TanStack weighs invitation-only pull requests after supply chain attack