react-query — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited react-query (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Authoritative source: the TanStack Query v5 React docs. Every rule and pattern in this skill is either cited directly to a docs page or explicitly marked as a community best practice. When uncertain, fetch the cited URL and verify — the docs are the source of truth, not this file.
Pick a mode based on what the user is asking for. The modes compose — e.g., a v4 project being upgraded often wants both migration guidance and a review pass after.
| Intent | Mode | Primary reference |
|---|---|---|
| "Review this code" / "audit my React Query usage" / "check for anti-patterns" | Review | references/review-checklist.md |
"Upgrade from v4" / "migrate to v5" / cacheTime/onSuccess on useQuery spotted | Migrate | references/v5-migration.md |
| "Add a query/mutation" / "how do I…" / setting up a new feature | Code | references/coding-standards.md + topic refs |
When asked to audit a codebase:
@tanstack/react-query / @tanstack/react-query-devtools, identify the router, locate the QueryClient and its defaultOptions, enumerate every useQuery / useMutation / useSuspenseQuery / useInfiniteQuery / useQueries call site, and check for queryOptions factories vs scattered inline keys.references/review-checklist.md with detection hints and doc URLs per check.review-checklist.md — include file:line, cite the v5 doc URL under Source, and give concrete before/after fixes for every finding.Do not invent findings to fill the report. If the code is clean, say so.
Full migration reference lives in references/v5-migration.md. TL;DR:
npx jscodeshift@latest ./path/to/src/ \
--extensions=ts,tsx \
--parser=tsx \
--transform=./node_modules/@tanstack/react-query/build/codemods/src/v5/remove-overloads/remove-overloads.cjscacheTime → gcTime, keepPreviousData: true → placeholderData: keepPreviousData, suspense: true → useSuspenseQuery, useErrorBoundary → throwOnError, <Hydrate> → <HydrationBoundary>, status === 'loading' → 'pending', etc.initialPageParam to every useInfiniteQuery.onSuccess/onError/onSettled from useQuery configs — relocate to QueryCache callbacks or component effects. Mutations keep these callbacks.Writing new v5 code. The full rule set is in references/coding-standards.md. The non-negotiables:
gcTime >= staleTime.fetch-based queryFn.useState.enabled: false only when manual refetch is intended.onSuccess. Snapshot → cancel → write → rollback on error.useSuspenseQueries.useInfiniteQuery.retry: false, gcTime: Infinity, MSW for network mocking.Source: queries.
| Flag | Meaning |
|---|---|
isPending | No cached data yet (v4 isLoading) |
isFetching | A fetch is in flight (background or foreground) |
isLoading | isPending && isFetching — first load in progress (v4 isInitialLoading) |
isSuccess | Resolved; data is defined |
isError | Rejected; error is defined |
isPlaceholderData | Rendering placeholder / kept-previous data |
When reading or writing code, these should pattern-match instantly:
useState(data) or useEffect(() => setX(data), [data]) → copying server state to client state. Delete the local state.const { data, ...rest } = useQuery(...) → the spread defeats tracked-query re-render optimization.fetch(url).then(r => r.json()) with no r.ok check → HTTP errors cached as success.cacheTime: anywhere → v4 leftover, rename to gcTime.onSuccess / onError / onSettled inside a useQuery({...}) config → v4 leftover, these are removed in v5 for queries.suspense: true on a query → use useSuspenseQuery.keepPreviousData: true → rename to placeholderData: keepPreviousData.useInfiniteQuery({...}) with no initialPageParam → will throw in v5.useSuspenseQuery calls in one component → serial waterfall, use useSuspenseQueries.setQueryData updater mutating old in place → breaks structural sharing.invalidateQueries inside a mutation onSuccess without return → UI flashes stale before refetch.QueryClient across tests → state leakage, order-dependent failures.Every reference below cites the v5 docs at the top. Fetch the doc URLs when you need verification.
QueryClient configuration, QueryCache.onError, feature-based colocation, query key rules, queryOptionsselect, skipToken, dependent queries, paginated, infinite, prefetching, Suspense, error boundaries, status flags, cache timing, TypeScript tipsvariables, optimistic updates via cache manipulation with rollbackskipToken/enabled gating, queryClient.clear() on logout, retry policy for 401sQueryClient, MSW handlers, success/error-path test shapes, cache pre-seedingEvery recommendation in this skill maps to a v5 doc section. If a user request leads you into territory not covered by the cited docs (e.g., a third-party HTTP client's auth integration), call it out explicitly and verify against that tool's own documentation before recommending a pattern. When the v5 docs change between minor versions, the docs win — flag the discrepancy and offer to update this skill.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.