way they explicitly cache. This is run from the affected workflow: https://github.com/TanStack/config/blob/main/.github/setup/action.yml#L22-L23 The restore-key looks too wide and this still looks like an issue. This wide caching may also cause issue if they ever upgrade major nodejs version independently of OS, for example.", "context": "", "use_case": "", "switched_from": "", "story": "TanStack NPM Packages Compromised"}]}], "who": [], "tags": [], "use_cases": ["react stack", "default project framework", "full-stack routing", "frontend libraries"], "compared": [{"slug": "next-js", "name": "Next.js", "co": 4, "switched_from": 0, "switched_to": 0}, {"slug": "astro", "name": "Astro", "co": 2, "switched_from": 0, "switched_to": 0}, {"slug": "react", "name": "React", "co": 2, "switched_from": 0, "switched_to": 0}, {"slug": "vite", "name": "Vite", "co": 2, "switched_from": 0, "switched_to": 0}], "makers": [{"id": 769635456, "item_id": 48102216, "url": "https://news.ycombinator.com/item?id=48102216", "by": "crutchcorn", "date": "2026-05-11", "version": null, "stance": "neutral", "quote": "We (TanStack) just released our postmortem about this.", "excerpt": "https://tanstack.com/blog/npm-supply-chain-compromise-postmortem We (TanStack) just released our postmortem about this.", "context": "", "use_case": "", "switched_from": "", "story": "TanStack NPM Packages Compromised"}], "threads": [{"url": "https://news.ycombinator.com/item?id=48100706", "title": "TanStack NPM Packages Compromised", "mentions": 3}, {"url": "https://news.ycombinator.com/item?id=49493018", "title": "Zod v4.5 adds schema compilation (3-9x faster validation)", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=49478178", "title": "Htmx 4.0", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=48398055", "title": "VoidZero Is Joining Cloudflare", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=48212242", "title": "Node.js 26.0.0 (Now with Temporal)", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=48216614", "title": "Nx Console VS Code extension was the initial access vector in the GitHub breach", "mentions": 1}], "sentiment_by_month": {"2025-11": {}, "2025-12": {"neutral": 1}, "2026-01": {"recommend": 1, "neutral": 1}, "2026-02": {}, "2026-03": {}, "2026-04": {"recommend": 1}, "2026-05": {"warn": 4, "recommend": 1}, "2026-06": {"neutral": 1}, "2026-07": {}, "2026-08": {"recommend": 1, "warn": 1}, "2026-09": {}, "2026-10": {}}, "versions": [], "version_unnamed": 0, "family_ref": null, "runs_on": null, "lines": [], "quotes": [{"id": 791899282, "item_id": 49493705, "url": "https://news.ycombinator.com/item?id=49493705", "by": "_the_inflator", "date": "2026-08-29", "version": null, "stance": "warn", "quote": "I stopped using TanStack because it got to meta for me and AI as well.", "excerpt": "Serious question: how widespread and actually used in production is Zod? Honestly, it made things worse for me. JavaScript isn\u2019t a statistical typed language and TypeScript already is something, where due to compiler issues I just use \u201cany\u201d. Zod has its conventions and JavaScript ain\u2019t Java. So Zod is also hard to read and debug. It is type conversion to type conversion - bloat, not JavaScript. Even Pydantic looks ta", "context": "", "use_case": "", "switched_from": "TanStack", "story": "Zod v4.5 adds schema compilation (3-9x faster validation)"}, {"id": 791761476, "item_id": 49485092, "url": "https://news.ycombinator.com/item?id=49485092", "by": "perardi", "date": "2026-08-28", "version": null, "stance": "recommend", "quote": "Zustand and TanStack and Vite", "excerpt": "I agree. We are moving away from HTMX at work, to React. (After we moved away from Angular. That was\u2026a choice\u2026that I didn\u2019t make.) Here\u2019s the thing: there\u2019s still a place for HTMX. Lots of places. But \u201cbuilding an SPA but not actually and SPA\u201d is not a lane for HTMX. Nor do they promote HTMX for that purpose. Really quite the opposite. Different tools for different jobs. (Me? I honestly love React, just a more minima", "context": "", "use_case": "React stack", "switched_from": "", "story": "Htmx 4.0"}, {"id": 774454544, "item_id": 48403409, "url": "https://news.ycombinator.com/item?id=48403409", "by": "tom1337", "date": "2026-06-04", "version": null, "stance": "neutral", "quote": "Lovable just switched to TanStack as a default project framework which uses Vite under the hood.", "excerpt": "Also Lovable just switched to TanStack as a default project framework which uses Vite under the hood. Lovable uses Cloudflare so they\u2019re probably deploying it via Cloudflare Workers.", "context": "", "use_case": "default project framework", "switched_from": "", "story": "VoidZero Is Joining Cloudflare"}, {"id": 771476225, "item_id": 48217264, "url": "https://news.ycombinator.com/item?id=48217264", "by": "chrisweekly", "date": "2026-05-20", "version": null, "stance": "recommend", "quote": "VoidZero (and TanStack, FWIW) are a breath of fresh air", "excerpt": "I mostly agree. But without argument, I can point out that a modern webapp requires tooling for capabilities like testing, linting, formatting, and bundling. Vite (and its ecosystem) has proven its mettle, and when it comes to being able to understand your dependencies, I'll take fewer, and simpler, and way faster, and more coherent, and more independent of misaligned corporate influence, every time. It's not even a ", "context": "", "use_case": "", "switched_from": "", "story": "Node.js 26.0.0 (Now with Temporal)"}, {"id": 771465841, "item_id": 48216615, "url": "https://news.ycombinator.com/item?id=48216615", "by": "vldszn", "date": "2026-05-20", "version": null, "stance": "warn", "quote": "supply-chain compromise on Tanstack, which leaked their GitHub credentials through the GitHub CLI (gh)", "excerpt": "Per security advisory on GitHub: Root Cause One of our developers was compromised by a recent supply-chain compromise on Tanstack, which leaked their GitHub credentials through the GitHub CLI (gh). This allowed the attacker to run workflows on our GitHub repository as a contributor. More links: https://github.com/nrwl/nx-console/security/advisories/GHSA-c9j4-9m59-847w https://www.stepsecurity.io/blog/nx-console-vs-co", "context": "", "use_case": "", "switched_from": "", "story": "Nx Console VS Code extension was the initial access vector in the GitHub breach"}, {"id": 771058960, "item_id": 48191185, "url": "https://news.ycombinator.com/item?id=48191185", "by": "darkwi11ow", "date": "2026-05-19", "version": null, "stance": "warn", "quote": "Last week when Tanstack got compromised", "excerpt": "I use Tanstack in my projects. Last week when Tanstack got compromised, it was only my laziness that saved me -- was thinking about doing pnpm upgrade but got lazy and played some dota... Finished game was just going to pnpm upgrade, opened hacker news and boom! news hit. Since then, I had set up libvirt/qemu based VM with another Linux running in it specifically for development. Now I run all of docker, kubernetes, ", "context": "", "use_case": "", "switched_from": "", "story": "Mini Shai-Hulud Strikes Again: 314 npm Packages Compromised"}, {"id": 769684384, "item_id": 48105274, "url": "https://news.ycombinator.com/item?id=48105274", "by": "d3ng", "date": "2026-05-12", "version": null, "stance": "warn", "quote": "TanStack messed this up in the way they explicitly cache.", "excerpt": "I take the above back. TanStack messed this up in the way they explicitly cache. This is run from the affected workflow: https://github.com/TanStack/config/blob/main/.github/setup/action.yml#L22-L23 The restore-key looks too wide and this still looks like an issue. This wide caching may also cause issue if they ever upgrade major nodejs version independently of OS, for example.", "context": "", "use_case": "", "switched_from": "", "story": "TanStack NPM Packages Compromised"}, {"id": 769635520, "item_id": 48102220, "url": "https://news.ycombinator.com/item?id=48102220", "by": "tannerlinsley", "date": "2026-05-11", "version": null, "stance": "warn", "quote": "", "excerpt": "Post Mortem: https://tanstack.com/blog/npm-supply-chain-compromise-postmortem", "context": "", "use_case": "", "switched_from": "", "story": "TanStack NPM Packages Compromised"}, {"id": 763214497, "item_id": 47700906, "url": "https://news.ycombinator.com/item?id=47700906", "by": "twohaibei", "date": "2026-04-09", "version": null, "stance": "recommend", "quote": "", "excerpt": "If you consider that, you might also want to take a look at Astro.js", "context": "", "use_case": "", "switched_from": "", "story": "We moved Railway's front end off Next.js. Builds went from 10 minutes to under 2"}, {"id": 747245805, "item_id": 46702862, "url": "https://news.ycombinator.com/item?id=46702862", "by": "rutagandasalim", "date": "2026-01-21", "version": null, "stance": "neutral", "quote": "tanstack", "excerpt": "yo, i\u2019m 17 and been building projects for a while. every \u201cnext big boilerplate\u201d i tried either broke, felt outdated, or forced me to rebuild the same stuff again and again. i\u2019d lose weeks wiring auth, payments, seo, and ai just to launch something simple. so i built my own \u2014 shipfree. it\u2019s a modern next.js saas boilerplate made for this new agentic + llm era. built on next.js / bun / drizzle / prisma / tailwind / str", "context": "", "use_case": "", "switched_from": "", "story": "I'm 17, built shipfree because every SaaS boilerplate I tried was trash"}, {"id": 746349617, "item_id": 46646851, "url": "https://news.ycombinator.com/item?id=46646851", "by": "mpeg", "date": "2026-01-16", "version": null, "stance": "recommend", "quote": "Astro and Tanstack are probably the best full-stack routers these days", "excerpt": "This is cool, I use astro when I just want to spin up a quick site without having to fight the framework (looking at you, Nextjs) and the main thing I disliked was the initiatives around paid extras they had going Astro and Tanstack are probably the best full-stack routers these days, and Astro wins in terms of the wide support for almost any client-side tech", "context": "", "use_case": "full-stack routing", "switched_from": "", "story": "Astro Joining Cloudflare"}, {"id": 737775171, "item_id": 46110948, "url": "https://news.ycombinator.com/item?id=46110948", "by": "octember", "date": "2025-12-01", "version": null, "stance": "neutral", "quote": "React + Tanstack", "excerpt": "Bevyl | Founding Engineer / AI Engineer | NYC/open to remote | https://bevyl.ai/ Bevyl is a pre-seed startup (team of 2) building AI-powered content creation tools for consumer brands. We're making it possible for brands to produce high-quality social media content at scale without agencies or massive creative teams. You'll work with me (CTO, ex-Airbnb/Loom/Hightouch) to build key parts of our video + AI tooling. Vid", "context": "", "use_case": "Frontend libraries", "switched_from": "", "story": "Ask HN: Who is hiring? (December 2025)"}]}