From cb62ee05612f3dfc1a49fb7f4669eb732e6feb0b Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Thu, 10 Sep 2026 09:49:35 +0000 Subject: [PATCH] Version packages (rc) --- .changeset/pre.json | 18 +++ packages/babel-plugin/CHANGELOG.md | 25 ++++ packages/babel-plugin/package.json | 2 +- packages/compiler/CHANGELOG.md | 25 ++++ .../compiler/npm/darwin-arm64/package.json | 2 +- packages/compiler/npm/darwin-x64/package.json | 2 +- .../compiler/npm/linux-arm64-gnu/package.json | 2 +- .../compiler/npm/linux-x64-gnu/package.json | 2 +- .../compiler/npm/wasm32-wasi/package.json | 2 +- .../compiler/npm/win32-x64-msvc/package.json | 2 +- packages/compiler/package.json | 14 +- packages/diagnostics/CHANGELOG.md | 64 ++++++++++ packages/diagnostics/package.json | 4 +- packages/element/CHANGELOG.md | 18 +++ packages/element/package.json | 6 +- packages/h/CHANGELOG.md | 29 +++++ packages/h/package.json | 4 +- packages/html/CHANGELOG.md | 29 +++++ packages/html/package.json | 4 +- packages/signals/CHANGELOG.md | 120 ++++++++++++++++++ packages/signals/package.json | 2 +- packages/solid/CHANGELOG.md | 101 +++++++++++++++ packages/solid/package.json | 4 +- packages/test-integration/CHANGELOG.md | 30 +++++ packages/test-integration/package.json | 2 +- packages/universal/CHANGELOG.md | 71 +++++++++++ packages/universal/package.json | 4 +- packages/web/CHANGELOG.md | 103 +++++++++++++++ packages/web/package.json | 4 +- 29 files changed, 664 insertions(+), 31 deletions(-) diff --git a/.changeset/pre.json b/.changeset/pre.json index 394de44e8..35a8d35e3 100644 --- a/.changeset/pre.json +++ b/.changeset/pre.json @@ -60,6 +60,7 @@ "async-waterfall-attribution", "attribution-feedback-facts", "attribution-feedback-tables", + "attribution-navigation-origin", "attribution-unstable-memo-output", "attribution-wide-write", "attribution-write-provenance", @@ -122,6 +123,7 @@ "dev-error-invalid-refresh-target", "dev-error-non-function-component", "dev-error-untracked-async-read", + "dev-gate-lazy-hydration-diagnostics", "dev-invariant-assertions", "dev-tools-cleanup", "dev-warn-scripted-304", @@ -138,6 +140,7 @@ "document-action-mutation-navigation-framing", "document-control-flow-callback-shapes", "document-entry-only-handler-wrap", + "document-event-request-contract", "document-face-live-holes-client", "document-live-slot-args-client", "document-shell-hydration-docs", @@ -193,10 +196,12 @@ "fix-composed-header-bounds", "fix-conditional-async-reveal-pending", "fix-content-length-guard-bypass", + "fix-contested-effect-rederive", "fix-cookie-bounds-and-validity", "fix-create-projection-seed-inference", "fix-dead-transition-stamp-revival", "fix-decoder-collision-orphaned-promise", + "fix-deep-chained-view-subscription", "fix-deep-optimistic-store-pending", "fix-deep-snapshot-held-landing-visibility", "fix-derived-event-locals-sharing", @@ -219,6 +224,7 @@ "fix-error-carrier-hidden-data-slots", "fix-errored-derive-memo-parity", "fix-errored-loading-hydration-ids", + "fix-finalize-reentry-effect-ownership", "fix-flash-url-unbound-base", "fix-flatten-needsunwrap-or", "fix-flight-owned-transaction", @@ -364,6 +370,7 @@ "fix-ssr-async-error-handling", "fix-ssr-bench-shape", "fix-ssr-errored-async-retry-loop", + "fix-ssr-escape-function-results", "fix-ssr-loading-errored-hydration", "fix-ssr-memo-promise-notready", "fix-ssr-owner-id-parity", @@ -373,6 +380,7 @@ "fix-ssr-retry-child-reset", "fix-ssr-retry-convergence-oom", "fix-ssr-server-projection-pending-store", + "fix-ssr-spread-children-read-once", "fix-ssr-stream-rejected-fragment-hang", "fix-ssr-sync-memo-child-id-leak", "fix-ssr-textarea-spread-value", @@ -433,6 +441,7 @@ "gate-child-companion-walk", "gate-invariants-to-test-builds", "get-read-contract", + "golf-effect-ownership-flag", "graph-size-diagnostics", "guard-error-carried-failure-channels", "guard-failures-iterative-walk", @@ -471,6 +480,7 @@ "lazy-async-inflight-autodispose", "lazy-children-storepath", "lazy-client-only-export-option", + "lazy-hydration-failure-visibility", "lazy-hydration-id-asset-keys", "lazy-nohydration-renders", "lazy-preload-assets", @@ -503,6 +513,8 @@ "nohydration-lazy-maparray-deps", "notready-skip-stack-capture", "npm-descriptions", + "observe-node-shapes", + "observe-tier", "optimistic-draft-reads-compose-over-staged-truth", "optimistic-landing-fold", "optimistic-lists-drivable", @@ -560,6 +572,7 @@ "rc-api-freeze-pass", "reaction-rearm-replaces", "read-every-body-the-transport-tees", + "rebuild-buffered-request-from-parts", "reconcile-array-object-shape-guard", "reconcile-default-id-positional-null", "reconcile-symbol-keyed-nodes", @@ -581,12 +594,14 @@ "refresh-lifts-stale-manual-write-mask", "refreshable-type-alias", "refusals-commit-event-stub", + "refuse-flush-in-action-body", "refuse-invalid-wrap-invocation-values", "refuse-unknown-body-format-tags-as-version-skew", "refuse-unstorable-flash-cookies", "register-settle-walk-diagnostic-code", "relocate-uninit-lane-check", "remove-capturing-event-listeners", + "remove-cjs", "remove-create-effect-single-argument-overload", "remove-derived-initial-values", "remove-dist-exports-and-fix-dual-types", @@ -605,6 +620,7 @@ "republish-fresh-signals-build", "require-client-source-commit-zero", "require-seroval-1-5-4", + "require-seroval-1-6", "response-head-lifecycle", "responsive-preload-links", "reveal-order-prop", @@ -665,6 +681,7 @@ "snapshot-hydration-safety", "snapshot-trailing-holes", "solid-native-frame-protocol-identifiers", + "spread-direct-sources", "ssr-falsy-rejections-and-thenables", "ssr-hole-id-scopes", "ssr-retry-robustness", @@ -718,6 +735,7 @@ "tighten-show-match-jsx-types", "tiny-lions-jam", "track-applied-classes", + "tracked-style-class-objects", "transform-result-sees-thrown-errors", "transparent-devcomponent", "transparent-effect-option-typed", diff --git a/packages/babel-plugin/CHANGELOG.md b/packages/babel-plugin/CHANGELOG.md index 024295b9f..fc60057ea 100644 --- a/packages/babel-plugin/CHANGELOG.md +++ b/packages/babel-plugin/CHANGELOG.md @@ -1,5 +1,30 @@ # @solidjs/babel-plugin +## 2.0.0-rc.8 + +### Patch Changes + +- 7d985b6: Fix SSR XSS: strings yielded by flow-control memos rendered unescaped + + `{s}`, `{v => v}`, ` s} />`, + `/`, boundary fallbacks and any component that returns a string through a + memo rendered that string raw on the server. The server flow controls return memos for + hydration-id alignment; `escape()` passed functions through by identity, and the resolver + appended whatever they later produced without escaping. + + One rule now: `escape(x)` at a hole covers everything reachable from `x` — strings, array + items, and what a function yields when the resolver calls it (a deferred-escape wrapper). + Finished `{ t }` nodes pass through. `Loading` escapes its content the way it already + escaped its fallback. The compilers stop wrapping fragment / mixed component children in + `_$escape` (they are values; escaping them too double-escaped through + `{props.children}`), and a single-expression fragment at a hole keeps the + hole's wrap. Live-hole tags ride the wrapper and `$slot` survives the array copy, so + frames behave as before. + +- ab4c40c: Object-valued `style` / `class` bindings are read in the TRACKED half of their effect. `style()` and `className()` enumerate their object in the effect's untracked commit phase, so a proxy value — a store sub-object (`style={state.style}`, `class={row.classes}`), merged props, anything arriving through a spread — was identity-reactive only: in-place key mutations never re-applied, and every leaf read tripped `STRICT_READ_UNTRACKED` in dev. Both compilers now wrap the compute value of a non-inline `style={expr}` / `class={expr}` in a new compiler primitive, `readShallow()`, and `spread()` applies it to those two keys as it copies. `readShallow` is an identity passthrough for strings, plain objects and proxy-free arrays (a fresh literal is already the compute's own — the common case pays a `typeof`); a proxy is copied with one `ownKeys` trap (its own trap keeps the key set tracked) plus one tracked read per key; arrays are re-mapped only when an element is a proxy. Inline literals are untouched — they already compile per property. Provably-string expressions (string/template literals, concatenation) and literal objects/arrays skip the wrap at compile time. New Tier-1 bench `style-class-object`: plain-object rows at parity; store-backed rows go from identity-only (and, in dev, ~97 ms per 500 elements of diagnostics) to per-key reactive at ~3.5 ms. Octane svg-dashboard (prod build, store-backed style/attrs through spread): mount at parity, style_spread_pulse −6%, select_toggle −7%. + + `spread()` shares the same enumeration: its compute half copied the source with `for…in` + `hasOwn`, which on a proxy source (`merge()`/`omit()`, `{...props}` in a component, store records — nearly every spread) is an `ownKeys` trap plus two `getOwnPropertyDescriptor` traps per key, each allocating a descriptor and a getter closure. It now takes the key set from one `Reflect.ownKeys` trap (the trap keeps the key set tracked) and reads each string key once; plain sources use `Object.keys`, the exact own-enumerable set the old loop yielded. New Tier-1 bench `spread-enumerate` (500 elements, 8 keys): `merge(static, reactive)` 376 → 537 ops/s (+43%), store record 253 → 415 ops/s (+64%), plain object at parity. + ## 2.0.0-rc.7 ### Patch Changes diff --git a/packages/babel-plugin/package.json b/packages/babel-plugin/package.json index fdf651f29..8b5c5ed8c 100644 --- a/packages/babel-plugin/package.json +++ b/packages/babel-plugin/package.json @@ -1,7 +1,7 @@ { "name": "@solidjs/babel-plugin", "description": "Babel compiler plugin for Solid templates", - "version": "2.0.0-rc.7", + "version": "2.0.0-rc.8", "author": "Ryan Carniato", "license": "MIT", "repository": { diff --git a/packages/compiler/CHANGELOG.md b/packages/compiler/CHANGELOG.md index 16f32d77c..d058d7712 100644 --- a/packages/compiler/CHANGELOG.md +++ b/packages/compiler/CHANGELOG.md @@ -1,5 +1,30 @@ # @solidjs/compiler +## 2.0.0-rc.8 + +### Patch Changes + +- 7d985b6: Fix SSR XSS: strings yielded by flow-control memos rendered unescaped + + `{s}`, `{v => v}`, ` s} />`, + `/`, boundary fallbacks and any component that returns a string through a + memo rendered that string raw on the server. The server flow controls return memos for + hydration-id alignment; `escape()` passed functions through by identity, and the resolver + appended whatever they later produced without escaping. + + One rule now: `escape(x)` at a hole covers everything reachable from `x` — strings, array + items, and what a function yields when the resolver calls it (a deferred-escape wrapper). + Finished `{ t }` nodes pass through. `Loading` escapes its content the way it already + escaped its fallback. The compilers stop wrapping fragment / mixed component children in + `_$escape` (they are values; escaping them too double-escaped through + `{props.children}`), and a single-expression fragment at a hole keeps the + hole's wrap. Live-hole tags ride the wrapper and `$slot` survives the array copy, so + frames behave as before. + +- ab4c40c: Object-valued `style` / `class` bindings are read in the TRACKED half of their effect. `style()` and `className()` enumerate their object in the effect's untracked commit phase, so a proxy value — a store sub-object (`style={state.style}`, `class={row.classes}`), merged props, anything arriving through a spread — was identity-reactive only: in-place key mutations never re-applied, and every leaf read tripped `STRICT_READ_UNTRACKED` in dev. Both compilers now wrap the compute value of a non-inline `style={expr}` / `class={expr}` in a new compiler primitive, `readShallow()`, and `spread()` applies it to those two keys as it copies. `readShallow` is an identity passthrough for strings, plain objects and proxy-free arrays (a fresh literal is already the compute's own — the common case pays a `typeof`); a proxy is copied with one `ownKeys` trap (its own trap keeps the key set tracked) plus one tracked read per key; arrays are re-mapped only when an element is a proxy. Inline literals are untouched — they already compile per property. Provably-string expressions (string/template literals, concatenation) and literal objects/arrays skip the wrap at compile time. New Tier-1 bench `style-class-object`: plain-object rows at parity; store-backed rows go from identity-only (and, in dev, ~97 ms per 500 elements of diagnostics) to per-key reactive at ~3.5 ms. Octane svg-dashboard (prod build, store-backed style/attrs through spread): mount at parity, style_spread_pulse −6%, select_toggle −7%. + + `spread()` shares the same enumeration: its compute half copied the source with `for…in` + `hasOwn`, which on a proxy source (`merge()`/`omit()`, `{...props}` in a component, store records — nearly every spread) is an `ownKeys` trap plus two `getOwnPropertyDescriptor` traps per key, each allocating a descriptor and a getter closure. It now takes the key set from one `Reflect.ownKeys` trap (the trap keeps the key set tracked) and reads each string key once; plain sources use `Object.keys`, the exact own-enumerable set the old loop yielded. New Tier-1 bench `spread-enumerate` (500 elements, 8 keys): `merge(static, reactive)` 376 → 537 ops/s (+43%), store record 253 → 415 ops/s (+64%), plain object at parity. + ## 2.0.0-rc.7 ### Patch Changes diff --git a/packages/compiler/npm/darwin-arm64/package.json b/packages/compiler/npm/darwin-arm64/package.json index 9cb4a2476..d427695d2 100644 --- a/packages/compiler/npm/darwin-arm64/package.json +++ b/packages/compiler/npm/darwin-arm64/package.json @@ -1,6 +1,6 @@ { "name": "@solidjs/compiler-darwin-arm64", - "version": "2.0.0-rc.7", + "version": "2.0.0-rc.8", "cpu": [ "arm64" ], diff --git a/packages/compiler/npm/darwin-x64/package.json b/packages/compiler/npm/darwin-x64/package.json index bb9173c0b..8e046f74f 100644 --- a/packages/compiler/npm/darwin-x64/package.json +++ b/packages/compiler/npm/darwin-x64/package.json @@ -1,6 +1,6 @@ { "name": "@solidjs/compiler-darwin-x64", - "version": "2.0.0-rc.7", + "version": "2.0.0-rc.8", "cpu": [ "x64" ], diff --git a/packages/compiler/npm/linux-arm64-gnu/package.json b/packages/compiler/npm/linux-arm64-gnu/package.json index cf6cd0c6c..2b5207267 100644 --- a/packages/compiler/npm/linux-arm64-gnu/package.json +++ b/packages/compiler/npm/linux-arm64-gnu/package.json @@ -1,6 +1,6 @@ { "name": "@solidjs/compiler-linux-arm64-gnu", - "version": "2.0.0-rc.7", + "version": "2.0.0-rc.8", "cpu": [ "arm64" ], diff --git a/packages/compiler/npm/linux-x64-gnu/package.json b/packages/compiler/npm/linux-x64-gnu/package.json index af9123905..af8dd9847 100644 --- a/packages/compiler/npm/linux-x64-gnu/package.json +++ b/packages/compiler/npm/linux-x64-gnu/package.json @@ -1,6 +1,6 @@ { "name": "@solidjs/compiler-linux-x64-gnu", - "version": "2.0.0-rc.7", + "version": "2.0.0-rc.8", "cpu": [ "x64" ], diff --git a/packages/compiler/npm/wasm32-wasi/package.json b/packages/compiler/npm/wasm32-wasi/package.json index a83cb3398..2749a8050 100644 --- a/packages/compiler/npm/wasm32-wasi/package.json +++ b/packages/compiler/npm/wasm32-wasi/package.json @@ -1,6 +1,6 @@ { "name": "@solidjs/compiler-wasm32-wasi", - "version": "2.0.0-rc.7", + "version": "2.0.0-rc.8", "main": "compiler.wasi.cjs", "files": [ "compiler.wasm32-wasi.wasm", diff --git a/packages/compiler/npm/win32-x64-msvc/package.json b/packages/compiler/npm/win32-x64-msvc/package.json index 4daaeaa0f..270f4c33e 100644 --- a/packages/compiler/npm/win32-x64-msvc/package.json +++ b/packages/compiler/npm/win32-x64-msvc/package.json @@ -1,6 +1,6 @@ { "name": "@solidjs/compiler-win32-x64-msvc", - "version": "2.0.0-rc.7", + "version": "2.0.0-rc.8", "cpu": [ "x64" ], diff --git a/packages/compiler/package.json b/packages/compiler/package.json index 00d83514d..6ffbd670d 100644 --- a/packages/compiler/package.json +++ b/packages/compiler/package.json @@ -1,7 +1,7 @@ { "name": "@solidjs/compiler", "description": "Solid's native Oxc JSX compiler", - "version": "2.0.0-rc.7", + "version": "2.0.0-rc.8", "author": "Ryan Carniato", "license": "MIT", "repository": { @@ -62,11 +62,11 @@ "emnapi": "^1.11.3" }, "optionalDependencies": { - "@solidjs/compiler-darwin-x64": "2.0.0-rc.7", - "@solidjs/compiler-darwin-arm64": "2.0.0-rc.7", - "@solidjs/compiler-linux-x64-gnu": "2.0.0-rc.7", - "@solidjs/compiler-linux-arm64-gnu": "2.0.0-rc.7", - "@solidjs/compiler-win32-x64-msvc": "2.0.0-rc.7", - "@solidjs/compiler-wasm32-wasi": "2.0.0-rc.7" + "@solidjs/compiler-darwin-x64": "2.0.0-rc.8", + "@solidjs/compiler-darwin-arm64": "2.0.0-rc.8", + "@solidjs/compiler-linux-x64-gnu": "2.0.0-rc.8", + "@solidjs/compiler-linux-arm64-gnu": "2.0.0-rc.8", + "@solidjs/compiler-win32-x64-msvc": "2.0.0-rc.8", + "@solidjs/compiler-wasm32-wasi": "2.0.0-rc.8" } } diff --git a/packages/diagnostics/CHANGELOG.md b/packages/diagnostics/CHANGELOG.md index 743343367..7788fc6ef 100644 --- a/packages/diagnostics/CHANGELOG.md +++ b/packages/diagnostics/CHANGELOG.md @@ -1,5 +1,69 @@ # @solidjs/diagnostics +## 2.0.0-rc.8 + +### Patch Changes + +- 1807f7f: Observe tier: split dev-only checks from production-legal observability wiring. + + **Breaking (pre-release):** `DEV.diagnostics` moved to a new `OBSERVE` export + — `OBSERVE.diagnostics.{subscribe,capture,emit}`, `OBSERVE.subjectOf(event)`. + `DEV` keeps the devtools surface (`hooks`, `getChildren`/`getSignals`/ + `getParent`/`getSources`/`getObservers`) and gains the console face + (`DEV.report`, `DEV.setConsoleFooter` — formerly + `DEV.diagnostics.setConsoleFooter`). Both are exported from `@solidjs/signals` + and `solid-js` (client and server). + + **Breaking (pre-release):** the attribution engine is its own entry. + `DEV.attribution.enable()` and friends are now + `import { attribution } from "solid-js/attribution"` (or + `@solidjs/signals/attribution`) — `enable/disable/subscribe/history/why/ +subscriptions/costs/waterfalls/holds/feedback/markFlight/format/formatOrigin`, + plus the record types (`RerunEvent`, `ChangeRecord`, `ChangeOrigin`, + `HoldEvent`, …) which were previously unexported. The runtime keeps only the + core's side as `OBSERVE.attribution`: `install(hooks)`/`installed` (the hook + slot an engine — built-in or a devtools' own — installs into) and + `withInteraction(ref, fn)` (the frame the web runtime opens around every event + dispatch; `fn()` when no engine is installed). A build that never imports the + engine never ships it: the observe tier costs ~1.3 KB brotli over prod on the + CSR scenario, the engine 9.7 KB more when enabled. The import is legal in + every tier — prod resolves an inert engine with the same surface. + `@solidjs/diagnostics` requires `OBSERVE` and imports the engine itself; it now + works against observe builds. + + **New build tier.** Every package with wiring ships `.observe.{js,cjs}` + beside its prod and dev artifacts, selected by a new `observe` export condition + (listed after `development`, so dev still wins when both are set): signals + `dist/observe/` + `dist/node.observe.cjs` (each with an `attribution` entry + beside `index`; the flat dev/CJS builds are code-split so both entries share + one module instance), solid-js `solid.observe.*` and + `server.observe.*`, web `web.observe.*`, universal `universal.observe.*`. + Observe builds keep attribution hook sites, owner labels (`_name`, flow-control + memo names, component roots), graph edge counters and the diagnostics channel; + they fold out strict-read checks, invariants, forbidden-scope guards, devtools + brands and all console output. Entries without wiring (frames, server-functions, + storage, h, html, element) fall through to prod under `observe`. Signals gates + on `__OBSERVE__` (dev implies observe; asserted at init), solid-js/web/universal + on the `"_SOLID_OBSERVE_"` literal. Default prod artifacts are unchanged apart + from the new `OBSERVE = undefined` export; `_name` is reserved from property + mangling so the cross-package label survives in the observe tree. + `OBSERVE.diagnostics.emit` accepts an explicit `ownerPath` for hosts whose + owners are not signals' owners (the SSR runtime). + +- Updated dependencies [21c5460] +- Updated dependencies [711b557] +- Updated dependencies [1354a53] +- Updated dependencies [ae0ec3f] +- Updated dependencies [1c9e9e7] +- Updated dependencies [05725e8] +- Updated dependencies [fe3ab92] +- Updated dependencies [2fa7539] +- Updated dependencies [1807f7f] +- Updated dependencies [3a5fe8c] +- Updated dependencies [a39415c] +- Updated dependencies [4e730a9] + - @solidjs/signals@2.0.0-rc.8 + ## 2.0.0-rc.7 ### Patch Changes diff --git a/packages/diagnostics/package.json b/packages/diagnostics/package.json index 7998722e8..5050b9b0d 100644 --- a/packages/diagnostics/package.json +++ b/packages/diagnostics/package.json @@ -1,6 +1,6 @@ { "name": "@solidjs/diagnostics", - "version": "2.0.0-rc.7", + "version": "2.0.0-rc.8", "description": "Agent-consumable diagnostics harness for Solid: capture the dev-mode diagnostic and attribution channels as structured artifacts, with assertion helpers for tests and agent loops.", "author": "Ryan Carniato", "license": "MIT", @@ -52,7 +52,7 @@ "test:watch": "vitest watch tests" }, "dependencies": { - "@solidjs/signals": "^2.0.0-rc.7" + "@solidjs/signals": "^2.0.0-rc.8" }, "peerDependencies": { "vitest": ">=2.0.0" diff --git a/packages/element/CHANGELOG.md b/packages/element/CHANGELOG.md index 4d379ee49..39b52dda7 100644 --- a/packages/element/CHANGELOG.md +++ b/packages/element/CHANGELOG.md @@ -1,5 +1,23 @@ # solid-element +## 2.0.0-rc.8 + +### Patch Changes + +- Updated dependencies [711b557] +- Updated dependencies [9e6c867] +- Updated dependencies [7d985b6] +- Updated dependencies [3b4db21] +- Updated dependencies [fe3ab92] +- Updated dependencies [1807f7f] +- Updated dependencies [a71e42e] +- Updated dependencies [a39415c] +- Updated dependencies [8cfa272] +- Updated dependencies [4e730a9] +- Updated dependencies [ab4c40c] + - solid-js@2.0.0-rc.8 + - @solidjs/web@2.0.0-rc.8 + ## 2.0.0-rc.7 ### Patch Changes diff --git a/packages/element/package.json b/packages/element/package.json index db10fb65a..f0f953103 100644 --- a/packages/element/package.json +++ b/packages/element/package.json @@ -3,7 +3,7 @@ "description": "Webcomponents wrapper for Solid", "author": "Ryan Carniato", "license": "MIT", - "version": "2.0.0-rc.7", + "version": "2.0.0-rc.8", "homepage": "https://github.com/solidjs/solid/blob/main/packages/element#readme", "repository": { "type": "git", @@ -30,8 +30,8 @@ "component-register": "^0.8.7" }, "peerDependencies": { - "solid-js": "^2.0.0-rc.7", - "@solidjs/web": "^2.0.0-rc.7" + "solid-js": "^2.0.0-rc.8", + "@solidjs/web": "^2.0.0-rc.8" }, "devDependencies": { "solid-js": "workspace:*", diff --git a/packages/h/CHANGELOG.md b/packages/h/CHANGELOG.md index b8b6d26cd..4465e9558 100644 --- a/packages/h/CHANGELOG.md +++ b/packages/h/CHANGELOG.md @@ -1,5 +1,34 @@ # @solidjs/h +## 2.0.0-rc.8 + +### Patch Changes + +- a39415c: **Breaking:** all runtime packages are ESM only and declare `engines.node >= 22.12`. + + Every `.cjs` artifact, every `require` branch in the exports maps, and the `types-cjs/` declaration mirrors are gone. Node 22.12+ loads ESM through `require()` natively, so a CommonJS host resolves the same files through the same export conditions it always did (`browser`, `node`, `development`, `observe`, …) — there is one module graph per tier rather than two to keep in step. `main` now points at the ESM server entry. + + For consumers: + - ESM apps, Vite, Vitest, Bun, Deno, workers: no change. + - CommonJS Node apps: require Node 22.12 or later. `require("solid-js")` keeps working. + - TypeScript CommonJS projects: use `module: "NodeNext"` (TS 5.8+), which type-checks `require()` of ESM packages; `module: "Node16"` will report TS1479. + - Jest: needs Node 22.12+ for `require(esm)`; any preset that maps specifiers to `.cjs` paths (as `solid-jest` does for Solid 1.x) has nothing to map to and must be updated. + + `@solidjs/signals` drops its flat `dist/node*.cjs` builds; its ESM entries (`dist/prod/`, `dist/observe/`, `dist/dev.js`) are the only ones. `@solidjs/babel-plugin` and `@solidjs/compiler` (build-time tooling loaded by Babel/Node) are unchanged. + +- Updated dependencies [711b557] +- Updated dependencies [9e6c867] +- Updated dependencies [7d985b6] +- Updated dependencies [3b4db21] +- Updated dependencies [fe3ab92] +- Updated dependencies [1807f7f] +- Updated dependencies [a71e42e] +- Updated dependencies [a39415c] +- Updated dependencies [8cfa272] +- Updated dependencies [4e730a9] +- Updated dependencies [ab4c40c] + - @solidjs/web@2.0.0-rc.8 + ## 2.0.0-rc.7 ### Patch Changes diff --git a/packages/h/package.json b/packages/h/package.json index 649b15228..e58637b55 100644 --- a/packages/h/package.json +++ b/packages/h/package.json @@ -1,7 +1,7 @@ { "name": "@solidjs/h", "description": "Hyperscript / h() factory for Solid — write components without compiled JSX.", - "version": "2.0.0-rc.7", + "version": "2.0.0-rc.8", "author": "Ryan Carniato", "license": "MIT", "homepage": "https://solidjs.com", @@ -58,7 +58,7 @@ "test": "vitest run" }, "peerDependencies": { - "@solidjs/web": "^2.0.0-rc.7" + "@solidjs/web": "^2.0.0-rc.8" }, "devDependencies": { "@solidjs/web": "workspace:*", diff --git a/packages/html/CHANGELOG.md b/packages/html/CHANGELOG.md index 9c78f6656..b25b25ccc 100644 --- a/packages/html/CHANGELOG.md +++ b/packages/html/CHANGELOG.md @@ -1,5 +1,34 @@ # @solidjs/html +## 2.0.0-rc.8 + +### Patch Changes + +- a39415c: **Breaking:** all runtime packages are ESM only and declare `engines.node >= 22.12`. + + Every `.cjs` artifact, every `require` branch in the exports maps, and the `types-cjs/` declaration mirrors are gone. Node 22.12+ loads ESM through `require()` natively, so a CommonJS host resolves the same files through the same export conditions it always did (`browser`, `node`, `development`, `observe`, …) — there is one module graph per tier rather than two to keep in step. `main` now points at the ESM server entry. + + For consumers: + - ESM apps, Vite, Vitest, Bun, Deno, workers: no change. + - CommonJS Node apps: require Node 22.12 or later. `require("solid-js")` keeps working. + - TypeScript CommonJS projects: use `module: "NodeNext"` (TS 5.8+), which type-checks `require()` of ESM packages; `module: "Node16"` will report TS1479. + - Jest: needs Node 22.12+ for `require(esm)`; any preset that maps specifiers to `.cjs` paths (as `solid-jest` does for Solid 1.x) has nothing to map to and must be updated. + + `@solidjs/signals` drops its flat `dist/node*.cjs` builds; its ESM entries (`dist/prod/`, `dist/observe/`, `dist/dev.js`) are the only ones. `@solidjs/babel-plugin` and `@solidjs/compiler` (build-time tooling loaded by Babel/Node) are unchanged. + +- Updated dependencies [711b557] +- Updated dependencies [9e6c867] +- Updated dependencies [7d985b6] +- Updated dependencies [3b4db21] +- Updated dependencies [fe3ab92] +- Updated dependencies [1807f7f] +- Updated dependencies [a71e42e] +- Updated dependencies [a39415c] +- Updated dependencies [8cfa272] +- Updated dependencies [4e730a9] +- Updated dependencies [ab4c40c] + - @solidjs/web@2.0.0-rc.8 + ## 2.0.0-rc.7 ### Patch Changes diff --git a/packages/html/package.json b/packages/html/package.json index 964d2004d..1e2e5f253 100644 --- a/packages/html/package.json +++ b/packages/html/package.json @@ -1,7 +1,7 @@ { "name": "@solidjs/html", "description": "Tagged-template-literal templating for Solid — write components with no build step.", - "version": "2.0.0-rc.7", + "version": "2.0.0-rc.8", "author": "Ryan Carniato", "license": "MIT", "homepage": "https://solidjs.com", @@ -42,7 +42,7 @@ "test": "vitest run" }, "peerDependencies": { - "@solidjs/web": "^2.0.0-rc.7" + "@solidjs/web": "^2.0.0-rc.8" }, "devDependencies": { "@solidjs/web": "workspace:*", diff --git a/packages/signals/CHANGELOG.md b/packages/signals/CHANGELOG.md index 695431257..e85fb4771 100644 --- a/packages/signals/CHANGELOG.md +++ b/packages/signals/CHANGELOG.md @@ -1,5 +1,125 @@ # @solidjs/signals +## 2.0.0-rc.8 + +### Patch Changes + +- 21c5460: Router-agnostic navigation attribution: `OBSERVE.attribution.withOrigin({ kind: "navigation", name, to, from, params }, fn)` + + A navigation in Solid 2 is a plain write to the location; the runtime already sees everything it costs (the hold behind route data, the re-runs, the silence) but not that the writes were a navigation, or to which route. `withOrigin` is the seam where a router says so, around its write — the one router-specific line, living in the router. From it the attribution engine: + - stamps the writes with a `navigation` origin (new `ChangeOrigin.kind`, with `name`/`to`/`from`/`params`), nested under the enclosing interaction — including through an action step — so cause chains read `— navigation to /users/:id (under click on a.nav "Alice")`; + - names holds by route: `HoldEvent.origin`, `SILENT_HOLD`/`LONG_HOLD` messages that start from the navigation, and `data.navigation` on the event; + - keeps one `NavigationEvent` per frame (`attribution.navigations()`), settled exactly once as `committed` (a plain drain took the writes), `held` (with the `HoldEvent` attached), or `superseded` (a later write replaced them before they landed); + - folds settled navigations per route into `feedback().navigations`. + + The ref is read late on purpose. `name`/`to`/`params` are re-read from the object when the navigation settles, so a router whose match is coarse at write time (a lazy route subtree resolving inside the hold) assigns the exact pattern onto the same object and every consumer reads it — no second API. A redirect is declared with `redirect: n` (the hop depth routers already track) and folds onto the pending navigation instead of opening one: one record, timed from the user's request, the abandoned destination kept in `NavigationEvent.redirects`, `feedback().navigations[].redirected` counting them, and `formatOrigin` reading `navigation to /login (redirected from /users/42)`. + + Hold census fix: a `latest()`/`isPending()` companion now counts as acknowledgement only when an effect reads it, through however many memos. Memos compute eagerly, so a router's internal `createMemo(() => isPending(location))` used to clear `SILENT_HOLD` for every navigation whether or not anything rendered it. + + One new core hook, `flushEnd`, fires once per `flush()` drain so the engine has the "committed and effects ran" instant for writes no transition held. Prod builds are unchanged (the hook site folds out; only the inert attribution twin gained the new empty queries). + +- 711b557: Move the #3338 diagnostics out of prod bytes. The `lazy()` "not preloaded" explanation and the document-root preload-failure framing are dev-only; prod keeps terse messages and, at a document root, hands the preload failure itself to `reportError` (no wrapper `Error`). The `haltReactivity` `reportError` hand-off is compacted. +- 1354a53: Fix a render effect that reads sources written by two concurrent, non-entangled transactions committing the wrong value and then never updating (#3322). Effects have one value slot and do not entangle transactions, so the second transaction's recompute overwrote the value the first still owed a run for; the first's silent commit then published it, and the second found nothing left to run. Such effects are now re-derived against the committed world at each owed commit, ahead of the effect phase. The same mechanism covers a mainline recompute of an effect a live transaction had computed (the transaction's commit re-derives it), and render effects recomputing with no transaction active no longer see a foreign transaction's staged signal through the read fast path — the mask the slow path already applied. +- ae0ec3f: Fix `deep()` over optimistic and derived stores missing writes it should hear, and derived views churning row identities under an optimistic overlay (#3323). + - `deep(view)` / `deep(view[i])` over a derived view — `createOptimisticStore(base)` or a projection whose backing is another store — never re-ran when the base store was written, while per-key reads on the same view did. A view's targets chain to the inner store's proxies and base writes bump the inner record's witness nodes; the walk never subscribed them, and it resolved children to fresh non-chained wrappers of the base raw instead of the chained row targets the view serves. The walk now reads through the whole chain and resolves children to the targets the get trap would serve. + - `deep()` over any optimistic store was deaf to every write on a row added under a held action: the row lives in presence/value overrides, not the committed backing, and the walk enumerated the raw backing. The `ownKeys` / `getOwnPropertyDescriptor` trap bodies are now shared helpers the walk uses, so the walk sees exactly what readers see. + - A derived view's untouched rows came back as fresh proxies for the life of an optimistic action (`view.map(r => r)` was O(n) new identities per action) and snapped back at settle. The optimistic diff compared the inner store's child proxies to the draft's raws and marked every row changed; it now compares unwrapped values. Chained targets serving from a pending backing resolve inner-owned raws to the inner proxy before wrapping, and `snapshot()` composes outer overrides below the root. + + Only `deep()`, the chained-view read path, and the optimistic diff changed; plain-store reads and writes are unaffected. + +- 1c9e9e7: Fix a held transaction being re-entered while an unrelated flush finalizes — through a store commit hook (`deep()` readers of a projection), a boundary check, or a recompute — and that flush then committing the transaction's state and running its effects as if it still owned the batch, leaving the UI permanently stale once the transaction settled (#3319). Finalization now captures the batch it started with and settles nothing an entered transaction adopted (a completing transaction still settles its own separate containers). Effects follow ownership: a run is applied by the commit of the transaction that computed its value, so the entering flush still applies everything it computed mainline — the write that caused it reads and renders together — while runs owned by the still-held transaction park with it and release when it completes. Optimistic lanes are unaffected; they apply their own effects ahead of their transaction by design. +- 05725e8: Trim the #3319/#3322 fixes: `runEffect` reads `activeTransition` directly instead of a `parkHeldOwners` flag toggled around the ordinary effect phase (lane runners and the creation-time immediate run mark themselves exempt with `LANE_RUN`), and `contestEffect` is inlined into its single call site in `recompute`. Behavior-identical; -41 B minified on the core floor. +- fe3ab92: Make a failed lazy() hydration observable instead of a silently dead page (#3338): + - The client's "was not preloaded before hydration" error no longer says to add a Loading boundary — none is required for root-level `lazy()`. It now names the actual cause: the server serialized no client entry for the module (check the server log for "Asset manifest returned no client assets for module"), or the hydration id namespaces are misaligned. + - An uncaught error that halts the reactive system is handed to `reportError` where the platform provides it, so it reaches `window.onerror` / error monitoring. Creation-time throws (a lazy miss during the hydration render) are converted to status by ancestor recomputes and never reached the top; console.error was their only trace. + - `hydrate()`'s "module preload failed → fall back to client render" path no longer runs for a document root, where a client render is impossible (the shell cannot be created) and died deep in the walk with an unrelated "Hydration Mismatch" as an unhandled rejection. It now reports an explicit error carrying the preload failure as its cause. + +- 2fa7539: Observe tier: no post-construction fields on reactive nodes. + + The observe build stamped `_name` on every node, `_owner` on `createSignal` + nodes and live `_subCount`/`_depCount` edge counters on linked nodes after the + node literal — exactly the hidden-class transitions the prod literals are + shaped to avoid. Measured against prod on the reactivity benchmark the tier + cost +15% overall with creation tests 2–3× under polymorphic load. + - Node factories (`computed`, `createEffectNode`, `signal`, `slotSignal`, + `createOwner`) now have two literals selected at build time: prod, and + observe = prod plus its `_name` slot (`_owner` too on signals). Default + labels (`signal`, `computed`, `effect`, `trackedEffect`) come from the + literal, so the `createEffect`/`createRenderEffect`/`createTrackedEffect` + wrappers no longer spread a fresh options object per effect to inject one. + A dist test pins observe's key set to prod's plus the slots. + - Edge counters are gone. `HUGE_FAN_OUT` is counted by the notify walk a + committed change already makes over its subscribers, `HUGE_FAN_IN` by one + walk of the recompute's trimmed dep list at the end of the pass. + Both therefore fire on the work — the change / the recompute — rather than + on the link, once per node and again after +500 growth (a WeakMap, not a + node field). `WIDE_WRITE` (engine) counts the subscriber list on the write + and hands over to `HUGE_FAN_OUT` at 2000, so a change never carries both. + Messages: "changed with N subscribers" / "tracked N sources". + - Prod artifacts are unchanged apart from removing a leftover + `...(false ? {...} : options)` spread in `createEffect`. + +- 1807f7f: Observe tier: split dev-only checks from production-legal observability wiring. + + **Breaking (pre-release):** `DEV.diagnostics` moved to a new `OBSERVE` export + — `OBSERVE.diagnostics.{subscribe,capture,emit}`, `OBSERVE.subjectOf(event)`. + `DEV` keeps the devtools surface (`hooks`, `getChildren`/`getSignals`/ + `getParent`/`getSources`/`getObservers`) and gains the console face + (`DEV.report`, `DEV.setConsoleFooter` — formerly + `DEV.diagnostics.setConsoleFooter`). Both are exported from `@solidjs/signals` + and `solid-js` (client and server). + + **Breaking (pre-release):** the attribution engine is its own entry. + `DEV.attribution.enable()` and friends are now + `import { attribution } from "solid-js/attribution"` (or + `@solidjs/signals/attribution`) — `enable/disable/subscribe/history/why/ +subscriptions/costs/waterfalls/holds/feedback/markFlight/format/formatOrigin`, + plus the record types (`RerunEvent`, `ChangeRecord`, `ChangeOrigin`, + `HoldEvent`, …) which were previously unexported. The runtime keeps only the + core's side as `OBSERVE.attribution`: `install(hooks)`/`installed` (the hook + slot an engine — built-in or a devtools' own — installs into) and + `withInteraction(ref, fn)` (the frame the web runtime opens around every event + dispatch; `fn()` when no engine is installed). A build that never imports the + engine never ships it: the observe tier costs ~1.3 KB brotli over prod on the + CSR scenario, the engine 9.7 KB more when enabled. The import is legal in + every tier — prod resolves an inert engine with the same surface. + `@solidjs/diagnostics` requires `OBSERVE` and imports the engine itself; it now + works against observe builds. + + **New build tier.** Every package with wiring ships `.observe.{js,cjs}` + beside its prod and dev artifacts, selected by a new `observe` export condition + (listed after `development`, so dev still wins when both are set): signals + `dist/observe/` + `dist/node.observe.cjs` (each with an `attribution` entry + beside `index`; the flat dev/CJS builds are code-split so both entries share + one module instance), solid-js `solid.observe.*` and + `server.observe.*`, web `web.observe.*`, universal `universal.observe.*`. + Observe builds keep attribution hook sites, owner labels (`_name`, flow-control + memo names, component roots), graph edge counters and the diagnostics channel; + they fold out strict-read checks, invariants, forbidden-scope guards, devtools + brands and all console output. Entries without wiring (frames, server-functions, + storage, h, html, element) fall through to prod under `observe`. Signals gates + on `__OBSERVE__` (dev implies observe; asserted at init), solid-js/web/universal + on the `"_SOLID_OBSERVE_"` literal. Default prod artifacts are unchanged apart + from the new `OBSERVE = undefined` export; `_name` is reserved from property + mangling so the cross-package label survives in the observe tree. + `OBSERVE.diagnostics.emit` accepts an explicit `ownerPath` for hosts whose + owners are not signals' owners (the SSR runtime). + +- 3a5fe8c: Refuse `flush()` inside an action body. An action's writes are held by its transaction until it settles, so a flush can't reveal them — and the drain loop only exits once the ambient transition is cleared, so it parked the transaction mid-slice and every write that followed in the body landed as a plain, committed write, visible before the action finished. DEV now throws `FLUSH_IN_ACTION`; prod skips the drain (the `flush(fn)` form still runs `fn`). The same drain inside `restoreTransition` is skipped when a nested action resumes synchronously inside an outer body, which had the same leak. +- a39415c: **Breaking:** all runtime packages are ESM only and declare `engines.node >= 22.12`. + + Every `.cjs` artifact, every `require` branch in the exports maps, and the `types-cjs/` declaration mirrors are gone. Node 22.12+ loads ESM through `require()` natively, so a CommonJS host resolves the same files through the same export conditions it always did (`browser`, `node`, `development`, `observe`, …) — there is one module graph per tier rather than two to keep in step. `main` now points at the ESM server entry. + + For consumers: + - ESM apps, Vite, Vitest, Bun, Deno, workers: no change. + - CommonJS Node apps: require Node 22.12 or later. `require("solid-js")` keeps working. + - TypeScript CommonJS projects: use `module: "NodeNext"` (TS 5.8+), which type-checks `require()` of ESM packages; `module: "Node16"` will report TS1479. + - Jest: needs Node 22.12+ for `require(esm)`; any preset that maps specifiers to `.cjs` paths (as `solid-jest` does for Solid 1.x) has nothing to map to and must be updated. + + `@solidjs/signals` drops its flat `dist/node*.cjs` builds; its ESM entries (`dist/prod/`, `dist/observe/`, `dist/dev.js`) are the only ones. `@solidjs/babel-plugin` and `@solidjs/compiler` (build-time tooling loaded by Babel/Node) are unchanged. + +- 4e730a9: `spread()` reads a `merge()` proxy through its sources instead of through the proxy. A spread mixed with other attributes compiles to `spread(el, merge(statics, () => rest))`; going through the proxy cost merge's `keys()` (a `Set` plus an own-enumerable scan of every source) and then, per key, a right-to-left `in` walk of the sources, on every run. The spread now iterates the flattened sources directly — the union of own string keys, later sources overriding earlier, `children`/`ref` excluded — and enumerates each source through the same single-trap path as `readShallow()`. `omit()` is not a merge and stays opaque: it is enumerated through its own filtering trap. Own keys only, per source: a key an earlier source owns and a later source merely inherits resolves to the earlier source's value (the proxy's `in` walk saw the inherited one) — spread has always applied own properties only. `@solidjs/signals` gains an `@internal` `mergeSources()`. Guarded by the Tier-1 `spread-enumerate` bench (`merge(static, reactive)` row). `readShallow()` re-maps a class array element-wise instead of copy-on-write (−58 B brotli on `web.js`; `className` allocates for an array anyway, measured at parity). + ## 2.0.0-rc.7 ### Patch Changes diff --git a/packages/signals/package.json b/packages/signals/package.json index 6dcd7e30c..410c17506 100644 --- a/packages/signals/package.json +++ b/packages/signals/package.json @@ -1,6 +1,6 @@ { "name": "@solidjs/signals", - "version": "2.0.0-rc.7", + "version": "2.0.0-rc.8", "description": "Solid's reactive primitives: signals, memos, effects, stores, and async-aware computations.", "author": "Ryan Carniato", "license": "MIT", diff --git a/packages/solid/CHANGELOG.md b/packages/solid/CHANGELOG.md index c8ebbb600..5f91fae0a 100644 --- a/packages/solid/CHANGELOG.md +++ b/packages/solid/CHANGELOG.md @@ -1,5 +1,106 @@ # solid-js +## 2.0.0-rc.8 + +### Patch Changes + +- 711b557: Move the #3338 diagnostics out of prod bytes. The `lazy()` "not preloaded" explanation and the document-root preload-failure framing are dev-only; prod keeps terse messages and, at a document root, hands the preload failure itself to `reportError` (no wrapper `Error`). The `haltReactivity` `reportError` hand-off is compacted. +- 7d985b6: Fix SSR XSS: strings yielded by flow-control memos rendered unescaped + + `{s}`, `{v => v}`, ` s} />`, + `/`, boundary fallbacks and any component that returns a string through a + memo rendered that string raw on the server. The server flow controls return memos for + hydration-id alignment; `escape()` passed functions through by identity, and the resolver + appended whatever they later produced without escaping. + + One rule now: `escape(x)` at a hole covers everything reachable from `x` — strings, array + items, and what a function yields when the resolver calls it (a deferred-escape wrapper). + Finished `{ t }` nodes pass through. `Loading` escapes its content the way it already + escaped its fallback. The compilers stop wrapping fragment / mixed component children in + `_$escape` (they are values; escaping them too double-escaped through + `{props.children}`), and a single-expression fragment at a hole keeps the + hole's wrap. Live-hole tags ride the wrapper and `$slot` survives the array copy, so + frames behave as before. + +- fe3ab92: Make a failed lazy() hydration observable instead of a silently dead page (#3338): + - The client's "was not preloaded before hydration" error no longer says to add a Loading boundary — none is required for root-level `lazy()`. It now names the actual cause: the server serialized no client entry for the module (check the server log for "Asset manifest returned no client assets for module"), or the hydration id namespaces are misaligned. + - An uncaught error that halts the reactive system is handed to `reportError` where the platform provides it, so it reaches `window.onerror` / error monitoring. Creation-time throws (a lazy miss during the hydration render) are converted to status by ancestor recomputes and never reached the top; console.error was their only trace. + - `hydrate()`'s "module preload failed → fall back to client render" path no longer runs for a document root, where a client render is impossible (the shell cannot be created) and died deep in the walk with an unrelated "Hydration Mismatch" as an unhandled rejection. It now reports an explicit error carrying the preload failure as its cause. + +- 1807f7f: Observe tier: split dev-only checks from production-legal observability wiring. + + **Breaking (pre-release):** `DEV.diagnostics` moved to a new `OBSERVE` export + — `OBSERVE.diagnostics.{subscribe,capture,emit}`, `OBSERVE.subjectOf(event)`. + `DEV` keeps the devtools surface (`hooks`, `getChildren`/`getSignals`/ + `getParent`/`getSources`/`getObservers`) and gains the console face + (`DEV.report`, `DEV.setConsoleFooter` — formerly + `DEV.diagnostics.setConsoleFooter`). Both are exported from `@solidjs/signals` + and `solid-js` (client and server). + + **Breaking (pre-release):** the attribution engine is its own entry. + `DEV.attribution.enable()` and friends are now + `import { attribution } from "solid-js/attribution"` (or + `@solidjs/signals/attribution`) — `enable/disable/subscribe/history/why/ +subscriptions/costs/waterfalls/holds/feedback/markFlight/format/formatOrigin`, + plus the record types (`RerunEvent`, `ChangeRecord`, `ChangeOrigin`, + `HoldEvent`, …) which were previously unexported. The runtime keeps only the + core's side as `OBSERVE.attribution`: `install(hooks)`/`installed` (the hook + slot an engine — built-in or a devtools' own — installs into) and + `withInteraction(ref, fn)` (the frame the web runtime opens around every event + dispatch; `fn()` when no engine is installed). A build that never imports the + engine never ships it: the observe tier costs ~1.3 KB brotli over prod on the + CSR scenario, the engine 9.7 KB more when enabled. The import is legal in + every tier — prod resolves an inert engine with the same surface. + `@solidjs/diagnostics` requires `OBSERVE` and imports the engine itself; it now + works against observe builds. + + **New build tier.** Every package with wiring ships `.observe.{js,cjs}` + beside its prod and dev artifacts, selected by a new `observe` export condition + (listed after `development`, so dev still wins when both are set): signals + `dist/observe/` + `dist/node.observe.cjs` (each with an `attribution` entry + beside `index`; the flat dev/CJS builds are code-split so both entries share + one module instance), solid-js `solid.observe.*` and + `server.observe.*`, web `web.observe.*`, universal `universal.observe.*`. + Observe builds keep attribution hook sites, owner labels (`_name`, flow-control + memo names, component roots), graph edge counters and the diagnostics channel; + they fold out strict-read checks, invariants, forbidden-scope guards, devtools + brands and all console output. Entries without wiring (frames, server-functions, + storage, h, html, element) fall through to prod under `observe`. Signals gates + on `__OBSERVE__` (dev implies observe; asserted at init), solid-js/web/universal + on the `"_SOLID_OBSERVE_"` literal. Default prod artifacts are unchanged apart + from the new `OBSERVE = undefined` export; `_name` is reserved from property + mangling so the cross-package label survives in the observe tree. + `OBSERVE.diagnostics.emit` accepts an explicit `ownerPath` for hosts whose + owners are not signals' owners (the SSR runtime). + +- a39415c: **Breaking:** all runtime packages are ESM only and declare `engines.node >= 22.12`. + + Every `.cjs` artifact, every `require` branch in the exports maps, and the `types-cjs/` declaration mirrors are gone. Node 22.12+ loads ESM through `require()` natively, so a CommonJS host resolves the same files through the same export conditions it always did (`browser`, `node`, `development`, `observe`, …) — there is one module graph per tier rather than two to keep in step. `main` now points at the ESM server entry. + + For consumers: + - ESM apps, Vite, Vitest, Bun, Deno, workers: no change. + - CommonJS Node apps: require Node 22.12 or later. `require("solid-js")` keeps working. + - TypeScript CommonJS projects: use `module: "NodeNext"` (TS 5.8+), which type-checks `require()` of ESM packages; `module: "Node16"` will report TS1479. + - Jest: needs Node 22.12+ for `require(esm)`; any preset that maps specifiers to `.cjs` paths (as `solid-jest` does for Solid 1.x) has nothing to map to and must be updated. + + `@solidjs/signals` drops its flat `dist/node*.cjs` builds; its ESM entries (`dist/prod/`, `dist/observe/`, `dist/dev.js`) are the only ones. `@solidjs/babel-plugin` and `@solidjs/compiler` (build-time tooling loaded by Babel/Node) are unchanged. + +- 8cfa272: Require `seroval` and `seroval-plugins` `~1.6.7` (minor-locked, as before). Seroval 1.6 ships bundled declarations with no extensionless relative imports, so the `@solidjs/web` `server-functions`, `serialization` and `frames` type surfaces now type-check under `module: NodeNext` from a CommonJS project without `skipLibCheck` — the packaged-types check covers every public `@solidjs/web` specifier. +- 4e730a9: `spread()` reads a `merge()` proxy through its sources instead of through the proxy. A spread mixed with other attributes compiles to `spread(el, merge(statics, () => rest))`; going through the proxy cost merge's `keys()` (a `Set` plus an own-enumerable scan of every source) and then, per key, a right-to-left `in` walk of the sources, on every run. The spread now iterates the flattened sources directly — the union of own string keys, later sources overriding earlier, `children`/`ref` excluded — and enumerates each source through the same single-trap path as `readShallow()`. `omit()` is not a merge and stays opaque: it is enumerated through its own filtering trap. Own keys only, per source: a key an earlier source owns and a later source merely inherits resolves to the earlier source's value (the proxy's `in` walk saw the inherited one) — spread has always applied own properties only. `@solidjs/signals` gains an `@internal` `mergeSources()`. Guarded by the Tier-1 `spread-enumerate` bench (`merge(static, reactive)` row). `readShallow()` re-maps a class array element-wise instead of copy-on-write (−58 B brotli on `web.js`; `className` allocates for an array anyway, measured at parity). +- Updated dependencies [21c5460] +- Updated dependencies [711b557] +- Updated dependencies [1354a53] +- Updated dependencies [ae0ec3f] +- Updated dependencies [1c9e9e7] +- Updated dependencies [05725e8] +- Updated dependencies [fe3ab92] +- Updated dependencies [2fa7539] +- Updated dependencies [1807f7f] +- Updated dependencies [3a5fe8c] +- Updated dependencies [a39415c] +- Updated dependencies [4e730a9] + - @solidjs/signals@2.0.0-rc.8 + ## 2.0.0-rc.7 ### Patch Changes diff --git a/packages/solid/package.json b/packages/solid/package.json index 0aec08869..dfbde2a2d 100644 --- a/packages/solid/package.json +++ b/packages/solid/package.json @@ -1,7 +1,7 @@ { "name": "solid-js", "description": "Reactive JavaScript library for building user interfaces. Compiles JSX to real DOM with fine-grained signal-based updates — no virtual DOM.", - "version": "2.0.0-rc.7", + "version": "2.0.0-rc.8", "author": "Ryan Carniato", "license": "MIT", "homepage": "https://solidjs.com", @@ -123,7 +123,7 @@ "performance" ], "dependencies": { - "@solidjs/signals": "^2.0.0-rc.7", + "@solidjs/signals": "^2.0.0-rc.8", "csstype": "^3.1.0", "seroval": "~1.6.7", "seroval-plugins": "~1.6.7" diff --git a/packages/test-integration/CHANGELOG.md b/packages/test-integration/CHANGELOG.md index b5b6aad81..da7dcd377 100644 --- a/packages/test-integration/CHANGELOG.md +++ b/packages/test-integration/CHANGELOG.md @@ -1,5 +1,35 @@ # test-integration +## 2.0.0-rc.8 + +### Patch Changes + +- Updated dependencies [21c5460] +- Updated dependencies [711b557] +- Updated dependencies [9e6c867] +- Updated dependencies [1354a53] +- Updated dependencies [ae0ec3f] +- Updated dependencies [1c9e9e7] +- Updated dependencies [7d985b6] +- Updated dependencies [3b4db21] +- Updated dependencies [05725e8] +- Updated dependencies [fe3ab92] +- Updated dependencies [2fa7539] +- Updated dependencies [1807f7f] +- Updated dependencies [a71e42e] +- Updated dependencies [3a5fe8c] +- Updated dependencies [a39415c] +- Updated dependencies [8cfa272] +- Updated dependencies [4e730a9] +- Updated dependencies [ab4c40c] + - @solidjs/signals@2.0.0-rc.8 + - solid-js@2.0.0-rc.8 + - @solidjs/web@2.0.0-rc.8 + - @solidjs/babel-plugin@2.0.0-rc.8 + - @solidjs/universal@2.0.0-rc.8 + - @solidjs/h@2.0.0-rc.8 + - @solidjs/html@2.0.0-rc.8 + ## 2.0.0-rc.7 ### Patch Changes diff --git a/packages/test-integration/package.json b/packages/test-integration/package.json index 4a76ad58f..6b07ae503 100644 --- a/packages/test-integration/package.json +++ b/packages/test-integration/package.json @@ -21,5 +21,5 @@ "gitly": "^2.2.1", "shelljs": "^0.8.5" }, - "version": "2.0.0-rc.7" + "version": "2.0.0-rc.8" } diff --git a/packages/universal/CHANGELOG.md b/packages/universal/CHANGELOG.md index d17cd54ac..1ac194f29 100644 --- a/packages/universal/CHANGELOG.md +++ b/packages/universal/CHANGELOG.md @@ -1,5 +1,76 @@ # @solidjs/universal +## 2.0.0-rc.8 + +### Patch Changes + +- 1807f7f: Observe tier: split dev-only checks from production-legal observability wiring. + + **Breaking (pre-release):** `DEV.diagnostics` moved to a new `OBSERVE` export + — `OBSERVE.diagnostics.{subscribe,capture,emit}`, `OBSERVE.subjectOf(event)`. + `DEV` keeps the devtools surface (`hooks`, `getChildren`/`getSignals`/ + `getParent`/`getSources`/`getObservers`) and gains the console face + (`DEV.report`, `DEV.setConsoleFooter` — formerly + `DEV.diagnostics.setConsoleFooter`). Both are exported from `@solidjs/signals` + and `solid-js` (client and server). + + **Breaking (pre-release):** the attribution engine is its own entry. + `DEV.attribution.enable()` and friends are now + `import { attribution } from "solid-js/attribution"` (or + `@solidjs/signals/attribution`) — `enable/disable/subscribe/history/why/ +subscriptions/costs/waterfalls/holds/feedback/markFlight/format/formatOrigin`, + plus the record types (`RerunEvent`, `ChangeRecord`, `ChangeOrigin`, + `HoldEvent`, …) which were previously unexported. The runtime keeps only the + core's side as `OBSERVE.attribution`: `install(hooks)`/`installed` (the hook + slot an engine — built-in or a devtools' own — installs into) and + `withInteraction(ref, fn)` (the frame the web runtime opens around every event + dispatch; `fn()` when no engine is installed). A build that never imports the + engine never ships it: the observe tier costs ~1.3 KB brotli over prod on the + CSR scenario, the engine 9.7 KB more when enabled. The import is legal in + every tier — prod resolves an inert engine with the same surface. + `@solidjs/diagnostics` requires `OBSERVE` and imports the engine itself; it now + works against observe builds. + + **New build tier.** Every package with wiring ships `.observe.{js,cjs}` + beside its prod and dev artifacts, selected by a new `observe` export condition + (listed after `development`, so dev still wins when both are set): signals + `dist/observe/` + `dist/node.observe.cjs` (each with an `attribution` entry + beside `index`; the flat dev/CJS builds are code-split so both entries share + one module instance), solid-js `solid.observe.*` and + `server.observe.*`, web `web.observe.*`, universal `universal.observe.*`. + Observe builds keep attribution hook sites, owner labels (`_name`, flow-control + memo names, component roots), graph edge counters and the diagnostics channel; + they fold out strict-read checks, invariants, forbidden-scope guards, devtools + brands and all console output. Entries without wiring (frames, server-functions, + storage, h, html, element) fall through to prod under `observe`. Signals gates + on `__OBSERVE__` (dev implies observe; asserted at init), solid-js/web/universal + on the `"_SOLID_OBSERVE_"` literal. Default prod artifacts are unchanged apart + from the new `OBSERVE = undefined` export; `_name` is reserved from property + mangling so the cross-package label survives in the observe tree. + `OBSERVE.diagnostics.emit` accepts an explicit `ownerPath` for hosts whose + owners are not signals' owners (the SSR runtime). + +- a39415c: **Breaking:** all runtime packages are ESM only and declare `engines.node >= 22.12`. + + Every `.cjs` artifact, every `require` branch in the exports maps, and the `types-cjs/` declaration mirrors are gone. Node 22.12+ loads ESM through `require()` natively, so a CommonJS host resolves the same files through the same export conditions it always did (`browser`, `node`, `development`, `observe`, …) — there is one module graph per tier rather than two to keep in step. `main` now points at the ESM server entry. + + For consumers: + - ESM apps, Vite, Vitest, Bun, Deno, workers: no change. + - CommonJS Node apps: require Node 22.12 or later. `require("solid-js")` keeps working. + - TypeScript CommonJS projects: use `module: "NodeNext"` (TS 5.8+), which type-checks `require()` of ESM packages; `module: "Node16"` will report TS1479. + - Jest: needs Node 22.12+ for `require(esm)`; any preset that maps specifiers to `.cjs` paths (as `solid-jest` does for Solid 1.x) has nothing to map to and must be updated. + + `@solidjs/signals` drops its flat `dist/node*.cjs` builds; its ESM entries (`dist/prod/`, `dist/observe/`, `dist/dev.js`) are the only ones. `@solidjs/babel-plugin` and `@solidjs/compiler` (build-time tooling loaded by Babel/Node) are unchanged. + +- Updated dependencies [711b557] +- Updated dependencies [7d985b6] +- Updated dependencies [fe3ab92] +- Updated dependencies [1807f7f] +- Updated dependencies [a39415c] +- Updated dependencies [8cfa272] +- Updated dependencies [4e730a9] + - solid-js@2.0.0-rc.8 + ## 2.0.0-rc.7 ### Patch Changes diff --git a/packages/universal/package.json b/packages/universal/package.json index c5dd6d3a0..025361629 100644 --- a/packages/universal/package.json +++ b/packages/universal/package.json @@ -1,7 +1,7 @@ { "name": "@solidjs/universal", "description": "Solid's universal runtime for creating custom renderers", - "version": "2.0.0-rc.7", + "version": "2.0.0-rc.8", "author": "Ryan Carniato", "license": "MIT", "homepage": "https://solidjs.com", @@ -51,7 +51,7 @@ "test": "vitest run" }, "peerDependencies": { - "solid-js": "^2.0.0-rc.7" + "solid-js": "^2.0.0-rc.8" }, "devDependencies": { "solid-js": "workspace:*" diff --git a/packages/web/CHANGELOG.md b/packages/web/CHANGELOG.md index 99ff4c5e4..4706f4c56 100644 --- a/packages/web/CHANGELOG.md +++ b/packages/web/CHANGELOG.md @@ -1,5 +1,108 @@ # @solidjs/web +## 2.0.0-rc.8 + +### Patch Changes + +- 711b557: Move the #3338 diagnostics out of prod bytes. The `lazy()` "not preloaded" explanation and the document-root preload-failure framing are dev-only; prod keeps terse messages and, at a document root, hands the preload failure itself to `reportError` (no wrapper `Error`). The `haltReactivity` `reportError` hand-off is compacted. +- 9e6c867: Document the `createEvent(request)` contract: the request is a standards-shaped `Request` and nothing more. Body-size enforcement may hand a rebuilt `Request`, so host-specific fields on the inbound object are not carried; hosts surface platform handles on the event from their own request. +- 7d985b6: Fix SSR XSS: strings yielded by flow-control memos rendered unescaped + + `{s}`, `{v => v}`, ` s} />`, + `/`, boundary fallbacks and any component that returns a string through a + memo rendered that string raw on the server. The server flow controls return memos for + hydration-id alignment; `escape()` passed functions through by identity, and the resolver + appended whatever they later produced without escaping. + + One rule now: `escape(x)` at a hole covers everything reachable from `x` — strings, array + items, and what a function yields when the resolver calls it (a deferred-escape wrapper). + Finished `{ t }` nodes pass through. `Loading` escapes its content the way it already + escaped its fallback. The compilers stop wrapping fragment / mixed component children in + `_$escape` (they are values; escaping them too double-escaped through + `{props.children}`), and a single-expression fragment at a hole keeps the + hole's wrap. Live-hole tags ride the wrapper and `$slot` survives the array copy, so + frames behave as before. + +- 3b4db21: Fix an rc.7 SSR hydration regression: a self-closing element that spreads props containing `children` (`` in a wrapper component) read the compiled `children` getter twice on the server, building the child element twice and consuming a hydration id the client never allocates. Every element after the first such spread then hydrated against the wrong node and the client halted. `ssrElement` again reads each spread key at most once and never reads `children` when JSX children are present; the textarea `value`/`defaultValue`-as-content behaviour from #3286 is preserved. +- fe3ab92: Make a failed lazy() hydration observable instead of a silently dead page (#3338): + - The client's "was not preloaded before hydration" error no longer says to add a Loading boundary — none is required for root-level `lazy()`. It now names the actual cause: the server serialized no client entry for the module (check the server log for "Asset manifest returned no client assets for module"), or the hydration id namespaces are misaligned. + - An uncaught error that halts the reactive system is handed to `reportError` where the platform provides it, so it reaches `window.onerror` / error monitoring. Creation-time throws (a lazy miss during the hydration render) are converted to status by ancestor recomputes and never reached the top; console.error was their only trace. + - `hydrate()`'s "module preload failed → fall back to client render" path no longer runs for a document root, where a client render is impossible (the shell cannot be created) and died deep in the walk with an unrelated "Hydration Mismatch" as an unhandled rejection. It now reports an explicit error carrying the preload failure as its cause. + +- 1807f7f: Observe tier: split dev-only checks from production-legal observability wiring. + + **Breaking (pre-release):** `DEV.diagnostics` moved to a new `OBSERVE` export + — `OBSERVE.diagnostics.{subscribe,capture,emit}`, `OBSERVE.subjectOf(event)`. + `DEV` keeps the devtools surface (`hooks`, `getChildren`/`getSignals`/ + `getParent`/`getSources`/`getObservers`) and gains the console face + (`DEV.report`, `DEV.setConsoleFooter` — formerly + `DEV.diagnostics.setConsoleFooter`). Both are exported from `@solidjs/signals` + and `solid-js` (client and server). + + **Breaking (pre-release):** the attribution engine is its own entry. + `DEV.attribution.enable()` and friends are now + `import { attribution } from "solid-js/attribution"` (or + `@solidjs/signals/attribution`) — `enable/disable/subscribe/history/why/ +subscriptions/costs/waterfalls/holds/feedback/markFlight/format/formatOrigin`, + plus the record types (`RerunEvent`, `ChangeRecord`, `ChangeOrigin`, + `HoldEvent`, …) which were previously unexported. The runtime keeps only the + core's side as `OBSERVE.attribution`: `install(hooks)`/`installed` (the hook + slot an engine — built-in or a devtools' own — installs into) and + `withInteraction(ref, fn)` (the frame the web runtime opens around every event + dispatch; `fn()` when no engine is installed). A build that never imports the + engine never ships it: the observe tier costs ~1.3 KB brotli over prod on the + CSR scenario, the engine 9.7 KB more when enabled. The import is legal in + every tier — prod resolves an inert engine with the same surface. + `@solidjs/diagnostics` requires `OBSERVE` and imports the engine itself; it now + works against observe builds. + + **New build tier.** Every package with wiring ships `.observe.{js,cjs}` + beside its prod and dev artifacts, selected by a new `observe` export condition + (listed after `development`, so dev still wins when both are set): signals + `dist/observe/` + `dist/node.observe.cjs` (each with an `attribution` entry + beside `index`; the flat dev/CJS builds are code-split so both entries share + one module instance), solid-js `solid.observe.*` and + `server.observe.*`, web `web.observe.*`, universal `universal.observe.*`. + Observe builds keep attribution hook sites, owner labels (`_name`, flow-control + memo names, component roots), graph edge counters and the diagnostics channel; + they fold out strict-read checks, invariants, forbidden-scope guards, devtools + brands and all console output. Entries without wiring (frames, server-functions, + storage, h, html, element) fall through to prod under `observe`. Signals gates + on `__OBSERVE__` (dev implies observe; asserted at init), solid-js/web/universal + on the `"_SOLID_OBSERVE_"` literal. Default prod artifacts are unchanged apart + from the new `OBSERVE = undefined` export; `_name` is reserved from property + mangling so the cross-package label survives in the observe tree. + `OBSERVE.diagnostics.emit` accepts an explicit `ownerPath` for hosts whose + owners are not signals' owners (the SSR runtime). + +- a71e42e: Rebuild the buffered server-function request from its url, method, headers and signal instead of through the `Request` copy constructor, so a host adapter's lazy request (Nitro via srvx) no longer fails every POST with 400 "Malformed server function arguments"; only a failed upload read answers 400 now, a failure to put the bytes back surfaces as its own error. +- a39415c: **Breaking:** all runtime packages are ESM only and declare `engines.node >= 22.12`. + + Every `.cjs` artifact, every `require` branch in the exports maps, and the `types-cjs/` declaration mirrors are gone. Node 22.12+ loads ESM through `require()` natively, so a CommonJS host resolves the same files through the same export conditions it always did (`browser`, `node`, `development`, `observe`, …) — there is one module graph per tier rather than two to keep in step. `main` now points at the ESM server entry. + + For consumers: + - ESM apps, Vite, Vitest, Bun, Deno, workers: no change. + - CommonJS Node apps: require Node 22.12 or later. `require("solid-js")` keeps working. + - TypeScript CommonJS projects: use `module: "NodeNext"` (TS 5.8+), which type-checks `require()` of ESM packages; `module: "Node16"` will report TS1479. + - Jest: needs Node 22.12+ for `require(esm)`; any preset that maps specifiers to `.cjs` paths (as `solid-jest` does for Solid 1.x) has nothing to map to and must be updated. + + `@solidjs/signals` drops its flat `dist/node*.cjs` builds; its ESM entries (`dist/prod/`, `dist/observe/`, `dist/dev.js`) are the only ones. `@solidjs/babel-plugin` and `@solidjs/compiler` (build-time tooling loaded by Babel/Node) are unchanged. + +- 8cfa272: Require `seroval` and `seroval-plugins` `~1.6.7` (minor-locked, as before). Seroval 1.6 ships bundled declarations with no extensionless relative imports, so the `@solidjs/web` `server-functions`, `serialization` and `frames` type surfaces now type-check under `module: NodeNext` from a CommonJS project without `skipLibCheck` — the packaged-types check covers every public `@solidjs/web` specifier. +- 4e730a9: `spread()` reads a `merge()` proxy through its sources instead of through the proxy. A spread mixed with other attributes compiles to `spread(el, merge(statics, () => rest))`; going through the proxy cost merge's `keys()` (a `Set` plus an own-enumerable scan of every source) and then, per key, a right-to-left `in` walk of the sources, on every run. The spread now iterates the flattened sources directly — the union of own string keys, later sources overriding earlier, `children`/`ref` excluded — and enumerates each source through the same single-trap path as `readShallow()`. `omit()` is not a merge and stays opaque: it is enumerated through its own filtering trap. Own keys only, per source: a key an earlier source owns and a later source merely inherits resolves to the earlier source's value (the proxy's `in` walk saw the inherited one) — spread has always applied own properties only. `@solidjs/signals` gains an `@internal` `mergeSources()`. Guarded by the Tier-1 `spread-enumerate` bench (`merge(static, reactive)` row). `readShallow()` re-maps a class array element-wise instead of copy-on-write (−58 B brotli on `web.js`; `className` allocates for an array anyway, measured at parity). +- ab4c40c: Object-valued `style` / `class` bindings are read in the TRACKED half of their effect. `style()` and `className()` enumerate their object in the effect's untracked commit phase, so a proxy value — a store sub-object (`style={state.style}`, `class={row.classes}`), merged props, anything arriving through a spread — was identity-reactive only: in-place key mutations never re-applied, and every leaf read tripped `STRICT_READ_UNTRACKED` in dev. Both compilers now wrap the compute value of a non-inline `style={expr}` / `class={expr}` in a new compiler primitive, `readShallow()`, and `spread()` applies it to those two keys as it copies. `readShallow` is an identity passthrough for strings, plain objects and proxy-free arrays (a fresh literal is already the compute's own — the common case pays a `typeof`); a proxy is copied with one `ownKeys` trap (its own trap keeps the key set tracked) plus one tracked read per key; arrays are re-mapped only when an element is a proxy. Inline literals are untouched — they already compile per property. Provably-string expressions (string/template literals, concatenation) and literal objects/arrays skip the wrap at compile time. New Tier-1 bench `style-class-object`: plain-object rows at parity; store-backed rows go from identity-only (and, in dev, ~97 ms per 500 elements of diagnostics) to per-key reactive at ~3.5 ms. Octane svg-dashboard (prod build, store-backed style/attrs through spread): mount at parity, style_spread_pulse −6%, select_toggle −7%. + + `spread()` shares the same enumeration: its compute half copied the source with `for…in` + `hasOwn`, which on a proxy source (`merge()`/`omit()`, `{...props}` in a component, store records — nearly every spread) is an `ownKeys` trap plus two `getOwnPropertyDescriptor` traps per key, each allocating a descriptor and a getter closure. It now takes the key set from one `Reflect.ownKeys` trap (the trap keeps the key set tracked) and reads each string key once; plain sources use `Object.keys`, the exact own-enumerable set the old loop yielded. New Tier-1 bench `spread-enumerate` (500 elements, 8 keys): `merge(static, reactive)` 376 → 537 ops/s (+43%), store record 253 → 415 ops/s (+64%), plain object at parity. + +- Updated dependencies [711b557] +- Updated dependencies [7d985b6] +- Updated dependencies [fe3ab92] +- Updated dependencies [1807f7f] +- Updated dependencies [a39415c] +- Updated dependencies [8cfa272] +- Updated dependencies [4e730a9] + - solid-js@2.0.0-rc.8 + ## 2.0.0-rc.7 ### Patch Changes diff --git a/packages/web/package.json b/packages/web/package.json index 83b811a53..f5321fcef 100644 --- a/packages/web/package.json +++ b/packages/web/package.json @@ -1,7 +1,7 @@ { "name": "@solidjs/web", "description": "Solid's web runtime: client rendering, hydration, SSR, and DOM-specific control flow (Portal, Dynamic).", - "version": "2.0.0-rc.7", + "version": "2.0.0-rc.8", "author": "Ryan Carniato", "license": "MIT", "homepage": "https://solidjs.com", @@ -235,7 +235,7 @@ "seroval-plugins": "~1.6.7" }, "peerDependencies": { - "solid-js": "^2.0.0-rc.7" + "solid-js": "^2.0.0-rc.8" }, "devDependencies": { "@codspeed/vitest-plugin": "^5.4.0",