Release RC packages (rc)

[github-actions]

This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to next, this PR will be updated.

⚠️⚠️⚠️⚠️⚠️⚠️

next is currently in pre mode so this branch has prereleases rather than normal releases. If you want to exit prereleases, run changeset pre exit on next.

⚠️⚠️⚠️⚠️⚠️⚠️

Releases

@solidjs/compiler@2.0.0-rc.10

Patch Changes

• a5bd44a: Fix directive transform source maps to point to the original input by running dead-code elimination on the existing AST instead of printing and reparsing between passes.

@solidjs/diagnostics@2.0.0-rc.10

Patch Changes

• Updated dependencies [ebc1b03]
• Updated dependencies [f2bd662]
• Updated dependencies [756b1b3]
• Updated dependencies [27bb3fa]
  • @solidjs/signals@2.0.0-rc.10

@solidjs/element@2.0.0-rc.10

Patch Changes

• Updated dependencies [ce17c29]
• Updated dependencies [bfc320c]
• Updated dependencies [ae2bc9f]
  • @solidjs/web@2.0.0-rc.10
  • solid-js@2.0.0-rc.10

@solidjs/h@2.0.0-rc.10

Patch Changes

• ce17c29: Type the anchor's scroll opt-out as noscroll, not noScroll (README says noScroll becomes lowercase noscroll, but @solidjs/web types the anchor attribute as noScroll solid-router#605). The client-navigation contract on plain <a> elements is spelled lowercase — link, state, replace, preload — like every other HTML attribute in these types (novalidate, autofocus, crossorigin), and the router documents and reads the lowercase form (a.hasAttribute("noscroll")); noScroll was the one camelCase outlier, so the spelling the router README shows was a type error. Runtime is unchanged: setAttribute and the HTML parser already lowercase the name, so existing <a noScroll> markup keeps working and only needs the spelling updated to type-check.
• Updated dependencies [ce17c29]
• Updated dependencies [bfc320c]
  • @solidjs/web@2.0.0-rc.10

@solidjs/html@2.0.0-rc.10

Patch Changes

• Updated dependencies [ce17c29]
• Updated dependencies [bfc320c]
  • @solidjs/web@2.0.0-rc.10

@solidjs/signals@2.0.0-rc.10

Patch Changes

• ebc1b03: A zombie that recomputes stays a zombie (rc.9: deferred child recomputation loses REACTIVE_ZOMBIE and leaks subscriptions #3543). recompute and updateIfNecessary rewrote _flags wholesale and dropped REACTIVE_ZOMBIE, the flag that says a node sits on its owner's deferred-disposal chain. While any transaction was parked, the scheduler reruns zombies for mainline writes (Pending removal releases latest while its async reader is still visible #3463), so an owner that recreates a child each pass — a compiled <Show when={a() && b()}> condition — had its previous child rerun de-flagged; at the owner's commit disposeChildren then spliced that child out of the live chain instead of the pending one, orphaning the current child. The orphan stayed subscribed and recomputing forever: one leaked node per update, until HUGE_FAN_OUT. The flag now survives every per-pass wipe.

  A consequence pinned in lane-outside-view.test.ts: a zombie whose removal is staged by a transaction no longer holds that transaction's commit after it reruns — its say was always meant to be moot for the verdict that disposes it, and the extra hold was this bug.

• f2bd662: OBSERVE.subjectOf JSDoc names the subscriptions() export of solid-js/attribution rather than the removed attribution.subscriptions() method

• 756b1b3: omit()'s no-Proxy copy path re-homes accessors with the source as receiver instead of forwarding the descriptor, matching merge()'s copy path. A prop's getter is defined only for a read through its own object — the compiler's server-side props keep their state on the instance — so a copy that must stay live defines its own getter that reads through the source.

• 27bb3fa: Dev-only owner-chain invariant on the disposal splice (rc.9: deferred child recomputation loses REACTIVE_ZOMBIE and leaks subscriptions #3543 follow-up). disposeChildren unlinks a self-disposing node from its parent's child chain by position: a node with no _prevSibling is written up as the chain's head. The only way that is false is a node flagged live that sits elsewhere — the rc.9: deferred child recomputation loses REACTIVE_ZOMBIE and leaks subscriptions #3543 shape, a zombie that lost REACTIVE_ZOMBIE — and the write then clobbers the head with a stale _nextSibling, orphaning every live child ahead of it. Dev builds now assert parent._firstChild === node at that write and report [INVARIANT_VIOLATION] owner-chain-head (thrown under __TEST__, console.error diagnostic in dev). The check is __DEV__-guarded and folds out of the prod and observe tiers (size unchanged).

  Also pins the create-pass shape of rc.9: deferred child recomputation loses REACTIVE_ZOMBIE and leaks subscriptions #3543: a lazy memo zombified by its owner's rerun and first read from the owner's new pass goes through recompute(comp, true), whose flag wipe must carry REACTIVE_ZOMBIE too.

solid-js@2.0.0-rc.10

Patch Changes

• ae2bc9f: Hybrid store hydration waits for the server's answer before handing off to the client (Shallow computed stores lose leaf identity; hybrid hydration can lose the first answer #3498)

  Root cause: the hybrid store gate flipped synchronously at the end of the claim pass. With loadingValue/seedLoadingValue the server serializes a pending placeholder whose real answer arrives later over the stream; flipping before it landed let the client takeover supersede the server flight, so the engine dropped the server's answer and the store never showed it.

  The handoff now follows four rules:

  1. It waits for the first server answer to land. Synchronous when the serialized value is already settled, as before. When it is pending, the handoff happens when that answer lands — resolve or reject — by adopting it as a one-yield stream whose next pull (the engine's own continuation after the landing commits) is the handoff. It never waits on hydration end and never holds hydration open.
  2. Only the handoff run's first yield is the duplicate. Later runs (a dependency change, refresh()) run the client source against the real draft and commit their first yield normally; previously every run kept discarding it.
  3. A rejected server answer is the adopted answer. The store surfaces the error until a refresh() (a non-handoff run) replaces it; the client's handoff run does not paper over the rejection.
  4. A dependency change before the pending answer lands supersedes it. Like any new pending change, it cancels the incoming server answer: the store goes live on that run — genuinely new work, not a handoff, so its first yield commits — and the abandoned server flight's landing or rejection is dropped without applying to the store or running it again.

• Updated dependencies [ebc1b03]

• Updated dependencies [f2bd662]

• Updated dependencies [756b1b3]

• Updated dependencies [27bb3fa]

  • @solidjs/signals@2.0.0-rc.10

@solidjs/universal@2.0.0-rc.10

Patch Changes

• Updated dependencies [ae2bc9f]
  • solid-js@2.0.0-rc.10

@solidjs/web@2.0.0-rc.10

Patch Changes

• ce17c29: Type the anchor's scroll opt-out as noscroll, not noScroll (README says noScroll becomes lowercase noscroll, but @solidjs/web types the anchor attribute as noScroll solid-router#605). The client-navigation contract on plain <a> elements is spelled lowercase — link, state, replace, preload — like every other HTML attribute in these types (novalidate, autofocus, crossorigin), and the router documents and reads the lowercase form (a.hasAttribute("noscroll")); noScroll was the one camelCase outlier, so the spelling the router README shows was a type error. Runtime is unchanged: setAttribute and the HTML parser already lowercase the name, so existing <a noScroll> markup keeps working and only needs the spelling updated to type-check.
• bfc320c: Let the csrf.origin allowlist admit a cross-origin caller, and answer it with CORS (The CSRF origin allowlist is never consulted for a cross-site caller, so a static client on another origin cannot call server functions #3538). configureServerFunctionsServer({ csrf: { origin } }) accepted a string, a list or a matcher, but the handler refused Sec-Fetch-Site: cross-site (and same-site) before consulting it, so an explicitly listed origin was refused by every current browser and WebView — a client-only build in a Capacitor WebView could not call server functions on another host at all. Now a cross-site request carrying a browser-set Origin is decided by the matcher: refused when none is configured (today's default) or when it does not answer true; none stays refused. An admitted cross-origin caller gets Access-Control-Allow-Origin echoing its exact Origin (with Vary: Origin), the protocol's response headers exposed, and the OPTIONS preflight answered for the transport's methods and headers — on every response, the labelled unknown-id 404 included. Access-Control-Allow-Credentials: true is sent only with the new csrf.allowCredentials option, so listing an origin never silently turns on cookie sharing. The same-origin path is byte-identical to before, with one exception: once a matcher is configured, every GET-declared read carries Vary: Origin — the read stays ungated and Allow-Origin appears only for a listed origin, but a declared read is cacheable and its answer now depends on who asked, so a shared cache must not serve a same-origin page's header-less variant to the listed origin. Without a matcher, reads carry no Vary, as before. The client's endpoint option now documents an absolute URL, with csrf.origin as the server-side allowlist that makes it work.
• Updated dependencies [ae2bc9f]
  • solid-js@2.0.0-rc.10

@solidjs/babel-plugin@2.0.0-rc.10

test-integration@2.0.0-rc.10

Patch Changes

• a5219fd: The TanStack Solid Query release gate now compiles the adapter with this tree's compiler as well as running it on this tree's runtime (test-integration: solid-query gate must pack the workspace compiler, not just the runtime #3534). It packs @solidjs/compiler and @solidjs/babel-plugin beside the core tarballs, resolves the compiler's platform packages to the in-repo stubs (their pinned version reaches the registry only after the gate), hands the locally built binding to the loader through SOLID_COMPILER_NATIVE, and lifts the fixture's @solidjs/vite-plugin to the version the workspace itself is tested with. A release that changes the compiled-output contract (rc.9's _$$<type> delegated-event key) is no longer circular with its own gate; SKIP_SOLID_QUERY_GATE stays as a self-expiring emergency valve and is no longer set.

  The gate also tracks the adapter where it is actually released from — TanStack/query#solid-query-v6-pre, the branch behind the @tanstack/solid-query rc dist-tag — instead of the fork branch frozen at the day feat(solid-query): built-in single-flight consumer via FLIGHT_DATA_SOURCE TanStack/query#11326 merged, and judges the inner runner's exit by status and signal: a runner aborted by V8's heap limit has no exit code, and the previous check read that as green.

• Updated dependencies [ce17c29]

• Updated dependencies [bfc320c]

• Updated dependencies [ae2bc9f]

• Updated dependencies [ebc1b03]

• Updated dependencies [f2bd662]

• Updated dependencies [756b1b3]

• Updated dependencies [27bb3fa]

  • @solidjs/web@2.0.0-rc.10
  • @solidjs/h@2.0.0-rc.10
  • solid-js@2.0.0-rc.10
  • @solidjs/signals@2.0.0-rc.10
  • @solidjs/babel-plugin@2.0.0-rc.10
  • @solidjs/html@2.0.0-rc.10
  • @solidjs/universal@2.0.0-rc.10