RC of Angular Adapter

[benjavicente]

🎯 Changes

Creates a prerelease of the Angular Adapter. It follow the same API, but has changes in the implementation to better support some edge cases present in the experimental version (better pending tasks support #9981, immediate updates #9735, invalidate the delayed subscription #9020, improved signal aliasing #7488, and remove shape that would easelly allowed accidentally sharing a query client between requests in SSR [Discord]).

This changes originated from PR #9893, that would also have introduced breaking changes, but has since then deviated a lot to resolve other reported issues while improving the internal shape of the adapter. The older Angular version supported is updated to Angular 20.1, matching the long term support. The update includes some additional features:

• Build in SSR support, that hydrates queries automatically, matching how Angular HTTP client works.
• toResource helper, to integrate queries into new Angular APIs like SIgnal Forms
• injectQueries support
• Dynamic filtering for injectIsFetching and injectIsMutating
• Persist client, that works with SSR

It removed deprecated APIs of the experimental package, imrpoves some consistency issues (like the missing dynamic filters and options that accepted 2 different shapes), and moved the devtools to a separate package matching other adapters.

Made as a prerelease targeting the release as @tanstack/angular-query@5.0.0-rc (similar on how the Solid 2.0 adapter), to match the version of the other adapters and how it is displayed in the docs, while not publishing a stable package yet. The experimental adapter isn't changed since it has been too "stable".

AI was used to help to write code, but it was heavelly reviewed.

✅ Checklist

• I have followed the steps in the Contributing guide.
• I have tested code changes locally with pnpm run test:pr, or these tests do not apply to this pull request.
• I fully understand the code in this pull request, including any code generated with AI assistance.

🚀 Release Impact

• This change affects published code, and I have generated a changeset.
• This change is docs/CI/dev-only (no release).

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​types/​express@​5.0.6
	@​angular/​platform-browser@​20.3.18 ⏵ 22.1.6	+23
	@​angular/​ssr@​22.1.8
	@​angular/​compiler-cli@​20.3.18 ⏵ 22.1.6	+20
	@​angular/​router@​20.3.18 ⏵ 22.1.6	+21
	@​angular/​platform-server@​22.1.6
	@​angular/​forms@​20.3.18 ⏵ 22.1.6	+21		+1
	@​angular/​cli@​20.3.22 ⏵ 22.1.8	+16		+1	+1
	@​angular/​build@​20.3.22 ⏵ 22.1.8	-3			-1
	@​angular/​compiler@​20.3.18 ⏵ 22.1.6	+20	+20		+2
	@​angular/​core@​20.3.18 ⏵ 22.1.6	+18	+26	-1
	@​angular/​common@​20.3.18 ⏵ 22.1.6		+50
	@​schematics/​angular@​20.3.22 ⏵ 22.1.8	+21			+1
	zone.js@​0.15.0 ⏵ 0.16.1	+12			-1
	@​analogjs/​vite-plugin-angular@​2.5.2
	@​angular-devkit/​schematics@​20.3.22 ⏵ 22.1.8				+1

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm lmdb is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → npm/@angular/build@22.1.8 → npm/lmdb@3.5.6 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/lmdb@3.5.6. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		High CVE: Vite: server.fs.deny bypassed with queries CVE: GHSA-v2wj-q39q-566r Vite: server.fs.deny bypassed with queries (HIGH) Affected versions: >= 8.0.0 < 8.0.5; >= 7.1.0 < 7.3.2 Patched version: 7.3.2 From: pnpm-lock.yaml → npm/@angular/build@22.1.8 → npm/vite@7.1.11 ℹ Read more on: This package | This alert | What is a CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/vite@7.1.11. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[TkDodo]

have you set the libs to 4.0 and the changeset to major so that we get a 5.x then? I’m not sure if that will work 🤷

[benjavicente]

Yes 😅

It doesn't seem to be a check for verifying 4.0 exists (or any existing published version). Audited that plan with Astra, it had an issue with the versioning group fixed in the new commit, it only seems to consider those groups versions to create the prerelease.