Release RC packages (rc)

.changeset/pre.json

@@ -60,6 +60,7 @@
     "async-waterfall-attribution",
     "attribution-feedback-facts",
     "attribution-feedback-tables",
+    "attribution-navigation-origin",
     "attribution-unstable-memo-output",
     "attribution-wide-write",
     "attribution-write-provenance",
@@ -138,6 +139,7 @@
     "document-action-mutation-navigation-framing",
     "document-control-flow-callback-shapes",
     "document-entry-only-handler-wrap",
+    "document-event-request-contract",
     "document-face-live-holes-client",
     "document-live-slot-args-client",
     "document-shell-hydration-docs",
@@ -193,10 +195,12 @@
     "fix-composed-header-bounds",
     "fix-conditional-async-reveal-pending",
     "fix-content-length-guard-bypass",
+    "fix-contested-effect-rederive",
     "fix-cookie-bounds-and-validity",
     "fix-create-projection-seed-inference",
     "fix-dead-transition-stamp-revival",
     "fix-decoder-collision-orphaned-promise",
+    "fix-deep-chained-view-subscription",
     "fix-deep-optimistic-store-pending",
     "fix-deep-snapshot-held-landing-visibility",
     "fix-derived-event-locals-sharing",
@@ -219,6 +223,7 @@
     "fix-error-carrier-hidden-data-slots",
     "fix-errored-derive-memo-parity",
     "fix-errored-loading-hydration-ids",
+    "fix-finalize-reentry-effect-ownership",
     "fix-flash-url-unbound-base",
     "fix-flatten-needsunwrap-or",
     "fix-flight-owned-transaction",
@@ -364,6 +369,7 @@
     "fix-ssr-async-error-handling",
     "fix-ssr-bench-shape",
     "fix-ssr-errored-async-retry-loop",
+    "fix-ssr-escape-function-results",
     "fix-ssr-loading-errored-hydration",
     "fix-ssr-memo-promise-notready",
     "fix-ssr-owner-id-parity",
@@ -373,6 +379,7 @@
     "fix-ssr-retry-child-reset",
     "fix-ssr-retry-convergence-oom",
     "fix-ssr-server-projection-pending-store",
+    "fix-ssr-spread-children-read-once",
     "fix-ssr-stream-rejected-fragment-hang",
     "fix-ssr-sync-memo-child-id-leak",
     "fix-ssr-textarea-spread-value",
@@ -433,6 +440,7 @@
     "gate-child-companion-walk",
     "gate-invariants-to-test-builds",
     "get-read-contract",
+    "golf-effect-ownership-flag",
     "graph-size-diagnostics",
     "guard-error-carried-failure-channels",
     "guard-failures-iterative-walk",
@@ -503,6 +511,8 @@
     "nohydration-lazy-maparray-deps",
     "notready-skip-stack-capture",
     "npm-descriptions",
+    "observe-node-shapes",
+    "observe-tier",
     "optimistic-draft-reads-compose-over-staged-truth",
     "optimistic-landing-fold",
     "optimistic-lists-drivable",
@@ -560,6 +570,7 @@
     "rc-api-freeze-pass",
     "reaction-rearm-replaces",
     "read-every-body-the-transport-tees",
+    "rebuild-buffered-request-from-parts",
     "reconcile-array-object-shape-guard",
     "reconcile-default-id-positional-null",
     "reconcile-symbol-keyed-nodes",
@@ -581,12 +592,14 @@
     "refresh-lifts-stale-manual-write-mask",
     "refreshable-type-alias",
     "refusals-commit-event-stub",
+    "refuse-flush-in-action-body",
     "refuse-invalid-wrap-invocation-values",
     "refuse-unknown-body-format-tags-as-version-skew",
     "refuse-unstorable-flash-cookies",
     "register-settle-walk-diagnostic-code",
     "relocate-uninit-lane-check",
     "remove-capturing-event-listeners",
+    "remove-cjs",
     "remove-create-effect-single-argument-overload",
     "remove-derived-initial-values",
     "remove-dist-exports-and-fix-dual-types",
@@ -605,6 +618,7 @@
     "republish-fresh-signals-build",
     "require-client-source-commit-zero",
     "require-seroval-1-5-4",
+    "require-seroval-1-6",
     "response-head-lifecycle",
     "responsive-preload-links",
     "reveal-order-prop",
@@ -718,6 +732,7 @@
     "tighten-show-match-jsx-types",
     "tiny-lions-jam",
     "track-applied-classes",
+    "tracked-style-class-objects",
     "transform-result-sees-thrown-errors",
     "transparent-devcomponent",
     "transparent-effect-option-typed",

packages/babel-plugin/CHANGELOG.md

@@ -1,5 +1,30 @@
 # @solidjs/babel-plugin
 
+## 2.0.0-rc.8
+
+### Patch Changes
+
+- 7d985b6: Fix SSR XSS: strings yielded by flow-control memos rendered unescaped
+
+  `<Show when={s}>{s}</Show>`, `<For>{v => v}</For>`, `<Dynamic component={() => s} />`,
+  `<Switch>/<Match>`, boundary fallbacks and any component that returns a string through a
+  memo rendered that string raw on the server. The server flow controls return memos for
+  hydration-id alignment; `escape()` passed functions through by identity, and the resolver
+  appended whatever they later produced without escaping.
+
+  One rule now: `escape(x)` at a hole covers everything reachable from `x` — strings, array
+  items, and what a function yields when the resolver calls it (a deferred-escape wrapper).
+  Finished `{ t }` nodes pass through. `Loading` escapes its content the way it already
+  escaped its fallback. The compilers stop wrapping fragment / mixed component children in
+  `_$escape` (they are values; escaping them too double-escaped through
+  `<Comp>{props.children}</Comp>`), and a single-expression fragment at a hole keeps the
+  hole's wrap. Live-hole tags ride the wrapper and `$slot` survives the array copy, so
+  frames behave as before.
+
+- ab4c40c: Object-valued `style` / `class` bindings are read in the TRACKED half of their effect. `style()` and `className()` enumerate their object in the effect's untracked commit phase, so a proxy value — a store sub-object (`style={state.style}`, `class={row.classes}`), merged props, anything arriving through a spread — was identity-reactive only: in-place key mutations never re-applied, and every leaf read tripped `STRICT_READ_UNTRACKED` in dev. Both compilers now wrap the compute value of a non-inline `style={expr}` / `class={expr}` in a new compiler primitive, `readShallow()`, and `spread()` applies it to those two keys as it copies. `readShallow` is an identity passthrough for strings, plain objects and proxy-free arrays (a fresh literal is already the compute's own — the common case pays a `typeof`); a proxy is copied with one `ownKeys` trap (its own trap keeps the key set tracked) plus one tracked read per key; arrays are re-mapped only when an element is a proxy. Inline literals are untouched — they already compile per property. Provably-string expressions (string/template literals, concatenation) and literal objects/arrays skip the wrap at compile time. New Tier-1 bench `style-class-object`: plain-object rows at parity; store-backed rows go from identity-only (and, in dev, ~97 ms per 500 elements of diagnostics) to per-key reactive at ~3.5 ms. Octane svg-dashboard (prod build, store-backed style/attrs through spread): mount at parity, style_spread_pulse −6%, select_toggle −7%.
+
+  `spread()` shares the same enumeration: its compute half copied the source with `for…in` + `hasOwn`, which on a proxy source (`merge()`/`omit()`, `{...props}` in a component, store records — nearly every spread) is an `ownKeys` trap plus two `getOwnPropertyDescriptor` traps per key, each allocating a descriptor and a getter closure. It now takes the key set from one `Reflect.ownKeys` trap (the trap keeps the key set tracked) and reads each string key once; plain sources use `Object.keys`, the exact own-enumerable set the old loop yielded. New Tier-1 bench `spread-enumerate` (500 elements, 8 keys): `merge(static, reactive)` 376 → 537 ops/s (+43%), store record 253 → 415 ops/s (+64%), plain object at parity.
+
 ## 2.0.0-rc.7
 
 ### Patch Changes

packages/babel-plugin/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@solidjs/babel-plugin",
   "description": "Babel compiler plugin for Solid templates",
-  "version": "2.0.0-rc.7",
+  "version": "2.0.0-rc.8",
   "author": "Ryan Carniato",
   "license": "MIT",
   "repository": {

packages/compiler/CHANGELOG.md

@@ -1,5 +1,30 @@
 # @solidjs/compiler
 
+## 2.0.0-rc.8
+
+### Patch Changes
+
+- 7d985b6: Fix SSR XSS: strings yielded by flow-control memos rendered unescaped
+
+  `<Show when={s}>{s}</Show>`, `<For>{v => v}</For>`, `<Dynamic component={() => s} />`,
+  `<Switch>/<Match>`, boundary fallbacks and any component that returns a string through a
+  memo rendered that string raw on the server. The server flow controls return memos for
+  hydration-id alignment; `escape()` passed functions through by identity, and the resolver
+  appended whatever they later produced without escaping.
+
+  One rule now: `escape(x)` at a hole covers everything reachable from `x` — strings, array
+  items, and what a function yields when the resolver calls it (a deferred-escape wrapper).
+  Finished `{ t }` nodes pass through. `Loading` escapes its content the way it already
+  escaped its fallback. The compilers stop wrapping fragment / mixed component children in
+  `_$escape` (they are values; escaping them too double-escaped through
+  `<Comp>{props.children}</Comp>`), and a single-expression fragment at a hole keeps the
+  hole's wrap. Live-hole tags ride the wrapper and `$slot` survives the array copy, so
+  frames behave as before.
+
+- ab4c40c: Object-valued `style` / `class` bindings are read in the TRACKED half of their effect. `style()` and `className()` enumerate their object in the effect's untracked commit phase, so a proxy value — a store sub-object (`style={state.style}`, `class={row.classes}`), merged props, anything arriving through a spread — was identity-reactive only: in-place key mutations never re-applied, and every leaf read tripped `STRICT_READ_UNTRACKED` in dev. Both compilers now wrap the compute value of a non-inline `style={expr}` / `class={expr}` in a new compiler primitive, `readShallow()`, and `spread()` applies it to those two keys as it copies. `readShallow` is an identity passthrough for strings, plain objects and proxy-free arrays (a fresh literal is already the compute's own — the common case pays a `typeof`); a proxy is copied with one `ownKeys` trap (its own trap keeps the key set tracked) plus one tracked read per key; arrays are re-mapped only when an element is a proxy. Inline literals are untouched — they already compile per property. Provably-string expressions (string/template literals, concatenation) and literal objects/arrays skip the wrap at compile time. New Tier-1 bench `style-class-object`: plain-object rows at parity; store-backed rows go from identity-only (and, in dev, ~97 ms per 500 elements of diagnostics) to per-key reactive at ~3.5 ms. Octane svg-dashboard (prod build, store-backed style/attrs through spread): mount at parity, style_spread_pulse −6%, select_toggle −7%.
+
+  `spread()` shares the same enumeration: its compute half copied the source with `for…in` + `hasOwn`, which on a proxy source (`merge()`/`omit()`, `{...props}` in a component, store records — nearly every spread) is an `ownKeys` trap plus two `getOwnPropertyDescriptor` traps per key, each allocating a descriptor and a getter closure. It now takes the key set from one `Reflect.ownKeys` trap (the trap keeps the key set tracked) and reads each string key once; plain sources use `Object.keys`, the exact own-enumerable set the old loop yielded. New Tier-1 bench `spread-enumerate` (500 elements, 8 keys): `merge(static, reactive)` 376 → 537 ops/s (+43%), store record 253 → 415 ops/s (+64%), plain object at parity.
+
 ## 2.0.0-rc.7
 
 ### Patch Changes

packages/compiler/npm/darwin-arm64/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solidjs/compiler-darwin-arm64",
-  "version": "2.0.0-rc.7",
+  "version": "2.0.0-rc.8",
   "cpu": [
     "arm64"
   ],

packages/compiler/npm/darwin-x64/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solidjs/compiler-darwin-x64",
-  "version": "2.0.0-rc.7",
+  "version": "2.0.0-rc.8",
   "cpu": [
     "x64"
   ],

packages/compiler/npm/linux-arm64-gnu/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solidjs/compiler-linux-arm64-gnu",
-  "version": "2.0.0-rc.7",
+  "version": "2.0.0-rc.8",
   "cpu": [
     "arm64"
   ],

packages/compiler/npm/linux-x64-gnu/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solidjs/compiler-linux-x64-gnu",
-  "version": "2.0.0-rc.7",
+  "version": "2.0.0-rc.8",
   "cpu": [
     "x64"
   ],

packages/compiler/npm/wasm32-wasi/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solidjs/compiler-wasm32-wasi",
-  "version": "2.0.0-rc.7",
+  "version": "2.0.0-rc.8",
   "main": "compiler.wasi.cjs",
   "files": [
     "compiler.wasm32-wasi.wasm",

packages/compiler/npm/win32-x64-msvc/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solidjs/compiler-win32-x64-msvc",
-  "version": "2.0.0-rc.7",
+  "version": "2.0.0-rc.8",
   "cpu": [
     "x64"
   ],

packages/compiler/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@solidjs/compiler",
   "description": "Solid's native Oxc JSX compiler",
-  "version": "2.0.0-rc.7",
+  "version": "2.0.0-rc.8",
   "author": "Ryan Carniato",
   "license": "MIT",
   "repository": {
@@ -62,11 +62,11 @@
     "emnapi": "^1.11.3"
   },
   "optionalDependencies": {
-    "@solidjs/compiler-darwin-x64": "2.0.0-rc.7",
-    "@solidjs/compiler-darwin-arm64": "2.0.0-rc.7",
-    "@solidjs/compiler-linux-x64-gnu": "2.0.0-rc.7",
-    "@solidjs/compiler-linux-arm64-gnu": "2.0.0-rc.7",
-    "@solidjs/compiler-win32-x64-msvc": "2.0.0-rc.7",
-    "@solidjs/compiler-wasm32-wasi": "2.0.0-rc.7"
+    "@solidjs/compiler-darwin-x64": "2.0.0-rc.8",
+    "@solidjs/compiler-darwin-arm64": "2.0.0-rc.8",
+    "@solidjs/compiler-linux-x64-gnu": "2.0.0-rc.8",
+    "@solidjs/compiler-linux-arm64-gnu": "2.0.0-rc.8",
+    "@solidjs/compiler-win32-x64-msvc": "2.0.0-rc.8",
+    "@solidjs/compiler-wasm32-wasi": "2.0.0-rc.8"
   }
 }

packages/diagnostics/CHANGELOG.md

@@ -1,5 +1,66 @@
 # @solidjs/diagnostics
 
+## 2.0.0-rc.8
+
+### Patch Changes
+
+- 1807f7f: Observe tier: split dev-only checks from production-legal observability wiring.
+
+  **Breaking (pre-release):** `DEV.diagnostics` moved to a new `OBSERVE` export
+  — `OBSERVE.diagnostics.{subscribe,capture,emit}`, `OBSERVE.subjectOf(event)`.
+  `DEV` keeps the devtools surface (`hooks`, `getChildren`/`getSignals`/
+  `getParent`/`getSources`/`getObservers`) and gains the console face
+  (`DEV.report`, `DEV.setConsoleFooter` — formerly
+  `DEV.diagnostics.setConsoleFooter`). Both are exported from `@solidjs/signals`
+  and `solid-js` (client and server).
+
+  **Breaking (pre-release):** the attribution engine is its own entry.
+  `DEV.attribution.enable()` and friends are now
+  `import { attribution } from "solid-js/attribution"` (or
+  `@solidjs/signals/attribution`) — `enable/disable/subscribe/history/why/
+subscriptions/costs/waterfalls/holds/feedback/markFlight/format/formatOrigin`,
+  plus the record types (`RerunEvent`, `ChangeRecord`, `ChangeOrigin`,
+  `HoldEvent`, …) which were previously unexported. The runtime keeps only the
+  core's side as `OBSERVE.attribution`: `install(hooks)`/`installed` (the hook
+  slot an engine — built-in or a devtools' own — installs into) and
+  `withInteraction(ref, fn)` (the frame the web runtime opens around every event
+  dispatch; `fn()` when no engine is installed). A build that never imports the
+  engine never ships it: the observe tier costs ~1.3 KB brotli over prod on the
+  CSR scenario, the engine 9.7 KB more when enabled. The import is legal in
+  every tier — prod resolves an inert engine with the same surface.
+  `@solidjs/diagnostics` requires `OBSERVE` and imports the engine itself; it now
+  works against observe builds.
+
+  **New build tier.** Every package with wiring ships `<entry>.observe.{js,cjs}`
+  beside its prod and dev artifacts, selected by a new `observe` export condition
+  (listed after `development`, so dev still wins when both are set): signals
+  `dist/observe/` + `dist/node.observe.cjs` (each with an `attribution` entry
+  beside `index`; the flat dev/CJS builds are code-split so both entries share
+  one module instance), solid-js `solid.observe.*` and
+  `server.observe.*`, web `web.observe.*`, universal `universal.observe.*`.
+  Observe builds keep attribution hook sites, owner labels (`_name`, flow-control
+  memo names, component roots), graph edge counters and the diagnostics channel;
+  they fold out strict-read checks, invariants, forbidden-scope guards, devtools
+  brands and all console output. Entries without wiring (frames, server-functions,
+  storage, h, html, element) fall through to prod under `observe`. Signals gates
+  on `__OBSERVE__` (dev implies observe; asserted at init), solid-js/web/universal
+  on the `"_SOLID_OBSERVE_"` literal. Default prod artifacts are unchanged apart
+  from the new `OBSERVE = undefined` export; `_name` is reserved from property
+  mangling so the cross-package label survives in the observe tree.
+  `OBSERVE.diagnostics.emit` accepts an explicit `ownerPath` for hosts whose
+  owners are not signals' owners (the SSR runtime).
+
+- Updated dependencies [21c5460]
+- Updated dependencies [1354a53]
+- Updated dependencies [ae0ec3f]
+- Updated dependencies [1c9e9e7]
+- Updated dependencies [05725e8]
+- Updated dependencies [2fa7539]
+- Updated dependencies [1807f7f]
+- Updated dependencies [3a5fe8c]
+- Updated dependencies [a39415c]
+  - @solidjs/signals@2.0.0-rc.8
+
 ## 2.0.0-rc.7
 
 ### Patch Changes

packages/diagnostics/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solidjs/diagnostics",
-  "version": "2.0.0-rc.7",
+  "version": "2.0.0-rc.8",
   "description": "Agent-consumable diagnostics harness for Solid: capture the dev-mode diagnostic and attribution channels as structured artifacts, with assertion helpers for tests and agent loops.",
   "author": "Ryan Carniato",
   "license": "MIT",
@@ -52,7 +52,7 @@
     "test:watch": "vitest watch tests"
   },
   "dependencies": {
-    "@solidjs/signals": "^2.0.0-rc.7"
+    "@solidjs/signals": "^2.0.0-rc.8"
   },
   "peerDependencies": {
     "vitest": ">=2.0.0"

packages/element/CHANGELOG.md

@@ -1,5 +1,20 @@
 # solid-element
 
+## 2.0.0-rc.8
+
+### Patch Changes
+
+- Updated dependencies [9e6c867]
+- Updated dependencies [7d985b6]
+- Updated dependencies [3b4db21]
+- Updated dependencies [1807f7f]
+- Updated dependencies [a71e42e]
+- Updated dependencies [a39415c]
+- Updated dependencies [8cfa272]
+- Updated dependencies [ab4c40c]
+  - @solidjs/web@2.0.0-rc.8
+  - solid-js@2.0.0-rc.8
+
 ## 2.0.0-rc.7
 
 ### Patch Changes

packages/element/package.json

@@ -3,7 +3,7 @@
   "description": "Webcomponents wrapper for Solid",
   "author": "Ryan Carniato",
   "license": "MIT",
-  "version": "2.0.0-rc.7",
+  "version": "2.0.0-rc.8",
   "homepage": "https://github.com/solidjs/solid/blob/main/packages/element#readme",
   "repository": {
     "type": "git",
@@ -30,8 +30,8 @@
     "component-register": "^0.8.7"
   },
   "peerDependencies": {
-    "solid-js": "^2.0.0-rc.7",
-    "@solidjs/web": "^2.0.0-rc.7"
+    "solid-js": "^2.0.0-rc.8",
+    "@solidjs/web": "^2.0.0-rc.8"
   },
   "devDependencies": {
     "solid-js": "workspace:*",