@tanstack/start-server-core

Patch Changes

• Render generated script preloads (modulepreload, or preload as="script" for IIFE output) with fetchPriority="low" and forward it into static Early Hints, so they no longer compete with render-blocking stylesheets, fonts and images.

Patch Changes

• Skip request middleware bookkeeping when no request middleware is configured, and stop copying serialization adapters when the router adds none.

  Server route handlers and route middleware now receive the router's decoded pathname, the same one used for route matching. Characters that would change how the path is read, such as %2F, %3F, and %23, stay encoded.

• Reuse the parsed request location during SSR instead of repeating input rewrites. Match server routes against the app router's parsed pathname while preserving encoded pathnames for server handlers and middleware.

Patch Changes

• Return 400 Bad Request for malformed percent-encoded request pathnames before running server entry callbacks. Preserve valid encoded paths and query handling.

• Reduce request middleware overhead, reuse loaded entries and transport header requirements, and avoid unnecessary URL normalization for server functions. Preserve response helper writes made during body cancellation and SSR cleanup.

  Avoid allocating absent middleware headers and reply context, and construct RPC redirects with their final response state. Preserve middleware accessor evaluation and the documented undefined value for absent sendContext.

  Reduce synchronous server-function response overhead while preserving cancellation cleanup and middleware response mutations.

• Keep streaming a page when request middleware returns a response that reads the page body, such as a copy made through a wrapped global Response, a copy in Bun, or a body piped through a transform. Start now disposes a replaced page stream only when nothing reads it. transferResponseBodyOwnership is removed: return the derived response directly.

• Let request middleware read the body of a HEAD response, and strip it when the response leaves the pipeline. Start no longer applies Content-Encoding, Content-Length, or other framing headers set through response helpers to error bodies and serialized server-function replies that it builds itself. A response that middleware assigns to result.response is now disposed when the middleware returns another response.

• removed

  Remove the built-in useSession API. Applications choose a session library, such as iron-session, and save or destroy sessions explicitly before returning or redirecting. Connect a cookie adapter through getCookie and setCookie, or append serialized cookies with appendResponseHeader('set-cookie', cookie). Existing session cookies require a deliberate migration or signing in again with a new cookie name.

  createServerEntry keeps the complete callback, including custom error handling, inside the request context and converts errors that escape it. The built-in entry still converts errors automatically. Raw createStartHandler handlers now rethrow the original error. For custom reporting, catch inside createServerEntry, then rethrow for default conversion or return handleStartError(error) to preserve response-helper status, headers, and cookies. Return an explicit Response when choosing a custom error payload.

  Response helpers now apply consistently across server routes, SSR, server functions, redirects, errors, and middleware response replacements. Helper setters override returned values; cookie helpers preserve independent cookies and replace matching cookie identities. Use appendResponseHeader('set-cookie', cookie) when adding a serialized cookie without replacing other cookies. Changed responses receive copied headers and reuse the body stream, so applications should inspect the response returned by Start rather than relying on mutation of the original response.