tRPC 10.45

Last reviewed Sep 23, 2026

Export as PDF

Prompt Details

Prompt Composition

4prompts
  1. JavaScript ES2026102 lines · 3.1K tokens
  2. Node.js 22114 lines · 3.7K tokens
  3. TypeScript 5.940 lines · 1.2K tokens
  4. tRPC 10.4595 lines · 3.7K tokens
Total351 lines · 11.8K tokens

CWE Coverage

  • 15
  • 20
  • 22
  • 59
  • 73
  • 78
  • 79
  • 89
  • 95
  • 113
  • 117
  • 200
  • 201
  • 208
  • 209
  • 214
  • 250
  • 295
  • 297
  • 306
  • 319
  • 323
  • 327
  • 338
  • 346
  • 347
  • 352
  • 354
  • 362
  • 367
  • 377
  • 426
  • 444
  • 459
  • 471
  • 488
  • 494
  • 502
  • 522
  • 524
  • 532
  • 598
  • 602
  • 613
  • 639
  • 653
  • 732
  • 770
  • 772
  • 807
  • 829
  • 838
  • 862
  • 863
  • 908
  • 915
  • 916
  • 918
  • 922
  • 942
  • 943
  • 1004
  • 1321
  • 1333

Prompt Preview

Apply the Node.js 22, TypeScript 5.9, and JavaScript ES2026 prompts first. These rules target tRPC 10.45 as implemented by the 10.45.4 packages, with Node.js 22 and TypeScript 5.9 as the deployment baseline. Apply optional adapter and integration rules when those components are used.

Release scope and initialization

  • Install @trpc/server, @trpc/client, @trpc/react-query, and @trpc/next at one shared version in the lockfile and upgrade them together; the integrations require matching tRPC peers, and the FormData normalization that v10 server actions use lives in @trpc/next, so upgrading the server alone leaves that code unchanged.
  • Keep @trpc/react-query and @trpc/next on their declared TanStack React Query 4 peer range; do not copy React Query 5 or tRPC 11 configuration into v10 clients.
  • Initialize initTRPC once per backend and export reviewed router, publicProcedure, and protected procedure builders so routers share the intended transformer and errorFormatter.
  • Import only AppRouter's type into client code; keep router values, resolvers, and their server dependencies out of browser bundles.
  • Keep allowOutsideOfServer false in deployments, and do not force isServer: true to suppress an accidental browser import of @trpc/server.

Routers, procedures, and legacy interop

  • Derive each authenticated operation from a named base procedure built with t.procedure.use(...), and authorize the concrete tenant, record, field, and action before its resolver performs work.
  • Review every procedure reachable from the router mounted on an