Skip to content

feat(marko-virtual): post-release follow-ups: full option parity, streaming SSR Support with Resume, typed handles, e2e coverage, examples#1219

Open
defunkt-dev wants to merge 2 commits into
TanStack:mainfrom
defunkt-dev:main
Open

feat(marko-virtual): post-release follow-ups: full option parity, streaming SSR Support with Resume, typed handles, e2e coverage, examples#1219
defunkt-dev wants to merge 2 commits into
TanStack:mainfrom
defunkt-dev:main

Conversation

@defunkt-dev

@defunkt-dev defunkt-dev commented Jul 5, 2026

Copy link
Copy Markdown
Contributor

marko-virtual:

SSR + Streaming support, full option parity, typed handles, 12 new examples, e2e coverage, canonical Marko packaging

Follow-up to the initial @tanstack/marko-virtual [PR#1156](#1156), covering the review follow-ups
and everything found while hardening. packages/virtual-core is untouched — this
PR is Marko-adapter-only. The file count (~260) is dominated by per-example
scaffolding (test suites, tsconfigs, generated route typings, per-example type-check
wiring) across 19 examples; the source-logic changes are concentrated in the two tags
and the example pages. Two commits: the follow-up feature/fix work, and the
packaging restructure to the canonical Marko library shape (details in §4).

1. SSR support (new architecture in the tags)

The tags are now SSR-safe by construction. On the server, a tag renders either an
empty container with the correct total height, or — when given initialRect — the
actual initial rows into the HTML, computed by a lightweight renderSlice pass
(no live virtualizer instance ever runs on the server). The live, observing instance
is built client-only on mount and takes over on resume ([MarkoJS](https://markojs.com/) v6 does not replay).

Consumer-facing consequence, visible in the 7 pre-existing examples' diffs: the
<let/mounted> + <lifecycle onMount> + <if=mounted> guard scaffolding is
deleted — nobody needs to hide the virtualizer from the server anymore. Those
pages also migrate to the [tag-variable API](https://markojs.com/docs/guide/marko-5-interop#tags-api-syntax) (<virtualizer/v .../>, self-closing),
the documented shape.

Streaming composes for free: a virtualizer inside a streamed <await> (with
<try>/<@placeholder>) renders its server slice into the mid-stream chunk and
resumes independently when that chunk arrives. This is a gated fact, not a claim:
the ssr-slice suite includes a raw-HTTP wire test asserting the placeholder flushes
first and the server-painted rows arrive in a later chunk. Documented with a full
pattern sample in the README and docs (including the out-of-order no-JS caveat).

2. Full option parity

Both tags accept the remaining core options: scrollMargin, enabled, isRtl,
isScrollingResetDelay, useScrollendEvent, useAnimationFrameWithResizeObserver,
laneAssignmentMode, useCachedMeasurements, debug, custom measureElement; the
window tag adds horizontal and initialOffset. Each option is proven by a
real-Chromium behavioral test in packages/marko-virtual/e2e/option-gates (a test
rig, excluded from publish via the files field).

3. Typed tag variables + type verification

The tag variables (/v) are typed by exported interfaces — VirtualizerHandle /
WindowVirtualizerHandle. The .d.marko declarations consumers see are build
output
(see §4) — generated by
[marko-type-check](https://github.com/marko-js/language-server/tree/main/packages/type-check),
never hand-written, never committed. pnpm test:types runs mtc in check-only mode
over the whole package (sources, tags, tests, fixtures). Every example additionally
has its own test:types script, so
pnpm -r --filter "./examples/marko/*" run test:types type-checks all 19 example
apps from the CLI.

4. Canonical Marko library packaging (per Marko team guidance)

The package now follows the structure of
marko-js/examples library, replacing the
initial hand-rolled setup:

  • marko.json is the one-liner { "exports": "./dist/tags" } — no tags-dir, no
    script-lang (both flagged in review as app-style config in a package).
  • pnpm build runs two tools: vite build for the plain-TS entry, then
    marko-type-check -p tsconfig.tags.json building the tags into dist/tags
    each tag's .marko with the TypeScript stripped, its generated .d.marko,
    and compiled helper .js/.d.ts. The tag build's incremental cache lives
    inside dist so any clean forces a re-emit (a stale cache outside the
    cleaned dir silently emits nothing).
  • files ships dist + marko.json + README only; raw src/tags no longer
    publishes; the committed .d.marko files and their generator script are retired.
  • In-repo consumers (the package's own test fixtures, and every example) resolve
    the tags from source via a small nested marko.json with tags-dir — full
    types, no build-order dependency — with the examples' tsconfigs include-ing the
    source tags (build-mode type-checking requires listing cross-package files).
  • Known limitation documented in the README: an open Marko language-tools issue
    makes installed-package tag types fail to load under pnpm's symlinked layout
    (falls back to a permissive read-only default); npm/yarn consumers and runtime
    behavior everywhere are unaffected; consumer stopgap node-linker=hoisted.

5. Twelve new examples (7 → 19)

  • padding, scroll-padding, sticky, table, pretext — one per core
    feature area (padding offsets, scroll padding, sticky headers, table semantics,
    calculated text heights via @chenglou/pretext).
  • chat — bottom-anchored messaging: anchorTo="end", followOnAppend,
    history prepends that keep the visible message anchored, near-top auto-load with
    a load-ahead trigger, and a real streamed reply over the network (marko-run
    +handler returning a chunked ReadableStream).
  • chat-pretext — chat rebuilt on calculated heights: prepends land with
    zero scroll correction at any width (the suite asserts the prepend landed AND
    produced at most the single compensation jump), and the streamed reply pushes its
    growing height through v.resizeItem per chunk (that API's first real consumer).
  • Five SSR examples covering the server-rendering matrix, each asserting resume
    behavior and raw view-source HTML in its suite:
    ssr (no fetch, empty container, rows on client), ssr-fetch (server fetch,
    client rows), ssr-slice (server fetch, rows in the server HTML via
    initialRect, plus the streaming wire gate), ssr-restore (server rows at a
    scroll offset
    ), window-ssr-slice (server rows for the window tag).

6. Tests

  • Unit (66): tags.test.ts expanded; new options.test.ts (option plumbing)
    and render-slice.test.ts (SSR seed math); fixtures updated + a new surface
    fixture.
  • Browser e2e for every example (19 suites) + the option-gate proofs. Suites
    share port 4173, so they run sequentially (command below).
  • Per-example CLI type checks (see §3).

7. Fixes

  • sideEffects corrected to ["**/*.marko"] (was false): Marko templates
    register their renderers and resume effects via module side effects, so
    sideEffects: false let production bundlers tree-shake a tag's client module on
    any page that uses the tag render-only (no function references) — the resume
    payload then points at registrations that never ran: TypeError: effects[(i++)] is not a function, zero hydration. Invisible in dev and to
    dev-mode suites; only surfaced by production-previewing a simple example.
    Note for maintainers: the published 3.14.x carries this bug — render-only
    consumers' prod builds are broken until this ships.
  • marko bumped to ^6.2.2: marko ≤6.1.9 had a production-only bug — rows in a
    keyed loop lose their subscription to a page-level signal — which broke the chat
    example's streamed reply in prod builds (text arrived and was stored, but never
    painted). Reproduced in a 25-line page with no TanStack code, bisected to the fix
    in marko 6.1.10, verified end-to-end here.
  • Chat: measured size estimate (74 → 88), history loads ~1.5 viewports ahead
    of the top (prepends land above the viewport; no hard-stop jolt), and
    overflow-anchor: none on the scroller (the virtualizer owns prepend
    compensation; native browser anchoring could double-compensate).
  • option-gates no longer depends on its ancestor package: the pnpm workspace
    symlink formed a directory cycle that crashed marko-run build (ENAMETOOLONG)
    via @marko/vite's production template scan.
  • TypeScript-strict cleanup across example pages (annotated closures to break
    tag-variable inference cycles, String(item.key) for <for by>, the
    second-parameter event-handler idiom instead of currentTarget, which Marko's
    delegated events reject at runtime).

8. Toolchain & workspace modernization

  • Examples moved to the current Marko stack: @marko/run ^0.7 → ^0.10,
    marko^6.2.2; package devDeps to @marko/vite ^6.1.0.
  • Example dependencies pinned to published versions (workspace:*^3.14.0) so
    any example folder works when copied out of the monorepo; each example also
    declares the @marko/type-check + @marko/language-tools pair (both are needed
    for the CLI type checks: pnpm exposes only a project's own bins, and
    language-tools needs its marko peer resolved from the declaring project).
  • @playwright/test aligned to the root's ^1.53.1 everywhere; sherif passes.
  • pnpm-workspace.yaml: single @marko/compiler (5.40.0) enforced via override
    (two compiler instances in the graph break taglib discovery — comment inline),
    plus the option-gates workspace entry.
  • Each example commits its .marko-run/routes.d.ts (marko-run's generated route
    typings) — same convention as marko-run's own examples: typed routes on a fresh
    clone, and route-surface changes show up in review.
  • .gitignore: **/*.tsbuildinfo (incremental-build cache from the new
    per-example tsconfigs).

9. Docs

docs/framework/marko/marko-virtual.md substantially expanded (full input
reference for both tags, SSR guide including streaming via <await> and the
no-JS caveat, TypeScript guide); the package README adds the build/packaging
story, the streaming section, the pnpm consumer limitation, and a
production-sanity note naming both manual canaries (a render-only example AND
the interactive chat); docs/installation.md gains the Marko section;
docs/config.json lists all 19 examples.

How to verify

pnpm install
pnpm --filter @tanstack/virtual-core build
pnpm --filter @tanstack/marko-virtual build
ls packages/marko-virtual/dist/tags   # stripped .marko + generated .d.marko per tag

# unit tests (66)
pnpm --filter @tanstack/marko-virtual exec vitest run

# type verification: the package, then every example app
pnpm --filter @tanstack/marko-virtual run test:types
pnpm -r --workspace-concurrency=1 --filter "./examples/marko/*" run test:types

# all 19 example browser suites (sequential — shared port)
npx playwright install chromium   # one-time
pnpm -r --workspace-concurrency=1 --filter "./examples/marko/*" run test:e2e

# option-gate behavioral proofs
cd packages/marko-virtual/e2e/option-gates && npm run test:e2e && cd -

# workspace lint + published-shape check
pnpm run test:sherif
pnpm --filter @tanstack/marko-virtual run test:build

# production sanity — BOTH canaries:
# render-only (the sideEffects fix, §7 — rows must appear):
pnpm --filter tanstack-marko-virtual-example-fixed build
PORT=3000 pnpm --filter tanstack-marko-virtual-example-fixed preview
# interactive (the marko 6.2.2 fix — reply streams into the bubble live):
pnpm --filter tanstack-marko-virtual-example-chat build
PORT=3000 pnpm --filter tanstack-marko-virtual-example-chat preview

✅ Checklist

🚀 Release Impact

@defunkt-dev defunkt-dev requested a review from a team as a code owner July 5, 2026 23:50
@coderabbitai

coderabbitai Bot commented Jul 5, 2026

Copy link
Copy Markdown

Important

Review skipped

Too many files!

This PR contains 196 files, which is 46 over the limit of 150.

To get a review, narrow the scope:
• coderabbit review --type committed # exclude uncommitted changes
• coderabbit review --dir # limit to a subdirectory
• coderabbit review --base # compare against a closer base

Upgrade to a paid plan to raise the limit.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 66b699ba-2077-41fb-abf9-293b38f163a8

📥 Commits

Reviewing files that changed from the base of the PR and between e2cb096 and 81a6731.

⛔ Files ignored due to path filters (1)
  • pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml
📒 Files selected for processing (196)
  • .changeset/marko-virtual-followups.md
  • .gitignore
  • docs/config.json
  • docs/framework/marko/marko-virtual.md
  • docs/installation.md
  • examples/marko/chat-pretext/.marko-run/routes.d.ts
  • examples/marko/chat-pretext/e2e/README.md
  • examples/marko/chat-pretext/e2e/chat-pretext.spec.ts
  • examples/marko/chat-pretext/marko.json
  • examples/marko/chat-pretext/package.json
  • examples/marko/chat-pretext/playwright.config.ts
  • examples/marko/chat-pretext/src/routes/+page.marko
  • examples/marko/chat-pretext/src/routes/api/reply/+handler.ts
  • examples/marko/chat-pretext/tsconfig.json
  • examples/marko/chat-pretext/vite.config.ts
  • examples/marko/chat/.marko-run/routes.d.ts
  • examples/marko/chat/e2e/README.md
  • examples/marko/chat/e2e/chat.spec.ts
  • examples/marko/chat/marko.json
  • examples/marko/chat/package.json
  • examples/marko/chat/playwright.config.ts
  • examples/marko/chat/src/routes/+page.marko
  • examples/marko/chat/src/routes/api/reply/+handler.ts
  • examples/marko/chat/tsconfig.json
  • examples/marko/chat/vite.config.ts
  • examples/marko/dynamic/.marko-run/routes.d.ts
  • examples/marko/dynamic/e2e/dynamic.spec.ts
  • examples/marko/dynamic/marko.json
  • examples/marko/dynamic/package.json
  • examples/marko/dynamic/playwright.config.ts
  • examples/marko/dynamic/src/routes/+page.marko
  • examples/marko/dynamic/tsconfig.json
  • examples/marko/fixed/.marko-run/routes.d.ts
  • examples/marko/fixed/e2e/fixed.spec.ts
  • examples/marko/fixed/marko.json
  • examples/marko/fixed/package.json
  • examples/marko/fixed/playwright.config.ts
  • examples/marko/fixed/src/routes/+page.marko
  • examples/marko/fixed/tsconfig.json
  • examples/marko/grid/.marko-run/routes.d.ts
  • examples/marko/grid/e2e/grid.spec.ts
  • examples/marko/grid/marko.json
  • examples/marko/grid/package.json
  • examples/marko/grid/playwright.config.ts
  • examples/marko/grid/src/routes/+page.marko
  • examples/marko/grid/tsconfig.json
  • examples/marko/infinite-scroll/.marko-run/routes.d.ts
  • examples/marko/infinite-scroll/e2e/infinite-scroll.spec.ts
  • examples/marko/infinite-scroll/marko.json
  • examples/marko/infinite-scroll/package.json
  • examples/marko/infinite-scroll/playwright.config.ts
  • examples/marko/infinite-scroll/src/routes/+page.marko
  • examples/marko/infinite-scroll/tsconfig.json
  • examples/marko/padding/.marko-run/routes.d.ts
  • examples/marko/padding/e2e/padding.spec.ts
  • examples/marko/padding/marko.json
  • examples/marko/padding/package.json
  • examples/marko/padding/playwright.config.ts
  • examples/marko/padding/src/routes/+page.marko
  • examples/marko/padding/tsconfig.json
  • examples/marko/padding/vite.config.ts
  • examples/marko/pretext/.marko-run/routes.d.ts
  • examples/marko/pretext/e2e/pretext.spec.ts
  • examples/marko/pretext/marko.json
  • examples/marko/pretext/package.json
  • examples/marko/pretext/playwright.config.ts
  • examples/marko/pretext/src/routes/+page.marko
  • examples/marko/pretext/tsconfig.json
  • examples/marko/pretext/vite.config.ts
  • examples/marko/scroll-padding/.marko-run/routes.d.ts
  • examples/marko/scroll-padding/e2e/scroll-padding.spec.ts
  • examples/marko/scroll-padding/marko.json
  • examples/marko/scroll-padding/package.json
  • examples/marko/scroll-padding/playwright.config.ts
  • examples/marko/scroll-padding/src/routes/+page.marko
  • examples/marko/scroll-padding/tsconfig.json
  • examples/marko/scroll-padding/vite.config.ts
  • examples/marko/smooth-scroll/.marko-run/routes.d.ts
  • examples/marko/smooth-scroll/e2e/smooth-scroll.spec.ts
  • examples/marko/smooth-scroll/marko.json
  • examples/marko/smooth-scroll/package.json
  • examples/marko/smooth-scroll/playwright.config.ts
  • examples/marko/smooth-scroll/src/routes/+page.marko
  • examples/marko/smooth-scroll/tsconfig.json
  • examples/marko/ssr-fetch/.marko-run/routes.d.ts
  • examples/marko/ssr-fetch/e2e/ssr-fetch.spec.ts
  • examples/marko/ssr-fetch/marko.json
  • examples/marko/ssr-fetch/package.json
  • examples/marko/ssr-fetch/playwright.config.ts
  • examples/marko/ssr-fetch/src/data.ts
  • examples/marko/ssr-fetch/src/routes/+page.marko
  • examples/marko/ssr-fetch/tsconfig.json
  • examples/marko/ssr-fetch/vite.config.ts
  • examples/marko/ssr-restore/.marko-run/routes.d.ts
  • examples/marko/ssr-restore/e2e/ssr-restore.spec.ts
  • examples/marko/ssr-restore/marko.json
  • examples/marko/ssr-restore/package.json
  • examples/marko/ssr-restore/playwright.config.ts
  • examples/marko/ssr-restore/src/data.ts
  • examples/marko/ssr-restore/src/routes/+page.marko
  • examples/marko/ssr-restore/tsconfig.json
  • examples/marko/ssr-restore/vite.config.ts
  • examples/marko/ssr-slice/.marko-run/routes.d.ts
  • examples/marko/ssr-slice/e2e/ssr-slice.spec.ts
  • examples/marko/ssr-slice/marko.json
  • examples/marko/ssr-slice/package.json
  • examples/marko/ssr-slice/playwright.config.ts
  • examples/marko/ssr-slice/src/data.ts
  • examples/marko/ssr-slice/src/routes/+page.marko
  • examples/marko/ssr-slice/tsconfig.json
  • examples/marko/ssr-slice/vite.config.ts
  • examples/marko/ssr/.marko-run/routes.d.ts
  • examples/marko/ssr/e2e/ssr.spec.ts
  • examples/marko/ssr/marko.json
  • examples/marko/ssr/package.json
  • examples/marko/ssr/playwright.config.ts
  • examples/marko/ssr/src/routes/+page.marko
  • examples/marko/ssr/tsconfig.json
  • examples/marko/ssr/vite.config.ts
  • examples/marko/sticky/.marko-run/routes.d.ts
  • examples/marko/sticky/e2e/sticky.spec.ts
  • examples/marko/sticky/marko.json
  • examples/marko/sticky/package.json
  • examples/marko/sticky/playwright.config.ts
  • examples/marko/sticky/src/routes/+page.marko
  • examples/marko/sticky/tsconfig.json
  • examples/marko/sticky/vite.config.ts
  • examples/marko/table/.marko-run/routes.d.ts
  • examples/marko/table/e2e/table.spec.ts
  • examples/marko/table/marko.json
  • examples/marko/table/package.json
  • examples/marko/table/playwright.config.ts
  • examples/marko/table/src/routes/+page.marko
  • examples/marko/table/tsconfig.json
  • examples/marko/table/vite.config.ts
  • examples/marko/variable/.marko-run/routes.d.ts
  • examples/marko/variable/e2e/variable.spec.ts
  • examples/marko/variable/marko.json
  • examples/marko/variable/package.json
  • examples/marko/variable/playwright.config.ts
  • examples/marko/variable/src/routes/+page.marko
  • examples/marko/variable/tsconfig.json
  • examples/marko/window-ssr-slice/.marko-run/routes.d.ts
  • examples/marko/window-ssr-slice/e2e/window-ssr-slice.spec.ts
  • examples/marko/window-ssr-slice/marko.json
  • examples/marko/window-ssr-slice/package.json
  • examples/marko/window-ssr-slice/playwright.config.ts
  • examples/marko/window-ssr-slice/src/data.ts
  • examples/marko/window-ssr-slice/src/routes/+page.marko
  • examples/marko/window-ssr-slice/tsconfig.json
  • examples/marko/window-ssr-slice/vite.config.ts
  • examples/marko/window/.marko-run/routes.d.ts
  • examples/marko/window/e2e/window.spec.ts
  • examples/marko/window/marko.json
  • examples/marko/window/package.json
  • examples/marko/window/playwright.config.ts
  • examples/marko/window/src/routes/+page.marko
  • examples/marko/window/tsconfig.json
  • packages/marko-virtual/README.md
  • packages/marko-virtual/e2e/option-gates/.marko-run/routes.d.ts
  • packages/marko-virtual/e2e/option-gates/README.md
  • packages/marko-virtual/e2e/option-gates/e2e/option-gates.spec.ts
  • packages/marko-virtual/e2e/option-gates/marko.json
  • packages/marko-virtual/e2e/option-gates/package.json
  • packages/marko-virtual/e2e/option-gates/playwright.config.ts
  • packages/marko-virtual/e2e/option-gates/src/routes/+page.marko
  • packages/marko-virtual/e2e/option-gates/src/routes/cached/+page.marko
  • packages/marko-virtual/e2e/option-gates/src/routes/debug/+page.marko
  • packages/marko-virtual/e2e/option-gates/src/routes/enabled/+page.marko
  • packages/marko-virtual/e2e/option-gates/src/routes/lanes-mode/+page.marko
  • packages/marko-virtual/e2e/option-gates/src/routes/measure-element/+page.marko
  • packages/marko-virtual/e2e/option-gates/src/routes/rtl/+page.marko
  • packages/marko-virtual/e2e/option-gates/src/routes/scroll-events/+page.marko
  • packages/marko-virtual/e2e/option-gates/src/routes/scroll-margin/+page.marko
  • packages/marko-virtual/e2e/option-gates/src/routes/window-example/+page.marko
  • packages/marko-virtual/e2e/option-gates/src/routes/window-horizontal/+page.marko
  • packages/marko-virtual/e2e/option-gates/src/routes/window-initial-offset/+page.marko
  • packages/marko-virtual/e2e/option-gates/tsconfig.json
  • packages/marko-virtual/e2e/option-gates/vite.config.ts
  • packages/marko-virtual/marko.json
  • packages/marko-virtual/package.json
  • packages/marko-virtual/src/tags/virtualizer/index.marko
  • packages/marko-virtual/src/tags/virtualizer/options.ts
  • packages/marko-virtual/src/tags/window-virtualizer/index.marko
  • packages/marko-virtual/src/tags/window-virtualizer/options.ts
  • packages/marko-virtual/tests/fixtures/count-update-fixture.marko
  • packages/marko-virtual/tests/fixtures/surface-fixture.marko
  • packages/marko-virtual/tests/fixtures/virtualizer-fixture.marko
  • packages/marko-virtual/tests/fixtures/window-virtualizer-fixture.marko
  • packages/marko-virtual/tests/marko.json
  • packages/marko-virtual/tests/options.test.ts
  • packages/marko-virtual/tests/render-slice.test.ts
  • packages/marko-virtual/tests/tags.test.ts
  • packages/marko-virtual/tsconfig.tags.json
  • packages/marko-virtual/tsconfig.typecheck.json
  • pnpm-workspace.yaml

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@defunkt-dev defunkt-dev changed the title feat(marko-virtual): post-release follow-ups — full option parity, typed handles, e2e coverage, new Chat + Pretext example feat(marko-virtual): post-release follow-ups: full option parity, typed handles, e2e coverage, new Chat + Pretext example Jul 5, 2026
@defunkt-dev defunkt-dev changed the title feat(marko-virtual): post-release follow-ups: full option parity, typed handles, e2e coverage, new Chat + Pretext example feat(marko-virtual): post-release follow-ups: full option parity, SSR Support, typed handles, e2e coverage, examples Jul 5, 2026
@defunkt-dev defunkt-dev changed the title feat(marko-virtual): post-release follow-ups: full option parity, SSR Support, typed handles, e2e coverage, examples feat(marko-virtual): post-release follow-ups: full option parity, Streaming SSR Support, typed handles, e2e coverage, examples Jul 5, 2026
@socket-security

socket-security Bot commented Jul 5, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Added@​marko/​language-tools@​2.6.38010073100100
Added@​marko/​type-check@​3.1.17610090100100
Added@​marko/​vite@​6.1.27710010099100
Added@​marko/​run@​0.10.08010010098100
Addedmarko@​6.3.38110094100100

View full report

@socket-security

socket-security Bot commented Jul 5, 2026

Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
Obfuscated code: npm @emnapi/runtime is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: pnpm-lock.yamlnpm/@marko/run@0.10.0npm/@emnapi/runtime@1.11.1

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@emnapi/runtime@1.11.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm @marko/compiler is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: pnpm-lock.yamlnpm/@marko/run@0.10.0npm/@marko/type-check@3.1.1npm/@marko/language-tools@2.6.3npm/marko@6.3.3npm/@marko/vite@6.1.2npm/@marko/compiler@5.40.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@marko/compiler@5.40.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Medium
Low adoption: npm @marko/language-tools

Location: Package overview

From: examples/marko/chat-pretext/package.jsonnpm/@marko/language-tools@2.6.3

ℹ Read more on: This package | This alert | What are unpopular packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Unpopular packages may have less maintenance and contain other problems.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@marko/language-tools@2.6.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Medium
Low adoption: npm @marko/run

Location: Package overview

From: examples/marko/chat-pretext/package.jsonnpm/@marko/run@0.10.0

ℹ Read more on: This package | This alert | What are unpopular packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Unpopular packages may have less maintenance and contain other problems.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@marko/run@0.10.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Medium
Low adoption: npm @marko/type-check

Location: Package overview

From: examples/marko/chat-pretext/package.jsonnpm/@marko/type-check@3.1.1

ℹ Read more on: This package | This alert | What are unpopular packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Unpopular packages may have less maintenance and contain other problems.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@marko/type-check@3.1.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

@defunkt-dev

Copy link
Copy Markdown
Contributor Author

@coderabbitai help

@coderabbitai

coderabbitai Bot commented Jul 6, 2026

Copy link
Copy Markdown

Chat

There are 3 ways to chat with CodeRabbit:

  • Review comments: Directly reply to a review comment made by CodeRabbit. Example:
    • I pushed a fix in commit <commit_id>, please review it.
    • Open a follow-up GitHub issue for this discussion.
  • Files and specific lines of code (under the "Files changed" tab): Tag @coderabbitai in a new review comment at the desired location with your query.
  • PR comments: Tag @coderabbitai in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
    • @coderabbitai gather interesting stats about this repository and render them as a table. Additionally, render a pie chart showing the language distribution in the codebase.
    • @coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.

CodeRabbit commands

These commands are invoked using PR/Issue comments.

  • @coderabbitai pause to pause the reviews on a PR.
  • @coderabbitai resume to resume the paused reviews.
  • @coderabbitai review to trigger an incremental review. This is useful when automatic reviews are disabled for the repository.
  • @coderabbitai full review to do a full review from scratch and review all the files again.
  • @coderabbitai rate limit to show your current review rate limit status.
  • @coderabbitai summary to regenerate the summary of the PR.
  • @coderabbitai evaluate custom pre-merge check --instructions <custom-checks-instructions> --name <custom-checks-title> [--mode <error|warning>] to validate the custom pre-merge checks instructions. Defaults to error when --mode is omitted.
  • @coderabbitai ignore pre-merge checks to override pre-merge checks and get an approval on PR.
  • @coderabbitai run pre-merge checks to run pre-merge checks on the pull request.
  • @coderabbitai generate docstrings to generate docstrings for this PR.
  • @coderabbitai generate sequence diagram to generate a sequence diagram of the changes in this PR.
  • @coderabbitai generate unit tests to generate unit tests for this PR.
  • @coderabbitai emit path instructions to emit generated path-specific review instructions for this repository.
  • @coderabbitai resolve merge conflict to automatically resolve merge conflicts.
  • @coderabbitai autofix to automatically fix issues identified in unresolved review comments.
  • @coderabbitai resolve to resolve all the CodeRabbit review comments.
  • @coderabbitai configuration to show the current CodeRabbit configuration for the repository.
  • @coderabbitai generate configuration to create a PR that adds the current resolved configuration as .coderabbit.yaml (or show it if already present).
  • @coderabbitai help to get help.

Other keywords and placeholders

  • Add @coderabbitai ignore or @coderabbit ignore anywhere in the PR description to prevent this PR from being reviewed.
  • Add @coderabbitai summary to generate the high-level summary at a specific location in the PR description.
  • Add @coderabbitai anywhere in the PR title to generate the title automatically.

CodeRabbit configuration file (.coderabbit.yaml)

  • You can programmatically configure CodeRabbit by adding a .coderabbit.yaml file to the root of your repository.
  • Please see the configuration documentation for more information.
  • You can also validate your configuration using the online YAML validator.
  • If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json

Status, support, documentation and community

  • Visit our status page to check the current availability of CodeRabbit.
  • Create a ticket on our support page for assistance with any issues or questions.
  • Visit our documentation site for detailed information on how to use CodeRabbit.
  • Join our Discord community to connect with other users and get help from the community.
  • Follow us on X/Twitter for updates and announcements.

@defunkt-dev

Copy link
Copy Markdown
Contributor Author

@coderabbitai summary

@coderabbitai

coderabbitai Bot commented Jul 6, 2026

Copy link
Copy Markdown
✅ Action performed

Summary regeneration triggered.

@defunkt-dev defunkt-dev changed the title feat(marko-virtual): post-release follow-ups: full option parity, Streaming SSR Support, typed handles, e2e coverage, examples feat(marko-virtual): post-release follow-ups: full option parity, streaming SSR Support with Resume, typed handles, e2e coverage, examples Jul 6, 2026
@defunkt-dev defunkt-dev force-pushed the main branch 2 times, most recently from 4bd71a2 to fb05f90 Compare July 6, 2026 00:27
@defunkt-dev

Copy link
Copy Markdown
Contributor Author

To build

pnpm install
pnpm --filter @tanstack/virtual-core build                                   
pnpm --filter @tanstack/marko-virtual build    
pnpm --filter @tanstack/marko-virtual test:types                                                           

To Test

## runs unit tests
pnpm --filter @tanstack/marko-virtual exec vitest run --reporter=verbose  

## runs e2e
pnpm -r --workspace-concurrency=1 --filter "./examples/marko/*" run test:e2e

To run examples

pnpm --filter tanstack-marko-virtual-example-fixed dev
pnpm --filter tanstack-marko-virtual-example-variable dev
pnpm --filter tanstack-marko-virtual-example-dynamic dev
pnpm --filter tanstack-marko-virtual-example-grid dev
pnpm --filter tanstack-marko-virtual-example-smooth-scroll dev
pnpm --filter tanstack-marko-virtual-example-infinite-scroll dev
pnpm --filter tanstack-marko-virtual-example-window dev
pnpm --filter tanstack-marko-virtual-example-ssr dev
pnpm --filter tanstack-marko-virtual-example-ssr-fetch dev
pnpm --filter tanstack-marko-virtual-example-ssr-slice dev
pnpm --filter tanstack-marko-virtual-example-ssr-restore dev
pnpm --filter tanstack-marko-virtual-example-window-ssr-slice dev
pnpm --filter tanstack-marko-virtual-example-chat dev
pnpm --filter tanstack-marko-virtual-example-scroll-padding dev
pnpm --filter tanstack-marko-virtual-example-padding dev
pnpm --filter tanstack-marko-virtual-example-pretext dev
pnpm --filter tanstack-marko-virtual-example-sticky dev
pnpm --filter tanstack-marko-virtual-example-table dev
pnpm --filter tanstack-marko-virtual-example-chat-pretext dev

…am guidance

packaging changed to the canonical Marko library shape per Marko team guidance (marko.json exports → built dist/tags, no tags-dir/script-lang, mtc-built declarations, in-repo consumers resolve tags from source via nested marko.json), plus the sideEffects fix
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant