Post

In many of my comms about the TanStack attack, I mentioned a list we published to keep us accountable. But I only realized that this was removed between the draft I saw and the public publication. We'll have this all in a blog post very soon, but 🧵 on what we're fixing

- [x] Enforced non-SMS GitHub 2FA (NPM & GitHub 2FA was already enforced, but SMS was previously allowed) - [x] Removed all usage of `pull_request_target` from our CI pipeline (already wasn't in our CD) - [x] Upgraded all repos to use PNPM 11 to ensure ecosystem install cooldown

- [ ] Are introducing `zizmor` as action linting to every repo via a PR check - [ ] Are likely introducing `CODEOWNERS` on `.github` folders to restrict merging to only the 7 core maintainers

- [ ] Will replace the PNPM setup cache with `actions/cache/restore`, w/ more secure defaults - [ ] Will replace the PNPM setup cache to be isolated between release and PR envs - [ ] May close the ability to make a TanStack PR as an external contributor (But we're absolutely not going closed source)

Thanks so much Corbin, you guys are handling this really well. 🙏 couldn't ask for more

Appreciate it Corbin. Re: the closing off of external PRs, what's do you plan to do with existing PRs? I assume such a policy would be across all the Tanstack PRs?