Post

In many of my comms about the TanStack attack, I mentioned a list we published to keep us accountable. But I only realized that this was removed between the draft I saw and the public publication. We'll have this all in a blog post very soon, but 🧵 on what we're fixing

- [x] Enforced non-SMS GitHub 2FA (NPM & GitHub 2FA was already enforced, but SMS was previously allowed) - [x] Removed all usage of `pull_request_target` from our CI pipeline (already wasn't in our CD) - [x] Upgraded all repos to use PNPM 11 to ensure ecosystem install cooldown

- [ ] Are introducing `zizmor` as action linting to every repo via a PR check - [ ] Are likely introducing `CODEOWNERS` on `.github` folders to restrict merging to only the 7 core maintainers

- [ ] Will replace the PNPM setup cache with `actions/cache/restore`, w/ more secure defaults - [ ] Will replace the PNPM setup cache to be isolated between release and PR envs - [ ] May close the ability to make a TanStack PR as an external contributor (But we're absolutely not going closed source)

Hopefully this shows that we're taking this incident very seriously and are working hard on adding resilience measures to fix our processes. Please don't hesitate to let us know if there's more you think we can be doing. We're listening.

Appreciate it Corbin. Re: the closing off of external PRs, what's do you plan to do with existing PRs? I assume such a policy would be across all the Tanstack PRs?