fix(eslint-plugin-query): prevent Object.prototype false positives in no-unstable-deps

[kamalprakhar]

Summary

Fixes a false positive in the @tanstack/query/no-unstable-deps rule caused by inherited Object.prototype properties being treated as tracked custom hooks.

Root Cause

getTrackedQueryHook performs a direct property lookup on trackedCustomHooks:

return trackedCustomHooks[callExpression.callee.name]

Since trackedCustomHooks is a plain object, property names inherited from Object.prototype (such as toString, valueOf, constructor, etc.) resolve to their inherited implementations instead of undefined.

As a result, unrelated functions with these names (for example, Lodash's toString) are incorrectly treated as tracked TanStack Query hooks, causing false positives from no-unstable-deps.

Example:

import { toString } from 'lodash'

const sessionId = toString(router.query.sessionId)

useCallback(() => {
  console.log(sessionId)
}, [sessionId])

sessionId is incorrectly reported as an unstable dependency even though it is unrelated to TanStack Query.

Fix

Use Object.hasOwn before reading from trackedCustomHooks so only explicitly tracked custom hooks are considered.

Tests

Added regression tests covering inherited Object.prototype property names to ensure they are no longer treated as tracked custom hooks.

[coderabbitai]

📝 Walkthrough

Walkthrough

The no-unstable-deps rule now restricts tracked custom hook lookups to own properties, preventing false positives for Object.prototype method names. Tests cover these names, and a patch Changesets entry documents the fix.

Changes

no-unstable-deps prototype lookup fix

Layer / File(s)	Summary
Prototype-safe hook resolution packages/eslint-plugin-query/src/rules/no-unstable-deps/no-unstable-deps.rule.ts, packages/eslint-plugin-query/src/__tests__/no-unstable-deps.test.ts, .changeset/fix-no-unstable-deps-prototype-lookup.md	Custom hook resolution now checks own properties, regression tests cover prototype method names as valid cases, and a patch release note documents the correction.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Possibly related PRs

• TanStack/query#10730: Updates no-unstable-deps tracked custom hook resolution in the same rule.

Suggested labels: package: eslint-plugin-query

Suggested reviewers: tkdodo

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The PR explains the fix well, but it does not follow the required template sections for Changes, Checklist, and Release Impact.	Reformat the description to use the template headings, add the checklist items, and note the release impact and changeset status.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly matches the main change: preventing Object.prototype-derived false positives in no-unstable-deps.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}