chore: modernize template builds, security, and dependencies

[KevinVandy]

🎯 Changes

Bring the starter repository up to the build and release conventions used by Table v9 and Hotkeys, so new libraries inherit the current setup.

• Configure all six package scaffolds as ES2022 ESM with declarations and Node >=20 support. Remove CommonJS, published source, and source maps while preserving the core ./types entry.
• Add strict publint and actual-tarball validation to PR/release checks, and enforce the existing size budget in full builds/tests.
• Update workspace dependencies with ncu -u -ws --root -x typescript: pnpm 12.6, Nx 23, tsdown 0.23, Vitest 5, Vite 8.3.1, React 19.3, and Store 0.11.1. Keep TypeScript 6.0.3. Align development/CI on Node 24.21.0 and remove the conflicting .npmrc Node pin.
• Migrate to Changesets CLI 3, action 2.1.2 with its renamed inputs/output, and the official GitHub changelog generator. Exclude private packages from versioning/tagging. Update and pin GitHub actions, including current TanStack/config shared actions with # main comments. This adopts the shared Vite+ setup.
• Document the defaults and regenerate reference docs. Document that this repository never releases packages or adds changesets. Gate release scaffolding behind the ENABLE_RELEASES repository variable for new libraries.

Security baseline additions:

• Add Zizmor with pinned actions, no write permissions, concurrency control, and a timeout; preserve provenance checks.
• Add CODEOWNERS for sensitive CI/build/dependency files, an importable branch-rules starter, and a security setup guide covering GitHub settings, scanners, private reporting, apps, Nx tokens, and npm trusted publishing.
• Scope release permissions to its job, explain each write permission, limit Nx tokens to test/build steps, and prevent newer pushes from canceling an active release.
• Configure Renovate action digest pinning, manual review of action updates, a one-day npm release delay, and the existing TypeScript hold. Resolve stale transitive ESLint/Vite peer constraints and lock preview tooling in the workspace instead of downloading an unpinned CLI in CI.
• Add CodeRabbit contributor/agent guidance, LF normalization, and broader .env.* exclusions while allowing example files.

Addresses the requested action-comment change: all shared action references carry # main, with their SHA updated to match the reviewed upstream branch revision.

GitHub settings are separate from scaffold files: the audit found no Template branch rulesets, disabled secret scanning/push protection/private reporting, and unconfigured CodeQL default setup. This PR supplies a setup guide and importable ruleset; it does not change live repository administration settings or claim those controls are enabled.

The pnpm policy exceptions are limited to the reviewed vite@8.3.1 patch release published today and the legacy semver@6.3.1 trust exception also used by Hotkeys.

Validation on Node 24.21.0: pnpm test and pnpm test:pr pass (35 main tasks plus lint); all four example builds/types, all six packed artifacts, root TypeScript/script lint, formatting, docs generation/link checks, and frozen install pass. Packed consumers pass Bundler and NodeNext type checks; core and ./types runtime imports pass on Node 20.0.0. An isolated fixture verified the scaffold’s Changesets 3 versioning; no changeset or version bump is included in this template repository. Core size is 1.57 kB against the 8 kB budget.

Security validation: Zizmor 1.30.1 online scan, Renovate 44.115.0 config validation, and dependency peer checks pass locally. GitHub CI passes on b6827ed: Test, Zizmor, provenance, preview publication, version preview, autofix, and Socket checks. The requested review change is addressed; reviewer reapproval remains pending.

✅ Checklist

• I have followed the steps in the Contributing guide.
• I have tested this code locally with pnpm run test:pr.

🚀 Release Impact

No release. This template repository never publishes packages or adds changesets.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 6819bead-aec6-4c2a-a01a-2df36416bfdc

📥 Commits

Reviewing files that changed from the base of the PR and between 617c8b7 and 6b14622.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (52)

• .changeset/config.json
• .github/pull_request_template.md
• .github/workflows/autofix.yml
• .github/workflows/pr.yml
• .github/workflows/release.yml
• .npmrc
• .nvmrc
• AGENTS.md
• CONTRIBUTING.md
• README.md
• TEMPLATE_GUIDE.md
• docs/framework/react/reference/functions/useTemplate.md
• docs/framework/react/reference/index.md
• docs/framework/solid/reference/functions/createTemplateSignal.md
• docs/framework/solid/reference/index.md
• docs/installation.md
• docs/reference/classes/Template.md
• docs/reference/functions/createTemplate.md
• docs/reference/index.md
• docs/reference/interfaces/TemplateOptions.md
• examples/react/basic/package.json
• examples/react/basic/tsconfig.json
• examples/react/devtools/package.json
• examples/react/devtools/tsconfig.json
• examples/solid/basic/package.json
• examples/solid/basic/tsconfig.json
• examples/solid/devtools/package.json
• examples/solid/devtools/tsconfig.json
• knip.json
• nx.json
• package.json
• packages/react-template-devtools/README.md
• packages/react-template-devtools/package.json
• packages/react-template-devtools/tsdown.config.ts
• packages/react-template/README.md
• packages/react-template/package.json
• packages/react-template/tsdown.config.ts
• packages/solid-template-devtools/README.md
• packages/solid-template-devtools/package.json
• packages/solid-template-devtools/tsdown.config.ts
• packages/solid-template/README.md
• packages/solid-template/package.json
• packages/solid-template/tsdown.config.ts
• packages/template-devtools/README.md
• packages/template-devtools/package.json
• packages/template-devtools/tsdown.config.ts
• packages/template/README.md
• packages/template/package.json
• packages/template/tsdown.config.ts
• pnpm-workspace.yaml
• scripts/verify-package.ts
• tsconfig.json

💤 Files with no reviewable changes (6)

• docs/reference/classes/Template.md
• .npmrc
• docs/reference/index.md
• docs/reference/functions/createTemplate.md
• docs/framework/solid/reference/index.md
• docs/framework/react/reference/index.md

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The pull request updates template packages to publish ES2022 ESM output with declarations and Node.js 20 support. It adds packed-package validation, updates repository tooling and examples, and changes release workflows, contributor guidance, and reference documentation.

Changes

Template package output and verification

Layer / File(s)	Summary
Package output and verification packages/*/package.json, packages/*/tsdown.config.ts, scripts/verify-package.ts, nx.json, package.json, tsconfig.json, docs/installation.md, TEMPLATE_GUIDE.md, README.md, packages/*/README.md	Template packages now specify direct ESM exports, .d.ts declarations, Node.js 20 minimums, and dist-only published files. Builds target ES2022 and disable source maps. test:build runs package checks, including tarball verification; CI scripts include the target. Documentation describes the package requirements and validation.
Repository and example toolchain .npmrc, .nvmrc, package.json, pnpm-workspace.yaml, knip.json, examples/react/*, examples/solid/*	The repository updates Node.js and pnpm settings, dependency versions, Knip schema, and workspace install policies. React and Solid examples update dependency ranges and use explicit ES2022 TypeScript settings.
Release configuration and repository rules .changeset/config.json, .github/pull_request_template.md, .github/workflows/*, AGENTS.md, CONTRIBUTING.md, TEMPLATE_GUIDE.md, README.md, packages/*/README.md	Changesets configuration uses the GitHub changelog generator and disables versioning and tagging for private packages. Workflows pin actions, restrict pull-request write permission to version preview, and gate releases on repository owner and ENABLE_RELEASES. Contributor and README guidance reflects the template repository’s release and versioning rules.
Reference documentation updates docs/reference/*, docs/framework/react/reference/*, docs/framework/solid/reference/*	Selected generated reference headings are removed, source links use package paths, and TemplateOptions.message is documented as optional.

Priority: ⬇️ Low

Estimated code review effort: 4 (Complex) | ~60 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to 6b146

The template updates appear mergeable after normal checks; no actionable blocking issue remains.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 7 files. (39 skipped: 3…	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly summarizes the main changes: modernizing build configuration, security controls, and dependencies.
Description check	✅ Passed	The description is complete and explains the changes, motivation, validation, checklist status, and lack of release impact. It follows the required section structure.

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 7 files. (39 skipped: 39 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🚀 Changeset Version Preview

No changeset entries found. Merging this PR will not cause a version bump for any packages.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​size-limit/​preset-small-lib@​12.1.0 ⏵ 14.0.0				+10
	@​tanstack/​typedoc-config@​0.3.3 ⏵ 0.3.4	+8			+7
	happy-dom@​20.9.0 ⏵ 20.14.5			+1	-1
	nx@​22.7.0 ⏵ 23.2.1	+9	+18
	@​tanstack/​react-store@​0.11.0 ⏵ 0.11.1	+1			+1
	@​tanstack/​solid-store@​0.11.0 ⏵ 0.11.1	+1			+6
	pkg-pr-new@​0.0.88
	@​tanstack/​store@​0.11.0 ⏵ 0.11.1				+1
	@​changesets/​cli@​2.31.0 ⏵ 3.0.3	+2		-25
	@​types/​react-dom@​19.3.0
	tinyglobby@​0.2.17
	@​types/​react@​19.2.14 ⏵ 19.3.0
	vitest@​4.1.5 ⏵ 5.0.1	+1	+2	+1
	@​faker-js/​faker@​10.4.0 ⏵ 10.6.0		+16
	@​types/​node@​12.20.55 ⏵ 26.6.2			+2
	publint@​0.3.18 ⏵ 0.3.24			+1	+5
	size-limit@​12.1.0 ⏵ 14.0.0	+1		+2	+1
	vite@​8.0.10 ⏵ 8.3.1		+18	+1
	markdown-link-extractor@​4.0.3 ⏵ 4.0.4	+1			+3
	react@​19.2.5 ⏵ 19.3.0	+1		+1
	sherif@​1.11.1 ⏵ 1.13.0	+1			-4
	tsdown@​0.21.10 ⏵ 0.23.0			+1	+1
	@​testing-library/​react@​16.3.2 ⏵ 16.3.3	+1
	react-dom@​19.2.3 ⏵ 19.3.0			+1
	prettier-plugin-svelte@​3.5.1 ⏵ 4.1.1
	@​vitejs/​plugin-react@​6.0.1 ⏵ 6.1.1			+1
	@​testing-library/​jest-dom@​6.9.1 ⏵ 7.0.1				+5
	knip@​6.6.3 ⏵ 6.38.0	+1		+1	+1
	@​changesets/​changelog-github@​1.0.1
	solid-js@​1.9.12 ⏵ 1.9.15	+1
	@​eslint-react/​eslint-plugin@​4.2.3 ⏵ 5.20.8	+1
	eslint@​10.2.1 ⏵ 10.11.0	+1
See 2 more rows in the dashboard

View full report

[pkg-pr-new]

More templates

• @tanstack/template-example-react-basic
• @tanstack/template-example-react-devtools
• @tanstack/template-example-solid-basic
• @tanstack/template-example-solid-devtools

@tanstack/react-template

npm i https://pkg.pr.new/TanStack/template/@tanstack/react-template@6

@tanstack/react-template-devtools

npm i https://pkg.pr.new/TanStack/template/@tanstack/react-template-devtools@6

@tanstack/solid-template

npm i https://pkg.pr.new/TanStack/template/@tanstack/solid-template@6

@tanstack/solid-template-devtools

npm i https://pkg.pr.new/TanStack/template/@tanstack/solid-template-devtools@6

@tanstack/template

npm i https://pkg.pr.new/TanStack/template/@tanstack/template@6

@tanstack/template-devtools

npm i https://pkg.pr.new/TanStack/template/@tanstack/template-devtools@6

commit: b6827ed