From acb5c3c35abd4a7c06ac7b4822052f335ba681ff Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Tue, 4 Aug 2026 14:45:47 +0000 Subject: [PATCH 1/2] chore: release --- .changeset/brave-hoops-listen.md | 5 -- .changeset/bright-dogs-serve.md | 5 -- .changeset/calm-types-vanish.md | 5 -- .changeset/chilly-rabbits-lie.md | 5 -- .changeset/deep-sails-peel.md | 5 -- .changeset/eighty-jars-invite.md | 7 --- .changeset/eleven-actors-nail.md | 5 -- .changeset/fluffy-bats-return.md | 5 -- .changeset/fresh-tools-build.md | 5 -- .changeset/great-hooks-observe.md | 5 -- .changeset/lemon-plugins-serialize.md | 25 -------- .changeset/lucky-moths-nonce.md | 8 --- .changeset/lucky-pans-gather.md | 5 -- .changeset/olive-apes-clap.md | 5 -- .changeset/olive-pugs-shave.md | 5 -- .changeset/pre.json | 38 ----------- .changeset/quiet-errors-wait.md | 6 -- .changeset/soft-cases-repeat.md | 5 -- .changeset/sour-knives-look.md | 5 -- .changeset/spotty-jobs-relax.md | 5 -- .changeset/spotty-moons-repeat.md | 5 -- .changeset/stale-goats-go.md | 28 --------- .changeset/strong-geckos-rescue.md | 5 -- .changeset/tall-donuts-smile.md | 5 -- .changeset/tidy-donkeys-cheat.md | 5 -- .changeset/tidy-donkeys-reject.md | 5 -- .changeset/tidy-paths-resolve.md | 5 -- .changeset/tricky-goats-cheer.md | 5 -- .changeset/wild-pots-repeat.md | 5 -- packages/start/CHANGELOG.md | 91 +++++++++++++++++++++++++++ packages/start/package.json | 2 +- 31 files changed, 92 insertions(+), 228 deletions(-) delete mode 100644 .changeset/brave-hoops-listen.md delete mode 100644 .changeset/bright-dogs-serve.md delete mode 100644 .changeset/calm-types-vanish.md delete mode 100644 .changeset/chilly-rabbits-lie.md delete mode 100644 .changeset/deep-sails-peel.md delete mode 100644 .changeset/eighty-jars-invite.md delete mode 100644 .changeset/eleven-actors-nail.md delete mode 100644 .changeset/fluffy-bats-return.md delete mode 100644 .changeset/fresh-tools-build.md delete mode 100644 .changeset/great-hooks-observe.md delete mode 100644 .changeset/lemon-plugins-serialize.md delete mode 100644 .changeset/lucky-moths-nonce.md delete mode 100644 .changeset/lucky-pans-gather.md delete mode 100644 .changeset/olive-apes-clap.md delete mode 100644 .changeset/olive-pugs-shave.md delete mode 100644 .changeset/pre.json delete mode 100644 .changeset/quiet-errors-wait.md delete mode 100644 .changeset/soft-cases-repeat.md delete mode 100644 .changeset/sour-knives-look.md delete mode 100644 .changeset/spotty-jobs-relax.md delete mode 100644 .changeset/spotty-moons-repeat.md delete mode 100644 .changeset/stale-goats-go.md delete mode 100644 .changeset/strong-geckos-rescue.md delete mode 100644 .changeset/tall-donuts-smile.md delete mode 100644 .changeset/tidy-donkeys-cheat.md delete mode 100644 .changeset/tidy-donkeys-reject.md delete mode 100644 .changeset/tidy-paths-resolve.md delete mode 100644 .changeset/tricky-goats-cheer.md delete mode 100644 .changeset/wild-pots-repeat.md diff --git a/.changeset/brave-hoops-listen.md b/.changeset/brave-hoops-listen.md deleted file mode 100644 index 0c35a9728..000000000 --- a/.changeset/brave-hoops-listen.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@solidjs/start": patch ---- - -Remove leftover debug `console.log` calls from the server functions inspector, which logged on every server function request in dev. diff --git a/.changeset/bright-dogs-serve.md b/.changeset/bright-dogs-serve.md deleted file mode 100644 index f4f171365..000000000 --- a/.changeset/bright-dogs-serve.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@solidjs/start": patch ---- - -Update srvx to version 0.12.0. diff --git a/.changeset/calm-types-vanish.md b/.changeset/calm-types-vanish.md deleted file mode 100644 index 84bdb53e2..000000000 --- a/.changeset/calm-types-vanish.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@solidjs/start": patch ---- - -Remove type-only import remnants from client server-function transforms so they do not retain server-only dependency chains. diff --git a/.changeset/chilly-rabbits-lie.md b/.changeset/chilly-rabbits-lie.md deleted file mode 100644 index 38d5e62ba..000000000 --- a/.changeset/chilly-rabbits-lie.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@solidjs/start": minor ---- - -add new dev toolbar diff --git a/.changeset/deep-sails-peel.md b/.changeset/deep-sails-peel.md deleted file mode 100644 index 46c2ac521..000000000 --- a/.changeset/deep-sails-peel.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@solidjs/start": patch ---- - -Fixed shared chunk css not being server rendered in production (Vite 8 regression). diff --git a/.changeset/eighty-jars-invite.md b/.changeset/eighty-jars-invite.md deleted file mode 100644 index 3283965ad..000000000 --- a/.changeset/eighty-jars-invite.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -"@solidjs/start": patch ---- - -Route module ids now end in the source extension, so ecosystem plugins apply inside `src/routes`. - -Route files are imported through an id carrying the picked exports in the query (`routes/api.ts?pick=GET`), which left the id ending in the export name. Plugins whose filter is anchored on the file extension (`/\.[cm]?[jt]sx?$/`, the default for `unplugin-auto-import`, `unplugin-macros` and others) silently skipped every route file. The id now ends with a `lang.` marker, the same convention Vue SFCs use for `?vue&type=script&lang.ts`. Chunk filenames are unchanged. diff --git a/.changeset/eleven-actors-nail.md b/.changeset/eleven-actors-nail.md deleted file mode 100644 index 8e941eb4a..000000000 --- a/.changeset/eleven-actors-nail.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@solidjs/start": patch ---- - -fix(types): add missing properties to `SolidStartOptions` and expose them via Vite plugin configuration diff --git a/.changeset/fluffy-bats-return.md b/.changeset/fluffy-bats-return.md deleted file mode 100644 index a94b6147d..000000000 --- a/.changeset/fluffy-bats-return.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@solidjs/start": patch ---- - -chore: bump seroval to v1.6.0 diff --git a/.changeset/fresh-tools-build.md b/.changeset/fresh-tools-build.md deleted file mode 100644 index 7b21b616e..000000000 --- a/.changeset/fresh-tools-build.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@solidjs/start": patch ---- - -Migrate the built-in Vite configuration from the deprecated `rollupOptions` alias to `rolldownOptions`. diff --git a/.changeset/great-hooks-observe.md b/.changeset/great-hooks-observe.md deleted file mode 100644 index bd974d890..000000000 --- a/.changeset/great-hooks-observe.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@solidjs/start": minor ---- - -Add a `serverFunctions.onError` option naming a module that observes and replaces what a server function threw, before it is serialized into the response diff --git a/.changeset/lemon-plugins-serialize.md b/.changeset/lemon-plugins-serialize.md deleted file mode 100644 index 1c4c75233..000000000 --- a/.changeset/lemon-plugins-serialize.md +++ /dev/null @@ -1,25 +0,0 @@ ---- -"@solidjs/start": minor ---- - -Add `serialization.plugins` to configure custom Seroval plugins for server functions. - -Values Seroval has no built-in support for (Mongo's `ObjectId`, Prisma's `Decimal`, `Temporal`, and other custom classes) previously threw when returned from or passed to a server function. Point the new option at a module whose default export is an array of plugins: - -```ts -// vite.config.ts -solidStart({ - serialization: { - plugins: "src/seroval-plugins.ts", - }, -}); -``` - -```ts -// src/seroval-plugins.ts -import { createPlugin } from "@solidjs/start/serialization"; -``` - -The module is bundled into both the client and the server so both ends of a server function agree on the format, so it must not import server-only code. SolidStart's built-in plugins keep precedence. Only server-function and action payloads are affected; the SSR hydration payload is serialized by `solid-js/web`. - -Also adds a `@solidjs/start/serialization` entrypoint re-exporting Seroval's `createPlugin`, `OpaqueReference`, and plugin types, so plugin authors stay on the same Seroval version SolidStart serializes with. diff --git a/.changeset/lucky-moths-nonce.md b/.changeset/lucky-moths-nonce.md deleted file mode 100644 index 27dd7be09..000000000 --- a/.changeset/lucky-moths-nonce.md +++ /dev/null @@ -1,8 +0,0 @@ ---- -"@solidjs/start": patch ---- - -Apply the configured `nonce` to the two script tags that were still missing it, so a strict `script-src` CSP no longer needs `unsafe-inline`: - -- The client-side redirect that streaming mode emits after the shell has already flushed (``) now carries the nonce. -- The SPA entry script tag now carries the nonce, matching the SSR entry script. diff --git a/.changeset/lucky-pans-gather.md b/.changeset/lucky-pans-gather.md deleted file mode 100644 index 8bf4f873c..000000000 --- a/.changeset/lucky-pans-gather.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@solidjs/start": patch ---- - -Updated dependencies, including `cookie-es` to 3, `shiki` to 4, `srvx` to 0.12.4, `oxc-parser` to 0.141 and `seroval` to 1.5.6. `parseSetCookie` now returns `undefined` for cookies with a forbidden name or an empty name and value, and those cookies are no longer forwarded to nested server function requests. diff --git a/.changeset/olive-apes-clap.md b/.changeset/olive-apes-clap.md deleted file mode 100644 index 27315cfb1..000000000 --- a/.changeset/olive-apes-clap.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@solidjs/start": patch ---- - -Fix TS2883/TS2742 when emitting declarations for `entry-server.tsx`. `createHandler` now returns `StartHandler`, a type owned by `@solidjs/start`, instead of h3's `H3`, so the inferred type of `export default createHandler(...)` no longer has to be named through a nested `node_modules/@solidjs/start/node_modules/h3` path. diff --git a/.changeset/olive-pugs-shave.md b/.changeset/olive-pugs-shave.md deleted file mode 100644 index 1fc7649ef..000000000 --- a/.changeset/olive-pugs-shave.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@solidjs/start": patch ---- - -keep TypeScript namespace members in route files during production builds diff --git a/.changeset/pre.json b/.changeset/pre.json deleted file mode 100644 index 6cbe95239..000000000 --- a/.changeset/pre.json +++ /dev/null @@ -1,38 +0,0 @@ -{ - "mode": "exit", - "tag": "rc", - "initialVersions": { - "@solidjs/start": "2.0.0-rc.1", - "@solidjs/image": "0.0.0" - }, - "changesets": [ - "brave-hoops-listen", - "bright-dogs-serve", - "calm-types-vanish", - "chilly-rabbits-lie", - "deep-sails-peel", - "eighty-jars-invite", - "eleven-actors-nail", - "fluffy-bats-return", - "fresh-tools-build", - "great-hooks-observe", - "lemon-plugins-serialize", - "lucky-moths-nonce", - "lucky-pans-gather", - "olive-apes-clap", - "olive-pugs-shave", - "quiet-errors-wait", - "soft-cases-repeat", - "sour-knives-look", - "spotty-jobs-relax", - "spotty-moons-repeat", - "stale-goats-go", - "strong-geckos-rescue", - "tall-donuts-smile", - "tidy-donkeys-cheat", - "tidy-donkeys-reject", - "tidy-paths-resolve", - "tricky-goats-cheer", - "wild-pots-repeat" - ] -} diff --git a/.changeset/quiet-errors-wait.md b/.changeset/quiet-errors-wait.md deleted file mode 100644 index 594247dce..000000000 --- a/.changeset/quiet-errors-wait.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@solidjs/start": patch ---- - -Await asynchronous `serverFunctions.onError` handlers before serializing server function errors. -Preserve the original error if the handler throws or rejects. diff --git a/.changeset/soft-cases-repeat.md b/.changeset/soft-cases-repeat.md deleted file mode 100644 index 5a3c903c0..000000000 --- a/.changeset/soft-cases-repeat.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@solidjs/start": patch ---- - -Fix actions returning `json()` or `reload()` leaving no-JS form submissions stranded on the `/_server` endpoint. These responses carry a value rather than a destination, so the redirect issued for progressive-enhancement submissions had no `Location` header. It now falls back to the submitting page, and the response value is unwrapped into the flash cookie so `useSubmission().result` matches the JS path. diff --git a/.changeset/sour-knives-look.md b/.changeset/sour-knives-look.md deleted file mode 100644 index 6da1592e9..000000000 --- a/.changeset/sour-knives-look.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@solidjs/start": patch ---- - -Update `h3` to `2.0.1-rc.26`. diff --git a/.changeset/spotty-jobs-relax.md b/.changeset/spotty-jobs-relax.md deleted file mode 100644 index 3ef55638f..000000000 --- a/.changeset/spotty-jobs-relax.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@solidjs/start": patch ---- - -Fixed event response status and headers set during server-side rendering with deferred async resources, not being applied on the outgoing response. diff --git a/.changeset/spotty-moons-repeat.md b/.changeset/spotty-moons-repeat.md deleted file mode 100644 index daa950dc4..000000000 --- a/.changeset/spotty-moons-repeat.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@solidjs/start": patch ---- - -Restore the optional `routerLoad` third argument to `createHandler`, which primes custom routers (e.g. TanStack Router) on the server before SSR rendering. It was accidentally dropped in the v2 rewrite. diff --git a/.changeset/stale-goats-go.md b/.changeset/stale-goats-go.md deleted file mode 100644 index 0f9262f03..000000000 --- a/.changeset/stale-goats-go.md +++ /dev/null @@ -1,28 +0,0 @@ ---- -"@solidjs/start": minor ---- - -The file filter logic used for CSS crawling in development can now be configured with the vite plugin option `css.filter` analog to `serverFunctions.filter`: - -```ts -solidStart({ - css: { - filter: { - // Exclude all node_modules except "my-dependency" with a flat node_modules layout - exclude: "node_modules/!(my-dependency)/**/*", - }, - }, -}); -``` - -With pnpm, Vite may resolve dependencies through the nested `.pnpm` directory. Use a regular expression that accounts for that layout: - -```ts -solidStart({ - css: { - filter: { - exclude: /node_modules\/(?!(?:\.pnpm\/[^/]+\/node_modules\/)?my-dependency(?:\/|$))/, - }, - }, -}); -``` diff --git a/.changeset/strong-geckos-rescue.md b/.changeset/strong-geckos-rescue.md deleted file mode 100644 index 0c45abcc3..000000000 --- a/.changeset/strong-geckos-rescue.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@solidjs/start": patch ---- - -Fixed css from files with url sensitive characters such as `+` not being server-rendered. diff --git a/.changeset/tall-donuts-smile.md b/.changeset/tall-donuts-smile.md deleted file mode 100644 index 379e2bd7d..000000000 --- a/.changeset/tall-donuts-smile.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@solidjs/start": patch ---- - -Declare `@solidjs/router` as an optional peer dependency constrained to `>=0.16.0 <2.0.0-0`. Router v2 is expected to target Solid v2, so installing it alongside `@solidjs/start` v2 now surfaces a peer warning instead of silently producing an incompatible pairing. The peer is marked optional, so apps that do not use the router are unaffected. diff --git a/.changeset/tidy-donkeys-cheat.md b/.changeset/tidy-donkeys-cheat.md deleted file mode 100644 index 1572fd0c1..000000000 --- a/.changeset/tidy-donkeys-cheat.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@solidjs/start": patch ---- - -Apply cookies set on a returned or thrown response during single flight mutations. `redirect(to, { headers: { "Set-Cookie": ... } })` previously only reached the browser: the single flight re-render of the redirect target still ran with the old request cookies, so queries reading that cookie saw stale values. Those cookies are now merged into the request the re-render sees, matching what a browser round trip would have sent. diff --git a/.changeset/tidy-donkeys-reject.md b/.changeset/tidy-donkeys-reject.md deleted file mode 100644 index 2a43f23c8..000000000 --- a/.changeset/tidy-donkeys-reject.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@solidjs/start": patch ---- - -Reject server function calls when the response is a 5xx without an X-Error header, instead of resolving with the parsed error body diff --git a/.changeset/tidy-paths-resolve.md b/.changeset/tidy-paths-resolve.md deleted file mode 100644 index 693bb8647..000000000 --- a/.changeset/tidy-paths-resolve.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@solidjs/start": patch ---- - -Scope the built-in `~` alias to the app package, so files in other workspace packages can map `~` to their own root through an importer-aware plugin such as `vite-tsconfig-paths`. In stylesheets and asset URLs (CSS `@import`, `url()`, `new URL(..., import.meta.url)`) `~` still always means the app root, since Vite resolves those without running plugins. diff --git a/.changeset/tricky-goats-cheer.md b/.changeset/tricky-goats-cheer.md deleted file mode 100644 index e02ac9eb3..000000000 --- a/.changeset/tricky-goats-cheer.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@solidjs/start": patch ---- - -Stop the dev toolbar from reporting benign `ResizeObserver loop` notifications as application errors. Browsers dispatch these as window `error` events carrying no error object, so the toolbar was capturing the raw `ErrorEvent` and force-opening the error panel over the app on every resize. diff --git a/.changeset/wild-pots-repeat.md b/.changeset/wild-pots-repeat.md deleted file mode 100644 index 7f30570d2..000000000 --- a/.changeset/wild-pots-repeat.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@solidjs/start": patch ---- - -Don't send server error stack traces to the client in production builds. When a server function throws, the error is serialized and rethrown on the client, and seroval included `Error.prototype.stack` by default, leaking server file paths and internal function names. Stacks are still serialized in development. diff --git a/packages/start/CHANGELOG.md b/packages/start/CHANGELOG.md index b11237cf6..ec2a45b75 100644 --- a/packages/start/CHANGELOG.md +++ b/packages/start/CHANGELOG.md @@ -1,5 +1,94 @@ # @solidjs/start +## 2.0.0 + +### Minor Changes + +- eeff49a: add new dev toolbar +- bac24b2: Add a `serverFunctions.onError` option naming a module that observes and replaces what a server function threw, before it is serialized into the response +- 4c803e5: Add `serialization.plugins` to configure custom Seroval plugins for server functions. + + Values Seroval has no built-in support for (Mongo's `ObjectId`, Prisma's `Decimal`, `Temporal`, and other custom classes) previously threw when returned from or passed to a server function. Point the new option at a module whose default export is an array of plugins: + + ```ts + // vite.config.ts + solidStart({ + serialization: { + plugins: "src/seroval-plugins.ts", + }, + }); + ``` + + ```ts + // src/seroval-plugins.ts + import { createPlugin } from "@solidjs/start/serialization"; + ``` + + The module is bundled into both the client and the server so both ends of a server function agree on the format, so it must not import server-only code. SolidStart's built-in plugins keep precedence. Only server-function and action payloads are affected; the SSR hydration payload is serialized by `solid-js/web`. + + Also adds a `@solidjs/start/serialization` entrypoint re-exporting Seroval's `createPlugin`, `OpaqueReference`, and plugin types, so plugin authors stay on the same Seroval version SolidStart serializes with. + +- 3f2b7a7: The file filter logic used for CSS crawling in development can now be configured with the vite plugin option `css.filter` analog to `serverFunctions.filter`: + + ```ts + solidStart({ + css: { + filter: { + // Exclude all node_modules except "my-dependency" with a flat node_modules layout + exclude: "node_modules/!(my-dependency)/**/*", + }, + }, + }); + ``` + + With pnpm, Vite may resolve dependencies through the nested `.pnpm` directory. Use a regular expression that accounts for that layout: + + ```ts + solidStart({ + css: { + filter: { + exclude: + /node_modules\/(?!(?:\.pnpm\/[^/]+\/node_modules\/)?my-dependency(?:\/|$))/, + }, + }, + }); + ``` + +### Patch Changes + +- 27c2877: Remove leftover debug `console.log` calls from the server functions inspector, which logged on every server function request in dev. +- bd8cb01: Update srvx to version 0.12.0. +- 8eef552: Remove type-only import remnants from client server-function transforms so they do not retain server-only dependency chains. +- 6581877: Fixed shared chunk css not being server rendered in production (Vite 8 regression). +- e117d91: Route module ids now end in the source extension, so ecosystem plugins apply inside `src/routes`. + + Route files are imported through an id carrying the picked exports in the query (`routes/api.ts?pick=GET`), which left the id ending in the export name. Plugins whose filter is anchored on the file extension (`/\.[cm]?[jt]sx?$/`, the default for `unplugin-auto-import`, `unplugin-macros` and others) silently skipped every route file. The id now ends with a `lang.` marker, the same convention Vue SFCs use for `?vue&type=script&lang.ts`. Chunk filenames are unchanged. + +- d9018d6: fix(types): add missing properties to `SolidStartOptions` and expose them via Vite plugin configuration +- 87d73e1: chore: bump seroval to v1.6.0 +- 37d4488: Migrate the built-in Vite configuration from the deprecated `rollupOptions` alias to `rolldownOptions`. +- d8f1ea8: Apply the configured `nonce` to the two script tags that were still missing it, so a strict `script-src` CSP no longer needs `unsafe-inline`: + + - The client-side redirect that streaming mode emits after the shell has already flushed (``) now carries the nonce. + - The SPA entry script tag now carries the nonce, matching the SSR entry script. + +- b6dfaac: Updated dependencies, including `cookie-es` to 3, `shiki` to 4, `srvx` to 0.12.4, `oxc-parser` to 0.141 and `seroval` to 1.5.6. `parseSetCookie` now returns `undefined` for cookies with a forbidden name or an empty name and value, and those cookies are no longer forwarded to nested server function requests. +- e26cef0: Fix TS2883/TS2742 when emitting declarations for `entry-server.tsx`. `createHandler` now returns `StartHandler`, a type owned by `@solidjs/start`, instead of h3's `H3`, so the inferred type of `export default createHandler(...)` no longer has to be named through a nested `node_modules/@solidjs/start/node_modules/h3` path. +- 7c8dbe6: keep TypeScript namespace members in route files during production builds +- 3573985: Await asynchronous `serverFunctions.onError` handlers before serializing server function errors. + Preserve the original error if the handler throws or rejects. +- 27fca88: Fix actions returning `json()` or `reload()` leaving no-JS form submissions stranded on the `/_server` endpoint. These responses carry a value rather than a destination, so the redirect issued for progressive-enhancement submissions had no `Location` header. It now falls back to the submitting page, and the response value is unwrapped into the flash cookie so `useSubmission().result` matches the JS path. +- b3c7aaf: Update `h3` to `2.0.1-rc.26`. +- b3c7aaf: Fixed event response status and headers set during server-side rendering with deferred async resources, not being applied on the outgoing response. +- 4e98ac0: Restore the optional `routerLoad` third argument to `createHandler`, which primes custom routers (e.g. TanStack Router) on the server before SSR rendering. It was accidentally dropped in the v2 rewrite. +- 3f2b7a7: Fixed css from files with url sensitive characters such as `+` not being server-rendered. +- f15724b: Declare `@solidjs/router` as an optional peer dependency constrained to `>=0.16.0 <2.0.0-0`. Router v2 is expected to target Solid v2, so installing it alongside `@solidjs/start` v2 now surfaces a peer warning instead of silently producing an incompatible pairing. The peer is marked optional, so apps that do not use the router are unaffected. +- 5c8612f: Apply cookies set on a returned or thrown response during single flight mutations. `redirect(to, { headers: { "Set-Cookie": ... } })` previously only reached the browser: the single flight re-render of the redirect target still ran with the old request cookies, so queries reading that cookie saw stale values. Those cookies are now merged into the request the re-render sees, matching what a browser round trip would have sent. +- 83122ed: Reject server function calls when the response is a 5xx without an X-Error header, instead of resolving with the parsed error body +- 75debc3: Scope the built-in `~` alias to the app package, so files in other workspace packages can map `~` to their own root through an importer-aware plugin such as `vite-tsconfig-paths`. In stylesheets and asset URLs (CSS `@import`, `url()`, `new URL(..., import.meta.url)`) `~` still always means the app root, since Vite resolves those without running plugins. +- 02cd41e: Stop the dev toolbar from reporting benign `ResizeObserver loop` notifications as application errors. Browsers dispatch these as window `error` events carrying no error object, so the toolbar was capturing the raw `ErrorEvent` and force-opening the error panel over the app on every resize. +- d3c2af2: Don't send server error stack traces to the client in production builds. When a server function throws, the error is serialized and rethrown on the client, and seroval included `Error.prototype.stack` by default, leaking server file paths and internal function names. Stacks are still serialized in development. + ## 2.0.0-rc.10 ### Minor Changes @@ -88,6 +177,7 @@ Route files are imported through an id carrying the picked exports in the query (`routes/api.ts?pick=GET`), which left the id ending in the export name. Plugins whose filter is anchored on the file extension (`/\.[cm]?[jt]sx?$/`, the default for `unplugin-auto-import`, `unplugin-macros` and others) silently skipped every route file. The id now ends with a `lang.` marker, the same convention Vue SFCs use for `?vue&type=script&lang.ts`. Chunk filenames are unchanged. - d8f1ea8: Apply the configured `nonce` to the two script tags that were still missing it, so a strict `script-src` CSP no longer needs `unsafe-inline`: + - The client-side redirect that streaming mode emits after the shell has already flushed (``) now carries the nonce. - The SPA entry script tag now carries the nonce, matching the SSR entry script. @@ -267,6 +357,7 @@ - 8256190: Rework `@solidjs/start/env` - 6cbba24: Fix multiple Set-Cookie headers being lost on redirect responses - d4cc548: ## Bump Seroval + - version `1.4.1` - dd40610: Handle base url in api routes diff --git a/packages/start/package.json b/packages/start/package.json index 8efa7479e..73c3f4d64 100644 --- a/packages/start/package.json +++ b/packages/start/package.json @@ -1,6 +1,6 @@ { "name": "@solidjs/start", - "version": "2.0.0-rc.10", + "version": "2.0.0", "repository": { "type": "git", "url": "git+https://github.com/solidjs/solid-start.git", From d3532641a80a5ccaa277bd74a0a61f45d005b76c Mon Sep 17 00:00:00 2001 From: Birk Skyum Date: Tue, 4 Aug 2026 17:08:55 +0200 Subject: [PATCH 2/2] github release notes --- packages/start/CHANGELOG.md | 91 +++---------------------------------- 1 file changed, 6 insertions(+), 85 deletions(-) diff --git a/packages/start/CHANGELOG.md b/packages/start/CHANGELOG.md index ec2a45b75..00735862b 100644 --- a/packages/start/CHANGELOG.md +++ b/packages/start/CHANGELOG.md @@ -2,92 +2,15 @@ ## 2.0.0 -### Minor Changes - -- eeff49a: add new dev toolbar -- bac24b2: Add a `serverFunctions.onError` option naming a module that observes and replaces what a server function threw, before it is serialized into the response -- 4c803e5: Add `serialization.plugins` to configure custom Seroval plugins for server functions. - - Values Seroval has no built-in support for (Mongo's `ObjectId`, Prisma's `Decimal`, `Temporal`, and other custom classes) previously threw when returned from or passed to a server function. Point the new option at a module whose default export is an array of plugins: - - ```ts - // vite.config.ts - solidStart({ - serialization: { - plugins: "src/seroval-plugins.ts", - }, - }); - ``` - - ```ts - // src/seroval-plugins.ts - import { createPlugin } from "@solidjs/start/serialization"; - ``` - - The module is bundled into both the client and the server so both ends of a server function agree on the format, so it must not import server-only code. SolidStart's built-in plugins keep precedence. Only server-function and action payloads are affected; the SSR hydration payload is serialized by `solid-js/web`. - - Also adds a `@solidjs/start/serialization` entrypoint re-exporting Seroval's `createPlugin`, `OpaqueReference`, and plugin types, so plugin authors stay on the same Seroval version SolidStart serializes with. - -- 3f2b7a7: The file filter logic used for CSS crawling in development can now be configured with the vite plugin option `css.filter` analog to `serverFunctions.filter`: - - ```ts - solidStart({ - css: { - filter: { - // Exclude all node_modules except "my-dependency" with a flat node_modules layout - exclude: "node_modules/!(my-dependency)/**/*", - }, - }, - }); - ``` - - With pnpm, Vite may resolve dependencies through the nested `.pnpm` directory. Use a regular expression that accounts for that layout: - - ```ts - solidStart({ - css: { - filter: { - exclude: - /node_modules\/(?!(?:\.pnpm\/[^/]+\/node_modules\/)?my-dependency(?:\/|$))/, - }, - }, - }); - ``` +### Highlights -### Patch Changes +SolidStart v2 is now stable. This release replaces Vinxi with direct use of Vite’s Environment API, providing Solid v1 applications with a simpler Vite 8 and Rolldown-powered foundation, improved compatibility with the Vite ecosystem, and direct integration with deployment plugins. -- 27c2877: Remove leftover debug `console.log` calls from the server functions inspector, which logged on every server function request in dev. -- bd8cb01: Update srvx to version 0.12.0. -- 8eef552: Remove type-only import remnants from client server-function transforms so they do not retain server-only dependency chains. -- 6581877: Fixed shared chunk css not being server rendered in production (Vite 8 regression). -- e117d91: Route module ids now end in the source extension, so ecosystem plugins apply inside `src/routes`. +SolidStart v2 requires Node.js 24 or newer and Vite 8. Most SolidStart v1 applications can upgrade by moving their framework configuration from `app.config.ts` to `vite.config.ts` and following the migration guide. - Route files are imported through an id carrying the picked exports in the query (`routes/api.ts?pick=GET`), which left the id ending in the export name. Plugins whose filter is anchored on the file extension (`/\.[cm]?[jt]sx?$/`, the default for `unplugin-auto-import`, `unplugin-macros` and others) silently skipped every route file. The id now ends with a `lang.` marker, the same convention Vue SFCs use for `?vue&type=script&lang.ts`. Chunk filenames are unchanged. - -- d9018d6: fix(types): add missing properties to `SolidStartOptions` and expose them via Vite plugin configuration -- 87d73e1: chore: bump seroval to v1.6.0 -- 37d4488: Migrate the built-in Vite configuration from the deprecated `rollupOptions` alias to `rolldownOptions`. -- d8f1ea8: Apply the configured `nonce` to the two script tags that were still missing it, so a strict `script-src` CSP no longer needs `unsafe-inline`: - - - The client-side redirect that streaming mode emits after the shell has already flushed (``) now carries the nonce. - - The SPA entry script tag now carries the nonce, matching the SSR entry script. - -- b6dfaac: Updated dependencies, including `cookie-es` to 3, `shiki` to 4, `srvx` to 0.12.4, `oxc-parser` to 0.141 and `seroval` to 1.5.6. `parseSetCookie` now returns `undefined` for cookies with a forbidden name or an empty name and value, and those cookies are no longer forwarded to nested server function requests. -- e26cef0: Fix TS2883/TS2742 when emitting declarations for `entry-server.tsx`. `createHandler` now returns `StartHandler`, a type owned by `@solidjs/start`, instead of h3's `H3`, so the inferred type of `export default createHandler(...)` no longer has to be named through a nested `node_modules/@solidjs/start/node_modules/h3` path. -- 7c8dbe6: keep TypeScript namespace members in route files during production builds -- 3573985: Await asynchronous `serverFunctions.onError` handlers before serializing server function errors. - Preserve the original error if the handler throws or rejects. -- 27fca88: Fix actions returning `json()` or `reload()` leaving no-JS form submissions stranded on the `/_server` endpoint. These responses carry a value rather than a destination, so the redirect issued for progressive-enhancement submissions had no `Location` header. It now falls back to the submitting page, and the response value is unwrapped into the flash cookie so `useSubmission().result` matches the JS path. -- b3c7aaf: Update `h3` to `2.0.1-rc.26`. -- b3c7aaf: Fixed event response status and headers set during server-side rendering with deferred async resources, not being applied on the outgoing response. -- 4e98ac0: Restore the optional `routerLoad` third argument to `createHandler`, which primes custom routers (e.g. TanStack Router) on the server before SSR rendering. It was accidentally dropped in the v2 rewrite. -- 3f2b7a7: Fixed css from files with url sensitive characters such as `+` not being server-rendered. -- f15724b: Declare `@solidjs/router` as an optional peer dependency constrained to `>=0.16.0 <2.0.0-0`. Router v2 is expected to target Solid v2, so installing it alongside `@solidjs/start` v2 now surfaces a peer warning instead of silently producing an incompatible pairing. The peer is marked optional, so apps that do not use the router are unaffected. -- 5c8612f: Apply cookies set on a returned or thrown response during single flight mutations. `redirect(to, { headers: { "Set-Cookie": ... } })` previously only reached the browser: the single flight re-render of the redirect target still ran with the old request cookies, so queries reading that cookie saw stale values. Those cookies are now merged into the request the re-render sees, matching what a browser round trip would have sent. -- 83122ed: Reject server function calls when the response is a 5xx without an X-Error header, instead of resolving with the parsed error body -- 75debc3: Scope the built-in `~` alias to the app package, so files in other workspace packages can map `~` to their own root through an importer-aware plugin such as `vite-tsconfig-paths`. In stylesheets and asset URLs (CSS `@import`, `url()`, `new URL(..., import.meta.url)`) `~` still always means the app root, since Vite resolves those without running plugins. -- 02cd41e: Stop the dev toolbar from reporting benign `ResizeObserver loop` notifications as application errors. Browsers dispatch these as window `error` events carrying no error object, so the toolbar was capturing the raw `ErrorEvent` and force-opening the error panel over the app on every resize. -- d3c2af2: Don't send server error stack traces to the client in production builds. When a server function throws, the error is serialized and rethrown on the client, and seroval included `Error.prototype.stack` by default, leaking server file paths and internal function names. Stacks are still serialized in development. +- [Read the full SolidStart v2 announcement](https://github.com/solidjs/solid-start/discussions/2281) +- [Follow the migration guide](https://docs.solidjs.com/solid-start/v2/migrating-from-v1) +- [View the complete changelog](https://github.com/solidjs/solid-start/blob/main/packages/start/CHANGELOG.md) ## 2.0.0-rc.10 @@ -177,7 +100,6 @@ Route files are imported through an id carrying the picked exports in the query (`routes/api.ts?pick=GET`), which left the id ending in the export name. Plugins whose filter is anchored on the file extension (`/\.[cm]?[jt]sx?$/`, the default for `unplugin-auto-import`, `unplugin-macros` and others) silently skipped every route file. The id now ends with a `lang.` marker, the same convention Vue SFCs use for `?vue&type=script&lang.ts`. Chunk filenames are unchanged. - d8f1ea8: Apply the configured `nonce` to the two script tags that were still missing it, so a strict `script-src` CSP no longer needs `unsafe-inline`: - - The client-side redirect that streaming mode emits after the shell has already flushed (``) now carries the nonce. - The SPA entry script tag now carries the nonce, matching the SSR entry script. @@ -357,7 +279,6 @@ - 8256190: Rework `@solidjs/start/env` - 6cbba24: Fix multiple Set-Cookie headers being lost on redirect responses - d4cc548: ## Bump Seroval - - version `1.4.1` - dd40610: Handle base url in api routes