solid-v2: repin to solid-js 2.0.0-rc.8, @solidjs/vite-plugin 3.0.0-next.43, router 2.0.0-next.24

[ryansolid]

Repin pass for the 11 solid-v2/* templates. Three commits: the rc.7 / next.41 / next.23 repin + lockfiles, the one piece of rc.7 fallout cleanup, and a refresh to the rc.8 / next.43 / next.24 lockstep that shipped 2026-09-11.

Pins (branch tip vs main)

Package	main	This PR	Templates
solid-js, @solidjs/web, @solidjs/diagnostics	^2.0.0-rc.6	^2.0.0-rc.8	all 11
@solidjs/vite-plugin	^3.0.0-next.38	^3.0.0-next.43	all 11
@solidjs/router	^2.0.0-next.21	^2.0.0-next.24	basic, fullstack, with-bootstrap, with-sass, with-tailwindcss, with-tsrx, with-unocss, with-vitest-browser-mode
filesystem-routing	0.2.1	0.3.0	basic, fullstack, fullstack-tanstack, with-bootstrap, with-sass, with-tailwindcss, with-unocss, with-vitest-browser-mode (with-tsrx already on 0.3.0)

Left as-is: @solidjs/testing-library ^1.0.0-beta.3 (next is still beta.3; peers >=2.0.0-0), @solidjs/meta ^1.0.0-next.2 (peers ^2.0.0-rc.0), vitest 5 / jest-dom 7 (#302), @tanstack/solid-router ^2.0.0-rc.7 (#303), @tanstack/solid-query ^6.0.0-rc.3. filesystem-routing 0.3.1 (2026-09-10) exists but was out of scope for this pass. Carets preserved everywhere (checked git diff after every install). No pnpm-workspace.yaml changes — nothing tripped ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION (solid-js / @solidjs/* are already excluded).

Every lockfile was regenerated from scratch (rm -rf node_modules pnpm-lock.yaml && pnpm install). All 11 resolve solid-js@2.0.0-rc.8, @solidjs/web@2.0.0-rc.8, @solidjs/diagnostics@2.0.0-rc.8, @solidjs/signals@2.0.0-rc.8, @solidjs/compiler@2.0.0-rc.8, @solidjs/babel-plugin@2.0.0-rc.8, @solidjs/vite-plugin@3.0.0-next.43, seroval@1.6.7; the 8 router templates resolve @solidjs/router@2.0.0-next.24; the 9 filesystem-routing templates resolve filesystem-routing@0.3.0. Exactly one solid-js copy per lockfile (no rc.7 leftovers beyond @tanstack/solid-router@2.0.0-rc.7, which is TanStack's own version string).

rc.7 → rc.8 audit (solidjs/solid 269fc653..f8b40b7e, 48 commits)

Consumer-visible changes, with the template impact:

• ESM only, engines.node >= 22.12 (a39415c): every .cjs artifact, require branch and types-cjs/ mirror is gone. Templates are "type": "module" + Vite/Vitest and never referenced a .cjs path — no impact. fullstack-tanstack's deep aliases (@solidjs/web/dist/server.js, @solidjs/web/storage/dist/storage.js) are still present in rc.8 (verified against the installed package; rc.8 only adds web.observe.js).
• Observe tier (1807f7f, 0961d97, 2fa7539): DEV.diagnostics → OBSERVE.diagnostics, attribution engine moved to solid-js/attribution, new observe export condition and <entry>.observe.js artifacts. No template touches DEV.*, attribution or the export map — no impact. @solidjs/vite-plugin next.43 gained the matching observe option; not enabled in any template.
• Compiler componentNames (01ac18c): the plugin enables it under the dev posture; needs @solidjs/compiler / @solidjs/babel-plugin ≥ rc.8 — both resolve to rc.8 in every lockfile. No impact on prod output (byte-identical when off; SSR never emits it).
• SSR XSS fix (7d985b6): strings yielded by flow-control memos are now escaped; compilers stop wrapping fragment children in _$escape. Verified by the dev/prod SSR smoke and all template tests — no impact.
• Flash cookie key: PBKDF2 instead of SHA-256 (ded39d2): secret should be ≥ 32 bytes. The templates never set secret; the plugin's generated deployment secret (randomBytes(32).toString('hex')) satisfies it. In-flight flashes across the upgrade read as "no flash" — expected. Tested via the single-flight smoke (the form POST path).
• Server-function ids by binding path (c0299bf), nested / method / this server-function compile errors (8366e09, a181e4d, 6bf2bf8, bb905db): template server functions are top-level query() / action() wrappers in src/lib/users.ts — all builds pass, no impact.
• Server-function registry on globalThis (839c05e): fixes query() reads answering 405 after the first HMR update in vite dev. Pure fix; no template change.
• Buffered server-function request rebuilt from parts (a71e42e, Nitro/srvx), rc.7 spread-children hydration regression fix (3b4db21), lazy() hydration observability (fe3ab92, 711b557), spread() / readShallow() tracked style/class (4e730a9, ab4c40c), seroval ~1.6.7 (8cfa272), signals perf/lane-authority fixes (b5bd6fb, 1354a53, 1c9e9e7, ae0ec3f, 51c201f, 27aee36, 645ec0d, 12c3be9, 3a5fe8c, dd1d4ed, 4935c7d, 0f14430): runtime-internal, no template change.

Router: @solidjs/router published 2.0.0-next.24 (2026-09-11 16:56Z) alongside rc.8 — a single change (65f41f3: navigations declared to the observe tier via OBSERVE.attribution.withOrigin) plus the peer floor bump to ^2.0.0-rc.8 (3753889). So the rc.8 floor bump already happened; no further router release is needed, and the templates move to next.24 to match. Everything the router imports from @solidjs/web (decodeFlashCookie, clearFlashCookie/hasFlashCookie, parseServerFunctionUrl, isResponseEnvelope, REVALIDATE_HEADER, registerElementClaim, delegateEvents, provideRequestEvent) is signature-unchanged in rc.8 — flash.ts changed only its key derivation; parseServerFunctionUrl is untouched and the new dotted ids keep - and . out of the name so the hash split is unaffected.

Plugin: next.43 peers are solid-js / @solidjs/web ^2.0.0-rc.7, which admits rc.8 — no ERESOLVE. (^2.0.0-rc.8 would be the tighter floor since componentNames needs the rc.8 compiler; cosmetic, not required for this PR.)

Peer ranges that could exclude rc.8 for npm users: none. @solidjs/testing-library@1.0.0-beta.3 >=2.0.0-0; @tanstack/solid-router@2.0.0-rc.7 >=2.0.0-0 <3.0.0; @tanstack/solid-query@6.0.0-rc.3 >=2.0.0-rc.6 <3.0.0; @solidjs/meta@1.0.0-next.2 ^2.0.0-rc.0. Pre-existing pnpm peers check warnings in fullstack-tanstack / with-tanstack-router (@solid-devtools/* and @solid-primitives/* wanting solid 1.x, via @tanstack/solid-router) and with-tsrx (@tsrx/solid@0.1.69 wanting exactly 2.0.0-rc.3) are unchanged from main and are warnings only.

rc.7 fallout (from the first pass, still applies)

• dist/dev.* rename (bd22ac8): no template references. Only deep-path aliases are in fullstack-tanstack and both still exist.
• with-vitest-browser-mode: dropped the optimizeDeps.include workaround for @solidjs/diagnostics/browser + /protocol (plugin next.40 fixed the cold-cache restart).

Verification (at the branch tip, rc.8 / next.43 / next.24)

• pnpm build: 11/11 pass.
• pnpm lint (oxlint src): 11/11, 0 errors.
• pnpm test (vitest --run): basic 1/1, fullstack 10/10 (2 files), fullstack-tanstack 10/10 (2 files), with-bootstrap 1/1, with-sass 1/1, with-tailwindcss 1/1, with-tanstack-router 1/1, with-tsrx 3/3 (2 files), with-unocss 1/1, with-vitest-browser-mode 1/1 (Chromium headless shell). with-tsrx pnpm typecheck passes.
• Dev-SSR smoke (pnpm dev) for fullstack and fullstack-tanstack: / and /users/1 → 200 with rendered HTML (<h1>Hello Solid!</h1>, <h1>Users</h1><h2>Ada Lovelace</h2>, hydration module script); /api/users → 200. Server output clean — no NoOwnerError, dual-runtime, or lazy-manifest errors.
• Production smoke (pnpm build && pnpm start): both fullstacks / and /users/1 → 200 with <link rel="stylesheet" href="/assets/virtual_solid-ssr-entry-client-*.css">.
• Single-flight mutation smoke (Playwright: sign in → /users/1 → rename): fullstack 1 POST / 0 GET to /_server, fullstack-tanstack 1 POST / 0 GET, <h2> updated in place, zero console errors — in dev and against the production build.

Notes

• solid-v2/fullstack/server.js and fullstack-tanstack/server.js are unchanged (byte-identical to the SERVER_JS constant in solid-cli's ssr-flip.ts), so no CLI fixture update is needed.
• Pre-existing, not touched here: with pnpm 10.14 a fresh install of with-sass reports ERR_PNPM_IGNORED_BUILDS for @parcel/watcher@2.6.0 (transitive via sass) and pnpm writes an allowBuilds placeholder into pnpm-workspace.yaml. Reproduced identically on main; the placeholder was reverted and with-sass was verified with pnpm --config.verify-deps-before-run=false …. Adding allowBuilds: { '@parcel/watcher': false } to with-sass/pnpm-workspace.yaml would resolve it, as a separate change.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​tsrx/​solid@​0.1.64 ⏵ 0.1.69				+1
	@​unocss/​reset@​66.9.2 ⏵ 66.10.1
	@​unocss/​preset-wind4@​66.9.2 ⏵ 66.10.1	+1		+1	+1
	@​solidjs/​diagnostics@​2.0.0-rc.6 ⏵ 2.0.0-rc.8	+2		+1	+1
	@​tsrx/​typescript-plugin@​0.3.129 ⏵ 0.3.135				+1
	playwright@​1.62.1 ⏵ 1.63.0	+1		+1
	@​types/​node@​26.4.1 ⏵ 26.5.1	+1		+1
	vite@​8.2.2 ⏵ 8.3.0			+1
	@​solidjs/​web@​2.0.0-rc.6 ⏵ 2.0.0-rc.8	+1			+1
	valibot@​1.4.2 ⏵ 1.5.0				-5
	solid-js@​2.0.0-rc.6 ⏵ 2.0.0-rc.8
	sass@​1.103.1 ⏵ 1.104.0				-1
	@​solidjs/​vite-plugin@​3.0.0-next.38 ⏵ 3.0.0-next.43			+1	+2
	unocss@​66.9.2 ⏵ 66.10.1	+1		+1	+1

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Low adoption: npm @solidjs/compiler-darwin-x64 Location: Package overview From: solid-v2/with-bootstrap/pnpm-lock.yaml → npm/@solidjs/vite-plugin@3.0.0-next.43 → npm/@solidjs/compiler-darwin-x64@2.0.0-rc.8 ℹ Read more on: This package | This alert | What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@solidjs/compiler-darwin-x64@2.0.0-rc.8. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report