fix(eslint-plugin-query): prevent Object.prototype false positives in no-unstable-deps

[kprakhar]

Summary

Fixes a false positive in the @tanstack/query/no-unstable-deps rule caused by inherited Object.prototype properties being treated as tracked custom hooks.

Root Cause

getTrackedQueryHook performs a direct property lookup on trackedCustomHooks:

return trackedCustomHooks[callExpression.callee.name]

Since trackedCustomHooks is a plain object, property names inherited from Object.prototype (such as toString, valueOf, and constructor) resolve to their inherited implementations instead of undefined.

As a result, unrelated functions with these names (for example, Lodash's toString) are incorrectly treated as tracked TanStack Query hooks, causing false positives from no-unstable-deps.

Example

import { toString } from 'lodash'

const sessionId = toString(router.query.sessionId)

useCallback(() => {
  console.log(sessionId)
}, [sessionId])

Here, sessionId is incorrectly reported as an unstable dependency even though it is unrelated to TanStack Query.

Fix

Use Object.hasOwn before reading from trackedCustomHooks so only explicitly tracked custom hooks are considered.

Tests

Added regression tests covering inherited Object.prototype property names to ensure they are no longer treated as tracked custom hooks.

Summary by CodeRabbit

• Bug Fixes

  • Fixed a false positive in the no-unstable-deps ESLint rule when variables are assigned from calls to common JavaScript prototype methods such as toString, valueOf, or constructor.
  • Improved detection of custom query hooks so inherited property names are not incorrectly treated as tracked hooks.

• Chores

  • Released a patch update for the ESLint plugin.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: eaf22966-00a1-4512-bb03-b8e856cdc546

📥 Commits

Reviewing files that changed from the base of the PR and between fd50fa1 and fc2129c.

📒 Files selected for processing (3)

• .changeset/fix-no-unstable-deps-prototype-lookup.md‎
• packages/eslint-plugin-query/src/__tests__/no-unstable-deps.test.ts
• packages/eslint-plugin-query/src/rules/no-unstable-deps/no-unstable-deps.rule.ts

---

📝 Walkthrough

Walkthrough

The no-unstable-deps rule now avoids inherited Object.prototype names during custom-hook lookup. Regression tests cover prototype method calls, and a patch changeset documents the fix.

Changes

no-unstable-deps prototype lookup fix

Layer / File(s)	Summary
Guard custom-hook lookup and validate prototype calls packages/eslint-plugin-query/src/rules/no-unstable-deps/no-unstable-deps.rule.ts, packages/eslint-plugin-query/src/__tests__/no-unstable-deps.test.ts, .changeset/*	Custom-hook resolution uses an own-property check, tests verify prototype method calls remain valid dependencies, and release metadata records a patch fix.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• TanStack/query#11107: Contains the corresponding no-unstable-deps own-property lookup fix and regression tests.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly matches the main fix: preventing Object.prototype false positives in no-unstable-deps.
Description check	✅ Passed	The description is on-topic and detailed, but it omits the template's checklist and release-impact sections.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}