Merge branch 'main' into upgrade-to-solid-2-beta

brenelz · brenelz · commit 4c7cfc971244 · 2026-03-18T22:15:56.000-05:00
diff --git a/.changeset/curly-waves-search.md b/.changeset/curly-waves-search.md
@@ -0,0 +1,6 @@
+---
+"@solidjs/vite-plugin-nitro-2": minor
+"@solidjs/start": minor
+---
+
+Updated dependencies.
diff --git a/apps/fixtures/bare/package.json b/apps/fixtures/bare/package.json
@@ -10,7 +10,7 @@
     "@solidjs/start": "workspace:*",
     "@solidjs/web": "2.0.0-beta.3",
     "solid-js": "2.0.0-beta.3",
-    "vite": "7.1.10"
+    "vite": "7.3.1"
   },
   "engines": {
     "node": ">=22"
diff --git a/apps/fixtures/basic/package.json b/apps/fixtures/basic/package.json
@@ -12,7 +12,7 @@
     "@solidjs/start": "workspace:*",
     "@solidjs/web": "2.0.0-beta.3",
     "solid-js": "2.0.0-beta.3",
-    "vite": "7.1.10"
+    "vite": "7.3.1"
   },
   "engines": {
     "node": ">=22"
diff --git a/apps/fixtures/css/package.json b/apps/fixtures/css/package.json
@@ -13,13 +13,13 @@
     "@solidjs/start": "workspace:*",
     "@solidjs/web": "2.0.0-beta.3",
     "solid-js": "2.0.0-beta.3",
-    "vite": "7.1.10"
+    "vite": "7.3.1"
   },
   "engines": {
     "node": ">=22"
   },
   "devDependencies": {
-    "@tailwindcss/vite": "^4.1.12",
-    "tailwindcss": "^4.1.12"
+    "@tailwindcss/vite": "^4.2.1",
+    "tailwindcss": "^4.2.1"
   }
 }
diff --git a/apps/fixtures/experiments/package.json b/apps/fixtures/experiments/package.json
@@ -12,7 +12,7 @@
     "@solidjs/start": "workspace:*",
     "@solidjs/web": "2.0.0-beta.3",
     "solid-js": "2.0.0-beta.3",
-    "vite": "7.1.10"
+    "vite": "7.3.1"
   },
   "engines": {
     "node": ">=22"
diff --git a/apps/fixtures/hackernews/package.json b/apps/fixtures/hackernews/package.json
@@ -11,7 +11,7 @@
     "@solidjs/start": "workspace:*",
     "@solidjs/web": "2.0.0-beta.3",
     "solid-js": "2.0.0-beta.3",
-    "vite": "7.1.10"
+    "vite": "7.3.1"
   },
   "engines": {
     "node": ">=22"
diff --git a/apps/fixtures/nitro-3/package.json b/apps/fixtures/nitro-3/package.json
@@ -13,7 +13,7 @@
     "@solidjs/start": "workspace:*",
     "nitro": "^3.0.1-alpha.2",
     "solid-js": "2.0.0-beta.3",
-    "vite": "7.1.10"
+    "vite": "7.3.1"
   },
   "engines": {
     "node": ">=22"
diff --git a/apps/fixtures/notes/package.json b/apps/fixtures/notes/package.json
@@ -11,10 +11,10 @@
     "@solidjs/start": "workspace:*",
     "@solidjs/web": "2.0.0-beta.3",
     "date-fns": "^3.6.0",
-    "marked": "^12.0.1",
+    "marked": "^12.0.2",
     "solid-js": "2.0.0-beta.3",
     "unstorage": "1.10.2",
-    "vite": "7.1.10"
+    "vite": "7.3.1"
   },
   "engines": {
     "node": ">=22"
diff --git a/apps/fixtures/todomvc/package.json b/apps/fixtures/todomvc/package.json
@@ -13,7 +13,7 @@
     "@solidjs/web": "2.0.0-beta.3",
     "solid-js": "2.0.0-beta.3",
     "unstorage": "1.10.2",
-    "vite": "7.1.10"
+    "vite": "7.3.1"
   },
   "engines": {
     "node": ">=22"
diff --git a/apps/landing-page/package.json b/apps/landing-page/package.json
@@ -9,24 +9,25 @@
   },
   "devDependencies": {
     "@kobalte/core": "^0.13.11",
-    "@kobalte/utils": "^0.9.0",
-    "@tailwindcss/typography": "^0.5.16",
-    "autoprefixer": "^10.4.21",
-    "postcss": "^8.5.6",
-    "tailwind-merge": "^3.3.1",
-    "tailwindcss": "^3.4.17",
+    "@kobalte/utils": "^0.9.1",
+    "@tailwindcss/typography": "^0.5.19",
+    "autoprefixer": "^10.4.27",
+    "postcss": "^8.5.8",
+    "tailwind-merge": "^3.5.0",
+    "tailwindcss": "^3.4.19",
     "tailwindcss-animate": "^1.0.7",
-    "tinyglobby": "^0.2.14",
+    "tinyglobby": "^0.2.15",
     "tippy.js": "^6.3.7",
-    "vite": "^7.1.10"
+    "vite": "^7.3.1"
   },
   "dependencies": {
     "@solidjs/meta": "^0.29.4",
-    "@solidjs/router": "^0.15.3",
+    "@solidjs/router": "^0.15.4",
     "@solidjs/start": "2.0.0-alpha.2",
+    "@solidjs/vite-plugin-nitro-2": "^0.2.0",
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",
-    "solid-js": "^1.9.9",
+    "solid-js": "^1.9.11",
     "solid-motionone": "^1.0.4",
     "solid-transition-group": "^0.3.0"
   }
diff --git a/apps/landing-page/vite.config.ts b/apps/landing-page/vite.config.ts
@@ -1,5 +1,5 @@
 import { defineConfig } from "vite";
-import { nitroV2Plugin } from "../../packages/start-nitro-v2-vite-plugin/src";
+import { nitroV2Plugin } from "@solidjs/vite-plugin-nitro-2";
 import { solidStart } from "@solidjs/start/config";
 
 export default defineConfig({
diff --git a/apps/tests/package.json b/apps/tests/package.json
@@ -19,21 +19,21 @@
     "@solidjs/start": "workspace:*",
     "@solidjs/testing-library": "^0.8.10",
     "@solidjs/web": "2.0.0-beta.3",
-    "@testing-library/jest-dom": "^6.6.2",
-    "@testing-library/user-event": "^14.5.2",
-    "@vitest/ui": "^4.0.10",
-    "jsdom": "^25.0.1",
-    "lodash": "^4.17.21",
+    "@testing-library/jest-dom": "^6.9.1",
+    "@testing-library/user-event": "^14.6.1",
+    "@vitest/ui": "^4.1.0",
+    "jsdom": "^28.1.0",
+    "lodash": "^4.17.23",
     "solid-js": "2.0.0-beta.3",
-    "vite": "^7.1.10",
+    "vite": "^7.3.1",
     "vite-plugin-solid": "^3.0.0-next.0",
-    "vitest": "^4.0.10"
+    "vitest": "^4.1.0"
   },
   "devDependencies": {
-    "@playwright/test": "^1.56.1",
-    "@types/lodash": "^4.17.14",
-    "@vitest/browser": "^4.0.10",
-    "@vitest/browser-playwright": "^4.0.10",
-    "playwright": "^1.56.1"
+    "@playwright/test": "^1.58.2",
+    "@types/lodash": "^4.17.24",
+    "@vitest/browser": "^4.1.0",
+    "@vitest/browser-playwright": "^4.1.0",
+    "playwright": "^1.58.2"
   }
 }
diff --git a/apps/tests/src/functions/server-secret.ts b/apps/tests/src/functions/server-secret.ts
@@ -0,0 +1 @@
+export const serverSecret = "MyServerSuperSecretUniqueString1";
diff --git a/apps/tests/src/functions/use-is-server.ts b/apps/tests/src/functions/use-is-server.ts
@@ -1,7 +1,12 @@
 "use server";
 
 import { isServer } from "@solidjs/web";
+import { keepAlive } from "~/utils/keep-alive-util";
+
+const serverSecret = "MyServerSuperSecretUniqueString2";
+
 
 export function serverFnWithIsServer() {
+  keepAlive(serverSecret);
   return isServer;
 }
diff --git a/apps/tests/src/routes/is-server-nested.tsx b/apps/tests/src/routes/is-server-nested.tsx
@@ -1,9 +1,12 @@
 import { createSignal, onSettled } from "solid-js";
 import { isServer } from "@solidjs/web";
+import { serverSecret } from "~/functions/server-secret";
+import { keepAlive } from "~/utils/keep-alive-util";
 
 function serverFnWithIsServer() {
   "use server";
-
+  keepAlive("MyServerSuperSecretUniqueString3");
+  keepAlive(serverSecret);
   return isServer;
 }
 
diff --git a/apps/tests/src/routes/treeshaking/server-secret-leak.server.test.ts b/apps/tests/src/routes/treeshaking/server-secret-leak.server.test.ts
@@ -0,0 +1,98 @@
+import { existsSync } from "node:fs";
+import { readdir, readFile } from "node:fs/promises";
+import path from "node:path";
+import { brotliDecompressSync, gunzipSync } from "node:zlib";
+import { describe, expect, it } from "vitest";
+
+// Avoid full pattern to exclude this file from scan
+const SECRET_MARKER = new RegExp(`${"MyServer"}${"SuperSecretUniqueString"}\\d+`, "g");
+const ALL_FILE_EXTENSIONS = /\.(ts|tsx|js|jsx|mjs|cjs|mts|cts|css|map|gz|br)$/;
+
+describe("server code does not leak to client bundle", () => {
+  it("verifies secret markers are server-only and not in client output", async () => {
+    const appRoot = process.cwd();
+    const sourceRoot = path.join(appRoot, "src");
+    const serverOutputRoot = path.join(appRoot, ".output/server");
+    const clientOutputRoot = path.join(appRoot, ".output/public");
+
+    // Verify required directories exist
+    expect(existsSync(sourceRoot), `Source dir not found: ${sourceRoot}`).toBe(true);
+    expect(
+      existsSync(serverOutputRoot),
+      `Server output dir not found: ${serverOutputRoot}. Did you run the build? (pnpm --filter tests run build)`,
+    ).toBe(true);
+    expect(
+      existsSync(clientOutputRoot),
+      `Client output dir not found: ${clientOutputRoot}. Did you run the build? (pnpm --filter tests run build)`,
+    ).toBe(true);
+
+    // Collect and validate markers from source code
+    const sourceMarkerCounts = await countSourceMarkers(sourceRoot);
+    expect(
+      sourceMarkerCounts.size,
+      `No markers found in source code: ${sourceRoot}`,
+    ).toBeGreaterThan(0);
+    for (const [marker, files] of sourceMarkerCounts) {
+      expect(
+        files.length,
+        `Marker "${marker}" appears in multiple files: ${files.join(", ")}. Each marker must appear exactly once.`,
+      ).toBe(1);
+    }
+    const markers = Array.from(sourceMarkerCounts.keys());
+
+    // Verify markers are in server output (not DCE'd)
+    const serverMarkerCounts = await countSourceMarkers(serverOutputRoot);
+    for (const marker of markers) {
+      // Check presence; exact count varies due to bundler duplication
+      expect(
+        serverMarkerCounts.has(marker),
+        `Marker "${marker}" missing from server output (likely DCE'd)`,
+      ).toBe(true);
+    }
+    expect(
+      serverMarkerCounts.size,
+      `Expected ${markers.length} markers, found ${serverMarkerCounts.size} in server output`,
+    ).toBe(markers.length);
+
+    // Verify no markers leak to client
+    const clientMarkerCounts = await countSourceMarkers(clientOutputRoot);
+    for (const [marker, files] of clientMarkerCounts) {
+      expect(files.length, `Marker "${marker}" leaked to client output: ${files.join(", ")}`).toBe(
+        0,
+      );
+    }
+  });
+});
+
+async function countSourceMarkers(rootDir: string) {
+  const sourceFiles = await getFiles(rootDir, ALL_FILE_EXTENSIONS);
+  const markerCounts = new Map<string, string[]>();
+  for (const filePath of sourceFiles) {
+    const content = await readFileContent(filePath);
+    for (const [marker] of content.matchAll(SECRET_MARKER)) {
+      const files = markerCounts.get(marker) ?? [];
+      files.push(filePath);
+      markerCounts.set(marker, files);
+    }
+  }
+  return markerCounts;
+}
+
+async function getFiles(dir: string, fileRegex: RegExp): Promise<string[]> {
+  const entries = await readdir(dir, { recursive: true, withFileTypes: true });
+  return entries
+    .filter(e => e.isFile() && fileRegex.test(e.name))
+    .map(e => path.join(e.parentPath, e.name));
+}
+
+async function readFileContent(filePath: string) {
+  if (filePath.endsWith(".br")) {
+    return brotliDecompressSync(await readFile(filePath)).toString("utf-8");
+  }
+
+  if (filePath.endsWith(".gz")) {
+    return gunzipSync(await readFile(filePath)).toString("utf-8");
+  }
+
+  return readFile(filePath, "utf-8");
+}
diff --git a/apps/tests/src/utils/keep-alive-util.ts b/apps/tests/src/utils/keep-alive-util.ts
@@ -0,0 +1,12 @@
+/**
+ * Prevents the provided value from being removed by dead-code elimination or aggressive
+ * bundler/minifier optimizations by creating an inert side-effect reference. The side-effect
+ * is intentionally never executed at runtime but ensures the value is
+ * referenced so bundlers and minifiers won't drop it.
+ */
+export function keepAlive(value: unknown): void {
+  if (Date.now() < 0) {
+    // kept intentionally unreachable to avoid runtime side-effects
+    console.log(value);
+  }
+}
diff --git a/package.json b/package.json
@@ -32,12 +32,12 @@
     "vite-ecosystem-ci:test": "pnpm --filter tests run test:all"
   },
   "devDependencies": {
-    "@changesets/cli": "^2.29.8",
-    "citty": "^0.1.5",
-    "oxfmt": "^0.28.0",
-    "tinyglobby": "^0.2.2",
+    "@changesets/cli": "^2.30.0",
+    "citty": "^0.2.1",
+    "oxfmt": "^0.36.0",
+    "tinyglobby": "^0.2.15",
     "tippy.js": "^6.3.7",
-    "typescript": "^5.7.0"
+    "typescript": "^5.9.3"
   },
   "engines": {
     "pnpm": "^10.8.1",
diff --git a/packages/start-nitro-v2-vite-plugin/package.json b/packages/start-nitro-v2-vite-plugin/package.json
@@ -23,10 +23,10 @@
     }
   },
   "dependencies": {
-    "nitropack": "^2.11.10"
+    "nitropack": "^2.13.1"
   },
   "devDependencies": {
-    "vite": "^7.1.10"
+    "vite": "^7.3.1"
   },
   "peerDependencies": {
     "vite": "^7"
diff --git a/packages/start/package.json b/packages/start/package.json
@@ -37,41 +37,42 @@
     }
   },
   "dependencies": {
-    "@babel/core": "^7.28.3",
-    "@babel/traverse": "^7.28.3",
-    "@babel/types": "^7.28.5",
+    "@babel/core": "^7.29.0",
+    "@babel/traverse": "^7.29.0",
+    "@babel/types": "^7.29.0",
     "@solidjs/meta": "0.30.0-next.0",
     "@solidjs/web": "2.0.0-beta.3",
     "@tanstack/server-functions-plugin": "1.134.5",
     "@types/babel__traverse": "^7.28.0",
-    "@types/micromatch": "^4.0.9",
+    "@types/micromatch": "^4.0.10",
     "cookie-es": "^2.0.0",
     "defu": "^6.1.4",
     "error-stack-parser": "^2.1.4",
-    "es-module-lexer": "^1.7.0",
-    "esbuild": "^0.25.3",
+    "es-module-lexer": "^2.0.0",
+    "esbuild": "^0.27.4",
     "fast-glob": "^3.3.3",
-    "h3": "npm:h3@2.0.1-rc.4",
+    "h3": "2.0.1-rc.16",
     "html-to-image": "^1.11.13",
     "micromatch": "^4.0.8",
-    "path-to-regexp": "^8.2.0",
+    "path-to-regexp": "^8.3.0",
     "pathe": "^2.0.3",
     "radix3": "^1.1.2",
-    "seroval": "^1.5.0",
-    "seroval-plugins": "^1.5.0",
-    "shiki": "^1.26.1",
+    "seroval": "^1.5.1",
+    "seroval-plugins": "^1.5.1",
+    "shiki": "^1.29.2",
     "solid-js": "2.0.0-beta.3",
     "source-map-js": "^1.2.1",
-    "srvx": "^0.9.1",
+    "srvx": "^0.11.9",
     "vite-plugin-solid": "3.0.0-next.2"
   },
   "engines": {
     "node": ">=22"
   },
   "devDependencies": {
     "@types/babel__core": "^7.20.5",
-    "vite": "^7.1.10",
-    "vitest": "^4.0.10"
+    "@types/node": "^25.5.0",
+    "vite": "^7.3.1",
+    "vitest": "^4.1.0"
   },
   "peerDependencies": {
     "vite": "^7"
diff --git a/patches/vite-plugin-solid.patch b/patches/vite-plugin-solid.patch
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
