v5.3.0

Compare Source

v5.3.0

Compare Source

v2.4.6

Compare Source

Patch Changes

• 62e331d: Fix named imports breaking under Rolldown (Vite 8+ / Storybook 10.4.6+) bundlers.

  These packages re-export their public API via export * from "./x.js" barrels. Rollup resolves named imports through these at link time, but Rolldown's static analysis doesn't reliably follow export * for named-export resolution, causing errors like:

  "createEventListener" is not exported by "@​solid-primitives/event-listener/dist/index.js"
  

  The build now also emits explicit export { name } from "./x.js" lines for every runtime export reachable through a barrel's export *, derived automatically from each submodule's compiled output — so dist/ is bundler-agnostic regardless of how a given tool resolves star re-exports.

• Updated dependencies [62e331d]

  • @​solid-primitives/utils@​6.4.1

v1.0.0

Major Changes

• Declare the router stable as 1.0.0. This is a version realignment, not a breaking change: the code is functionally identical to the 0.16 line, which has held API-stable for years, and ^1.0.0 finally gets normal caret semantics instead of the pinned-minor treatment resolvers give 0.x releases. It also aligns major numbers across the ecosystem — router 1.x pairs with Solid 1.x (and SolidStart 2.0), while the in-progress Solid 2 router moves from 1.0.0-next.* to 2.0.0-next.* prereleases under the next tag.

Patch Changes

• 1211a89: Restore scroll with a single scroll once routing settles, dropping the ResizeObserver that re-asserted the offset while the document was still growing (<Router scrollRestoration>, added in 0.16.3). Settling after the navigation commits is what makes the offset reachable, and it is the strategy every peer router ships (SvelteKit, TanStack Router, React Router, Next); TanStack's equivalent MutationObserver sits commented out in their source. The chase carried real downside for a case none of them try to cover: with no bound, a target that is never reachable (a list that is genuinely shorter now) left the observer connected for the life of the page, re-clamping the viewport to the bottom on every subsequent resize, and scroll-induced layout changes can feed it back into itself. It was also untestable in jsdom, which has no ResizeObserver, so the branch had no coverage. Content committing after the navigation settles — an image without reserved space, a boundary below the fold — now keeps whatever offset the document can hold.

v2.0.0-rc.10

Compare Source

Minor Changes

• 3f2b7a7: The file filter logic used for CSS crawling in development can now be configured with the vite plugin option css.filter analog to serverFunctions.filter:

  solidStart({
    css: {
      filter: {
        // Exclude all node_modules except "my-dependency" with a flat node_modules layout
        exclude: "node_modules/!(my-dependency)/**/*",
      },
    },
  });

Patch Changes

• 6581877: Fixed shared chunk css not being server rendered in production (Vite 8 regression).
• 37d4488: Migrate the built-in Vite configuration from the deprecated rollupOptions alias to rolldownOptions.
• 3f2b7a7: Fixed css from files with url sensitive characters such as + not being server-rendered.

v2.0.0-rc.9

Compare Source

Patch Changes

• 8eef552: Remove type-only import remnants from client server-function transforms so they do not retain server-only dependency chains.

v2.0.0-rc.8

Compare Source

Patch Changes

• 3573985: Await asynchronous serverFunctions.onError handlers before serializing server function errors.
  Preserve the original error if the handler throws or rejects.

v2.0.0-rc.7

Compare Source

Patch Changes

• 87d73e1: chore: bump seroval to v1.6.0

v2.0.0-rc.6

Compare Source

Minor Changes

• bac24b2: Add a serverFunctions.onError option naming a module that observes and replaces what a server function threw, before it is serialized into the response

Patch Changes

• 27c2877: Remove leftover debug console.log calls from the server functions inspector, which logged on every server function request in dev.
• f15724b: Declare @solidjs/router as an optional peer dependency constrained to >=0.16.0 <2.0.0-0. Router v2 is expected to target Solid v2, so installing it alongside @solidjs/start v2 now surfaces a peer warning instead of silently producing an incompatible pairing. The peer is marked optional, so apps that do not use the router are unaffected.
• 5c8612f: Apply cookies set on a returned or thrown response during single flight mutations. redirect(to, { headers: { "Set-Cookie": ... } }) previously only reached the browser: the single flight re-render of the redirect target still ran with the old request cookies, so queries reading that cookie saw stale values. Those cookies are now merged into the request the re-render sees, matching what a browser round trip would have sent.
• 83122ed: Reject server function calls when the response is a 5xx without an X-Error header, instead of resolving with the parsed error body

v2.0.0-rc.5

Compare Source

Minor Changes

• 4c803e5: Add serialization.plugins to configure custom Seroval plugins for server functions.

  Values Seroval has no built-in support for (Mongo's ObjectId, Prisma's Decimal, Temporal, and other custom classes) previously threw when returned from or passed to a server function. Point the new option at a module whose default export is an array of plugins:

  // vite.config.ts
  solidStart({
    serialization: {
      plugins: "src/seroval-plugins.ts",
    },
  });

  // src/seroval-plugins.ts
  import { createPlugin } from "@​solidjs/start/serialization";

  The module is bundled into both the client and the server so both ends of a server function agree on the format, so it must not import server-only code. SolidStart's built-in plugins keep precedence. Only server-function and action payloads are affected; the SSR hydration payload is serialized by solid-js/web.

  Also adds a @solidjs/start/serialization entrypoint re-exporting Seroval's createPlugin, OpaqueReference, and plugin types, so plugin authors stay on the same Seroval version SolidStart serializes with.

Patch Changes

• e117d91: Route module ids now end in the source extension, so ecosystem plugins apply inside src/routes.

  Route files are imported through an id carrying the picked exports in the query (routes/api.ts?pick=GET), which left the id ending in the export name. Plugins whose filter is anchored on the file extension (/\.[cm]?[jt]sx?$/, the default for unplugin-auto-import, unplugin-macros and others) silently skipped every route file. The id now ends with a lang.<ext> marker, the same convention Vue SFCs use for ?vue&type=script&lang.ts. Chunk filenames are unchanged.

• d8f1ea8: Apply the configured nonce to the two script tags that were still missing it, so a strict script-src CSP no longer needs unsafe-inline:

  • The client-side redirect that streaming mode emits after the shell has already flushed (<script>window.location=...</script>) now carries the nonce.
  • The SPA entry script tag now carries the nonce, matching the SSR entry script.

• 27fca88: Fix actions returning json() or reload() leaving no-JS form submissions stranded on the /_server endpoint. These responses carry a value rather than a destination, so the redirect issued for progressive-enhancement submissions had no Location header. It now falls back to the submitting page, and the response value is unwrapped into the flash cookie so useSubmission().result matches the JS path.

• 75debc3: Scope the built-in ~ alias to the app package, so files in other workspace packages can map ~ to their own root through an importer-aware plugin such as vite-tsconfig-paths. In stylesheets and asset URLs (CSS @import, url(), new URL(..., import.meta.url)) ~ still always means the app root, since Vite resolves those without running plugins.

v2.0.0-rc.4

Compare Source

Patch Changes

• b6dfaac: Updated dependencies, including cookie-es to 3, shiki to 4, srvx to 0.12.4, oxc-parser to 0.141 and seroval to 1.5.6. parseSetCookie now returns undefined for cookies with a forbidden name or an empty name and value, and those cookies are no longer forwarded to nested server function requests.
• 02cd41e: Stop the dev toolbar from reporting benign ResizeObserver loop notifications as application errors. Browsers dispatch these as window error events carrying no error object, so the toolbar was capturing the raw ErrorEvent and force-opening the error panel over the app on every resize.
• d3c2af2: Don't send server error stack traces to the client in production builds. When a server function throws, the error is serialized and rethrown on the client, and seroval included Error.prototype.stack by default, leaking server file paths and internal function names. Stacks are still serialized in development.

v2.0.0-rc.3

Compare Source

Patch Changes

• d9018d6: fix(types): add missing properties to SolidStartOptions and expose them via Vite plugin configuration
• e26cef0: Fix TS2883/TS2742 when emitting declarations for entry-server.tsx. createHandler now returns StartHandler, a type owned by @solidjs/start, instead of h3's H3, so the inferred type of export default createHandler(...) no longer has to be named through a nested node_modules/@​solidjs/start/node_modules/h3 path.
• 7c8dbe6: keep TypeScript namespace members in route files during production builds
• b3c7aaf: Update h3 to 2.0.1-rc.26.
• b3c7aaf: Fixed event response status and headers set during server-side rendering with deferred async resources, not being applied on the outgoing response.

v2.0.0-rc.2

Compare Source

Minor Changes

• eeff49a: add new dev toolbar

Patch Changes

• bd8cb01: Update srvx to version 0.12.0.
• 4e98ac0: Restore the optional routerLoad third argument to createHandler, which primes custom routers (e.g. TanStack Router) on the server before SSR rendering. It was accidentally dropped in the v2 rewrite.

v8.66.0

Compare Source

🩹 Fixes

• eslint-plugin: [class-literal-property-style] preserve type annotations and don't drop decorators (#​12617)
• eslint-plugin: [no-unnecessary-type-parameters] check MappedType key remapping (#​12588)
• eslint-plugin: [no-useless-default-assignment] don't report defaults used by other overloads (#​12607)
• eslint-plugin: [prefer-nullish-coalescing] handle shadowed Boolean calls (#​12591)
• eslint-plugin: [no-unnecessary-type-conversion] ignore shadowed built-ins (#​12590)

❤️ Thank You

• Evyatar Daud @​StyleShit
• 송재욱

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.66.0

Compare Source

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v10.8.0

Compare Source

Features

• 2fee9bb feat: export ConfigObject from eslint/config (#​21082) (sethamus)

Bug Fixes

• 6b8d2f7 fix: escape reserved characters in rule id in html formatter (#​21129) (Francesco Trotta)
• 9091071 fix: prevent no-unreachable-loop crash when all loop types are ignored (#​21116) (Pixel)
• e23fafe fix: prefer-object-spread add semicolon when adding parenthesis (#​21081) (synthex-byte)
• 20b5ad0 fix: quadratic-time regex in prefer-template (#​21096) (Milos Djermanovic)
• 8b6f6c0 fix: apply ignore configs to computed methods in class-methods-use-this (#​21094) (Pixel)
• b2c608c fix: NewExpression with parenthesized callee in preserve-caught-error (#​21083) (Francesco Trotta)

Documentation

• 6ddf858 docs: fix broken Specify Parser Options anchor link (#​21106) (Minsu)
• 784dfbe docs: Clarify no-eq-null description (#​21120) (Park Harin)
• 7ec733a docs: Fix typos and grammar in glossary (#​21095) (Marry (Subin Yang))
• 92bb13f docs: replace quake link (#​21108) (Jung Hyeon Jun)
• 68eb4a5 docs: fix broken Specify Globals anchor links in rule pages (#​21103) (Minsu)
• d28f697 docs: replace Code Climate CLI links with Qlty CLI links (#​21099) (Jung Hyeon Jun)
• eccc68d docs: correct --suppressions-location option description (#​21093) (Ga eun Lee)
• c5963f7 docs: Update README (GitHub Actions Bot)

Chores

• 4fbf46d test: pin webpack version to 5.108.4 (#​21137) (Francesco Trotta)
• 2d063e2 chore: update HTTP URLs to HTTPS in JSDoc and comments (#​21101) (Bo Hyun Kim)
• eccbe7b test: add error locations to no-class-assign (#​21123) (devoil)
• e7d1e43 ci: bump actions/setup-go from 6 to 7 (#​21118) (dependabot[bot])
• e9d66d0 ci: bump actions/setup-node from 6 to 7 (#​21119) (dependabot[bot])
• ee225b6 test: Add error location details to no-eq-null rule (#​21117) (Park Harin)
• 044a627 chore: update minimatch to ^10.2.5 (#​21107) (김채영)
• fb09aa8 chore: update ecosystem plugins (#​21115) (ESLint Bot)
• 5abd878 test: add error locations to no-proto (#​21114) (Gihyeon Jeong / 정기현)
• 9715887 test: Add error location details to no-div-regex (#​21110) (Park Harin)
• a746ec6 test: add error locations to no-new-wrappers (#​21109) (Gihyeon Jeong / 정기현)
• 8dde645 test: add error locations to no-ex-assign (#​21102) (devoil)
• 13ab0ec test: add error locations to no-label-var (#​21098) (Gihyeon Jeong / 정기현)
• a99906f test: Add error location details to no-delete-var rule (#​21105) (Park Harin)
• c47e8dc chore: add missing backticks to languages/js/index.js (#​21104) (beeen)
• 0174428 chore: add missing backticks to translate-cli-options.js (#​21097) (dongkyu lee)
• 3d36589 chore: add missing backticks to serialization.js (#​21091) (이규환)
• dcc9312 test: add error locations to eqeqeq (#​21090) (Ga eun Lee)
• 2710b18 ci: Add explicit permissions to rebuild-docs-sites workflow (#​21089) (Marry (Subin Yang))
• 5d2f866 chore: update dependency prettier to v3.9.5 (#​21086) (renovate[bot])
• d584e31 chore: fix failing ecosystem test for eslint-plugin-unicorn (#​21084) (Francesco Trotta)
• bf3eda0 chore: update ecosystem plugins (#​21079) (ESLint Bot)

v17.9.0

Compare Source

v17.8.0

Compare Source

• Update globals (2026-07-01) (#​347) 7394811

v11.20.0: pnpm 11.20

Compare Source

Minor Changes

• Security fix. Affects projects using namedRegistries on pnpm 11.1.0–11.19.x. It is semi-breaking for those projects — see "If you use named registries" below.

  The lockfile recorded no marker for which registry a package came from. Packages were keyed by name@version alone, and entry lookup went through refToRelative(ref, name), so a dependency you declared against one registry could be satisfied by an entry that was actually resolved from another. When two registries served the same name and version, both collapsed onto a single packages: entry and whichever resolved first decided the tarball every consumer got.

  That is a package-substitution risk: a package you expect from your private registry could be installed from a different registry that publishes the same name and version, and the lockfile recorded nothing that would let you tell.

  Packages resolved from a named registry are now recorded under registry-qualified keys (<name>@&#8203;<registryName>:<version>, e.g. foo@work:1.0.0), so each registry gets its own entry and the lockfile pins which one a dependency came from.

  The lockfile format version is unchanged. Registry-qualified keys appear only for packages resolved from a named registry, so a project that does not use namedRegistries sees no difference, and older pnpm versions keep reading the file.

If you use named registries

Your next non-frozen install re-keys those entries, which shows up as a lockfile diff. Commit it — that diff is the fix being applied. Review it: an entry that moves to a registry you did not expect is worth investigating.

Everyone working on the project should be on this version or newer before you do. An older pnpm reads the re-keyed lockfile fine — frozen installs are unaffected — but it does not produce registry-qualified keys itself, so any install that updates the lockfile writes those entries back to the old shape, and the next install on a current pnpm re-qualifies them. The result is a lockfile that flips back and forth, and while it is in the old shape the project is exposed again. Because the lockfile format version is deliberately unchanged, pnpm cannot detect this and warn you about it.

There is no setting to keep the old behavior: the old shape is the vulnerability.

Tarball URLs that follow the standard registry layout are no longer written to the lockfile for named-registry packages; they are recomputed from the namedRegistries setting on demand.

To use named registries, map your aliases in pnpm-workspace.yaml:

namedRegistries:
  work: https://npm.enterprise.example.com/

New built-in npmjs: alias

npmjs: now resolves to https://registry.npmjs.org/ with no configuration, alongside the existing gh: alias for GitHub Packages. It pins a dependency to the public registry even when registry points elsewhere, such as an internal proxy:

{ "dependencies": { "left-pad": "npmjs:^1.3.0" } }

npm: cannot do this — it is the alias protocol (npm:<name>@&#8203;<range>) and resolves through whatever registry points at.

If you mirror or proxy npmjs, point the alias at your mirror:

namedRegistries:
  npmjs: https://npm.internal.example.com/

Built-in registry URLs are also the prefixes a lockfile's recorded tarball URL is matched against when pnpm verifies a package. Without the override, an entry whose tarball URL is on registry.npmjs.org is verified against the public registry rather than your mirror. This only affects lockfiles that record such URLs — a canonical URL for your configured registry is omitted from the lockfile and unaffected — and only when a tarball-URL, minimumReleaseAge, or trustPolicy check runs. Overriding the alias is the same escape hatch GHES users already have for gh.

Every alias the lockfile references must stay in namedRegistries: reading an entry whose alias is gone fails with ERR_PNPM_MISSING_NAMED_REGISTRY rather than silently falling back to the default registry, since that would fetch a different package. Renaming an alias re-resolves the packages that used it.

Named registry aliases that shadow a reserved dependency specifier prefix (file, link, workspace, runtime, npm, jsr, ...) are now rejected with ERR_PNPM_RESERVED_NAMED_REGISTRY_NAME instead of being silently shadowed by the corresponding resolver.

pnpm licenses and pnpm sbom now keep the two artifacts apart as well: license records carry the registry alias, and SBOM components carry the purl repository_url qualifier.

Patch Changes

• An empty http-proxy, https-proxy, proxy, or no-proxy value — from the .npmrc, pnpm-workspace.yaml, the CLI, or the HTTP_PROXY / HTTPS_PROXY / PROXY / NO_PROXY environment variables — no longer fails the install with ERR_PNPM_INVALID_PROXY. Empty settings read as unset, so a shell exporting HTTP_PROXY= disables the proxy, and an empty proxy= in the .npmrc no longer suppresses HTTPS_PROXY #​13533.

  proxy=false in the .npmrc or proxy: false in pnpm-workspace.yaml now turns proxying off instead of being read as a proxy host named false. false and null on https-proxy / http-proxy / no-proxy read as unset, and on the command line they are ordinary host names, since a flag carries its value verbatim.

• The env lockfile no longer pins @pnpm/exe alongside pnpm when the wanted pnpm version is 12 or newer. From v12 the unscoped pnpm package is itself the native executable, so @pnpm/exe is not published for it and resolving it would fail. The engine identity check now verifies the native binary through whichever package ships it.

• lexCompare and nerfDart are now published as @pnpm/text.ordinal-comparator and @pnpm/config.registry-auth-key. Use these instead of @pnpm/util.lex-comparator and @pnpm/config.nerf-dart.

• Fixed the order in which pnpm matches a lockfile's recorded tarball URL against known registry URLs. Two registry URLs of equal length were previously ordered arbitrarily, so which one a tarball URL matched could differ between runs.

• Dependency resolution is faster: package metadata is now filtered once per packument instead of once per dependency edge when minimumReleaseAge is active, and parsed semver versions and ranges are reused instead of re-parsed on every comparison.

• Security: pnpm rebuild now refuses a lockfile whose packages key carries a path traversal in the package name (e.g. ../../../escaped@1.0.0), instead of running that package's lifecycle scripts and linking its bins in a directory outside the virtual store. Such a name is rejected with ERR_PNPM_INVALID_DEPENDENCY_NAME.

Platinum Sponsors

Gold Sponsors

v11.19.0: pnpm 11.19

Compare Source

Minor Changes

• pnpm login no longer requires an interactive terminal when the registry supports web-based login: without a TTY it prints the authentication URL (skipping the QR code and the "Press ENTER to open the URL in your browser" prompt) and polls the registry until the browser approval completes. Only the classic username/password login still fails with ERR_PNPM_LOGIN_NON_INTERACTIVE in a non-interactive terminal.

• The save-prefix setting now accepts =: newly added dependencies are saved with an explicit = operator (=1.2.3) instead of the setting being silently treated as the default ^.

Patch Changes

• allowBuilds entries can now approve git-hosted packages that pnpm downloads as a tarball, such as github: dependencies (which are fetched from codeload.github.com rather than cloned), by their repository URL without the resolved commit hash. This matches the hashless git+ matching already supported for cloned git dependencies. For example:

  allowBuilds:
    "foo@git+https://github.com/org/foo.git": true

  This approves the package whether pnpm clones it or downloads a tarball, so the entry no longer has to be updated every time the pinned commit changes. GitLab and Bitbucket tarball downloads are matched the same way. Approving or denying a specific resolved commit by its full tarball dep path continues to work.

• pnpm outdated --include-github-actions no longer blocks on an interactive git credential prompt when a workflow uses a private action repo.

• Prevented minimumReleaseAge from replacing latest with a SemVer-greater version than the registry tag target #​13034.

• Fixed empty bundledDependencies and bundleDependencies arrays causing nondeterministic lockfile changes. See #​13123.

• The install summary no longer prints (X is available) when the registry's dist-tags.latest is still held back by the active minimumReleaseAge policy. The hint only ever names the actual latest tag, so an immature latest suppresses the hint instead of advertising the version pnpm just refused to install #​11698.

• pnpm update keeps the explicit = operator of an exact version pin: a dependency saved as =3.5.1 now updates to =3.5.2 instead of the bare 3.5.2. See #​13168.

• Preserve a workspace dependency's link: entry when a run does not target it — e.g. pnpm update <other-pkg> (with or without --recursive), or a plain install after a root/catalog dependency change — with injectWorkspacePackages, instead of spuriously rewriting it to a peer-suffixed file: protocol. See #​10433.

• Workspace dependencies declared with a relative path (e.g. "foo": "workspace:../foo") are no longer silently dropped from the workspace projects graph, so --filter selection and the topological order of recursive commands take them into account.

Platinum Sponsors

Gold Sponsors

v11.18.0: pnpm 11.18

Compare Source

Minor Changes

• Fixed an installed optional dependency being left without one of its own required dependencies. When a package reached through `optio

✂ Note

PR body was truncated to here.