From 5adc0e2963c750263c69b2c70bbfb8dae9cc80e8 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
<41898282+github-actions[bot]@users.noreply.github.com>
Date: Fri, 11 Sep 2026 15:39:40 +0000
Subject: [PATCH] Version packages (rc)
---
.changeset/pre.json | 41 +++++
packages/babel-plugin/CHANGELOG.md | 26 +++
packages/babel-plugin/package.json | 2 +-
packages/compiler/CHANGELOG.md | 51 ++++++
.../compiler/npm/darwin-arm64/package.json | 2 +-
packages/compiler/npm/darwin-x64/package.json | 2 +-
.../compiler/npm/linux-arm64-gnu/package.json | 2 +-
.../compiler/npm/linux-x64-gnu/package.json | 2 +-
.../compiler/npm/wasm32-wasi/package.json | 2 +-
.../compiler/npm/win32-x64-msvc/package.json | 2 +-
packages/compiler/package.json | 14 +-
packages/diagnostics/CHANGELOG.md | 87 ++++++++++
packages/diagnostics/package.json | 4 +-
packages/element/CHANGELOG.md | 22 +++
packages/element/package.json | 6 +-
packages/h/CHANGELOG.md | 31 ++++
packages/h/package.json | 4 +-
packages/html/CHANGELOG.md | 32 ++++
packages/html/package.json | 4 +-
packages/signals/CHANGELOG.md | 154 ++++++++++++++++++
packages/signals/package.json | 2 +-
packages/solid/CHANGELOG.md | 125 ++++++++++++++
packages/solid/package.json | 4 +-
packages/test-integration/CHANGELOG.md | 48 ++++++
packages/test-integration/package.json | 2 +-
packages/universal/CHANGELOG.md | 73 +++++++++
packages/universal/package.json | 4 +-
packages/web/CHANGELOG.md | 111 +++++++++++++
packages/web/package.json | 4 +-
29 files changed, 832 insertions(+), 31 deletions(-)
diff --git a/.changeset/pre.json b/.changeset/pre.json
index 394de44e8..ff321db92 100644
--- a/.changeset/pre.json
+++ b/.changeset/pre.json
@@ -60,6 +60,7 @@
"async-waterfall-attribution",
"attribution-feedback-facts",
"attribution-feedback-tables",
+ "attribution-navigation-origin",
"attribution-unstable-memo-output",
"attribution-wide-write",
"attribution-write-provenance",
@@ -99,6 +100,7 @@
"commit-clears-transition-stamp",
"companion-oracle-census",
"companion-shadow-redesign",
+ "compiler-component-names",
"compiler-loader-accepts-patch-driver",
"compiler-loader-prefer-local-build",
"composed-header-bounds-transport",
@@ -122,6 +124,7 @@
"dev-error-invalid-refresh-target",
"dev-error-non-function-component",
"dev-error-untracked-async-read",
+ "dev-gate-lazy-hydration-diagnostics",
"dev-invariant-assertions",
"dev-tools-cleanup",
"dev-warn-scripted-304",
@@ -138,6 +141,7 @@
"document-action-mutation-navigation-framing",
"document-control-flow-callback-shapes",
"document-entry-only-handler-wrap",
+ "document-event-request-contract",
"document-face-live-holes-client",
"document-live-slot-args-client",
"document-shell-hydration-docs",
@@ -160,6 +164,7 @@
"enforce-provide-event-single-invocation",
"export-memo-options",
"expose-enableExternalSource-loading-on",
+ "extract-nested-server-function-declarations",
"fail-untagged-2xx-responses",
"fetch-option-retry-contract",
"fill-cleanup-occurrence-scope",
@@ -193,10 +198,12 @@
"fix-composed-header-bounds",
"fix-conditional-async-reveal-pending",
"fix-content-length-guard-bypass",
+ "fix-contested-effect-rederive",
"fix-cookie-bounds-and-validity",
"fix-create-projection-seed-inference",
"fix-dead-transition-stamp-revival",
"fix-decoder-collision-orphaned-promise",
+ "fix-deep-chained-view-subscription",
"fix-deep-optimistic-store-pending",
"fix-deep-snapshot-held-landing-visibility",
"fix-derived-event-locals-sharing",
@@ -219,6 +226,7 @@
"fix-error-carrier-hidden-data-slots",
"fix-errored-derive-memo-parity",
"fix-errored-loading-hydration-ids",
+ "fix-finalize-reentry-effect-ownership",
"fix-flash-url-unbound-base",
"fix-flatten-needsunwrap-or",
"fix-flight-owned-transaction",
@@ -247,7 +255,9 @@
"fix-keyed-affects-cross-family",
"fix-keyed-show-strict-read",
"fix-lane-ambient-write-replay",
+ "fix-lane-authority-store-twins",
"fix-lane-merge-transaction-ownership",
+ "fix-lane-recompute-compares-published-slot",
"fix-late-fragment-boundary-claims",
"fix-late-server-component-boundary-adoption",
"fix-latest-async-memo-lifecycle",
@@ -273,6 +283,7 @@
"fix-maparray-async-store-settle-wedge",
"fix-maparray-notready-exception-safety",
"fix-memo-created-inside-latest-window",
+ "fix-merged-lane-hold-per-node",
"fix-mid-recompute-missed-wakes",
"fix-nested-array-async-reconcile",
"fix-nested-boundary-foreign-status",
@@ -289,6 +300,7 @@
"fix-optimistic-store-stash-flicker",
"fix-optimistic-undefined-override",
"fix-overlay-adoption-reset",
+ "fix-override-supersession-on-arrival",
"fix-owned-write-guard-docs",
"fix-ownerless-conditional-memos",
"fix-pending-autodispose-release",
@@ -336,7 +348,9 @@
"fix-resolve-rejection-settlement",
"fix-response-aliasing-cookie-leak",
"fix-resting-optimistic-async-commit",
+ "fix-reveal-carve-out-input-visibility",
"fix-reveal-frontier-errored-boundary",
+ "fix-reveal-holds-on-lane-flight",
"fix-scheduler-child-queue-removal",
"fix-select-empty-value-ssr",
"fix-server-dynamic-promise-source",
@@ -364,6 +378,7 @@
"fix-ssr-async-error-handling",
"fix-ssr-bench-shape",
"fix-ssr-errored-async-retry-loop",
+ "fix-ssr-escape-function-results",
"fix-ssr-loading-errored-hydration",
"fix-ssr-memo-promise-notready",
"fix-ssr-owner-id-parity",
@@ -373,6 +388,7 @@
"fix-ssr-retry-child-reset",
"fix-ssr-retry-convergence-oom",
"fix-ssr-server-projection-pending-store",
+ "fix-ssr-spread-children-read-once",
"fix-ssr-stream-rejected-fragment-hang",
"fix-ssr-sync-memo-child-id-leak",
"fix-ssr-textarea-spread-value",
@@ -411,6 +427,7 @@
"fix-validate-document-shell",
"fix-version-skew-label-before-gate",
"flash-falsy-nojs-outcomes",
+ "flash-key-derivation",
"flatten-promise-of-async-iterable",
"fluffy-bananas-smoke",
"fold-runtime-wrappers",
@@ -433,6 +450,7 @@
"gate-child-companion-walk",
"gate-invariants-to-test-builds",
"get-read-contract",
+ "golf-effect-ownership-flag",
"graph-size-diagnostics",
"guard-error-carried-failure-channels",
"guard-failures-iterative-walk",
@@ -440,9 +458,11 @@
"halt-reactivity-on-uncaught-error",
"handle-async-setter-errors",
"head-shell-hold-probe-seam",
+ "heap-mark-incremental",
"hide-internal-type-exports",
"hoist-web-protocol-components",
"hot-scope-fanout-aggregation",
+ "html-braced-comments",
"html-element-claims",
"hydrating-store-engine-seam",
"hydration-primitive-wrappers",
@@ -471,6 +491,7 @@
"lazy-async-inflight-autodispose",
"lazy-children-storepath",
"lazy-client-only-export-option",
+ "lazy-hydration-failure-visibility",
"lazy-hydration-id-asset-keys",
"lazy-nohydration-renders",
"lazy-preload-assets",
@@ -489,6 +510,7 @@
"lone-spread-no-merge",
"long-hold-and-stricter-thresholds",
"maparray-nonkeyed-store-stale-row",
+ "maparray-small-move-fast-path",
"maparray-swap-commit",
"mean-bats-grin",
"migrate-web-runtime-to-ts",
@@ -503,6 +525,9 @@
"nohydration-lazy-maparray-deps",
"notready-skip-stack-capture",
"npm-descriptions",
+ "observe-node-shapes",
+ "observe-shape-freeze",
+ "observe-tier",
"optimistic-draft-reads-compose-over-staged-truth",
"optimistic-landing-fold",
"optimistic-lists-drivable",
@@ -551,8 +576,10 @@
"preload-identity-qualifiers",
"preserve-bound-event-tuples",
"preserve-store-symbol-snapshots",
+ "projection-leaf-release",
"projection-lists-drivable",
"projection-root-entity-swap",
+ "projection-root-write-overlay",
"propagation-hot-path-regression",
"protect-server-functions-csrf",
"purple-mayflies-give",
@@ -560,6 +587,7 @@
"rc-api-freeze-pass",
"reaction-rearm-replaces",
"read-every-body-the-transport-tees",
+ "rebuild-buffered-request-from-parts",
"reconcile-array-object-shape-guard",
"reconcile-default-id-positional-null",
"reconcile-symbol-keyed-nodes",
@@ -581,12 +609,17 @@
"refresh-lifts-stale-manual-write-mask",
"refreshable-type-alias",
"refusals-commit-event-stub",
+ "refuse-flush-in-action-body",
"refuse-invalid-wrap-invocation-values",
"refuse-unknown-body-format-tags-as-version-skew",
"refuse-unstorable-flash-cookies",
"register-settle-walk-diagnostic-code",
+ "reject-server-directive-on-methods",
+ "reject-this-arguments-server-function-capture",
+ "reject-unsupported-server-module-exports",
"relocate-uninit-lane-check",
"remove-capturing-event-listeners",
+ "remove-cjs",
"remove-create-effect-single-argument-overload",
"remove-derived-initial-values",
"remove-dist-exports-and-fix-dual-types",
@@ -605,6 +638,7 @@
"republish-fresh-signals-build",
"require-client-source-commit-zero",
"require-seroval-1-5-4",
+ "require-seroval-1-6",
"response-head-lifecycle",
"responsive-preload-links",
"reveal-order-prop",
@@ -631,6 +665,7 @@
"server-function-guard-simplification",
"server-function-http-hygiene",
"server-function-path-addressing",
+ "server-function-path-names",
"server-function-types-not-any",
"server-functions-client-fetch",
"server-memo-commit-liveness",
@@ -641,6 +676,7 @@
"server-store-replacement-optimistic-noop",
"setter-row-ops-tentative-lists",
"settle-superseded-flight-dependents",
+ "settle-unchanged-pending-branches",
"settle-walk-dev-invariant",
"settle-walk-invariant-completion",
"settle-walk-requires-initialization",
@@ -648,6 +684,7 @@
"shallow-compiled-slot-channel",
"shallow-slot-alignment-samevaluezero",
"shallow-stores-markraw",
+ "share-server-function-registry-across-reloads",
"shared-effect-status-notifier",
"shell-gate-first-apply",
"signals-dev-cjs",
@@ -665,6 +702,7 @@
"snapshot-hydration-safety",
"snapshot-trailing-holes",
"solid-native-frame-protocol-identifiers",
+ "spread-direct-sources",
"ssr-falsy-rejections-and-thenables",
"ssr-hole-id-scopes",
"ssr-retry-robustness",
@@ -679,6 +717,7 @@
"store-first-read-diet",
"store-hot-path-trims",
"store-next-settled-visibility",
+ "store-owner-stamp",
"store-pending-overlay",
"store-platform-objects-raw",
"store-rewrite-creation-perf",
@@ -701,6 +740,7 @@
"store-structural-hot-path-pass",
"store-thenable-probe-strict-read",
"store-treeshakeable-optimism",
+ "store-write-floor-narrow",
"stream-demand-gate",
"strict-untrack-warning",
"strictread-untrack-parameter",
@@ -718,6 +758,7 @@
"tighten-show-match-jsx-types",
"tiny-lions-jam",
"track-applied-classes",
+ "tracked-style-class-objects",
"transform-result-sees-thrown-errors",
"transparent-devcomponent",
"transparent-effect-option-typed",
diff --git a/packages/babel-plugin/CHANGELOG.md b/packages/babel-plugin/CHANGELOG.md
index 024295b9f..ed1892028 100644
--- a/packages/babel-plugin/CHANGELOG.md
+++ b/packages/babel-plugin/CHANGELOG.md
@@ -1,5 +1,31 @@
# @solidjs/babel-plugin
+## 2.0.0-rc.8
+
+### Patch Changes
+
+- 01ac18c: Compiler `componentNames` option: component owner labels that survive minification. With the flag on, DOM output carries the tag as written in source as a third `createComponent` argument — `` compiles to `createComponent(Home, props, "Home")`, `` to `"Ui.Button"`, `` to `"this.Row"` — and the dev and observe runtimes label the component's owner with it (`` in diagnostic `ownerPath`s, attribution chains, and the devtools `_component.name`), falling back to `Comp.name` as before. Until now an observe-tier production bundle reported hot scopes and holds under whatever the minifier left of the function name (` › `), and a `lazy()` or HMR wrapper hid the tag name even in dev. Off by default and byte-identical output when off; SSR (which inlines the call) and universal output never emit it; the production `createComponent` ignores the argument. Both compilers implement it in parity (shared fixtures, cross-mode ratchet). `@solidjs/vite-plugin` enables it for the dev and `observe` postures.
+- 7d985b6: Fix SSR XSS: strings yielded by flow-control memos rendered unescaped
+
+ `{s}`, `{v => v}`, ` s} />`,
+ `/`, boundary fallbacks and any component that returns a string through a
+ memo rendered that string raw on the server. The server flow controls return memos for
+ hydration-id alignment; `escape()` passed functions through by identity, and the resolver
+ appended whatever they later produced without escaping.
+
+ One rule now: `escape(x)` at a hole covers everything reachable from `x` — strings, array
+ items, and what a function yields when the resolver calls it (a deferred-escape wrapper).
+ Finished `{ t }` nodes pass through. `Loading` escapes its content the way it already
+ escaped its fallback. The compilers stop wrapping fragment / mixed component children in
+ `_$escape` (they are values; escaping them too double-escaped through
+ `{props.children}`), and a single-expression fragment at a hole keeps the
+ hole's wrap. Live-hole tags ride the wrapper and `$slot` survives the array copy, so
+ frames behave as before.
+
+- ab4c40c: Object-valued `style` / `class` bindings are read in the TRACKED half of their effect. `style()` and `className()` enumerate their object in the effect's untracked commit phase, so a proxy value — a store sub-object (`style={state.style}`, `class={row.classes}`), merged props, anything arriving through a spread — was identity-reactive only: in-place key mutations never re-applied, and every leaf read tripped `STRICT_READ_UNTRACKED` in dev. Both compilers now wrap the compute value of a non-inline `style={expr}` / `class={expr}` in a new compiler primitive, `readShallow()`, and `spread()` applies it to those two keys as it copies. `readShallow` is an identity passthrough for strings, plain objects and proxy-free arrays (a fresh literal is already the compute's own — the common case pays a `typeof`); a proxy is copied with one `ownKeys` trap (its own trap keeps the key set tracked) plus one tracked read per key; arrays are re-mapped only when an element is a proxy. Inline literals are untouched — they already compile per property. Provably-string expressions (string/template literals, concatenation) and literal objects/arrays skip the wrap at compile time. New Tier-1 bench `style-class-object`: plain-object rows at parity; store-backed rows go from identity-only (and, in dev, ~97 ms per 500 elements of diagnostics) to per-key reactive at ~3.5 ms. Octane svg-dashboard (prod build, store-backed style/attrs through spread): mount at parity, style_spread_pulse −6%, select_toggle −7%.
+
+ `spread()` shares the same enumeration: its compute half copied the source with `for…in` + `hasOwn`, which on a proxy source (`merge()`/`omit()`, `{...props}` in a component, store records — nearly every spread) is an `ownKeys` trap plus two `getOwnPropertyDescriptor` traps per key, each allocating a descriptor and a getter closure. It now takes the key set from one `Reflect.ownKeys` trap (the trap keeps the key set tracked) and reads each string key once; plain sources use `Object.keys`, the exact own-enumerable set the old loop yielded. New Tier-1 bench `spread-enumerate` (500 elements, 8 keys): `merge(static, reactive)` 376 → 537 ops/s (+43%), store record 253 → 415 ops/s (+64%), plain object at parity.
+
## 2.0.0-rc.7
### Patch Changes
diff --git a/packages/babel-plugin/package.json b/packages/babel-plugin/package.json
index 5af8db958..ef17c5206 100644
--- a/packages/babel-plugin/package.json
+++ b/packages/babel-plugin/package.json
@@ -1,7 +1,7 @@
{
"name": "@solidjs/babel-plugin",
"description": "Babel compiler plugin for Solid templates",
- "version": "2.0.0-rc.7",
+ "version": "2.0.0-rc.8",
"author": "Ryan Carniato",
"license": "MIT",
"repository": {
diff --git a/packages/compiler/CHANGELOG.md b/packages/compiler/CHANGELOG.md
index 16f32d77c..3091161bd 100644
--- a/packages/compiler/CHANGELOG.md
+++ b/packages/compiler/CHANGELOG.md
@@ -1,5 +1,56 @@
# @solidjs/compiler
+## 2.0.0-rc.8
+
+### Patch Changes
+
+- 01ac18c: Compiler `componentNames` option: component owner labels that survive minification. With the flag on, DOM output carries the tag as written in source as a third `createComponent` argument — `` compiles to `createComponent(Home, props, "Home")`, `` to `"Ui.Button"`, `` to `"this.Row"` — and the dev and observe runtimes label the component's owner with it (`` in diagnostic `ownerPath`s, attribution chains, and the devtools `_component.name`), falling back to `Comp.name` as before. Until now an observe-tier production bundle reported hot scopes and holds under whatever the minifier left of the function name (` › `), and a `lazy()` or HMR wrapper hid the tag name even in dev. Off by default and byte-identical output when off; SSR (which inlines the call) and universal output never emit it; the production `createComponent` ignores the argument. Both compilers implement it in parity (shared fixtures, cross-mode ratchet). `@solidjs/vite-plugin` enables it for the dev and `observe` postures.
+- 8366e09: A `"use server"` function declaration nested inside another function is now extracted like any other server function.
+ - Previously the directive on a nested declaration was silently ignored: the body shipped to the client and ran there, while captures from the enclosing function were still rejected at compile time.
+ - The declaration is hoisted to a `const` at the top of its block, so calling it before its source position still works.
+ - Its id follows the binding path, such as `outer.inner`.
+
+- 7d985b6: Fix SSR XSS: strings yielded by flow-control memos rendered unescaped
+
+ `{s}`, `{v => v}`, ` s} />`,
+ `/`, boundary fallbacks and any component that returns a string through a
+ memo rendered that string raw on the server. The server flow controls return memos for
+ hydration-id alignment; `escape()` passed functions through by identity, and the resolver
+ appended whatever they later produced without escaping.
+
+ One rule now: `escape(x)` at a hole covers everything reachable from `x` — strings, array
+ items, and what a function yields when the resolver calls it (a deferred-escape wrapper).
+ Finished `{ t }` nodes pass through. `Loading` escapes its content the way it already
+ escaped its fallback. The compilers stop wrapping fragment / mixed component children in
+ `_$escape` (they are values; escaping them too double-escaped through
+ `{props.children}`), and a single-expression fragment at a hole keeps the
+ hole's wrap. Live-hole tags ride the wrapper and `$slot` survives the array copy, so
+ frames behave as before.
+
+- a181e4d: A `"use server"` directive on a method, getter, or setter is now a compile error instead of being silently ignored.
+ - Those forms are never extracted, so the body kept running wherever it was called, browser included.
+ - Covers object literal methods and accessors, and class methods, accessors, and constructors.
+ - Assign a function to a property instead, which the pass does extract.
+
+- 6bf2bf8: An arrow marked `"use server"` that reads `this` or `arguments` is now a compile error instead of silently breaking at runtime.
+ - The arrow is extracted to module top level, where `this` is undefined and `arguments` does not exist.
+ - A marked `function` is unaffected, and so is any `function` or class nested inside the server function.
+
+- bb905db: A module-level `"use server"` module that exports something other than a server function is now a compile error instead of producing a client build with the export missing.
+ - Covers re-exports, `export *`, class and enum exports, destructured exports, and exports declared without an initializer.
+ - The message names the export, its position, and what to do instead.
+ - Type-only and `declare` exports are erased and stay allowed.
+
+- c0299bf: Server-function ids now name a function by its binding path, so two same-named functions no longer share one id.
+ - `makeA`'s `submit` becomes `makeA.submit-` instead of `submit-`.
+ - Adding a same-named function no longer re-points the ids of the existing ones.
+ - Ids for functions in objects and classes pick up those names too, such as `handlers.save`.
+ - A named function contributes its own name as well, so `register(function saveHandler() {})` inside `wire` is `wire.saveHandler` rather than sharing an ordinal with its siblings.
+
+- ab4c40c: Object-valued `style` / `class` bindings are read in the TRACKED half of their effect. `style()` and `className()` enumerate their object in the effect's untracked commit phase, so a proxy value — a store sub-object (`style={state.style}`, `class={row.classes}`), merged props, anything arriving through a spread — was identity-reactive only: in-place key mutations never re-applied, and every leaf read tripped `STRICT_READ_UNTRACKED` in dev. Both compilers now wrap the compute value of a non-inline `style={expr}` / `class={expr}` in a new compiler primitive, `readShallow()`, and `spread()` applies it to those two keys as it copies. `readShallow` is an identity passthrough for strings, plain objects and proxy-free arrays (a fresh literal is already the compute's own — the common case pays a `typeof`); a proxy is copied with one `ownKeys` trap (its own trap keeps the key set tracked) plus one tracked read per key; arrays are re-mapped only when an element is a proxy. Inline literals are untouched — they already compile per property. Provably-string expressions (string/template literals, concatenation) and literal objects/arrays skip the wrap at compile time. New Tier-1 bench `style-class-object`: plain-object rows at parity; store-backed rows go from identity-only (and, in dev, ~97 ms per 500 elements of diagnostics) to per-key reactive at ~3.5 ms. Octane svg-dashboard (prod build, store-backed style/attrs through spread): mount at parity, style_spread_pulse −6%, select_toggle −7%.
+
+ `spread()` shares the same enumeration: its compute half copied the source with `for…in` + `hasOwn`, which on a proxy source (`merge()`/`omit()`, `{...props}` in a component, store records — nearly every spread) is an `ownKeys` trap plus two `getOwnPropertyDescriptor` traps per key, each allocating a descriptor and a getter closure. It now takes the key set from one `Reflect.ownKeys` trap (the trap keeps the key set tracked) and reads each string key once; plain sources use `Object.keys`, the exact own-enumerable set the old loop yielded. New Tier-1 bench `spread-enumerate` (500 elements, 8 keys): `merge(static, reactive)` 376 → 537 ops/s (+43%), store record 253 → 415 ops/s (+64%), plain object at parity.
+
## 2.0.0-rc.7
### Patch Changes
diff --git a/packages/compiler/npm/darwin-arm64/package.json b/packages/compiler/npm/darwin-arm64/package.json
index 9cb4a2476..d427695d2 100644
--- a/packages/compiler/npm/darwin-arm64/package.json
+++ b/packages/compiler/npm/darwin-arm64/package.json
@@ -1,6 +1,6 @@
{
"name": "@solidjs/compiler-darwin-arm64",
- "version": "2.0.0-rc.7",
+ "version": "2.0.0-rc.8",
"cpu": [
"arm64"
],
diff --git a/packages/compiler/npm/darwin-x64/package.json b/packages/compiler/npm/darwin-x64/package.json
index bb9173c0b..8e046f74f 100644
--- a/packages/compiler/npm/darwin-x64/package.json
+++ b/packages/compiler/npm/darwin-x64/package.json
@@ -1,6 +1,6 @@
{
"name": "@solidjs/compiler-darwin-x64",
- "version": "2.0.0-rc.7",
+ "version": "2.0.0-rc.8",
"cpu": [
"x64"
],
diff --git a/packages/compiler/npm/linux-arm64-gnu/package.json b/packages/compiler/npm/linux-arm64-gnu/package.json
index cf6cd0c6c..2b5207267 100644
--- a/packages/compiler/npm/linux-arm64-gnu/package.json
+++ b/packages/compiler/npm/linux-arm64-gnu/package.json
@@ -1,6 +1,6 @@
{
"name": "@solidjs/compiler-linux-arm64-gnu",
- "version": "2.0.0-rc.7",
+ "version": "2.0.0-rc.8",
"cpu": [
"arm64"
],
diff --git a/packages/compiler/npm/linux-x64-gnu/package.json b/packages/compiler/npm/linux-x64-gnu/package.json
index af9123905..af8dd9847 100644
--- a/packages/compiler/npm/linux-x64-gnu/package.json
+++ b/packages/compiler/npm/linux-x64-gnu/package.json
@@ -1,6 +1,6 @@
{
"name": "@solidjs/compiler-linux-x64-gnu",
- "version": "2.0.0-rc.7",
+ "version": "2.0.0-rc.8",
"cpu": [
"x64"
],
diff --git a/packages/compiler/npm/wasm32-wasi/package.json b/packages/compiler/npm/wasm32-wasi/package.json
index a83cb3398..2749a8050 100644
--- a/packages/compiler/npm/wasm32-wasi/package.json
+++ b/packages/compiler/npm/wasm32-wasi/package.json
@@ -1,6 +1,6 @@
{
"name": "@solidjs/compiler-wasm32-wasi",
- "version": "2.0.0-rc.7",
+ "version": "2.0.0-rc.8",
"main": "compiler.wasi.cjs",
"files": [
"compiler.wasm32-wasi.wasm",
diff --git a/packages/compiler/npm/win32-x64-msvc/package.json b/packages/compiler/npm/win32-x64-msvc/package.json
index 4daaeaa0f..270f4c33e 100644
--- a/packages/compiler/npm/win32-x64-msvc/package.json
+++ b/packages/compiler/npm/win32-x64-msvc/package.json
@@ -1,6 +1,6 @@
{
"name": "@solidjs/compiler-win32-x64-msvc",
- "version": "2.0.0-rc.7",
+ "version": "2.0.0-rc.8",
"cpu": [
"x64"
],
diff --git a/packages/compiler/package.json b/packages/compiler/package.json
index 00d83514d..6ffbd670d 100644
--- a/packages/compiler/package.json
+++ b/packages/compiler/package.json
@@ -1,7 +1,7 @@
{
"name": "@solidjs/compiler",
"description": "Solid's native Oxc JSX compiler",
- "version": "2.0.0-rc.7",
+ "version": "2.0.0-rc.8",
"author": "Ryan Carniato",
"license": "MIT",
"repository": {
@@ -62,11 +62,11 @@
"emnapi": "^1.11.3"
},
"optionalDependencies": {
- "@solidjs/compiler-darwin-x64": "2.0.0-rc.7",
- "@solidjs/compiler-darwin-arm64": "2.0.0-rc.7",
- "@solidjs/compiler-linux-x64-gnu": "2.0.0-rc.7",
- "@solidjs/compiler-linux-arm64-gnu": "2.0.0-rc.7",
- "@solidjs/compiler-win32-x64-msvc": "2.0.0-rc.7",
- "@solidjs/compiler-wasm32-wasi": "2.0.0-rc.7"
+ "@solidjs/compiler-darwin-x64": "2.0.0-rc.8",
+ "@solidjs/compiler-darwin-arm64": "2.0.0-rc.8",
+ "@solidjs/compiler-linux-x64-gnu": "2.0.0-rc.8",
+ "@solidjs/compiler-linux-arm64-gnu": "2.0.0-rc.8",
+ "@solidjs/compiler-win32-x64-msvc": "2.0.0-rc.8",
+ "@solidjs/compiler-wasm32-wasi": "2.0.0-rc.8"
}
}
diff --git a/packages/diagnostics/CHANGELOG.md b/packages/diagnostics/CHANGELOG.md
index 743343367..65de3e371 100644
--- a/packages/diagnostics/CHANGELOG.md
+++ b/packages/diagnostics/CHANGELOG.md
@@ -1,5 +1,92 @@
# @solidjs/diagnostics
+## 2.0.0-rc.8
+
+### Patch Changes
+
+- 0961d97: Observe tier: first-class interaction records and a typed record channel.
+ - `attribution.interactions()` and `InteractionEvent`: one record per `withInteraction` dispatch with `at`, `handlerMs`, `writes`, `runs`, `created` (computations built in its runs), `runMs`, the `holds` and `navigations` attached, and `settledMs`/`outcome` (`idle` | `committed` | `held`) once everything it caused is through.
+ - `attribution.subscribe(type, listener)` for `"rerun" | "interaction" | "hold" | "navigation"`, delivered synchronously as each record completes; the bare `subscribe(listener)` form is unchanged.
+ - `RerunEvent.at` and `HoldEvent.at` — absolute times on the `performance.now()` clock beside the existing durations.
+ - `HoldEvent.acknowledgements` replaces `acknowledgedBy`: one `{ kind, source, reader? }` per affordance, `reader` the owner path of the effect that painted it. `feedback().sources[].acknowledgedBy` still ranks by `kind:source`. `@solidjs/diagnostics` artifact format version 4 (holds carry `acknowledgements`; assertion evidence likewise).
+ - `NavigationRef.params` values may be `undefined` (an optional segment left unbound).
+ - `OBSERVE.exclude(owner)` / `OBSERVE.isExcluded(subject)` — an observer rendering inside the app it watches marks its own subtree; diagnostics about it are suppressed and the engine records none of its runs.
+ - `solid-js` re-exports the tier types from its root: `InteractionRef`, `NavigationRef`, `OriginRef`, `DiagnosticEvent` and friends, and the engine's record types (`ChangeOrigin`, `RerunEvent`, `HoldEvent`, `NavigationEvent`, `InteractionEvent`, …).
+
+- 1807f7f: Observe tier: split dev-only checks from production-legal observability wiring.
+
+ **Breaking (pre-release):** `DEV.diagnostics` moved to a new `OBSERVE` export
+ — `OBSERVE.diagnostics.{subscribe,capture,emit}`, `OBSERVE.subjectOf(event)`.
+ `DEV` keeps the devtools surface (`hooks`, `getChildren`/`getSignals`/
+ `getParent`/`getSources`/`getObservers`) and gains the console face
+ (`DEV.report`, `DEV.setConsoleFooter` — formerly
+ `DEV.diagnostics.setConsoleFooter`). Both are exported from `@solidjs/signals`
+ and `solid-js` (client and server).
+
+ **Breaking (pre-release):** the attribution engine is its own entry.
+ `DEV.attribution.enable()` and friends are now
+ `import { attribution } from "solid-js/attribution"` (or
+ `@solidjs/signals/attribution`) — `enable/disable/subscribe/history/why/
+subscriptions/costs/waterfalls/holds/feedback/markFlight/format/formatOrigin`,
+ plus the record types (`RerunEvent`, `ChangeRecord`, `ChangeOrigin`,
+ `HoldEvent`, …) which were previously unexported. The runtime keeps only the
+ core's side as `OBSERVE.attribution`: `install(hooks)`/`installed` (the hook
+ slot an engine — built-in or a devtools' own — installs into) and
+ `withInteraction(ref, fn)` (the frame the web runtime opens around every event
+ dispatch; `fn()` when no engine is installed). A build that never imports the
+ engine never ships it: the observe tier costs ~1.3 KB brotli over prod on the
+ CSR scenario, the engine 9.7 KB more when enabled. The import is legal in
+ every tier — prod resolves an inert engine with the same surface.
+ `@solidjs/diagnostics` requires `OBSERVE` and imports the engine itself; it now
+ works against observe builds.
+
+ **New build tier.** Every package with wiring ships `.observe.{js,cjs}`
+ beside its prod and dev artifacts, selected by a new `observe` export condition
+ (listed after `development`, so dev still wins when both are set): signals
+ `dist/observe/` + `dist/node.observe.cjs` (each with an `attribution` entry
+ beside `index`; the flat dev/CJS builds are code-split so both entries share
+ one module instance), solid-js `solid.observe.*` and
+ `server.observe.*`, web `web.observe.*`, universal `universal.observe.*`.
+ Observe builds keep attribution hook sites, owner labels (`_name`, flow-control
+ memo names, component roots), graph edge counters and the diagnostics channel;
+ they fold out strict-read checks, invariants, forbidden-scope guards, devtools
+ brands and all console output. Entries without wiring (frames, server-functions,
+ storage, h, html, element) fall through to prod under `observe`. Signals gates
+ on `__OBSERVE__` (dev implies observe; asserted at init), solid-js/web/universal
+ on the `"_SOLID_OBSERVE_"` literal. Default prod artifacts are unchanged apart
+ from the new `OBSERVE = undefined` export; `_name` is reserved from property
+ mangling so the cross-package label survives in the observe tree.
+ `OBSERVE.diagnostics.emit` accepts an explicit `ownerPath` for hosts whose
+ owners are not signals' owners (the SSR runtime).
+
+- Updated dependencies [21c5460]
+- Updated dependencies [711b557]
+- Updated dependencies [1354a53]
+- Updated dependencies [ae0ec3f]
+- Updated dependencies [1c9e9e7]
+- Updated dependencies [b5bd6fb]
+- Updated dependencies [b5bd6fb]
+- Updated dependencies [b5bd6fb]
+- Updated dependencies [b5bd6fb]
+- Updated dependencies [b5bd6fb]
+- Updated dependencies [b5bd6fb]
+- Updated dependencies [05725e8]
+- Updated dependencies [27aee36]
+- Updated dependencies [fe3ab92]
+- Updated dependencies [51c201f]
+- Updated dependencies [2fa7539]
+- Updated dependencies [0961d97]
+- Updated dependencies [1807f7f]
+- Updated dependencies [645ec0d]
+- Updated dependencies [12c3be9]
+- Updated dependencies [3a5fe8c]
+- Updated dependencies [a39415c]
+- Updated dependencies [dd1d4ed]
+- Updated dependencies [4e730a9]
+- Updated dependencies [4935c7d]
+- Updated dependencies [0f14430]
+ - @solidjs/signals@2.0.0-rc.8
+
## 2.0.0-rc.7
### Patch Changes
diff --git a/packages/diagnostics/package.json b/packages/diagnostics/package.json
index 7998722e8..5050b9b0d 100644
--- a/packages/diagnostics/package.json
+++ b/packages/diagnostics/package.json
@@ -1,6 +1,6 @@
{
"name": "@solidjs/diagnostics",
- "version": "2.0.0-rc.7",
+ "version": "2.0.0-rc.8",
"description": "Agent-consumable diagnostics harness for Solid: capture the dev-mode diagnostic and attribution channels as structured artifacts, with assertion helpers for tests and agent loops.",
"author": "Ryan Carniato",
"license": "MIT",
@@ -52,7 +52,7 @@
"test:watch": "vitest watch tests"
},
"dependencies": {
- "@solidjs/signals": "^2.0.0-rc.7"
+ "@solidjs/signals": "^2.0.0-rc.8"
},
"peerDependencies": {
"vitest": ">=2.0.0"
diff --git a/packages/element/CHANGELOG.md b/packages/element/CHANGELOG.md
index 4d379ee49..5a3bda285 100644
--- a/packages/element/CHANGELOG.md
+++ b/packages/element/CHANGELOG.md
@@ -1,5 +1,27 @@
# solid-element
+## 2.0.0-rc.8
+
+### Patch Changes
+
+- Updated dependencies [01ac18c]
+- Updated dependencies [711b557]
+- Updated dependencies [9e6c867]
+- Updated dependencies [7d985b6]
+- Updated dependencies [3b4db21]
+- Updated dependencies [ded39d2]
+- Updated dependencies [fe3ab92]
+- Updated dependencies [0961d97]
+- Updated dependencies [1807f7f]
+- Updated dependencies [a71e42e]
+- Updated dependencies [a39415c]
+- Updated dependencies [8cfa272]
+- Updated dependencies [839c05e]
+- Updated dependencies [4e730a9]
+- Updated dependencies [ab4c40c]
+ - solid-js@2.0.0-rc.8
+ - @solidjs/web@2.0.0-rc.8
+
## 2.0.0-rc.7
### Patch Changes
diff --git a/packages/element/package.json b/packages/element/package.json
index db10fb65a..f0f953103 100644
--- a/packages/element/package.json
+++ b/packages/element/package.json
@@ -3,7 +3,7 @@
"description": "Webcomponents wrapper for Solid",
"author": "Ryan Carniato",
"license": "MIT",
- "version": "2.0.0-rc.7",
+ "version": "2.0.0-rc.8",
"homepage": "https://github.com/solidjs/solid/blob/main/packages/element#readme",
"repository": {
"type": "git",
@@ -30,8 +30,8 @@
"component-register": "^0.8.7"
},
"peerDependencies": {
- "solid-js": "^2.0.0-rc.7",
- "@solidjs/web": "^2.0.0-rc.7"
+ "solid-js": "^2.0.0-rc.8",
+ "@solidjs/web": "^2.0.0-rc.8"
},
"devDependencies": {
"solid-js": "workspace:*",
diff --git a/packages/h/CHANGELOG.md b/packages/h/CHANGELOG.md
index b8b6d26cd..ee3f70689 100644
--- a/packages/h/CHANGELOG.md
+++ b/packages/h/CHANGELOG.md
@@ -1,5 +1,36 @@
# @solidjs/h
+## 2.0.0-rc.8
+
+### Patch Changes
+
+- a39415c: **Breaking:** all runtime packages are ESM only and declare `engines.node >= 22.12`.
+
+ Every `.cjs` artifact, every `require` branch in the exports maps, and the `types-cjs/` declaration mirrors are gone. Node 22.12+ loads ESM through `require()` natively, so a CommonJS host resolves the same files through the same export conditions it always did (`browser`, `node`, `development`, `observe`, …) — there is one module graph per tier rather than two to keep in step. `main` now points at the ESM server entry.
+
+ For consumers:
+ - ESM apps, Vite, Vitest, Bun, Deno, workers: no change.
+ - CommonJS Node apps: require Node 22.12 or later. `require("solid-js")` keeps working.
+ - TypeScript CommonJS projects: use `module: "NodeNext"` (TS 5.8+), which type-checks `require()` of ESM packages; `module: "Node16"` will report TS1479.
+ - Jest: needs Node 22.12+ for `require(esm)`; any preset that maps specifiers to `.cjs` paths (as `solid-jest` does for Solid 1.x) has nothing to map to and must be updated.
+
+ `@solidjs/signals` drops its flat `dist/node*.cjs` builds; its ESM entries (`dist/prod/`, `dist/observe/`, `dist/dev.js`) are the only ones. `@solidjs/babel-plugin` and `@solidjs/compiler` (build-time tooling loaded by Babel/Node) are unchanged.
+
+- Updated dependencies [711b557]
+- Updated dependencies [9e6c867]
+- Updated dependencies [7d985b6]
+- Updated dependencies [3b4db21]
+- Updated dependencies [ded39d2]
+- Updated dependencies [fe3ab92]
+- Updated dependencies [1807f7f]
+- Updated dependencies [a71e42e]
+- Updated dependencies [a39415c]
+- Updated dependencies [8cfa272]
+- Updated dependencies [839c05e]
+- Updated dependencies [4e730a9]
+- Updated dependencies [ab4c40c]
+ - @solidjs/web@2.0.0-rc.8
+
## 2.0.0-rc.7
### Patch Changes
diff --git a/packages/h/package.json b/packages/h/package.json
index 4636e217d..458c86edd 100644
--- a/packages/h/package.json
+++ b/packages/h/package.json
@@ -1,7 +1,7 @@
{
"name": "@solidjs/h",
"description": "Hyperscript / h() factory for Solid — write components without compiled JSX.",
- "version": "2.0.0-rc.7",
+ "version": "2.0.0-rc.8",
"author": "Ryan Carniato",
"license": "MIT",
"homepage": "https://solidjs.com",
@@ -58,7 +58,7 @@
"test": "vitest run"
},
"peerDependencies": {
- "@solidjs/web": "^2.0.0-rc.7"
+ "@solidjs/web": "^2.0.0-rc.8"
},
"devDependencies": {
"@solidjs/web": "workspace:*",
diff --git a/packages/html/CHANGELOG.md b/packages/html/CHANGELOG.md
index 9c78f6656..60d698416 100644
--- a/packages/html/CHANGELOG.md
+++ b/packages/html/CHANGELOG.md
@@ -1,5 +1,37 @@
# @solidjs/html
+## 2.0.0-rc.8
+
+### Patch Changes
+
+- a1ed7f3: Support `{/* ... */}` style comments in tagged JSX templates, in addition to `` HTML comments. They are skipped at tokenize time, can contain template expressions, and may span string chunks.
+- a39415c: **Breaking:** all runtime packages are ESM only and declare `engines.node >= 22.12`.
+
+ Every `.cjs` artifact, every `require` branch in the exports maps, and the `types-cjs/` declaration mirrors are gone. Node 22.12+ loads ESM through `require()` natively, so a CommonJS host resolves the same files through the same export conditions it always did (`browser`, `node`, `development`, `observe`, …) — there is one module graph per tier rather than two to keep in step. `main` now points at the ESM server entry.
+
+ For consumers:
+ - ESM apps, Vite, Vitest, Bun, Deno, workers: no change.
+ - CommonJS Node apps: require Node 22.12 or later. `require("solid-js")` keeps working.
+ - TypeScript CommonJS projects: use `module: "NodeNext"` (TS 5.8+), which type-checks `require()` of ESM packages; `module: "Node16"` will report TS1479.
+ - Jest: needs Node 22.12+ for `require(esm)`; any preset that maps specifiers to `.cjs` paths (as `solid-jest` does for Solid 1.x) has nothing to map to and must be updated.
+
+ `@solidjs/signals` drops its flat `dist/node*.cjs` builds; its ESM entries (`dist/prod/`, `dist/observe/`, `dist/dev.js`) are the only ones. `@solidjs/babel-plugin` and `@solidjs/compiler` (build-time tooling loaded by Babel/Node) are unchanged.
+
+- Updated dependencies [711b557]
+- Updated dependencies [9e6c867]
+- Updated dependencies [7d985b6]
+- Updated dependencies [3b4db21]
+- Updated dependencies [ded39d2]
+- Updated dependencies [fe3ab92]
+- Updated dependencies [1807f7f]
+- Updated dependencies [a71e42e]
+- Updated dependencies [a39415c]
+- Updated dependencies [8cfa272]
+- Updated dependencies [839c05e]
+- Updated dependencies [4e730a9]
+- Updated dependencies [ab4c40c]
+ - @solidjs/web@2.0.0-rc.8
+
## 2.0.0-rc.7
### Patch Changes
diff --git a/packages/html/package.json b/packages/html/package.json
index 964d2004d..1e2e5f253 100644
--- a/packages/html/package.json
+++ b/packages/html/package.json
@@ -1,7 +1,7 @@
{
"name": "@solidjs/html",
"description": "Tagged-template-literal templating for Solid — write components with no build step.",
- "version": "2.0.0-rc.7",
+ "version": "2.0.0-rc.8",
"author": "Ryan Carniato",
"license": "MIT",
"homepage": "https://solidjs.com",
@@ -42,7 +42,7 @@
"test": "vitest run"
},
"peerDependencies": {
- "@solidjs/web": "^2.0.0-rc.7"
+ "@solidjs/web": "^2.0.0-rc.8"
},
"devDependencies": {
"@solidjs/web": "workspace:*",
diff --git a/packages/signals/CHANGELOG.md b/packages/signals/CHANGELOG.md
index 695431257..133ca6c67 100644
--- a/packages/signals/CHANGELOG.md
+++ b/packages/signals/CHANGELOG.md
@@ -1,5 +1,159 @@
# @solidjs/signals
+## 2.0.0-rc.8
+
+### Patch Changes
+
+- 21c5460: Router-agnostic navigation attribution: `OBSERVE.attribution.withOrigin({ kind: "navigation", name, to, from, params }, fn)`
+
+ A navigation in Solid 2 is a plain write to the location; the runtime already sees everything it costs (the hold behind route data, the re-runs, the silence) but not that the writes were a navigation, or to which route. `withOrigin` is the seam where a router says so, around its write — the one router-specific line, living in the router. From it the attribution engine:
+ - stamps the writes with a `navigation` origin (new `ChangeOrigin.kind`, with `name`/`to`/`from`/`params`), nested under the enclosing interaction — including through an action step — so cause chains read `— navigation to /users/:id (under click on a.nav "Alice")`;
+ - names holds by route: `HoldEvent.origin`, `SILENT_HOLD`/`LONG_HOLD` messages that start from the navigation, and `data.navigation` on the event;
+ - keeps one `NavigationEvent` per frame (`attribution.navigations()`), settled exactly once as `committed` (a plain drain took the writes), `held` (with the `HoldEvent` attached), or `superseded` (a later write replaced them before they landed);
+ - folds settled navigations per route into `feedback().navigations`.
+
+ The ref is read late on purpose. `name`/`to`/`params` are re-read from the object when the navigation settles, so a router whose match is coarse at write time (a lazy route subtree resolving inside the hold) assigns the exact pattern onto the same object and every consumer reads it — no second API. A redirect is declared with `redirect: n` (the hop depth routers already track) and folds onto the pending navigation instead of opening one: one record, timed from the user's request, the abandoned destination kept in `NavigationEvent.redirects`, `feedback().navigations[].redirected` counting them, and `formatOrigin` reading `navigation to /login (redirected from /users/42)`.
+
+ Hold census fix: a `latest()`/`isPending()` companion now counts as acknowledgement only when an effect reads it, through however many memos. Memos compute eagerly, so a router's internal `createMemo(() => isPending(location))` used to clear `SILENT_HOLD` for every navigation whether or not anything rendered it.
+
+ One new core hook, `flushEnd`, fires once per `flush()` drain so the engine has the "committed and effects ran" instant for writes no transition held. Prod builds are unchanged (the hook site folds out; only the inert attribution twin gained the new empty queries).
+
+- 711b557: Move the #3338 diagnostics out of prod bytes. The `lazy()` "not preloaded" explanation and the document-root preload-failure framing are dev-only; prod keeps terse messages and, at a document root, hands the preload failure itself to `reportError` (no wrapper `Error`). The `haltReactivity` `reportError` hand-off is compacted.
+- 1354a53: Fix a render effect that reads sources written by two concurrent, non-entangled transactions committing the wrong value and then never updating (#3322). Effects have one value slot and do not entangle transactions, so the second transaction's recompute overwrote the value the first still owed a run for; the first's silent commit then published it, and the second found nothing left to run. Such effects are now re-derived against the committed world at each owed commit, ahead of the effect phase. The same mechanism covers a mainline recompute of an effect a live transaction had computed (the transaction's commit re-derives it), and render effects recomputing with no transaction active no longer see a foreign transaction's staged signal through the read fast path — the mask the slow path already applied.
+- ae0ec3f: Fix `deep()` over optimistic and derived stores missing writes it should hear, and derived views churning row identities under an optimistic overlay (#3323).
+ - `deep(view)` / `deep(view[i])` over a derived view — `createOptimisticStore(base)` or a projection whose backing is another store — never re-ran when the base store was written, while per-key reads on the same view did. A view's targets chain to the inner store's proxies and base writes bump the inner record's witness nodes; the walk never subscribed them, and it resolved children to fresh non-chained wrappers of the base raw instead of the chained row targets the view serves. The walk now reads through the whole chain and resolves children to the targets the get trap would serve.
+ - `deep()` over any optimistic store was deaf to every write on a row added under a held action: the row lives in presence/value overrides, not the committed backing, and the walk enumerated the raw backing. The `ownKeys` / `getOwnPropertyDescriptor` trap bodies are now shared helpers the walk uses, so the walk sees exactly what readers see.
+ - A derived view's untouched rows came back as fresh proxies for the life of an optimistic action (`view.map(r => r)` was O(n) new identities per action) and snapped back at settle. The optimistic diff compared the inner store's child proxies to the draft's raws and marked every row changed; it now compares unwrapped values. Chained targets serving from a pending backing resolve inner-owned raws to the inner proxy before wrapping, and `snapshot()` composes outer overrides below the root.
+
+ Only `deep()`, the chained-view read path, and the optimistic diff changed; plain-store reads and writes are unaffected.
+
+- 1c9e9e7: Fix a held transaction being re-entered while an unrelated flush finalizes — through a store commit hook (`deep()` readers of a projection), a boundary check, or a recompute — and that flush then committing the transaction's state and running its effects as if it still owned the batch, leaving the UI permanently stale once the transaction settled (#3319). Finalization now captures the batch it started with and settles nothing an entered transaction adopted (a completing transaction still settles its own separate containers). Effects follow ownership: a run is applied by the commit of the transaction that computed its value, so the entering flush still applies everything it computed mainline — the write that caused it reads and renders together — while runs owned by the still-held transaction park with it and release when it completes. Optimistic lanes are unaffected; they apply their own effects ahead of their transaction by design.
+- b5bd6fb: Store twins of the lane-authority fixes. An optimistic store's optimistic write after a `yield` now reveals on its lane with its derivations when the action's transaction already holds the same truth (#3330 store twin): adoptions under a live transaction hold on optimistic families too, a held adoption notifies its nodes at write time so the commit promotes silently instead of re-running every subscriber, and a tentative write is judged against the view readers see rather than the swapped-in backing. A derived optimistic store's own truth landing a different value over a tentative edit supersedes the override for the graph now, with action provenance (#3331 store twin): the authoritative landing reaches the engine's supersession, and a tracked reader of a superseded node reads the committed truth once the landing has committed ahead of the override's revert. Surfaced alongside and fixed in core: a reader that first links to a node while another transaction holds a staged write (an effect created during the hold, a store key first read under it) read the committed value but never learned of the commit — such readers now re-derive when the transaction reveals. Plain-store `reconcile` inside an action, and store keys first read under a held adoption, hold like every other write: handlers read committed, `latest()` the staged value, and the reveal comes with the transaction.
+- b5bd6fb: A memo deriving from an optimistic value now reveals together with the override when the override is written after its transaction already staged the same derived result (e.g. `setOptimistic` after an `await` inside an action whose earlier write produced the same value). The lane recompute compared its result against the transaction-held value instead of the value on screen, called it unchanged, and left the derivation stale until the action committed (#3330).
+- b5bd6fb: Fix optimistic lanes merged through a shared reader releasing their reveal while one member's async is still in flight (#3335). A lane's hold is a property of each pending async node — looked up in whichever live transaction observed it — not of the merged root's transaction, which after a cross-transaction merge recorded only one member's observations. A memo reading two optimistic values now reveals with both, as it does for plain signals (A15).
+- b5bd6fb: An optimistic override is superseded the moment its source recomputes the node with a different value — its own async landing, or a sync recompute driven by an upstream change (`createOptimistic(() => asyncMemo())`): tracked derivations (memos, downstream async) recompute from the arrived truth immediately as held transaction work, instead of waiting for the override's own downstream flight to finish first — so the correction no longer takes two sequential round-trips (#3331). The override remains the displayed value for untracked reads and the applied frame until the transaction commits; `latest()` returns the arrived value and `isPending()` is `true` while they differ. An equal landing confirms silently. Only the override's own question or a newer one supersedes: when two rapid actions overlap on one node, the older action's late answer is held to the commit without moving the graph — a slow source does not leak back in over the user's latest intent.
+- b5bd6fb: fix(signals): a reveal of a foreign-held flight shows the committed value unless the flight's inputs are visible; a same-value re-prediction renews the override's provenance
+
+ The A15 reveal corollary is re-ruled (review on #3347): a stale (render) reader that lands on a node pending in another transaction shows the node's committed value, does not entangle the two transactions, and re-derives at that transaction's commit — parallel transactions, effects don't entangle. The reveal holds on the flight only when the committed value would tear against the frame: the flight's inputs were published while it was pending (`CONFIG_INPUTS_PUBLISHED`, set by a commit that leaves the node in the air, #3305), the node rides a live lane (optimistic / `latest`, #3334), or the node is uninitialized. An effect recorded for a transaction's commit replay that later recomputes under that transaction drops the stale recording (it is applied by the commit itself). GabbeV's "revealed reader never catches up" and "conditional reader stays hidden" shapes are pinned.
+
+ A same-value optimistic write by a newer action now renews the override's provenance stamp on the fast path, so an older action's slow answer no longer supersedes a value the user just re-confirmed (#3331 follow-up).
+
+- b5bd6fb: A reveal that discovers an async already in flight holds on the flight, whichever transaction the node is stamped with, and completes when the flight lands (#3334; A15 reveal corollary).
+ - `read()` no longer serves a pending node's committed value to a stale reader just because the node is stamped by another transaction. The stamp is pending-node bookkeeping — the flight's inputs may already be on screen (committed with no observer, #3305; revealed through an optimistic lane, #3334; held only by another reveal waiting on the same flight) — so that value tears the frame. The reader throws, the reveal opens/joins a transition blocked on the flight, and settles as one unit with it.
+ - Landing a lane-routed async now re-enters the transaction _waiting_ on it (`waitingTransition`) rather than the transaction that owns the lane. Entering the owner made the waiting reveal's stamped recompute merge the owner's still-running action into the reveal, so a `Show` flipped during an optimistic action stayed hidden until the action finished instead of until the data landed.
+ - `laneHeld` looks the observation up through the same `waitingTransition` helper (#3335).
+
+- 05725e8: Trim the #3319/#3322 fixes: `runEffect` reads `activeTransition` directly instead of a `parkHeldOwners` flag toggled around the ordinary effect phase (lane runners and the creation-time immediate run mark themselves exempt with `LANE_RUN`), and `contestEffect` is inlined into its single call site in `recompute`. Behavior-identical; -41 B minified on the core floor.
+- 27aee36: Mounting N rows in one flush was O(N²) when each row created a user effect whose source was written during row creation (the `ref` effect pattern). An unmarked node entering an already-marked pure heap invalidated the `markHeap` memo, so every later mid-tick memo pull re-walked the whole heap. The insertion now marks the incoming node in place instead; the mount is linear (8000 rows with a ref effect each: 231 ms → 12 ms).
+- fe3ab92: Make a failed lazy() hydration observable instead of a silently dead page (#3338):
+ - The client's "was not preloaded before hydration" error no longer says to add a Loading boundary — none is required for root-level `lazy()`. It now names the actual cause: the server serialized no client entry for the module (check the server log for "Asset manifest returned no client assets for module"), or the hydration id namespaces are misaligned.
+ - An uncaught error that halts the reactive system is handed to `reportError` where the platform provides it, so it reaches `window.onerror` / error monitoring. Creation-time throws (a lazy miss during the hydration render) are converted to status by ancestor recomputes and never reached the top; console.error was their only trace.
+ - `hydrate()`'s "module preload failed → fall back to client render" path no longer runs for a document root, where a client render is impossible (the shell cannot be created) and died deep in the walk with an unrelated "Hydration Mismatch" as an unhandled rejection. It now reports an explicit error carrying the preload failure as its cause.
+
+- 51c201f: mapArray SMALL-MOVE fast path: rotates, swaps, small displacements, and removals leave a keyed window that is the old window shifted with a bounded number of genuinely displaced identities — but the general diff paid O(newLen) regardless (window key-map, four full-length staged arrays, element-copied prefix/suffix), measured at ~50-140µs/op on 1000 rows against ~20µs of actual DOM work (the jfb-reorder suite's stable 1.8-4x deficits). The fast path scans first (two-pointer aligned-run detection with bounded realignment lookahead and a compare budget, so hopeless shapes like reverse bail almost immediately with nothing allocated), then commits by slicing the live arrays (native memcpy preserves the fresh-identity contract downstream change propagation relies on), copying only shifted runs, patching the displaced few, and disposing leftover sources. Gated to large trimmed windows (the trims already make small windows cheap), scoped to the plain identity-keyed mode (row-signal/custom-key/index modes keep the general path — halves the code for the same benchmark wins), and kept out of updateKeyedMap's function body (inlining deoptimized the general path). Rotate 140→6µs, swap 94→4µs, displace3 54→5µs; removefirst and reverse at parity; ~0.5 kB brotli in mapArray-bearing bundles.
+
+ Cold path (2026-09-09): the scan and the commit are two functions, so a pass that scans and bails — a full REPLACE, typically a page's first structural pass — compiles only the scan; and a 65-compare pre-probe in `updateKeyedMap` (is a mid-window item still within ±32 of its old position?) turns a replace away before the scan is even called. Interleaved A/B against `next`, cold (fresh page per sample) and warm: run/replace/runlots/clear at parity, swap and rotate ~0.5x, reverse/shuffle unchanged. On Octane's js-framework board: reorder suite 1.71x → 1.15x vs octane, js-framework 1.27x → 1.10x.
+
+- 2fa7539: Observe tier: no post-construction fields on reactive nodes.
+
+ The observe build stamped `_name` on every node, `_owner` on `createSignal`
+ nodes and live `_subCount`/`_depCount` edge counters on linked nodes after the
+ node literal — exactly the hidden-class transitions the prod literals are
+ shaped to avoid. Measured against prod on the reactivity benchmark the tier
+ cost +15% overall with creation tests 2–3× under polymorphic load.
+ - Node factories (`computed`, `createEffectNode`, `signal`, `slotSignal`,
+ `createOwner`) now have two literals selected at build time: prod, and
+ observe = prod plus its `_name` slot (`_owner` too on signals). Default
+ labels (`signal`, `computed`, `effect`, `trackedEffect`) come from the
+ literal, so the `createEffect`/`createRenderEffect`/`createTrackedEffect`
+ wrappers no longer spread a fresh options object per effect to inject one.
+ A dist test pins observe's key set to prod's plus the slots.
+ - Edge counters are gone. `HUGE_FAN_OUT` is counted by the notify walk a
+ committed change already makes over its subscribers, `HUGE_FAN_IN` by one
+ walk of the recompute's trimmed dep list at the end of the pass.
+ Both therefore fire on the work — the change / the recompute — rather than
+ on the link, once per node and again after +500 growth (a WeakMap, not a
+ node field). `WIDE_WRITE` (engine) counts the subscriber list on the write
+ and hands over to `HUGE_FAN_OUT` at 2000, so a change never carries both.
+ Messages: "changed with N subscribers" / "tracked N sources".
+ - Prod artifacts are unchanged apart from removing a leftover
+ `...(false ? {...} : options)` spread in `createEffect`.
+
+- 0961d97: Observe tier: first-class interaction records and a typed record channel.
+ - `attribution.interactions()` and `InteractionEvent`: one record per `withInteraction` dispatch with `at`, `handlerMs`, `writes`, `runs`, `created` (computations built in its runs), `runMs`, the `holds` and `navigations` attached, and `settledMs`/`outcome` (`idle` | `committed` | `held`) once everything it caused is through.
+ - `attribution.subscribe(type, listener)` for `"rerun" | "interaction" | "hold" | "navigation"`, delivered synchronously as each record completes; the bare `subscribe(listener)` form is unchanged.
+ - `RerunEvent.at` and `HoldEvent.at` — absolute times on the `performance.now()` clock beside the existing durations.
+ - `HoldEvent.acknowledgements` replaces `acknowledgedBy`: one `{ kind, source, reader? }` per affordance, `reader` the owner path of the effect that painted it. `feedback().sources[].acknowledgedBy` still ranks by `kind:source`. `@solidjs/diagnostics` artifact format version 4 (holds carry `acknowledgements`; assertion evidence likewise).
+ - `NavigationRef.params` values may be `undefined` (an optional segment left unbound).
+ - `OBSERVE.exclude(owner)` / `OBSERVE.isExcluded(subject)` — an observer rendering inside the app it watches marks its own subtree; diagnostics about it are suppressed and the engine records none of its runs.
+ - `solid-js` re-exports the tier types from its root: `InteractionRef`, `NavigationRef`, `OriginRef`, `DiagnosticEvent` and friends, and the engine's record types (`ChangeOrigin`, `RerunEvent`, `HoldEvent`, `NavigationEvent`, `InteractionEvent`, …).
+
+- 1807f7f: Observe tier: split dev-only checks from production-legal observability wiring.
+
+ **Breaking (pre-release):** `DEV.diagnostics` moved to a new `OBSERVE` export
+ — `OBSERVE.diagnostics.{subscribe,capture,emit}`, `OBSERVE.subjectOf(event)`.
+ `DEV` keeps the devtools surface (`hooks`, `getChildren`/`getSignals`/
+ `getParent`/`getSources`/`getObservers`) and gains the console face
+ (`DEV.report`, `DEV.setConsoleFooter` — formerly
+ `DEV.diagnostics.setConsoleFooter`). Both are exported from `@solidjs/signals`
+ and `solid-js` (client and server).
+
+ **Breaking (pre-release):** the attribution engine is its own entry.
+ `DEV.attribution.enable()` and friends are now
+ `import { attribution } from "solid-js/attribution"` (or
+ `@solidjs/signals/attribution`) — `enable/disable/subscribe/history/why/
+subscriptions/costs/waterfalls/holds/feedback/markFlight/format/formatOrigin`,
+ plus the record types (`RerunEvent`, `ChangeRecord`, `ChangeOrigin`,
+ `HoldEvent`, …) which were previously unexported. The runtime keeps only the
+ core's side as `OBSERVE.attribution`: `install(hooks)`/`installed` (the hook
+ slot an engine — built-in or a devtools' own — installs into) and
+ `withInteraction(ref, fn)` (the frame the web runtime opens around every event
+ dispatch; `fn()` when no engine is installed). A build that never imports the
+ engine never ships it: the observe tier costs ~1.3 KB brotli over prod on the
+ CSR scenario, the engine 9.7 KB more when enabled. The import is legal in
+ every tier — prod resolves an inert engine with the same surface.
+ `@solidjs/diagnostics` requires `OBSERVE` and imports the engine itself; it now
+ works against observe builds.
+
+ **New build tier.** Every package with wiring ships `.observe.{js,cjs}`
+ beside its prod and dev artifacts, selected by a new `observe` export condition
+ (listed after `development`, so dev still wins when both are set): signals
+ `dist/observe/` + `dist/node.observe.cjs` (each with an `attribution` entry
+ beside `index`; the flat dev/CJS builds are code-split so both entries share
+ one module instance), solid-js `solid.observe.*` and
+ `server.observe.*`, web `web.observe.*`, universal `universal.observe.*`.
+ Observe builds keep attribution hook sites, owner labels (`_name`, flow-control
+ memo names, component roots), graph edge counters and the diagnostics channel;
+ they fold out strict-read checks, invariants, forbidden-scope guards, devtools
+ brands and all console output. Entries without wiring (frames, server-functions,
+ storage, h, html, element) fall through to prod under `observe`. Signals gates
+ on `__OBSERVE__` (dev implies observe; asserted at init), solid-js/web/universal
+ on the `"_SOLID_OBSERVE_"` literal. Default prod artifacts are unchanged apart
+ from the new `OBSERVE = undefined` export; `_name` is reserved from property
+ mangling so the cross-package label survives in the observe tree.
+ `OBSERVE.diagnostics.emit` accepts an explicit `ownerPath` for hosts whose
+ owners are not signals' owners (the SSR runtime).
+
+- 645ec0d: Projection leaf nodes are released when their readers let go (#3351). Every node materialized under a projection or derived store is linked into the projection computed's firewall child chain; the chain was append-only, so a long-lived keyed record retained one node — and the last value it served — per leaf ever read, until the projection itself was disposed. The chain is now doubly linked and the unobserved sweep unlinks the node in O(1), so deleted rows and their nested objects are collectable while the projection stays live, and the per-mark child walk covers live leaves only.
+- 12c3be9: Projection and derived-store drafts now open as prototype overlays like plain stores, so a derive that touches one root key of a wide keyed record is O(written) instead of cloning the whole raw on every recompute (#3352: ~17 ms → ~0.02 ms per derive at 20k keys). Optimistic families, chained backings, and arrays keep the clone path. Also fixes an overlay commit bug this surfaced: a child's flatten could resurrect a slot that the parent's earlier fold in the same batch had replaced or deleted.
+- 3a5fe8c: Refuse `flush()` inside an action body. An action's writes are held by its transaction until it settles, so a flush can't reveal them — and the drain loop only exits once the ambient transition is cleared, so it parked the transaction mid-slice and every write that followed in the body landed as a plain, committed write, visible before the action finished. DEV now throws `FLUSH_IN_ACTION`; prod skips the drain (the `flush(fn)` form still runs `fn`). The same drain inside `restoreTransition` is skipped when a nested action resumes synchronously inside an outer body, which had the same leak.
+- a39415c: **Breaking:** all runtime packages are ESM only and declare `engines.node >= 22.12`.
+
+ Every `.cjs` artifact, every `require` branch in the exports maps, and the `types-cjs/` declaration mirrors are gone. Node 22.12+ loads ESM through `require()` natively, so a CommonJS host resolves the same files through the same export conditions it always did (`browser`, `node`, `development`, `observe`, …) — there is one module graph per tier rather than two to keep in step. `main` now points at the ESM server entry.
+
+ For consumers:
+ - ESM apps, Vite, Vitest, Bun, Deno, workers: no change.
+ - CommonJS Node apps: require Node 22.12 or later. `require("solid-js")` keeps working.
+ - TypeScript CommonJS projects: use `module: "NodeNext"` (TS 5.8+), which type-checks `require()` of ESM packages; `module: "Node16"` will report TS1479.
+ - Jest: needs Node 22.12+ for `require(esm)`; any preset that maps specifiers to `.cjs` paths (as `solid-jest` does for Solid 1.x) has nothing to map to and must be updated.
+
+ `@solidjs/signals` drops its flat `dist/node*.cjs` builds; its ESM entries (`dist/prod/`, `dist/observe/`, `dist/dev.js`) are the only ones. `@solidjs/babel-plugin` and `@solidjs/compiler` (build-time tooling loaded by Babel/Node) are unchanged.
+
+- dd1d4ed: Wake blocked readers when a conditional drops pending dependencies without changing its result, while preserving pending state from other dependency paths.
+- 4e730a9: `spread()` reads a `merge()` proxy through its sources instead of through the proxy. A spread mixed with other attributes compiles to `spread(el, merge(statics, () => rest))`; going through the proxy cost merge's `keys()` (a `Set` plus an own-enumerable scan of every source) and then, per key, a right-to-left `in` walk of the sources, on every run. The spread now iterates the flattened sources directly — the union of own string keys, later sources overriding earlier, `children`/`ref` excluded — and enumerates each source through the same single-trap path as `readShallow()`. `omit()` is not a merge and stays opaque: it is enumerated through its own filtering trap. Own keys only, per source: a key an earlier source owns and a later source merely inherits resolves to the earlier source's value (the proxy's `in` walk saw the inherited one) — spread has always applied own properties only. `@solidjs/signals` gains an `@internal` `mergeSources()`. Guarded by the Tier-1 `spread-enumerate` bench (`merge(static, reactive)` row). `readShallow()` re-maps a class array element-wise instead of copy-on-write (−58 B brotli on `web.js`; `className` allocates for an array anyway, measured at parity).
+- 4935c7d: Store-owned backings now carry their owning target under an internal enumerable symbol stamp instead of registering in two weak collections (ownership set + raw→target map) on every draft — the identity-hash/ephemeron cost of those registrations was the remaining floor of a one-key store write (#3360, part two). Steady-state single-key writes drop from ~340 ns to ~180 ns; reconcile and projection benches improve 10–80%. The stamp is invisible through the proxy (`ownKeys`, `in`, descriptors, spreads), never appears in `snapshot()` output, never acquires a node, and is skipped by every key walk (membership/deep-witness diffs, reconcile, optimistic staging, affects scopes).
+- 0f14430: Store writes on narrow containers are ~1.85× cheaper (629 → 340 ns per write+commit steady state; a fresh store's first write+commit 3× cheaper). Plain-data containers now clone by spread instead of a descriptor walk, and the #3044 prototype overlay is taken only for wide (>32 own keys) containers over an already-owned backing — for narrow or unowned ones the overlay cost more than the clone it was meant to avoid (`Object.create` turns the backing into a V8 prototype, and the first commit had to privatize-clone anyway). Part one of #3360; the remaining per-write cost is the weak-collection registration of each pending backing.
+
## 2.0.0-rc.7
### Patch Changes
diff --git a/packages/signals/package.json b/packages/signals/package.json
index 6dcd7e30c..410c17506 100644
--- a/packages/signals/package.json
+++ b/packages/signals/package.json
@@ -1,6 +1,6 @@
{
"name": "@solidjs/signals",
- "version": "2.0.0-rc.7",
+ "version": "2.0.0-rc.8",
"description": "Solid's reactive primitives: signals, memos, effects, stores, and async-aware computations.",
"author": "Ryan Carniato",
"license": "MIT",
diff --git a/packages/solid/CHANGELOG.md b/packages/solid/CHANGELOG.md
index c8ebbb600..76eb3b3ba 100644
--- a/packages/solid/CHANGELOG.md
+++ b/packages/solid/CHANGELOG.md
@@ -1,5 +1,130 @@
# solid-js
+## 2.0.0-rc.8
+
+### Patch Changes
+
+- 01ac18c: Compiler `componentNames` option: component owner labels that survive minification. With the flag on, DOM output carries the tag as written in source as a third `createComponent` argument — `` compiles to `createComponent(Home, props, "Home")`, `` to `"Ui.Button"`, `` to `"this.Row"` — and the dev and observe runtimes label the component's owner with it (`` in diagnostic `ownerPath`s, attribution chains, and the devtools `_component.name`), falling back to `Comp.name` as before. Until now an observe-tier production bundle reported hot scopes and holds under whatever the minifier left of the function name (` › `), and a `lazy()` or HMR wrapper hid the tag name even in dev. Off by default and byte-identical output when off; SSR (which inlines the call) and universal output never emit it; the production `createComponent` ignores the argument. Both compilers implement it in parity (shared fixtures, cross-mode ratchet). `@solidjs/vite-plugin` enables it for the dev and `observe` postures.
+- 711b557: Move the #3338 diagnostics out of prod bytes. The `lazy()` "not preloaded" explanation and the document-root preload-failure framing are dev-only; prod keeps terse messages and, at a document root, hands the preload failure itself to `reportError` (no wrapper `Error`). The `haltReactivity` `reportError` hand-off is compacted.
+- 7d985b6: Fix SSR XSS: strings yielded by flow-control memos rendered unescaped
+
+ `{s}`, `{v => v}`, ` s} />`,
+ `/`, boundary fallbacks and any component that returns a string through a
+ memo rendered that string raw on the server. The server flow controls return memos for
+ hydration-id alignment; `escape()` passed functions through by identity, and the resolver
+ appended whatever they later produced without escaping.
+
+ One rule now: `escape(x)` at a hole covers everything reachable from `x` — strings, array
+ items, and what a function yields when the resolver calls it (a deferred-escape wrapper).
+ Finished `{ t }` nodes pass through. `Loading` escapes its content the way it already
+ escaped its fallback. The compilers stop wrapping fragment / mixed component children in
+ `_$escape` (they are values; escaping them too double-escaped through
+ `{props.children}`), and a single-expression fragment at a hole keeps the
+ hole's wrap. Live-hole tags ride the wrapper and `$slot` survives the array copy, so
+ frames behave as before.
+
+- fe3ab92: Make a failed lazy() hydration observable instead of a silently dead page (#3338):
+ - The client's "was not preloaded before hydration" error no longer says to add a Loading boundary — none is required for root-level `lazy()`. It now names the actual cause: the server serialized no client entry for the module (check the server log for "Asset manifest returned no client assets for module"), or the hydration id namespaces are misaligned.
+ - An uncaught error that halts the reactive system is handed to `reportError` where the platform provides it, so it reaches `window.onerror` / error monitoring. Creation-time throws (a lazy miss during the hydration render) are converted to status by ancestor recomputes and never reached the top; console.error was their only trace.
+ - `hydrate()`'s "module preload failed → fall back to client render" path no longer runs for a document root, where a client render is impossible (the shell cannot be created) and died deep in the walk with an unrelated "Hydration Mismatch" as an unhandled rejection. It now reports an explicit error carrying the preload failure as its cause.
+
+- 0961d97: Observe tier: first-class interaction records and a typed record channel.
+ - `attribution.interactions()` and `InteractionEvent`: one record per `withInteraction` dispatch with `at`, `handlerMs`, `writes`, `runs`, `created` (computations built in its runs), `runMs`, the `holds` and `navigations` attached, and `settledMs`/`outcome` (`idle` | `committed` | `held`) once everything it caused is through.
+ - `attribution.subscribe(type, listener)` for `"rerun" | "interaction" | "hold" | "navigation"`, delivered synchronously as each record completes; the bare `subscribe(listener)` form is unchanged.
+ - `RerunEvent.at` and `HoldEvent.at` — absolute times on the `performance.now()` clock beside the existing durations.
+ - `HoldEvent.acknowledgements` replaces `acknowledgedBy`: one `{ kind, source, reader? }` per affordance, `reader` the owner path of the effect that painted it. `feedback().sources[].acknowledgedBy` still ranks by `kind:source`. `@solidjs/diagnostics` artifact format version 4 (holds carry `acknowledgements`; assertion evidence likewise).
+ - `NavigationRef.params` values may be `undefined` (an optional segment left unbound).
+ - `OBSERVE.exclude(owner)` / `OBSERVE.isExcluded(subject)` — an observer rendering inside the app it watches marks its own subtree; diagnostics about it are suppressed and the engine records none of its runs.
+ - `solid-js` re-exports the tier types from its root: `InteractionRef`, `NavigationRef`, `OriginRef`, `DiagnosticEvent` and friends, and the engine's record types (`ChangeOrigin`, `RerunEvent`, `HoldEvent`, `NavigationEvent`, `InteractionEvent`, …).
+
+- 1807f7f: Observe tier: split dev-only checks from production-legal observability wiring.
+
+ **Breaking (pre-release):** `DEV.diagnostics` moved to a new `OBSERVE` export
+ — `OBSERVE.diagnostics.{subscribe,capture,emit}`, `OBSERVE.subjectOf(event)`.
+ `DEV` keeps the devtools surface (`hooks`, `getChildren`/`getSignals`/
+ `getParent`/`getSources`/`getObservers`) and gains the console face
+ (`DEV.report`, `DEV.setConsoleFooter` — formerly
+ `DEV.diagnostics.setConsoleFooter`). Both are exported from `@solidjs/signals`
+ and `solid-js` (client and server).
+
+ **Breaking (pre-release):** the attribution engine is its own entry.
+ `DEV.attribution.enable()` and friends are now
+ `import { attribution } from "solid-js/attribution"` (or
+ `@solidjs/signals/attribution`) — `enable/disable/subscribe/history/why/
+subscriptions/costs/waterfalls/holds/feedback/markFlight/format/formatOrigin`,
+ plus the record types (`RerunEvent`, `ChangeRecord`, `ChangeOrigin`,
+ `HoldEvent`, …) which were previously unexported. The runtime keeps only the
+ core's side as `OBSERVE.attribution`: `install(hooks)`/`installed` (the hook
+ slot an engine — built-in or a devtools' own — installs into) and
+ `withInteraction(ref, fn)` (the frame the web runtime opens around every event
+ dispatch; `fn()` when no engine is installed). A build that never imports the
+ engine never ships it: the observe tier costs ~1.3 KB brotli over prod on the
+ CSR scenario, the engine 9.7 KB more when enabled. The import is legal in
+ every tier — prod resolves an inert engine with the same surface.
+ `@solidjs/diagnostics` requires `OBSERVE` and imports the engine itself; it now
+ works against observe builds.
+
+ **New build tier.** Every package with wiring ships `.observe.{js,cjs}`
+ beside its prod and dev artifacts, selected by a new `observe` export condition
+ (listed after `development`, so dev still wins when both are set): signals
+ `dist/observe/` + `dist/node.observe.cjs` (each with an `attribution` entry
+ beside `index`; the flat dev/CJS builds are code-split so both entries share
+ one module instance), solid-js `solid.observe.*` and
+ `server.observe.*`, web `web.observe.*`, universal `universal.observe.*`.
+ Observe builds keep attribution hook sites, owner labels (`_name`, flow-control
+ memo names, component roots), graph edge counters and the diagnostics channel;
+ they fold out strict-read checks, invariants, forbidden-scope guards, devtools
+ brands and all console output. Entries without wiring (frames, server-functions,
+ storage, h, html, element) fall through to prod under `observe`. Signals gates
+ on `__OBSERVE__` (dev implies observe; asserted at init), solid-js/web/universal
+ on the `"_SOLID_OBSERVE_"` literal. Default prod artifacts are unchanged apart
+ from the new `OBSERVE = undefined` export; `_name` is reserved from property
+ mangling so the cross-package label survives in the observe tree.
+ `OBSERVE.diagnostics.emit` accepts an explicit `ownerPath` for hosts whose
+ owners are not signals' owners (the SSR runtime).
+
+- a39415c: **Breaking:** all runtime packages are ESM only and declare `engines.node >= 22.12`.
+
+ Every `.cjs` artifact, every `require` branch in the exports maps, and the `types-cjs/` declaration mirrors are gone. Node 22.12+ loads ESM through `require()` natively, so a CommonJS host resolves the same files through the same export conditions it always did (`browser`, `node`, `development`, `observe`, …) — there is one module graph per tier rather than two to keep in step. `main` now points at the ESM server entry.
+
+ For consumers:
+ - ESM apps, Vite, Vitest, Bun, Deno, workers: no change.
+ - CommonJS Node apps: require Node 22.12 or later. `require("solid-js")` keeps working.
+ - TypeScript CommonJS projects: use `module: "NodeNext"` (TS 5.8+), which type-checks `require()` of ESM packages; `module: "Node16"` will report TS1479.
+ - Jest: needs Node 22.12+ for `require(esm)`; any preset that maps specifiers to `.cjs` paths (as `solid-jest` does for Solid 1.x) has nothing to map to and must be updated.
+
+ `@solidjs/signals` drops its flat `dist/node*.cjs` builds; its ESM entries (`dist/prod/`, `dist/observe/`, `dist/dev.js`) are the only ones. `@solidjs/babel-plugin` and `@solidjs/compiler` (build-time tooling loaded by Babel/Node) are unchanged.
+
+- 8cfa272: Require `seroval` and `seroval-plugins` `~1.6.7` (minor-locked, as before). Seroval 1.6 ships bundled declarations with no extensionless relative imports, so the `@solidjs/web` `server-functions`, `serialization` and `frames` type surfaces now type-check under `module: NodeNext` from a CommonJS project without `skipLibCheck` — the packaged-types check covers every public `@solidjs/web` specifier.
+- 4e730a9: `spread()` reads a `merge()` proxy through its sources instead of through the proxy. A spread mixed with other attributes compiles to `spread(el, merge(statics, () => rest))`; going through the proxy cost merge's `keys()` (a `Set` plus an own-enumerable scan of every source) and then, per key, a right-to-left `in` walk of the sources, on every run. The spread now iterates the flattened sources directly — the union of own string keys, later sources overriding earlier, `children`/`ref` excluded — and enumerates each source through the same single-trap path as `readShallow()`. `omit()` is not a merge and stays opaque: it is enumerated through its own filtering trap. Own keys only, per source: a key an earlier source owns and a later source merely inherits resolves to the earlier source's value (the proxy's `in` walk saw the inherited one) — spread has always applied own properties only. `@solidjs/signals` gains an `@internal` `mergeSources()`. Guarded by the Tier-1 `spread-enumerate` bench (`merge(static, reactive)` row). `readShallow()` re-maps a class array element-wise instead of copy-on-write (−58 B brotli on `web.js`; `className` allocates for an array anyway, measured at parity).
+- Updated dependencies [21c5460]
+- Updated dependencies [711b557]
+- Updated dependencies [1354a53]
+- Updated dependencies [ae0ec3f]
+- Updated dependencies [1c9e9e7]
+- Updated dependencies [b5bd6fb]
+- Updated dependencies [b5bd6fb]
+- Updated dependencies [b5bd6fb]
+- Updated dependencies [b5bd6fb]
+- Updated dependencies [b5bd6fb]
+- Updated dependencies [b5bd6fb]
+- Updated dependencies [05725e8]
+- Updated dependencies [27aee36]
+- Updated dependencies [fe3ab92]
+- Updated dependencies [51c201f]
+- Updated dependencies [2fa7539]
+- Updated dependencies [0961d97]
+- Updated dependencies [1807f7f]
+- Updated dependencies [645ec0d]
+- Updated dependencies [12c3be9]
+- Updated dependencies [3a5fe8c]
+- Updated dependencies [a39415c]
+- Updated dependencies [dd1d4ed]
+- Updated dependencies [4e730a9]
+- Updated dependencies [4935c7d]
+- Updated dependencies [0f14430]
+ - @solidjs/signals@2.0.0-rc.8
+
## 2.0.0-rc.7
### Patch Changes
diff --git a/packages/solid/package.json b/packages/solid/package.json
index 0aec08869..dfbde2a2d 100644
--- a/packages/solid/package.json
+++ b/packages/solid/package.json
@@ -1,7 +1,7 @@
{
"name": "solid-js",
"description": "Reactive JavaScript library for building user interfaces. Compiles JSX to real DOM with fine-grained signal-based updates — no virtual DOM.",
- "version": "2.0.0-rc.7",
+ "version": "2.0.0-rc.8",
"author": "Ryan Carniato",
"license": "MIT",
"homepage": "https://solidjs.com",
@@ -123,7 +123,7 @@
"performance"
],
"dependencies": {
- "@solidjs/signals": "^2.0.0-rc.7",
+ "@solidjs/signals": "^2.0.0-rc.8",
"csstype": "^3.1.0",
"seroval": "~1.6.7",
"seroval-plugins": "~1.6.7"
diff --git a/packages/test-integration/CHANGELOG.md b/packages/test-integration/CHANGELOG.md
index b5b6aad81..a8605ba3c 100644
--- a/packages/test-integration/CHANGELOG.md
+++ b/packages/test-integration/CHANGELOG.md
@@ -1,5 +1,53 @@
# test-integration
+## 2.0.0-rc.8
+
+### Patch Changes
+
+- Updated dependencies [21c5460]
+- Updated dependencies [01ac18c]
+- Updated dependencies [711b557]
+- Updated dependencies [9e6c867]
+- Updated dependencies [1354a53]
+- Updated dependencies [ae0ec3f]
+- Updated dependencies [1c9e9e7]
+- Updated dependencies [b5bd6fb]
+- Updated dependencies [b5bd6fb]
+- Updated dependencies [b5bd6fb]
+- Updated dependencies [b5bd6fb]
+- Updated dependencies [b5bd6fb]
+- Updated dependencies [b5bd6fb]
+- Updated dependencies [7d985b6]
+- Updated dependencies [3b4db21]
+- Updated dependencies [ded39d2]
+- Updated dependencies [05725e8]
+- Updated dependencies [27aee36]
+- Updated dependencies [a1ed7f3]
+- Updated dependencies [fe3ab92]
+- Updated dependencies [51c201f]
+- Updated dependencies [2fa7539]
+- Updated dependencies [0961d97]
+- Updated dependencies [1807f7f]
+- Updated dependencies [645ec0d]
+- Updated dependencies [12c3be9]
+- Updated dependencies [a71e42e]
+- Updated dependencies [3a5fe8c]
+- Updated dependencies [a39415c]
+- Updated dependencies [8cfa272]
+- Updated dependencies [dd1d4ed]
+- Updated dependencies [839c05e]
+- Updated dependencies [4e730a9]
+- Updated dependencies [4935c7d]
+- Updated dependencies [0f14430]
+- Updated dependencies [ab4c40c]
+ - @solidjs/signals@2.0.0-rc.8
+ - @solidjs/babel-plugin@2.0.0-rc.8
+ - solid-js@2.0.0-rc.8
+ - @solidjs/web@2.0.0-rc.8
+ - @solidjs/html@2.0.0-rc.8
+ - @solidjs/universal@2.0.0-rc.8
+ - @solidjs/h@2.0.0-rc.8
+
## 2.0.0-rc.7
### Patch Changes
diff --git a/packages/test-integration/package.json b/packages/test-integration/package.json
index 4a76ad58f..6b07ae503 100644
--- a/packages/test-integration/package.json
+++ b/packages/test-integration/package.json
@@ -21,5 +21,5 @@
"gitly": "^2.2.1",
"shelljs": "^0.8.5"
},
- "version": "2.0.0-rc.7"
+ "version": "2.0.0-rc.8"
}
diff --git a/packages/universal/CHANGELOG.md b/packages/universal/CHANGELOG.md
index d17cd54ac..d4c8d3f86 100644
--- a/packages/universal/CHANGELOG.md
+++ b/packages/universal/CHANGELOG.md
@@ -1,5 +1,78 @@
# @solidjs/universal
+## 2.0.0-rc.8
+
+### Patch Changes
+
+- 1807f7f: Observe tier: split dev-only checks from production-legal observability wiring.
+
+ **Breaking (pre-release):** `DEV.diagnostics` moved to a new `OBSERVE` export
+ — `OBSERVE.diagnostics.{subscribe,capture,emit}`, `OBSERVE.subjectOf(event)`.
+ `DEV` keeps the devtools surface (`hooks`, `getChildren`/`getSignals`/
+ `getParent`/`getSources`/`getObservers`) and gains the console face
+ (`DEV.report`, `DEV.setConsoleFooter` — formerly
+ `DEV.diagnostics.setConsoleFooter`). Both are exported from `@solidjs/signals`
+ and `solid-js` (client and server).
+
+ **Breaking (pre-release):** the attribution engine is its own entry.
+ `DEV.attribution.enable()` and friends are now
+ `import { attribution } from "solid-js/attribution"` (or
+ `@solidjs/signals/attribution`) — `enable/disable/subscribe/history/why/
+subscriptions/costs/waterfalls/holds/feedback/markFlight/format/formatOrigin`,
+ plus the record types (`RerunEvent`, `ChangeRecord`, `ChangeOrigin`,
+ `HoldEvent`, …) which were previously unexported. The runtime keeps only the
+ core's side as `OBSERVE.attribution`: `install(hooks)`/`installed` (the hook
+ slot an engine — built-in or a devtools' own — installs into) and
+ `withInteraction(ref, fn)` (the frame the web runtime opens around every event
+ dispatch; `fn()` when no engine is installed). A build that never imports the
+ engine never ships it: the observe tier costs ~1.3 KB brotli over prod on the
+ CSR scenario, the engine 9.7 KB more when enabled. The import is legal in
+ every tier — prod resolves an inert engine with the same surface.
+ `@solidjs/diagnostics` requires `OBSERVE` and imports the engine itself; it now
+ works against observe builds.
+
+ **New build tier.** Every package with wiring ships `.observe.{js,cjs}`
+ beside its prod and dev artifacts, selected by a new `observe` export condition
+ (listed after `development`, so dev still wins when both are set): signals
+ `dist/observe/` + `dist/node.observe.cjs` (each with an `attribution` entry
+ beside `index`; the flat dev/CJS builds are code-split so both entries share
+ one module instance), solid-js `solid.observe.*` and
+ `server.observe.*`, web `web.observe.*`, universal `universal.observe.*`.
+ Observe builds keep attribution hook sites, owner labels (`_name`, flow-control
+ memo names, component roots), graph edge counters and the diagnostics channel;
+ they fold out strict-read checks, invariants, forbidden-scope guards, devtools
+ brands and all console output. Entries without wiring (frames, server-functions,
+ storage, h, html, element) fall through to prod under `observe`. Signals gates
+ on `__OBSERVE__` (dev implies observe; asserted at init), solid-js/web/universal
+ on the `"_SOLID_OBSERVE_"` literal. Default prod artifacts are unchanged apart
+ from the new `OBSERVE = undefined` export; `_name` is reserved from property
+ mangling so the cross-package label survives in the observe tree.
+ `OBSERVE.diagnostics.emit` accepts an explicit `ownerPath` for hosts whose
+ owners are not signals' owners (the SSR runtime).
+
+- a39415c: **Breaking:** all runtime packages are ESM only and declare `engines.node >= 22.12`.
+
+ Every `.cjs` artifact, every `require` branch in the exports maps, and the `types-cjs/` declaration mirrors are gone. Node 22.12+ loads ESM through `require()` natively, so a CommonJS host resolves the same files through the same export conditions it always did (`browser`, `node`, `development`, `observe`, …) — there is one module graph per tier rather than two to keep in step. `main` now points at the ESM server entry.
+
+ For consumers:
+ - ESM apps, Vite, Vitest, Bun, Deno, workers: no change.
+ - CommonJS Node apps: require Node 22.12 or later. `require("solid-js")` keeps working.
+ - TypeScript CommonJS projects: use `module: "NodeNext"` (TS 5.8+), which type-checks `require()` of ESM packages; `module: "Node16"` will report TS1479.
+ - Jest: needs Node 22.12+ for `require(esm)`; any preset that maps specifiers to `.cjs` paths (as `solid-jest` does for Solid 1.x) has nothing to map to and must be updated.
+
+ `@solidjs/signals` drops its flat `dist/node*.cjs` builds; its ESM entries (`dist/prod/`, `dist/observe/`, `dist/dev.js`) are the only ones. `@solidjs/babel-plugin` and `@solidjs/compiler` (build-time tooling loaded by Babel/Node) are unchanged.
+
+- Updated dependencies [01ac18c]
+- Updated dependencies [711b557]
+- Updated dependencies [7d985b6]
+- Updated dependencies [fe3ab92]
+- Updated dependencies [0961d97]
+- Updated dependencies [1807f7f]
+- Updated dependencies [a39415c]
+- Updated dependencies [8cfa272]
+- Updated dependencies [4e730a9]
+ - solid-js@2.0.0-rc.8
+
## 2.0.0-rc.7
### Patch Changes
diff --git a/packages/universal/package.json b/packages/universal/package.json
index c5dd6d3a0..025361629 100644
--- a/packages/universal/package.json
+++ b/packages/universal/package.json
@@ -1,7 +1,7 @@
{
"name": "@solidjs/universal",
"description": "Solid's universal runtime for creating custom renderers",
- "version": "2.0.0-rc.7",
+ "version": "2.0.0-rc.8",
"author": "Ryan Carniato",
"license": "MIT",
"homepage": "https://solidjs.com",
@@ -51,7 +51,7 @@
"test": "vitest run"
},
"peerDependencies": {
- "solid-js": "^2.0.0-rc.7"
+ "solid-js": "^2.0.0-rc.8"
},
"devDependencies": {
"solid-js": "workspace:*"
diff --git a/packages/web/CHANGELOG.md b/packages/web/CHANGELOG.md
index 99ff4c5e4..43f91cff8 100644
--- a/packages/web/CHANGELOG.md
+++ b/packages/web/CHANGELOG.md
@@ -1,5 +1,116 @@
# @solidjs/web
+## 2.0.0-rc.8
+
+### Patch Changes
+
+- 711b557: Move the #3338 diagnostics out of prod bytes. The `lazy()` "not preloaded" explanation and the document-root preload-failure framing are dev-only; prod keeps terse messages and, at a document root, hands the preload failure itself to `reportError` (no wrapper `Error`). The `haltReactivity` `reportError` hand-off is compacted.
+- 9e6c867: Document the `createEvent(request)` contract: the request is a standards-shaped `Request` and nothing more. Body-size enforcement may hand a rebuilt `Request`, so host-specific fields on the inbound object are not carried; hosts surface platform handles on the event from their own request.
+- 7d985b6: Fix SSR XSS: strings yielded by flow-control memos rendered unescaped
+
+ `{s}`, `{v => v}`, ` s} />`,
+ `/`, boundary fallbacks and any component that returns a string through a
+ memo rendered that string raw on the server. The server flow controls return memos for
+ hydration-id alignment; `escape()` passed functions through by identity, and the resolver
+ appended whatever they later produced without escaping.
+
+ One rule now: `escape(x)` at a hole covers everything reachable from `x` — strings, array
+ items, and what a function yields when the resolver calls it (a deferred-escape wrapper).
+ Finished `{ t }` nodes pass through. `Loading` escapes its content the way it already
+ escaped its fallback. The compilers stop wrapping fragment / mixed component children in
+ `_$escape` (they are values; escaping them too double-escaped through
+ `{props.children}`), and a single-expression fragment at a hole keeps the
+ hole's wrap. Live-hole tags ride the wrapper and `$slot` survives the array copy, so
+ frames behave as before.
+
+- 3b4db21: Fix an rc.7 SSR hydration regression: a self-closing element that spreads props containing `children` (`` in a wrapper component) read the compiled `children` getter twice on the server, building the child element twice and consuming a hydration id the client never allocates. Every element after the first such spread then hydrated against the wrong node and the client halted. `ssrElement` again reads each spread key at most once and never reads `children` when JSX children are present; the textarea `value`/`defaultValue`-as-content behaviour from #3286 is preserved.
+- ded39d2: The flash cookie key is now derived with PBKDF2 instead of a single SHA-256 hash.
+ - Guessing a weak `secret` from a captured cookie is now 100,000 times more expensive.
+ - Set `secret` to a high-entropy value of 32 bytes or more. The option docs show how to generate one.
+ - Flash cookies in flight when you deploy read as no flash, the same as a secret rotation.
+
+- fe3ab92: Make a failed lazy() hydration observable instead of a silently dead page (#3338):
+ - The client's "was not preloaded before hydration" error no longer says to add a Loading boundary — none is required for root-level `lazy()`. It now names the actual cause: the server serialized no client entry for the module (check the server log for "Asset manifest returned no client assets for module"), or the hydration id namespaces are misaligned.
+ - An uncaught error that halts the reactive system is handed to `reportError` where the platform provides it, so it reaches `window.onerror` / error monitoring. Creation-time throws (a lazy miss during the hydration render) are converted to status by ancestor recomputes and never reached the top; console.error was their only trace.
+ - `hydrate()`'s "module preload failed → fall back to client render" path no longer runs for a document root, where a client render is impossible (the shell cannot be created) and died deep in the walk with an unrelated "Hydration Mismatch" as an unhandled rejection. It now reports an explicit error carrying the preload failure as its cause.
+
+- 1807f7f: Observe tier: split dev-only checks from production-legal observability wiring.
+
+ **Breaking (pre-release):** `DEV.diagnostics` moved to a new `OBSERVE` export
+ — `OBSERVE.diagnostics.{subscribe,capture,emit}`, `OBSERVE.subjectOf(event)`.
+ `DEV` keeps the devtools surface (`hooks`, `getChildren`/`getSignals`/
+ `getParent`/`getSources`/`getObservers`) and gains the console face
+ (`DEV.report`, `DEV.setConsoleFooter` — formerly
+ `DEV.diagnostics.setConsoleFooter`). Both are exported from `@solidjs/signals`
+ and `solid-js` (client and server).
+
+ **Breaking (pre-release):** the attribution engine is its own entry.
+ `DEV.attribution.enable()` and friends are now
+ `import { attribution } from "solid-js/attribution"` (or
+ `@solidjs/signals/attribution`) — `enable/disable/subscribe/history/why/
+subscriptions/costs/waterfalls/holds/feedback/markFlight/format/formatOrigin`,
+ plus the record types (`RerunEvent`, `ChangeRecord`, `ChangeOrigin`,
+ `HoldEvent`, …) which were previously unexported. The runtime keeps only the
+ core's side as `OBSERVE.attribution`: `install(hooks)`/`installed` (the hook
+ slot an engine — built-in or a devtools' own — installs into) and
+ `withInteraction(ref, fn)` (the frame the web runtime opens around every event
+ dispatch; `fn()` when no engine is installed). A build that never imports the
+ engine never ships it: the observe tier costs ~1.3 KB brotli over prod on the
+ CSR scenario, the engine 9.7 KB more when enabled. The import is legal in
+ every tier — prod resolves an inert engine with the same surface.
+ `@solidjs/diagnostics` requires `OBSERVE` and imports the engine itself; it now
+ works against observe builds.
+
+ **New build tier.** Every package with wiring ships `.observe.{js,cjs}`
+ beside its prod and dev artifacts, selected by a new `observe` export condition
+ (listed after `development`, so dev still wins when both are set): signals
+ `dist/observe/` + `dist/node.observe.cjs` (each with an `attribution` entry
+ beside `index`; the flat dev/CJS builds are code-split so both entries share
+ one module instance), solid-js `solid.observe.*` and
+ `server.observe.*`, web `web.observe.*`, universal `universal.observe.*`.
+ Observe builds keep attribution hook sites, owner labels (`_name`, flow-control
+ memo names, component roots), graph edge counters and the diagnostics channel;
+ they fold out strict-read checks, invariants, forbidden-scope guards, devtools
+ brands and all console output. Entries without wiring (frames, server-functions,
+ storage, h, html, element) fall through to prod under `observe`. Signals gates
+ on `__OBSERVE__` (dev implies observe; asserted at init), solid-js/web/universal
+ on the `"_SOLID_OBSERVE_"` literal. Default prod artifacts are unchanged apart
+ from the new `OBSERVE = undefined` export; `_name` is reserved from property
+ mangling so the cross-package label survives in the observe tree.
+ `OBSERVE.diagnostics.emit` accepts an explicit `ownerPath` for hosts whose
+ owners are not signals' owners (the SSR runtime).
+
+- a71e42e: Rebuild the buffered server-function request from its url, method, headers and signal instead of through the `Request` copy constructor, so a host adapter's lazy request (Nitro via srvx) no longer fails every POST with 400 "Malformed server function arguments"; only a failed upload read answers 400 now, a failure to put the bytes back surfaces as its own error.
+- a39415c: **Breaking:** all runtime packages are ESM only and declare `engines.node >= 22.12`.
+
+ Every `.cjs` artifact, every `require` branch in the exports maps, and the `types-cjs/` declaration mirrors are gone. Node 22.12+ loads ESM through `require()` natively, so a CommonJS host resolves the same files through the same export conditions it always did (`browser`, `node`, `development`, `observe`, …) — there is one module graph per tier rather than two to keep in step. `main` now points at the ESM server entry.
+
+ For consumers:
+ - ESM apps, Vite, Vitest, Bun, Deno, workers: no change.
+ - CommonJS Node apps: require Node 22.12 or later. `require("solid-js")` keeps working.
+ - TypeScript CommonJS projects: use `module: "NodeNext"` (TS 5.8+), which type-checks `require()` of ESM packages; `module: "Node16"` will report TS1479.
+ - Jest: needs Node 22.12+ for `require(esm)`; any preset that maps specifiers to `.cjs` paths (as `solid-jest` does for Solid 1.x) has nothing to map to and must be updated.
+
+ `@solidjs/signals` drops its flat `dist/node*.cjs` builds; its ESM entries (`dist/prod/`, `dist/observe/`, `dist/dev.js`) are the only ones. `@solidjs/babel-plugin` and `@solidjs/compiler` (build-time tooling loaded by Babel/Node) are unchanged.
+
+- 8cfa272: Require `seroval` and `seroval-plugins` `~1.6.7` (minor-locked, as before). Seroval 1.6 ships bundled declarations with no extensionless relative imports, so the `@solidjs/web` `server-functions`, `serialization` and `frames` type surfaces now type-check under `module: NodeNext` from a CommonJS project without `skipLibCheck` — the packaged-types check covers every public `@solidjs/web` specifier.
+- 839c05e: Keep the server-function dispatch registry on `globalThis` so a re-evaluated runtime (Vite's SSR program reload after an edit in dev) shares one registry with the RPC seam: `query()`-declared reads no longer answer 405 after the first HMR update (#3346).
+- 4e730a9: `spread()` reads a `merge()` proxy through its sources instead of through the proxy. A spread mixed with other attributes compiles to `spread(el, merge(statics, () => rest))`; going through the proxy cost merge's `keys()` (a `Set` plus an own-enumerable scan of every source) and then, per key, a right-to-left `in` walk of the sources, on every run. The spread now iterates the flattened sources directly — the union of own string keys, later sources overriding earlier, `children`/`ref` excluded — and enumerates each source through the same single-trap path as `readShallow()`. `omit()` is not a merge and stays opaque: it is enumerated through its own filtering trap. Own keys only, per source: a key an earlier source owns and a later source merely inherits resolves to the earlier source's value (the proxy's `in` walk saw the inherited one) — spread has always applied own properties only. `@solidjs/signals` gains an `@internal` `mergeSources()`. Guarded by the Tier-1 `spread-enumerate` bench (`merge(static, reactive)` row). `readShallow()` re-maps a class array element-wise instead of copy-on-write (−58 B brotli on `web.js`; `className` allocates for an array anyway, measured at parity).
+- ab4c40c: Object-valued `style` / `class` bindings are read in the TRACKED half of their effect. `style()` and `className()` enumerate their object in the effect's untracked commit phase, so a proxy value — a store sub-object (`style={state.style}`, `class={row.classes}`), merged props, anything arriving through a spread — was identity-reactive only: in-place key mutations never re-applied, and every leaf read tripped `STRICT_READ_UNTRACKED` in dev. Both compilers now wrap the compute value of a non-inline `style={expr}` / `class={expr}` in a new compiler primitive, `readShallow()`, and `spread()` applies it to those two keys as it copies. `readShallow` is an identity passthrough for strings, plain objects and proxy-free arrays (a fresh literal is already the compute's own — the common case pays a `typeof`); a proxy is copied with one `ownKeys` trap (its own trap keeps the key set tracked) plus one tracked read per key; arrays are re-mapped only when an element is a proxy. Inline literals are untouched — they already compile per property. Provably-string expressions (string/template literals, concatenation) and literal objects/arrays skip the wrap at compile time. New Tier-1 bench `style-class-object`: plain-object rows at parity; store-backed rows go from identity-only (and, in dev, ~97 ms per 500 elements of diagnostics) to per-key reactive at ~3.5 ms. Octane svg-dashboard (prod build, store-backed style/attrs through spread): mount at parity, style_spread_pulse −6%, select_toggle −7%.
+
+ `spread()` shares the same enumeration: its compute half copied the source with `for…in` + `hasOwn`, which on a proxy source (`merge()`/`omit()`, `{...props}` in a component, store records — nearly every spread) is an `ownKeys` trap plus two `getOwnPropertyDescriptor` traps per key, each allocating a descriptor and a getter closure. It now takes the key set from one `Reflect.ownKeys` trap (the trap keeps the key set tracked) and reads each string key once; plain sources use `Object.keys`, the exact own-enumerable set the old loop yielded. New Tier-1 bench `spread-enumerate` (500 elements, 8 keys): `merge(static, reactive)` 376 → 537 ops/s (+43%), store record 253 → 415 ops/s (+64%), plain object at parity.
+
+- Updated dependencies [01ac18c]
+- Updated dependencies [711b557]
+- Updated dependencies [7d985b6]
+- Updated dependencies [fe3ab92]
+- Updated dependencies [0961d97]
+- Updated dependencies [1807f7f]
+- Updated dependencies [a39415c]
+- Updated dependencies [8cfa272]
+- Updated dependencies [4e730a9]
+ - solid-js@2.0.0-rc.8
+
## 2.0.0-rc.7
### Patch Changes
diff --git a/packages/web/package.json b/packages/web/package.json
index 83b811a53..f5321fcef 100644
--- a/packages/web/package.json
+++ b/packages/web/package.json
@@ -1,7 +1,7 @@
{
"name": "@solidjs/web",
"description": "Solid's web runtime: client rendering, hydration, SSR, and DOM-specific control flow (Portal, Dynamic).",
- "version": "2.0.0-rc.7",
+ "version": "2.0.0-rc.8",
"author": "Ryan Carniato",
"license": "MIT",
"homepage": "https://solidjs.com",
@@ -235,7 +235,7 @@
"seroval-plugins": "~1.6.7"
},
"peerDependencies": {
- "solid-js": "^2.0.0-rc.7"
+ "solid-js": "^2.0.0-rc.8"
},
"devDependencies": {
"@codspeed/vitest-plugin": "^5.4.0",