Release RC packages (rc)

[github-actions]

This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to next, this PR will be updated.

⚠️⚠️⚠️⚠️⚠️⚠️

next is currently in pre mode so this branch has prereleases rather than normal releases. If you want to exit prereleases, run changeset pre exit on next.

⚠️⚠️⚠️⚠️⚠️⚠️

Releases

@solidjs/babel-plugin@2.0.0-rc.7

Patch Changes

• ead7b1a: Keep hydration IDs aligned when an intrinsic element has a ref and one reactive spread.
• d601119: Remove the experimental patch channel and patch-mode list driver (always opt-in, never default). Graph-native regions own value delivery and the unified-For design owns list structure, so the channel's parallel delivery machinery is retired: patch.ts/patch-driver.ts deleted, the compiler-contract exports (registerPatch/registerRowOps/registerSlotPatch/patchableRaw, patchDriver/rowProof/driveList) removed, the patchDriver compiler option dropped from both compilers, the insert $ll seam stripped, and the write-side channel struct dieted to the single written-keys bound (t.wk) the core fold/notify paths actually use. Store-family app bundles reclaim up to ~900 B brotli; every measured tier shrinks.

@solidjs/compiler@2.0.0-rc.7

Patch Changes

• ead7b1a: Keep hydration IDs aligned when an intrinsic element has a ref and one reactive spread.
• d601119: Remove the experimental patch channel and patch-mode list driver (always opt-in, never default). Graph-native regions own value delivery and the unified-For design owns list structure, so the channel's parallel delivery machinery is retired: patch.ts/patch-driver.ts deleted, the compiler-contract exports (registerPatch/registerRowOps/registerSlotPatch/patchableRaw, patchDriver/rowProof/driveList) removed, the patchDriver compiler option dropped from both compilers, the insert $ll seam stripped, and the write-side channel struct dieted to the single written-keys bound (t.wk) the core fold/notify paths actually use. Store-family app bundles reclaim up to ~900 B brotli; every measured tier shrinks.

@solidjs/diagnostics@2.0.0-rc.7

Patch Changes

• Updated dependencies [d601119]
  • @solidjs/signals@2.0.0-rc.7

@solidjs/element@2.0.0-rc.7

Patch Changes

• Updated dependencies [1226381]
• Updated dependencies [7009adf]
• Updated dependencies [a14c138]
• Updated dependencies [c08e974]
• Updated dependencies [292bdc5]
• Updated dependencies [3424f9a]
• Updated dependencies [f21e060]
• Updated dependencies [5cee0f7]
• Updated dependencies [6bb51c9]
• Updated dependencies [ff2ecf1]
• Updated dependencies [c0bc9ba]
• Updated dependencies [b7b17ab]
• Updated dependencies [ed6b605]
• Updated dependencies [6c9f8f4]
• Updated dependencies [3393fb6]
• Updated dependencies [d601119]
• Updated dependencies [84a94bc]
• Updated dependencies [a1ff286]
  • @solidjs/web@2.0.0-rc.7
  • solid-js@2.0.0-rc.7

@solidjs/h@2.0.0-rc.7

Patch Changes

• Updated dependencies [1226381]
• Updated dependencies [7009adf]
• Updated dependencies [a14c138]
• Updated dependencies [c08e974]
• Updated dependencies [292bdc5]
• Updated dependencies [f21e060]
• Updated dependencies [5cee0f7]
• Updated dependencies [6bb51c9]
• Updated dependencies [ff2ecf1]
• Updated dependencies [c0bc9ba]
• Updated dependencies [b7b17ab]
• Updated dependencies [ed6b605]
• Updated dependencies [6c9f8f4]
• Updated dependencies [3393fb6]
• Updated dependencies [d601119]
• Updated dependencies [84a94bc]
• Updated dependencies [a1ff286]
  • @solidjs/web@2.0.0-rc.7

@solidjs/html@2.0.0-rc.7

Patch Changes

• Updated dependencies [1226381]
• Updated dependencies [7009adf]
• Updated dependencies [a14c138]
• Updated dependencies [c08e974]
• Updated dependencies [292bdc5]
• Updated dependencies [f21e060]
• Updated dependencies [5cee0f7]
• Updated dependencies [6bb51c9]
• Updated dependencies [ff2ecf1]
• Updated dependencies [c0bc9ba]
• Updated dependencies [b7b17ab]
• Updated dependencies [ed6b605]
• Updated dependencies [6c9f8f4]
• Updated dependencies [3393fb6]
• Updated dependencies [d601119]
• Updated dependencies [84a94bc]
• Updated dependencies [a1ff286]
  • @solidjs/web@2.0.0-rc.7

@solidjs/signals@2.0.0-rc.7

Patch Changes

• d601119: Remove the experimental patch channel and patch-mode list driver (always opt-in, never default). Graph-native regions own value delivery and the unified-For design owns list structure, so the channel's parallel delivery machinery is retired: patch.ts/patch-driver.ts deleted, the compiler-contract exports (registerPatch/registerRowOps/registerSlotPatch/patchableRaw, patchDriver/rowProof/driveList) removed, the patchDriver compiler option dropped from both compilers, the insert $ll seam stripped, and the write-side channel struct dieted to the single written-keys bound (t.wk) the core fold/notify paths actually use. Store-family app bundles reclaim up to ~900 B brotli; every measured tier shrinks.

solid-js@2.0.0-rc.7

Patch Changes

• 3424f9a: Consume the first value of live-derived stores during SSR and reconnect their live sources after hydration.
• d601119: Remove the experimental patch channel and patch-mode list driver (always opt-in, never default). Graph-native regions own value delivery and the unified-For design owns list structure, so the channel's parallel delivery machinery is retired: patch.ts/patch-driver.ts deleted, the compiler-contract exports (registerPatch/registerRowOps/registerSlotPatch/patchableRaw, patchDriver/rowProof/driveList) removed, the patchDriver compiler option dropped from both compilers, the insert $ll seam stripped, and the write-side channel struct dieted to the single written-keys bound (t.wk) the core fold/notify paths actually use. Store-family app bundles reclaim up to ~900 B brotli; every measured tier shrinks.
• Updated dependencies [d601119]
  • @solidjs/signals@2.0.0-rc.7

@solidjs/universal@2.0.0-rc.7

Patch Changes

• d601119: Remove the experimental patch channel and patch-mode list driver (always opt-in, never default). Graph-native regions own value delivery and the unified-For design owns list structure, so the channel's parallel delivery machinery is retired: patch.ts/patch-driver.ts deleted, the compiler-contract exports (registerPatch/registerRowOps/registerSlotPatch/patchableRaw, patchDriver/rowProof/driveList) removed, the patchDriver compiler option dropped from both compilers, the insert $ll seam stripped, and the write-side channel struct dieted to the single written-keys bound (t.wk) the core fold/notify paths actually use. Store-family app bundles reclaim up to ~900 B brotli; every measured tier shrinks.
• Updated dependencies [3424f9a]
• Updated dependencies [d601119]
  • solid-js@2.0.0-rc.7

@solidjs/web@2.0.0-rc.7

Patch Changes

• 1226381: Bind GET() grants to the function identity they were declared about (A GET() grant governs an id, not the function it was granted to #3237). The grant — GET/HEAD dispatch plus the CSRF origin-gate exemption — was keyed by id alone, so register -> register -> GET(oldReference) handed the NEW function cross-site GET execution on the strength of a declaration the old one signed. The grant now records the declared function, and a single declaresRead(id) check governs both dispatch and the 405 Allow advertisement; a stale or unverifiable declaration fails closed (GET refused, POST + origin gate required). A declaration or withMeta({ method }) write that would change an existing grant's binding throws in dev and fails closed in prod, never silently rebinds.
• 7009adf: Bound the request body cap by the bytes actually received: a conforming Content-Length under the limit no longer skips the counting read, so an under-declared body cannot stream past bodySizeLimit into the decoder, and the abort/teardown coupling for abandoned uploads now covers declared-length POSTs too (The body cap is decided by the peer's Content-Length, so every ordinary POST skips it #3236).
• a14c138: Dedupe the requested single-flight source ids to a first-seen-order set at entry, so a repeated id runs its collector once and echoes once in the response header instead of multiplying work by the caller-controlled list length (The single-flight source list is honored as a multiset, so a caller picks its own amplification factor #3251)
• c08e974: Document the per-handler wrapInvocation option as entry-only (A per-handler wrapInvocation never sees the calls the dispatched body makes #3240). Ruled: entry-only semantics are kept — the option wraps exactly the invocation the request addressed, and nested direct server-function calls made by the dispatched body are not re-wrapped by it; hop-by-hop policy belongs to the configured (ambient) hook, which wraps every direct call. TSDoc only, no runtime behavior change; the boundary is now pinned by a regression test.
• 292bdc5: Enforce provideEvent's exactly-once contract on direct SSR calls too: the invocation count provideEvent's contract is unenforced: calling fn twice double-commits a mutation under a 200 #3172 added to HTTP dispatch now guards both legs through a shared provideEventOnce seam, so a hook that double-invokes or skips the callback fails loudly during a render instead of silently double-committing a mutation or answering undefined, while synchronous direct calls keep returning their value synchronously (provideEvent's exactly-once contract is enforced on HTTP dispatch and nowhere else #3246).
• f21e060: Flash falsy no-JS outcomes (0, false, "", null) instead of silently dropping them: the flash decode and the no-JS handler now decide structurally (result presence, Response shape) rather than by truthiness, and dispatch no longer erodes a returned null to undefined on its way to the handler; an undefined outcome keeps its current no-cookie behavior pending ruling (A falsy outcome is no outcome: a committed submission reports nothing to the next render #3248)
• 5cee0f7: Guard enumerable failure channels carried on Error results: the result-encoding guard walk now descends Error-prototyped carriers (which seroval encodes with their own properties) so a rejecting promise, erroring stream, or throwing iterable assigned onto a returned Error is sanitized and torn down like any other channel, while the carrier keeps its prototype, message, and own data (The result guard walks neither Error carriers nor non-enumerable slots, so the channels under them ride unguarded #3235).
• 6bb51c9: Keep -0 off the server-function JSON fast path. JSON.stringify(-0) is "0", so a signed zero admitted by isJSONSafe rode the fast path and arrived as +0 — a silent sign flip on the exact guard that already refuses NaN and the infinities for the same reason. -0 now answers "not JSON-safe" and rides the codec, which spells it exactly, on both legs (argument lists and results).
• ff2ecf1: Own every promise the server-function decoder mints. A rejected promise decoded out of a peer's payload — a rejection frame arriving mid-stream, or an atomic rejected-promise node settling synchronously during decode — had no owner when the consumer never read (or abandoned) the slot, and escaped as an unhandled rejection that ends a Node consumer under its default policy. The decoder now attaches a noop rejection handler at mint time, mirroring the encode side's guardedPromise ownership (A rejecting promise in a result graph that fails to encode takes down the Node process #3216); real consumers still observe the rejection unchanged.
• c0bc9ba: Adopt a transformFlightResult Response via the ownership seam (ownResponse) before stamping the mutation's cookies and accumulated headers onto it, so a Response the integration retains (a memoized shell) never accumulates one caller's session cookies and serves them to the next (The single-flight fold stamps this request's cookies onto a Response the integration still holds #3234, completing commitEventResponse mutates the returned Response in place, so a cached Response accumulates every user's Set-Cookie #3155)
• b7b17ab: Make extractBody own the stream it decodes: the body is read where it lies, never from an internal clone. An unread tee branch queues the whole payload in memory for the life of the read and defeats backpressure and cancellation — the same ownership defect fixed for the upload leg in bufferBodyWithin (A client disconnect on a chunked upload rejects out of handleServerFunctionRequest instead of answering a status #3217–The 413 refusal cancels a tee branch, never the upload source #3219). decodeResponse keeps its documented contract (an integration's response stays readable) by cloning at its own entry — a branch that is then read in full; the client transport decodes the response it owns directly, and the server's argument road reuses its one deliberate clone (kept so event.request stays readable) for the empty-body inspection instead of teeing again. This is the clone half of The client transport buffers every response twice and never ends the connection it opened #3244 only; connection teardown on completion is deliberately not included.
• ed6b605: Throw a clear configuration error for invalid wrapInvocation values (A wrapInvocation option that is not a hook removes the configured authorization gate #3238). A value other than a function or undefined — null, false, an options bag in the wrong slot — used to fail in the quietest available direction: falsy values silently took per-invocation policy (auth, logging) off the call, truthy non-functions threw a bare "not a function" mid-dispatch. The hook is now validated at the point it is resolved for an invocation, on both roads (HTTP dispatch and direct SSR calls), with an error naming wrapInvocation and the received type; undefined stays the one spelling of absence.
• 6c9f8f4: Refuse an unrecognized X-Server-Function-Format tag before the decode switch runs. The content-type sniffing branches (there for untagged form posts) matched regardless of the tag, so a body tagged with a format this build has no case for — version skew from a newer peer, or a duplicated header that Headers.get joins into one unknown value — was silently reinterpreted as a form and the function ran on an argument it was never sent. Such bodies now answer 400 before dispatch, with a development message naming version skew; untagged bodies keep the sniffing, and an untagged empty body stays a zero-argument call (Zero-argument server function calls 400 behind hosts that convert Node requests (empty POST body stream parses as an argument) #3214).
• 3393fb6: Refuse to flash when no storable cookie exists for a no-JS outcome (The degrade ladder bounds every field but url, so the cookie is discarded whole while claiming it fit #3249). The degrade ladder (The no-JS flash cookie has no size bound — an outcome past the browser's ceiling vanishes silently #3137) bounds the input echo and the result but never looked at url — pathname + search of a request the caller chose — so a long enough form action pushed the fully-degraded payload past the ~4 KB cookie ceiling and the encoder emitted a cookie the browser discards whole, with truncated: true inside asserting a degradation that never stored. encodeFlashCookie now returns null when even the degraded payload cannot fit, and the no-JS handler falls back to the plain redirect — never an oversized cookie, never a url truncated to a prefix that would attach the outcome to a submission it does not identify. Cookie naming, attributes, and refusal/redirect statuses are untouched (The flash cookie carries the submission with no SameSite, no lifetime and no __Host- prefix #3239, A form navigation refused before dispatch is left on /_server/<id> with everything the user typed gone #3250 pending).
• d601119: Remove the experimental patch channel and patch-mode list driver (always opt-in, never default). Graph-native regions own value delivery and the unified-For design owns list structure, so the channel's parallel delivery machinery is retired: patch.ts/patch-driver.ts deleted, the compiler-contract exports (registerPatch/registerRowOps/registerSlotPatch/patchableRaw, patchDriver/rowProof/driveList) removed, the patchDriver compiler option dropped from both compilers, the insert $ll seam stripped, and the write-side channel struct dieted to the single written-keys bound (t.wk) the core fold/notify paths actually use. Store-family app bundles reclaim up to ~900 B brotli; every measured tier shrinks.
• 84a94bc: Scope deferred work nested inside plain-object and array carriers to the producing call's request event (A generator or stream returned inside a container is scoped to no request #3241, completing Generator server function bodies run outside provideEvent: they read the puller's request event, and direct calls clobber each other's locals #3222). The HTTP road already applied the wrapping in the encoded representation (the guard walk's rebuilt shells); the direct SSR road only looked at the returned value itself, so return { rows: cursor() } ran its generator under the render's ambient event — two concurrent direct calls read and wrote each other's locals, and the render's own. The direct road now descends plain-object/array carriers and hands the caller a shallow-rebuilt carrier with the bound wrappers in the deferred slots; the user's returned containers are never written into, and results with nothing deferred keep their identity. Set/Map members, class instances, and frozen/non-writable slots are deliberately out of the carrier set (pinned by test): bodies reached through them stay bound to nothing, as before.
• a1ff286: Run transformResult for plain thrown errors as its documentation already promises: the hook now runs once at the thrown path's entry (context.thrown set) for every thrown value — not only thrown Response/envelope shapes — and the response tail is selected from its output, while the wire stays sanitized and a hook that itself throws is contained as a sanitized 500 (transformResult sees every failure an author shaped by hand and none that happen to the app #3247).
• Updated dependencies [3424f9a]
• Updated dependencies [d601119]
  • solid-js@2.0.0-rc.7

test-integration@2.0.0-rc.7

Patch Changes

• Updated dependencies [ead7b1a]
• Updated dependencies [1226381]
• Updated dependencies [7009adf]
• Updated dependencies [a14c138]
• Updated dependencies [c08e974]
• Updated dependencies [292bdc5]
• Updated dependencies [3424f9a]
• Updated dependencies [f21e060]
• Updated dependencies [5cee0f7]
• Updated dependencies [6bb51c9]
• Updated dependencies [ff2ecf1]
• Updated dependencies [c0bc9ba]
• Updated dependencies [b7b17ab]
• Updated dependencies [ed6b605]
• Updated dependencies [6c9f8f4]
• Updated dependencies [3393fb6]
• Updated dependencies [d601119]
• Updated dependencies [84a94bc]
• Updated dependencies [a1ff286]
  • @solidjs/babel-plugin@2.0.0-rc.7
  • @solidjs/web@2.0.0-rc.7
  • solid-js@2.0.0-rc.7
  • @solidjs/signals@2.0.0-rc.7
  • @solidjs/universal@2.0.0-rc.7
  • @solidjs/h@2.0.0-rc.7
  • @solidjs/html@2.0.0-rc.7