iframe-proxy

maximilian-hammerl · 2026-09-25T14:37:41Z

🎯 Changes

Fixes #11639. I added the necessary overloads, so that options that useQuery accepts are also accepted by ensureQueryData, fetchQuery and prefetchQuery, as in 5.102.8.

✅ Checklist

I have followed the steps in the Contributing guide.
I have tested code changes locally with pnpm run test:pr, or these tests do not apply to this pull request.
I have followed the AI contribution policy and fully understand the code in this pull request, including any code generated with AI assistance.

🚀 Release Impact

This change affects published code, and I have generated a changeset.

Summary by CodeRabbit

New Features
- Vue Query client methods now accept reactive query options, including options with conditional query functions.
- query, ensureQueryData, fetchQuery, and prefetchQuery retain their expected return types when using these options.

…', 'fetchQuery' and 'prefetchQuery' again

…e, ensureQueryData returns the cached type, and fetchQuery returns the cached type

coderabbitai · 2026-09-25T14:39:11Z

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: TanStack/query/.coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 71823aa9-7c93-440b-a19d-e6fa84cdb5cf

📥 Commits

Reviewing files that changed from the base of the PR and between 9ff2ee3 and 2c6142f.

📒 Files selected for processing (3)

.changeset/vue-query-client-use-query-options.md
packages/vue-query/src/__tests__/queryClient.test-d.ts
packages/vue-query/src/queryClient.ts

Included review availability: Your plan provides up to 10 included reviews per hour; 9 remain after this review.

📝 Walkthrough

Walkthrough

The Vue QueryClient restores deprecated UseQueryOptions overloads for query, ensureQueryData, fetchQuery, and prefetchQuery. The methods continue to deep-unref options before delegation. Type tests cover reactive options and result types.

Changes

Vue QueryClient option compatibility

Layer / File(s)	Summary
Restore options overloads and validate types `packages/vue-query/src/queryClient.ts`, `packages/vue-query/src/__tests__/queryClient.test-d.ts`, `.changeset/vue-query-client-use-query-options.md`	The four methods add deprecated `UseQueryOptions` overloads and accept those options in their implementations. Type tests check reactive options, promise result types, and selected-data behavior. A patch changeset records the compatibility restoration.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix · Severity of issue fixed: Medium

Suggested reviewers: sukvvon

Merge Risk: ⚪ Minimal · up to 2c614

No actionable merge-blocking issue is established. Run the type tests as part of normal validation before merging.

Security Architecture Review

Security architecture risk: 🔵 Low · up to 2c614

The restored overloads use the existing execution path, but they also accept an enabled option that does not stop an imperative call from fetching. This is a conditional risk for callers that mistake it for an execution guard; no privileged exposure was established.

Retained concerns

Low · security · inferred: Restored overloads accept observer options containing enabled, but the imperative methods can still fetch and populate the cache when enabled is false. A downstream caller treating that option as an authorization or consent gate could initiate an unintended request; no such caller or privileged sink is evidenced here.

Security review details

Security Blast Radius

inferred — Any unintended fetch depends on a downstream application calling an imperative method with a query function and relying on enabled to suppress it. The inspected change adds no new credential, cross-service dependency, or alternate cache owner.

Security Findings and Attack Paths

inferred — A conditional path exists if application-controlled state sets enabled to false while application code passes the options to an imperative method: that method may still execute its supplied query function. The evidence does not identify an attacker-controlled caller, sensitive destination, or authorization bypass in a consuming application.

Trust Boundaries and Controls

observed — Deep-unref normalization and query-core execution remain the relevant boundaries. enabled describes observer automatic-refetch behavior, not a check in the imperative core paths.

Hardening Proposals

proposed — Clarify that enabled is not an imperative execution or authorization guard. Callers handling sensitive queries should check the relevant authorization or consent condition before invoking these methods.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and specifically summarizes the main change: restoring UseQueryOptions support for the four Vue Query client methods.
Description check	✅ Passed	The description follows the required template, explains the change and motivation, completes all checklist items, and documents the release impact with a changeset.
Linked Issues check	✅ Passed	The change meets the coding requirements in [`#11639`]. `QueryClient` adds `UseQueryOptions` overloads for `ensureQueryData`, `fetchQuery`, and `prefetchQuery`. It also adds the related `query` overload…
Out of Scope Changes check	✅ Passed	The changed files are limited to the Vue Query client overloads, related type tests, and a patch changeset. The `query` overload uses the same `UseQueryOptions` compatibility fix as the directly requi…
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 2…

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create a new PR

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

DogPawHat · 2026-10-08T13:55:46Z

+    return super.query(
+      cloneDeepUnref(
+        options as MaybeRefDeep<
+          QueryExecuteOptions<
+            TQueryFnData,
+            TError,
+            TData,
+            TQueryData,
+            TQueryKey,
+            TPageParam
+          >
+        >,
+      ),
+    )


If were doing a cast here, that indicates to me that QueryExecuteOptions is where we should fix this not in just the vue adapter.

maximilian-hammerl added 2 commits September 25, 2026 16:30

fix(vue-query): accept 'UseQueryOptions' in 'query', 'ensureQueryData…

3bb5e71

…', 'fetchQuery' and 'prefetchQuery' again

Three additional tests to check that query() returns the selected typ…

2c6142f

…e, ensureQueryData returns the cached type, and fetchQuery returns the cached type

DogPawHat reviewed Oct 8, 2026

View reviewed changes

Sunbelt Computer Software

PL/B Language Development and Support

Navigation Menu

Repository navigation

fix(vue-query): accept 'UseQueryOptions' in 'query', 'ensureQueryData', 'fetchQuery' and 'prefetchQuery' again - #11644

fix(vue-query): accept 'UseQueryOptions' in 'query', 'ensureQueryData', 'fetchQuery' and 'prefetchQuery' again#11644
maximilian-hammerl wants to merge 2 commits into
TanStack:mainfrom
maximilian-hammerl:main

maximilian-hammerl commented Sep 25, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Sep 25, 2026 •

edited

Loading

Walkthrough

Changes

Uh oh!

DogPawHat Oct 8, 2026

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Sunbelt Computer Software

PL/B Language Development and Support

Conversation

maximilian-hammerl commented Sep 25, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🎯 Changes

✅ Checklist

🚀 Release Impact

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Sep 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Security Architecture Review

Uh oh!

DogPawHat Oct 8, 2026

Choose a reason for hiding this comment

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

maximilian-hammerl commented Sep 25, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Sep 25, 2026 •

edited

Loading