[Snyk] Security upgrade @trpc/server from 11.0.3 to 11.8.0

[RealSollyM]

Snyk has created this PR to fix 1 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

• package.json

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Prototype Pollution SNYK-JS-TRPCSERVER-14427432	746

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Prototype Pollution

[RealSollyM]

This is a minor version upgrade for @trpc/server within the v11 release series. While it should not contain major API breaking changes, it introduces an important dependency requirement and includes bug fixes that could alter behavior.

Key Changes:

• TypeScript Version: tRPC v11 requires TypeScript version 5.7.2 or higher. Upgrading may result in a peer dependency error if your project uses an older version of TypeScript. [2, 5]
• Behavioral Changes: The versions between 11.0.3 and 11.8.0 include various bug fixes and enhancements. For example, v11.17.0 includes a fix for how errors are unwrapped in streaming onError handlers, which could change error handling behavior. [3]
• New Features: This range includes additive features introduced in v11, such as improved support for React Server Components, streaming responses, and new subscription helpers. [1, 3]

Recommendation:
Verify that your project's TypeScript version is at least 5.7.2. After upgrading, it is important to run your test suite to ensure that bug fixes and minor enhancements do not negatively impact your application's behavior, particularly around error handling in streams.

Source: tRPC v11 Migration Guide, GitHub Releases

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
genstore	Error		Aug 25, 2026 1:13am

[coderabbitai]

Important

Review skipped

Ignore keyword(s) in the title.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: f555fa08-b17a-4747-a3cf-e370760b386f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 302fe49d09

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Update the Bun lockfile with the server upgrade

This repo commits bun.lock, but this change only updates package.json; the lockfile still lists the root @trpc/server dependency and resolved package as 11.0.3 (bun.lock lines 43 and 758). In environments that install from the lockfile or use bun install --frozen-lockfile, the security fix is either not installed or the install is rejected because the manifest and lockfile disagree. Please regenerate and commit bun.lock with @trpc/server@11.8.0.

Useful? React with 👍 / 👎.