@solidjs/web@2.0.0-rc.8

Patch Changes

• 711b557: Move the #3338 diagnostics out of prod bytes. The lazy() "not preloaded" explanation and the document-root preload-failure framing are dev-only; prod keeps terse messages and, at a document root, hands the preload failure itself to reportError (no wrapper Error). The haltReactivity reportError hand-off is compacted.

• 9e6c867: Document the createEvent(request) contract: the request is a standards-shaped Request and nothing more. Body-size enforcement may hand a rebuilt Request, so host-specific fields on the inbound object are not carried; hosts surface platform handles on the event from their own request.

• 7d985b6: Fix SSR XSS: strings yielded by flow-control memos rendered unescaped

  <Show when={s}>{s}</Show>, <For>{v => v}</For>, <Dynamic component={() => s} />,
  <Switch>/<Match>, boundary fallbacks and any component that returns a string through a
  memo rendered that string raw on the server. The server flow controls return memos for
  hydration-id alignment; escape() passed functions through by identity, and the resolver
  appended whatever they later produced without escaping.

  One rule now: escape(x) at a hole covers everything reachable from x — strings, array
  items, and what a function yields when the resolver calls it (a deferred-escape wrapper).
  Finished { t } nodes pass through. Loading escapes its content the way it already
  escaped its fallback. The compilers stop wrapping fragment / mixed component children in
  _$escape (they are values; escaping them too double-escaped through
  <Comp>{props.children}</Comp>), and a single-expression fragment at a hole keeps the
  hole's wrap. Live-hole tags ride the wrapper and $slot survives the array copy, so
  frames behave as before.

• 3b4db21: Fix an rc.7 SSR hydration regression: a self-closing element that spreads props containing children (<a {...props} /> in a wrapper component) read the compiled children getter twice on the server, building the child element twice and consuming a hydration id the client never allocates. Every element after the first such spread then hydrated against the wrong node and the client halted. ssrElement again reads each spread key at most once and never reads children when JSX children are present; the textarea value/defaultValue-as-content behaviour from #3286 is preserved.

• ded39d2: The flash cookie key is now derived with PBKDF2 instead of a single SHA-256 hash.

  • Guessing a weak secret from a captured cookie is now 100,000 times more expensive.
  • Set secret to a high-entropy value of 32 bytes or more. The option docs show how to generate one.
  • Flash cookies in flight when you deploy read as no flash, the same as a secret rotation.

• fe3ab92: Make a failed lazy() hydration observable instead of a silently dead page (#3338):

  • The client's "was not preloaded before hydration" error no longer says to add a Loading boundary — none is required for root-level lazy(). It now names the actual cause: the server serialized no client entry for the module (check the server log for "Asset manifest returned no client assets for module"), or the hydration id namespaces are misaligned.
  • An uncaught error that halts the reactive system is handed to reportError where the platform provides it, so it reaches window.onerror / error monitoring. Creation-time throws (a lazy miss during the hydration render) are converted to status by ancestor recomputes and never reached the top; console.error was their only trace.
  • hydrate()'s "module preload failed → fall back to client render" path no longer runs for a document root, where a client render is impossible (the shell cannot be created) and died deep in the walk with an unrelated "Hydration Mismatch" as an unhandled rejection. It now reports an explicit error carrying the preload failure as its cause.

• 1807f7f: Observe tier: split dev-only checks from production-legal observability wiring.

  Breaking (pre-release): DEV.diagnostics moved to a new OBSERVE export
  — OBSERVE.diagnostics.{subscribe,capture,emit}, OBSERVE.subjectOf(event).
  DEV keeps the devtools surface (hooks, getChildren/getSignals/
  getParent/getSources/getObservers) and gains the console face
  (DEV.report, DEV.setConsoleFooter — formerly
  DEV.diagnostics.setConsoleFooter). Both are exported from @solidjs/signals
  and solid-js (client and server).

  Breaking (pre-release): the attribution engine is its own entry.
  DEV.attribution.enable() and friends are now
  import { attribution } from "solid-js/attribution" (or
  @solidjs/signals/attribution) — enable/disable/subscribe/history/why/ subscriptions/costs/waterfalls/holds/feedback/markFlight/format/formatOrigin,
  plus the record types (RerunEvent, ChangeRecord, ChangeOrigin,
  HoldEvent, …) which were previously unexported. The runtime keeps only the
  core's side as OBSERVE.attribution: install(hooks)/installed (the hook
  slot an engine — built-in or a devtools' own — installs into) and
  withInteraction(ref, fn) (the frame the web runtime opens around every event
  dispatch; fn() when no engine is installed). A build that never imports the
  engine never ships it: the observe tier costs ~1.3 KB brotli over prod on the
  CSR scenario, the engine 9.7 KB more when enabled. The import is legal in
  every tier — prod resolves an inert engine with the same surface.
  @solidjs/diagnostics requires OBSERVE and imports the engine itself; it now
  works against observe builds.

  New build tier. Every package with wiring ships <entry>.observe.{js,cjs}
  beside its prod and dev artifacts, selected by a new observe export condition
  (listed after development, so dev still wins when both are set): signals
  dist/observe/ + dist/node.observe.cjs (each with an attribution entry
  beside index; the flat dev/CJS builds are code-split so both entries share
  one module instance), solid-js solid.observe.* and
  server.observe.*, web web.observe.*, universal universal.observe.*.
  Observe builds keep attribution hook sites, owner labels (_name, flow-control
  memo names, component roots), graph edge counters and the diagnostics channel;
  they fold out strict-read checks, invariants, forbidden-scope guards, devtools
  brands and all console output. Entries without wiring (frames, server-functions,
  storage, h, html, element) fall through to prod under observe. Signals gates
  on __OBSERVE__ (dev implies observe; asserted at init), solid-js/web/universal
  on the "_SOLID_OBSERVE_" literal. Default prod artifacts are unchanged apart
  from the new OBSERVE = undefined export; _name is reserved from property
  mangling so the cross-package label survives in the observe tree.
  OBSERVE.diagnostics.emit accepts an explicit ownerPath for hosts whose
  owners are not signals' owners (the SSR runtime).

• a71e42e: Rebuild the buffered server-function request from its url, method, headers and signal instead of through the Request copy constructor, so a host adapter's lazy request (Nitro via srvx) no longer fails every POST with 400 "Malformed server function arguments"; only a failed upload read answers 400 now, a failure to put the bytes back surfaces as its own error.

• a39415c: Breaking: all runtime packages are ESM only and declare engines.node >= 22.12.

  Every .cjs artifact, every require branch in the exports maps, and the types-cjs/ declaration mirrors are gone. Node 22.12+ loads ESM through require() natively, so a CommonJS host resolves the same files through the same export conditions it always did (browser, node, development, observe, …) — there is one module graph per tier rather than two to keep in step. main now points at the ESM server entry.

  For consumers:

  • ESM apps, Vite, Vitest, Bun, Deno, workers: no change.
  • CommonJS Node apps: require Node 22.12 or later. require("solid-js") keeps working.
  • TypeScript CommonJS projects: use module: "NodeNext" (TS 5.8+), which type-checks require() of ESM packages; module: "Node16" will report TS1479.
  • Jest: needs Node 22.12+ for require(esm); any preset that maps specifiers to .cjs paths (as solid-jest does for Solid 1.x) has nothing to map to and must be updated.

  @solidjs/signals drops its flat dist/node*.cjs builds; its ESM entries (dist/prod/, dist/observe/, dist/dev.js) are the only ones. @solidjs/babel-plugin and @solidjs/compiler (build-time tooling loaded by Babel/Node) are unchanged.

• 8cfa272: Require seroval and seroval-plugins ~1.6.7 (minor-locked, as before). Seroval 1.6 ships bundled declarations with no extensionless relative imports, so the @solidjs/web server-functions, serialization and frames type surfaces now type-check under module: NodeNext from a CommonJS project without skipLibCheck — the packaged-types check covers every public @solidjs/web specifier.

• 839c05e: Keep the server-function dispatch registry on globalThis so a re-evaluated runtime (Vite's SSR program reload after an edit in dev) shares one registry with the RPC seam: query()-declared reads no longer answer 405 after the first HMR update (#3346).

• 4e730a9: spread() reads a merge() proxy through its sources instead of through the proxy. A spread mixed with other attributes compiles to spread(el, merge(statics, () => rest)); going through the proxy cost merge's keys() (a Set plus an own-enumerable scan of every source) and then, per key, a right-to-left in walk of the sources, on every run. The spread now iterates the flattened sources directly — the union of own string keys, later sources overriding earlier, children/ref excluded — and enumerates each source through the same single-trap path as readShallow(). omit() is not a merge and stays opaque: it is enumerated through its own filtering trap. Own keys only, per source: a key an earlier source owns and a later source merely inherits resolves to the earlier source's value (the proxy's in walk saw the inherited one) — spread has always applied own properties only. @solidjs/signals gains an @internal mergeSources(). Guarded by the Tier-1 spread-enumerate bench (merge(static, reactive) row). readShallow() re-maps a class array element-wise instead of copy-on-write (−58 B brotli on web.js; className allocates for an array anyway, measured at parity).

• ab4c40c: Object-valued style / class bindings are read in the TRACKED half of their effect. style() and className() enumerate their object in the effect's untracked commit phase, so a proxy value — a store sub-object (style={state.style}, class={row.classes}), merged props, anything arriving through a spread — was identity-reactive only: in-place key mutations never re-applied, and every leaf read tripped STRICT_READ_UNTRACKED in dev. Both compilers now wrap the compute value of a non-inline style={expr} / class={expr} in a new compiler primitive, readShallow(), and spread() applies it to those two keys as it copies. readShallow is an identity passthrough for strings, plain objects and proxy-free arrays (a fresh literal is already the compute's own — the common case pays a typeof); a proxy is copied with one ownKeys trap (its own trap keeps the key set tracked) plus one tracked read per key; arrays are re-mapped only when an element is a proxy. Inline literals are untouched — they already compile per property. Provably-string expressions (string/template literals, concatenation) and literal objects/arrays skip the wrap at compile time. New Tier-1 bench style-class-object: plain-object rows at parity; store-backed rows go from identity-only (and, in dev, ~97 ms per 500 elements of diagnostics) to per-key reactive at ~3.5 ms. Octane svg-dashboard (prod build, store-backed style/attrs through spread): mount at parity, style_spread_pulse −6%, select_toggle −7%.

  spread() shares the same enumeration: its compute half copied the source with for…in + hasOwn, which on a proxy source (merge()/omit(), {...props} in a component, store records — nearly every spread) is an ownKeys trap plus two getOwnPropertyDescriptor traps per key, each allocating a descriptor and a getter closure. It now takes the key set from one Reflect.ownKeys trap (the trap keeps the key set tracked) and reads each string key once; plain sources use Object.keys, the exact own-enumerable set the old loop yielded. New Tier-1 bench spread-enumerate (500 elements, 8 keys): merge(static, reactive) 376 → 537 ops/s (+43%), store record 253 → 415 ops/s (+64%), plain object at parity.

• Updated dependencies [01ac18c]

• Updated dependencies [711b557]

• Updated dependencies [7d985b6]

• Updated dependencies [fe3ab92]

• Updated dependencies [0961d97]

• Updated dependencies [1807f7f]

• Updated dependencies [a39415c]

• Updated dependencies [8cfa272]

• Updated dependencies [4e730a9]

  • solid-js@2.0.0-rc.8