Config
The package-maintenance contract behind TanStack.
TanStack Config collects the lint, build, monorepo, preview, versioning, and publishing conventions used to keep a large open-source package family moving together.
configuration surface
eslint.config.js
maintained by
@tanstack/eslint-config
resulting contract
flat config · shared rules
Consumer boundary
The tarball is the product. Source is only its input.
Consumers receive exports, JavaScript, declarations, metadata, and documentation—not your repository. The conventions keep that package boundary reviewable and use package checks such as publint before a release reaches npm.
Build inputs and release machinery stay visible to maintainers.
changed package
router-core
lint · test · build
react-router
lint · test · build
start
lint · test · build
Nx affected + task cache
pkg-pr-new preview
Monorepo economics
A pull request should pay only for what it can affect.
Nx connects package dependencies to affected lint, test, and build tasks, then reuses cached work. pkg-pr-new closes the feedback loop by turning a pull request into packages maintainers can install before merging.
Release trust
Release intent is reviewed. Publish credentials are temporary.
Changesets record package-level release intent in the pull request. The release workflow turns that intent into versions and changelogs, while npm trusted publishing can exchange GitHub’s OIDC identity for short-lived publish access with provenance.
- 1
Pull request
changeset records intent
- 2
Release workflow
versions + changelogs
- 3
GitHub OIDC
job proves identity
- 4
npm
short-lived access + provenance
No long-lived npm token has to be stored in the repository.