From 680b4a288afda7254df37bfff0b747156174bb47 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Wed, 23 Sep 2026 06:58:24 +0000 Subject: [PATCH] chore: release --- .changeset/client-only-lazy-import.md | 7 ------ .changeset/nojs-server-function-crash.md | 7 ------ .changeset/server-function-csrf.md | 7 ------ .changeset/server-function-diagnostics.md | 15 ------------ packages/start/CHANGELOG.md | 28 +++++++++++++++++++++++ packages/start/package.json | 2 +- 6 files changed, 29 insertions(+), 37 deletions(-) delete mode 100644 .changeset/client-only-lazy-import.md delete mode 100644 .changeset/nojs-server-function-crash.md delete mode 100644 .changeset/server-function-csrf.md delete mode 100644 .changeset/server-function-diagnostics.md diff --git a/.changeset/client-only-lazy-import.md b/.changeset/client-only-lazy-import.md deleted file mode 100644 index f18487553..000000000 --- a/.changeset/client-only-lazy-import.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -"@solidjs/start": patch ---- - -Stop `client-only` from failing the build for lazily imported client components. - -A module that imported `client-only` and was loaded through `clientOnly(() => import(...))` failed the server build, even though it only ever runs in the browser. The server build resolves every dynamic import to emit its chunk, so it resolved the `client-only` module and rejected it, though that module never runs on the server. `client-only` no longer fails the build. `server-only` is unchanged and still fails a client build. diff --git a/.changeset/nojs-server-function-crash.md b/.changeset/nojs-server-function-crash.md deleted file mode 100644 index 248576783..000000000 --- a/.changeset/nojs-server-function-crash.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -"@solidjs/start": patch ---- - -Stop a no-JS server function POST from returning a 500 when the body is not a form. - -A POST to a server function without the client runtime, carrying an empty body or a non-form content type, left a value that is not a `FormData` as the last argument. Building the flash cookie called `.entries()` on it and threw, and the error handler rethrew the same way, so the request failed with a 500. The response is now the normal redirect, and the flash cookie is best effort so it can no longer take down the error path. diff --git a/.changeset/server-function-csrf.md b/.changeset/server-function-csrf.md deleted file mode 100644 index f897d71f4..000000000 --- a/.changeset/server-function-csrf.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -"@solidjs/start": patch ---- - -Reject cross-site server function requests to prevent CSRF. - -A `"use server"` function could be invoked by another site with the visitor's cookies, over a GET or a form POST, because the request was not checked. Requests to server functions are now allowed only from the same origin or same site. The check trusts the `Sec-Fetch-Site` header and falls back to comparing `Origin` against the request host, so a cross-site page can no longer trigger a server function. Same-origin calls, user-initiated navigations, and no-JS form submissions are unaffected. A separate origin that needs to call your backend should use an API route with explicit CORS. diff --git a/.changeset/server-function-diagnostics.md b/.changeset/server-function-diagnostics.md deleted file mode 100644 index 702a65587..000000000 --- a/.changeset/server-function-diagnostics.md +++ /dev/null @@ -1,15 +0,0 @@ ---- -"@solidjs/start": patch ---- - -Report server functions that cannot work instead of compiling them into broken output. - -- A `"use server"` function that reads a variable from an enclosing function now fails the build. The function is moved to the top level of its module, so the variable is not in scope when it runs. -- The same check covers `this` and `arguments` in an arrow function, `super`, and private class members. -- A `"use server"` directive in an object or class method now fails the build. It was ignored before, which shipped the method body and the modules it imports to the browser. -- A `"use server"` string that is not the first statement of a module or a function body now logs a warning. It has no effect there. -- An export a `"use server"` module cannot serve now logs a warning that names it. These exports are still left out of the client build. -- A `"use server"` module can now export an anonymous default function. Both `export default async () => {}` and `export default async function () {}` work. -- Server function ids are now built from the names a function is nested under, such as `Page.load`, instead of the order the functions appear in. An id no longer changes when another server function is added to the same file, and two functions that share a name are told apart by the names around them. Production ids stay opaque. -- Server functions are now compiled in `.mts` and `.cts` files. -- Build errors now point at the full path of the file, not just its name. diff --git a/packages/start/CHANGELOG.md b/packages/start/CHANGELOG.md index b09b2b181..0d3aae8fb 100644 --- a/packages/start/CHANGELOG.md +++ b/packages/start/CHANGELOG.md @@ -1,5 +1,33 @@ # @solidjs/start +## 2.0.6 + +### Patch Changes + +- a4ed2a4: Stop `client-only` from failing the build for lazily imported client components. + + A module that imported `client-only` and was loaded through `clientOnly(() => import(...))` failed the server build, even though it only ever runs in the browser. The server build resolves every dynamic import to emit its chunk, so it resolved the `client-only` module and rejected it, though that module never runs on the server. `client-only` no longer fails the build. `server-only` is unchanged and still fails a client build. + +- 048f5a9: Stop a no-JS server function POST from returning a 500 when the body is not a form. + + A POST to a server function without the client runtime, carrying an empty body or a non-form content type, left a value that is not a `FormData` as the last argument. Building the flash cookie called `.entries()` on it and threw, and the error handler rethrew the same way, so the request failed with a 500. The response is now the normal redirect, and the flash cookie is best effort so it can no longer take down the error path. + +- 378cbcd: Reject cross-site server function requests to prevent CSRF. + + A `"use server"` function could be invoked by another site with the visitor's cookies, over a GET or a form POST, because the request was not checked. Requests to server functions are now allowed only from the same origin or same site. The check trusts the `Sec-Fetch-Site` header and falls back to comparing `Origin` against the request host, so a cross-site page can no longer trigger a server function. Same-origin calls, user-initiated navigations, and no-JS form submissions are unaffected. A separate origin that needs to call your backend should use an API route with explicit CORS. + +- 9d3cbec: Report server functions that cannot work instead of compiling them into broken output. + + - A `"use server"` function that reads a variable from an enclosing function now fails the build. The function is moved to the top level of its module, so the variable is not in scope when it runs. + - The same check covers `this` and `arguments` in an arrow function, `super`, and private class members. + - A `"use server"` directive in an object or class method now fails the build. It was ignored before, which shipped the method body and the modules it imports to the browser. + - A `"use server"` string that is not the first statement of a module or a function body now logs a warning. It has no effect there. + - An export a `"use server"` module cannot serve now logs a warning that names it. These exports are still left out of the client build. + - A `"use server"` module can now export an anonymous default function. Both `export default async () => {}` and `export default async function () {}` work. + - Server function ids are now built from the names a function is nested under, such as `Page.load`, instead of the order the functions appear in. An id no longer changes when another server function is added to the same file, and two functions that share a name are told apart by the names around them. Production ids stay opaque. + - Server functions are now compiled in `.mts` and `.cts` files. + - Build errors now point at the full path of the file, not just its name. + ## 2.0.5 ### Patch Changes diff --git a/packages/start/package.json b/packages/start/package.json index aa4b41028..4a4dc2b24 100644 --- a/packages/start/package.json +++ b/packages/start/package.json @@ -1,6 +1,6 @@ { "name": "@solidjs/start", - "version": "2.0.5", + "version": "2.0.6", "repository": { "type": "git", "url": "git+https://github.com/solidjs/solid-start.git",