fix(create): resolve current npm versions

[tannerlinsley]

The npm latest endpoint rejects the install metadata response format, so generated projects currently fall back to an unpinned latest specifier. Request JSON from that endpoint and resolve versions for each generated project, allowing long-running builders to pick up new releases.

Adds regression coverage for the HTTP 406 response and a new release becoming available between generations. Includes a patch changeset for @tanstack/create; Changesets also updates the CLI and its published aliases.

Validation: creation-engine lint, TypeScript build, all 267 tests, and formatting passed. Fresh React and Solid projects from the published CLI and live builder resolve the current Start and core packages.

Summary by CodeRabbit

• Bug Fixes
  • Generated projects now resolve package versions using the npm registry’s current response, so repeated resolutions can reflect updated versions.
  • Version lookups use the standard JSON response format. Existing dependencies and the project template remain unchanged during resolution.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 38bd2e6b-46f0-4e6a-8a4a-9e72ea761dc7

📥 Commits

Reviewing files that changed from the base of the PR and between 4f7744c and ca29ada.

📒 Files selected for processing (3)

• .changeset/fresh-start-versions.md
• packages/create/src/npm-resolver.ts
• packages/create/tests/npm-resolver.test.ts

Included review availability: This review used your included allowance. Your plan provides up to 4 included reviews per hour; 3 remain after this review.

---

📝 Walkthrough

Walkthrough

resolveNpmVersion now requests npm package data as JSON and fetches the latest version on each call. Tests cover repeated resolutions, and a changeset declares a patch release for @tanstack/create.

Changes

npm version resolution

Layer / File(s)	Summary
Resolve and apply current npm versions packages/create/src/npm-resolver.ts, packages/create/tests/npm-resolver.test.ts, .changeset/fresh-start-versions.md	Each resolver call fetches the latest version using the JSON response format. Tests check version updates and preservation of unrelated template dependencies. A changeset declares a patch release.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to ca29a

Generated projects resolve current npm versions while retaining the existing fallback when lookups fail. No actionable merge-blocking risk is identified.

Architecture Summary

Architecture risk: 🔵 Low · up to ca29a

The change affects 1 system.

Changed systems: packages/create

Architecture concerns
No architecture-level concerns identified.

Review details

Systems and components

• observed — packages/create (library) was modified; 2 changed files map to changed impact.

Before / after behavior

• observed — Modified behavior in packages/create/src/npm-resolver.ts: resolveNpmVersion removes the package-version cache and its cache-hit return and no longer stores successful results. Each call now fetches the package’s latest version; the request Accept header changes to application/json from application/vnd.npm.install-v1+json. Non-OK responses and exceptions still return null.
• observed — Modified behavior in packages/create/tests/npm-resolver.test.ts: Adds tests that stub fetch and restore globals after each test. The tests expect JSON-format requests to resolve @tanstack/react-start: latest from the response’s version, and separate calls to use updated response versions while retaining the template’s unrelated React dependency and unchanged latest value.
• observed — Modified behavior in .changeset/fresh-start-versions.md: Adds a patch-release Changesets entry for @tanstack/create with a note about npm response format and resolving current versions for generated projects.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: resolving current npm versions for generated projects.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 2 files. (1 skipped: 1 …
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

Warning

Some tools did not complete. Review the errors below.

🔧 ESLint

If the error stems from missing dependencies, add them to the package.json file. For unrecoverable errors (e.g., due to private dependencies), disable the tool in the CodeRabbit configuration.

packages/create/tests/npm-resolver.test.ts

Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): packages/create/tests/npm-resolver.test.ts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}