Post

In many of my comms about the TanStack attack, I mentioned a list we published to keep us accountable. But I only realized that this was removed between the draft I saw and the public publication. We'll have this all in a blog post very soon, but 🧵 on what we're fixing

- [ ] Are introducing `zizmor` as action linting to every repo via a PR check - [ ] Are likely introducing `CODEOWNERS` on `.github` folders to restrict merging to only the 7 core maintainers

- [ ] Will replace the PNPM setup cache with `actions/cache/restore`, w/ more secure defaults - [ ] Will replace the PNPM setup cache to be isolated between release and PR envs - [ ] May close the ability to make a TanStack PR as an external contributor (But we're absolutely not going closed source)

Hopefully this shows that we're taking this incident very seriously and are working hard on adding resilience measures to fix our processes. Please don't hesitate to let us know if there's more you think we can be doing. We're listening.