chore(node & ts): update node and ts

[harry-whorlow]

Updates node to v26, bumps Ts, and angular is also updated due to dependancy conflicts.

I took the liberty to migrate to the Vite-angular tooling after angular-devkit/build-angular was deprecated.

Summary by CodeRabbit

• Documentation
  • Updated framework references to show optional selectors and comparison options where applicable, and corrected source links and API signatures.
  • Clarified reference documentation for observer callbacks, store properties, and subscription types.
• Chores
  • Updated example projects and development tools, including Angular 22 and TypeScript 6.0.3.
  • Updated the recommended Node.js and pnpm versions.
  • Migrated Angular examples to current build tooling while preserving their existing build and serve settings.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 86227e3

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[changeset-bot]

⚠️ No Changeset found

Latest commit: c1a40d4

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[coderabbitai]

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

• Configuration used: Repository: TanStack/store/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: 2b22349c-3bdc-4ce7-87bb-0cdb7403762e

---

📥 Commits

Reviewing files that changed from the base of the PR and between 7445a28 and 86227e3.

---

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

---

📒 Files selected for processing (9)

• .changeset/config.json
• .github/workflows/autofix.yml
• .github/workflows/pr.yml
• .github/workflows/release.yml
• .github/workflows/zizmor.yml
• package.json
• packages/store/package.json
• packages/vue-store/package.json
• pnpm-workspace.yaml

---

 _______________________________________
< CI/CD: Carrots In / Defects Canceled. >
 ---------------------------------------
  \
   \   (\__/)
       (•ㅅ•)
       / 　 づ

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 0bf21e1a-ae64-44dc-a3a2-49718df11ef2

---

📥 Commits

Reviewing files that changed from the base of the PR and between 1f90d1f and 7445a28.

---

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

---

📒 Files selected for processing (6)

• docs/framework/angular/reference/interfaces/InjectSelectorOptions.md
• examples/octane/atoms/package.json
• examples/octane/simple/package.json
• examples/octane/store-actions/package.json
• examples/octane/store-context/package.json
• examples/octane/stores/package.json

---

🚧 Files skipped from review as they are similar to previous changes (1)

• docs/framework/angular/reference/interfaces/InjectSelectorOptions.md

---

Included review availability: This review used your included allowance. Your plan provides up to 4 included reviews per hour; 3 remain after this review.

---

---

📝 Walkthrough

Walkthrough

Framework and core API references now document optional parameters and properties, revised headings and type formatting, and corrected source links. Repository and example configurations also update Node.js, pnpm, framework dependencies, and Angular builders.

Changes

API Reference Documentation

Layer / File(s)	Summary
Framework API references docs/framework/*/reference/**	Framework references document optional selectors and options, update source links to packages/..., and revise headings and type formatting.
Core API references docs/reference/classes/*, docs/reference/functions/*, docs/reference/interfaces/*, docs/reference/type-aliases/*	Core references document optional observer callbacks and internal atom properties, adjust callback type formatting, and remove parentheses from property headings.

Toolchain and Framework Example Updates

Layer / File(s)	Summary
Root runtime and package manager .nvmrc, package.json	The Node.js version changes to 26.10.0, and the pnpm requirement changes to 11.28.5. Root development dependency versions are updated.
Angular 22 dependencies and builders .gitignore, examples/angular/*/angular.json, examples/angular/*/package.json, packages/angular-store/package.json, packages/store/package.json	Angular example dependencies are upgraded to version 22.2.1, and build targets use @angular/build builders. Angular package development dependencies and ignore rules are also updated.
Other framework example dependencies examples/octane/*/package.json, examples/preact/*/package.json, examples/solid/*/package.json, examples/svelte/*/package.json, examples/vue/*/package.json	Octane examples update the TypeScript plugin and TypeScript. Preact examples update @types/node and TypeScript. Solid, Svelte, and Vue examples update TypeScript.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~15 minutes

Change: Other

Suggested reviewers: kevinvandy

---

Merge Risk: ⚪ Minimal · up to 7445a

No new merge-blocking issue is established; the identified Angular test-target gaps were already present before this change.

Pre-merge checks | 4 | 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check		The description explains the Node.js, TypeScript, Angular, and tooling updates, but it omits the required template sections for the checklist and release impact. It also does not confirm local testing…	Add the required "## 🎯 Changes", "## ✅ Checklist", and "## 🚀 Release Impact" sections. Describe the motivation and scope, confirm whether the contributing guide was followed, state whether pnpm test:pr passed, and select the appropriate r…

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check		The title clearly identifies the Node.js and TypeScript updates, which are major changes in the pull request. It is concise and specific enough for repository history.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

---

Full details: Description check

Explanation

The description explains the Node.js, TypeScript, Angular, and tooling updates, but it omits the required template sections for the checklist and release impact. It also does not confirm local testing or changeset status.

Resolution

Add the required "## 🎯 Changes", "## ✅ Checklist", and "## 🚀 Release Impact" sections. Describe the motivation and scope, confirm whether the contributing guide was followed, state whether pnpm test:pr passed, and select the appropriate release-impact option.

---

---

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

---

---

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}

[nx-cloud]

View your CI Pipeline Execution ↗ for commit 86227e3

Command	Status	Duration	Result
nx affected --targets=test:sherif,test:knip,tes...	✅ Succeeded	28s	View ↗
nx run-many --target=build --exclude=examples/**	✅ Succeeded	<1s	View ↗

---

☁️ Nx Cloud last updated this comment at 2026-10-09 23:10:28 UTC

[pkg-pr-new]

@tanstack/angular-store

npm i https://pkg.pr.new/@tanstack/angular-store@378

@tanstack/lit-store

npm i https://pkg.pr.new/@tanstack/lit-store@378

@tanstack/octane-store

npm i https://pkg.pr.new/@tanstack/octane-store@378

@tanstack/preact-store

npm i https://pkg.pr.new/@tanstack/preact-store@378

@tanstack/react-store

npm i https://pkg.pr.new/@tanstack/react-store@378

@tanstack/solid-store

npm i https://pkg.pr.new/@tanstack/solid-store@378

@tanstack/store

npm i https://pkg.pr.new/@tanstack/store@378

@tanstack/svelte-store

npm i https://pkg.pr.new/@tanstack/svelte-store@378

@tanstack/vue-store

npm i https://pkg.pr.new/@tanstack/vue-store@378

commit: 86227e3

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​tanstack/​typedoc-config@​0.3.3 ⏵ 0.3.4	+8			+7
	nx@​22.7.10 ⏵ 23.3.0	-3
	@​angular/​platform-browser-dynamic@​21.2.8 ⏵ 22.2.2				+47
	@​changesets/​cli@​2.30.0 ⏵ 3.0.3	+2		-25
	@​angular/​platform-browser@​21.2.8 ⏵ 22.2.2	+23
	@​angular/​animations@​21.2.8 ⏵ 22.2.2				+47
	@​angular/​compiler-cli@​21.2.8 ⏵ 22.2.2	+20
	@​angular/​router@​21.2.8 ⏵ 22.2.2	+21	+16
	@​angular/​cli@​21.2.7 ⏵ 22.2.2	+13
	@​angular/​build@​21.2.7 ⏵ 22.2.2	+4
	@​angular/​compiler@​21.2.8 ⏵ 22.2.2	+21	+20
	@​angular/​core@​21.2.8 ⏵ 22.2.2	+19	+26		-1
	@​angular/​common@​21.2.8 ⏵ 22.2.2		+50		-1
	@​types/​node@​25.6.0 ⏵ 26.6.4	+1		+1
	publint@​0.3.18 ⏵ 0.3.25	+1		+1	+4
	sherif@​1.11.1 ⏵ 1.13.0	+1			-4
	@​tsrx/​typescript-plugin@​0.3.118 ⏵ 0.6.3	+16		+1	+1
	typescript@​6.0.2 ⏵ 6.0.3
	vue@​3.5.43
	knip@​6.4.0 ⏵ 6.40.0	+1		+1
	@​changesets/​changelog-github@​0.7.0 ⏵ 1.0.1	+1		+28	+2
	@​analogjs/​vite-plugin-angular@​2.6.4 ⏵ 2.8.0	+1		+1	+1
	eslint@​10.12.0 ⏵ 10.10.0				+1

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Priority	Alert  (click "▶" to expand/collapse)	Action
	High CVE: npm devalue: Repeated primitive strings cause quadratic expansion in uneval CVE: GHSA-mcm9-63f2-9j32 devalue: Repeated primitive strings cause quadratic expansion in uneval (HIGH) Affected versions: < 5.9.3 Patched version: 5.9.3 From: pnpm-lock.yaml → npm/svelte@5.55.7 → npm/octane@0.12.1 → npm/devalue@5.9.2 ℹ Read more on: This package | This alert | What is a CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/devalue@5.9.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	High CVE: npm devalue: `stringify`/`uneval` serialize shared memory CVE: GHSA-j22f-vq7h-c4qm devalue: stringify/uneval serialize shared memory (HIGH) Affected versions: >= 5.1.0 < 5.9.3 Patched version: 5.9.3 From: pnpm-lock.yaml → npm/svelte@5.55.7 → npm/octane@0.12.1 → npm/devalue@5.9.2 ℹ Read more on: This package | This alert | What is a CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/devalue@5.9.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	High CVE: npm source-map-js allows event-loop denial of service through indexed source-map section offsets CVE: GHSA-68fv-2mgg-jv7q source-map-js allows event-loop denial of service through indexed source-map section offsets (HIGH) Affected versions: >= 1.0.0 < 1.2.2 Patched version: 1.2.2 From: pnpm-lock.yaml → npm/@testing-library/svelte@5.3.1 → npm/@sveltejs/vite-plugin-svelte@7.0.0 → npm/@vitejs/plugin-vue@6.0.5 → npm/@vitejs/plugin-react@6.0.1 → npm/vue-tsc@3.2.6 → npm/@preact/preset-vite@2.10.5 → npm/eslint-plugin-svelte@3.17.0 → npm/vue@3.5.32 → npm/vite-plugin-solid@2.11.12 → npm/vite@7.3.2 → npm/jsdom@29.0.2 → npm/@vitest/coverage-istanbul@4.1.4 → npm/vitest@4.1.11 → npm/vite@8.3.0 → npm/vue@3.5.43 → npm/@analogjs/vite-plugin-angular@2.8.0 → npm/@angular/build@22.2.2 → npm/octane@0.12.1 → npm/@testing-library/vue@8.1.0 → npm/vue@2.7.16 → npm/source-map-js@1.2.1 ℹ Read more on: This package | This alert | What is a CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/source-map-js@1.2.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn

View full report