[kamsz]

Lockfile only: @vitejs/plugin-rsc 0.5.27 -> 0.5.39 (transitive via vocs), plus its own dependencies.

Routine dependency upgrade.

Checks: frozen install, pnpm check and check:types pass.

[claude]

I reviewed this lockfile-only bump and didn't find any bugs. It's still worth a human look: the bump also affects the app's own @ tanstack/react-start, not just the vocs dependency.

What was reviewed:

• Lockfile consistency: every new version (plugin-rsc 0.5.39, es-module-lexer 3.0.4, magic-string 1.4.5, srvx 1.0.8, strip-literal 4.0.0, js-tokens 10.0.0, turbo-stream 3.2.1) has both a packages entry and a snapshots entry. Old versions that other packages still use (es-module-lexer 2.3.2, magic-string 0.30.21, strip-literal 3.1.0, srvx 1.0.5) are kept, and obug 3.0.0 was already in the lockfile.
• Peer wiring: @ tanstack/react-start-rsc 0.1.63 requires @ vitejs/plugin-rsc >=0.5.30. Version 0.5.27 didn't satisfy that range and 0.5.39 does, so pnpm now links plugin-rsc as an optional peer into the app's react-start. The PR description doesn't mention this. vite.config.ts calls tanstackStart() without RSC enabled, so I expect no build change, but I couldn't confirm that by reading alone.
• The react-start patch_hash is unchanged. The patch only edits dist/default-entry/esm/server.js, so the new peer resolution doesn't affect it. Not done here: frozen install, pnpm check/check:types, and the test suites.

Extended reasoning...

Only pnpm-lock.yaml changes. It moves @ vitejs/plugin-rsc from 0.5.27 to 0.5.39, which brings in four transitive major-version bumps and adds that package as an optional peer of the root app's patched @ tanstack/react-start and react-start-rsc. There is no application code change. The supply-chain surface is new third-party package versions, and the integrity hashes can't be checked by reading. I deferred because, besides the vocs path the description names, the bump changes peer resolution for the app's main framework package, and the claimed checks (frozen install, type checks) weren't run in this review.

[claude]

LGTM. This is a lockfile-only dependency bump plus a CI runner pin.

What was reviewed:

• The pnpm-lock.yaml changes for @ vitejs/plugin-rsc 0.5.27 -> 0.5.39. They are internally consistent: every new transitive package (es-module-lexer 3.0.4, magic-string 1.4.5, srvx 1.0.8, strip-literal 4.0.0, js-tokens 10.0.0, turbo-stream 3.2.1) has both a packages entry and a snapshots entry, and obug 3.0.0 was already in the lockfile.
• plugin-rsc now resolves as an optional peer of @ tanstack/react-start and react-start-rsc. vite.config.ts calls tanstackStart() without enabling RSC, so this only links the package and does not change how the app is configured. The react-start patch_hash is unchanged.
• In check.yml, only the E2E job moves to ubuntu-24.04. The other jobs stay on ubuntu-latest, which matches the Playwright reason given in the new comment.

Extended reasoning...

The change touches pnpm-lock.yaml (an upgrade of @ vitejs/plugin-rsc, which comes in through vocs, and its own dependencies) and the runs-on line of the E2E job in .github/workflows/check.yml. No package.json or application source changes, and no auth, payment or data-handling code is touched. The lockfile entries are consistent, and RSC is not enabled in vite.config.ts, so the new optional-peer link to TanStack Start is inert. The repo has no CODEOWNERS file and the timeline shows no outstanding change requests.

[github-actions]

The latest Tipbot preview deployment for c1fd504

Name	Status	Preview	Updated (UTC)
pr109	Shut Down	pr109.tip.bot	Nov 8, 2026, 6:56 PM