fix(deps): update all dependencies by renovate[bot] · Pull Request #1678 · solidjs/solid-docs

renovate · 2026-10-29T13:06:16Z

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@kobalte/core (source)	`0.13.12` → `0.13.14`
@kobalte/solidbase	`^0.6.13` → `^2.0.0`
@solidjs/router	`1.0.0` → `1.0.1`
@solidjs/start (source)	`2.0.0` → `2.1.0`
@types/node (source)	`^25.9.5` → `^26.0.0`
@typescript-eslint/eslint-plugin (source)	`8.65.0` → `8.72.1`
@typescript-eslint/parser (source)	`8.65.0` → `8.72.1`
dotenv	`^17.4.2` → `^18.0.0`
eslint (source)	`10.7.0` → `10.14.0`
eslint-plugin-solid	`^0.14.5` → `^0.18.0`
globals	`17.7.0` → `17.13.0`
pnpm (source)	`11.20.0` → `12.16.1`
prettier (source)	`3.9.6` → `3.9.10`
resolve	`1.22.12` → `1.22.13`
solid-js (source)	`1.9.14` → `1.9.18`
typescript-eslint (source)	`8.65.0` → `8.72.1`
vite (source)	`8.2.4` → `8.3.5`

Release Notes

kobaltedev/kobalte (@kobalte/core)

`v0.13.14`

Compare Source

Patch Changes

3d32663: ## v0.13.14 (September 7, 2026)

Bug fixes
- Preserve aria-hidden during modal handoff (#721)
- Resolve interact-outside targets across shadow boundaries (#722)
- Combobox: Prevent filter reset on blur (#731)

`v0.13.13`

Patch Changes

cb89022: ## v0.13.13 (August 10, 2026)

New features
- Export Menu (#708)
- Export DismissableLayer (#708)
Bug fixes
- Defer aria-hidden in ariaHideOutside to avoid focus warning (#700)
- Tabs: Skip indicator animation on initial render (#704)
- Prevent default in selection escape handler only when empy disallowEmptySelection (#708)
- Tooltip: button type (#708)
- Combobox: clear input on blur (#708)
- Select: call onChange only when changed (#708)
- Set form control label for attribute during ssr (#708)

kobaltedev/solidbase (@kobalte/solidbase)

`v2.0.0`

Compare Source

solidjs/solid-router (@solidjs/router)

`v1.0.1`

Patch Changes

eaafba6: Stamp history depth from the current entry instead of history.length, so useBeforeLeave and scroll restoration keep working on Back once the browser's session history is full (#694)
c3cbd67: Throw a descriptive error in development when an action is called directly instead of through useAction.
473c270: Anchor click handling no longer intercepts links with a non-http(s) scheme (blob:, mailto:, tel:, data:, …). Previously blob: links could be wrongly routed because they inherit the page origin and bypassed the same-origin check.
5a46ba1: Speed up <A> server rendering by roughly 5x

<A> spent most of its server render time in mergeProps and splitProps, which build
accessor-backed prop objects that can never be observed during a one shot
renderToString. The default activeClass / inactiveClass merge is gone, the
location.pathname normalization is shared instead of repeated per link, JSON.stringify
is skipped when there is no state, and on the server a link that passes nothing beyond
the props <A> consumes itself now skips splitProps and the JSX spread entirely.

Rendered output is unchanged on the client, and unchanged on the server apart from the
link marker serializing as link rather than link="true" on that fast path. Client
bundles get slightly smaller, since the server branch is constant folded away.
65f9ee7: Fixes browser history navigation when Forward is pressed while a Back transition is waiting on route data.

solidjs/solid-start (@solidjs/start)

`v2.1.0`

Compare Source

Minor Changes

ad92979: Add ssr: "data-only". The app renders on the client without hydration, as with ssr: false, but the server runs the requested page's route preloads and streams their query results with the HTML shell, so the client doesn't fetch that data again.

Patch Changes

5de5afd: Bump seroval and seroval-plugins to 1.6.11.
c30a825: Support a full URL in Vite's base so assets can be served from a CDN, completing the base URL prefixing from 2.0.3. Entry, stylesheet, modulepreload and serialized manifest paths no longer collapse https:// into https:/, and server functions post to the path the app is mounted at (server.baseURL, else Vite's base when it is a plain path, else /) instead of the asset base. There is no CDN in development: Vite serves the assets itself, including the public directory, under the URL's path, while the app stays at the root. Root-relative links to public files therefore differ between dev and a build; setting the CDN base for production builds only avoids that.
2ff5882: Let a clientOnly loader resolve to the component itself, so a named export works without wrapping it in { default }:
```
const Chart = clientOnly(() => import("./chart").then(({ Chart }) => Chart));
```
Destructuring the export inside the loader also lets the bundler leave the module's other exports out of the chunk.
45bacdb: Stop the dev toolbar's CSS from shipping in production builds. The error boundary statically imports the dev toolbar, whose module imports its stylesheet as a side effect. The toolbar is dead code in production, but the stylesheet survived because the package declared no sideEffects, so its styles were bundled into the client CSS. The package now marks only CSS files as having side effects, letting the bundler drop the toolbar and its styles from production output.
9ce2a5d: Add an earlyHints option that sends the page's assets as 103 Early Hints, so the browser can start downloading them while the server is still rendering. It covers the app's entry assets and the assets of the routes being rendered. On runtimes other than Node, the same hints are added as Link headers on the response. Off by default, and only applies to production builds.
6c9b0c9: Fall back to client rendering when the browser's path or query changes before hydration starts, preventing hydration mismatches and stale server data after early navigation.
a235891: Speed up the server function and lazy transforms.
- Modules without "use server" are no longer parsed by the server function transform.
- The server build no longer parses a module with Babel only to add its lazy id.
- Modules with many server functions compile about 4 times faster.
- A module with a server function no longer fails to compile when it has an unused for...of or for...in loop variable, or a chain of unused declarations.
017001e: Keep the result of a form submitted without JavaScript when its form data is too large for the flash cookie. Browsers silently drop cookies over 4096 bytes, so a large textarea used to make useSubmission() come back empty on the page the action redirected to. The form data is now left out of the cookie when it would not fit, the result and error still come through, and a warning is logged on the server.
e0e6f6d: Reload the browser when entry-server or the middleware changes in dev. Both are server-only, so Vite had nothing to send the browser and the page kept showing the previously rendered output until it was refreshed by hand.
6a9fb75: Reload the page once when a route's code fails to load during client-side navigation, such as when a deploy replaced it while the page was open. Before, the navigation ended on an error page until the user refreshed by hand. The page now reloads at the destination and loads the new version. A route that still fails right after the reload shows the error instead of reloading again. This only applies to production builds, and can be turned off with reloadOnRouteChunkError: false.
207cfd2: Make solid-js a peer dependency instead of a regular one. When an app's solid-js version was outside the range SolidStart asked for, package managers installed a second copy just for SolidStart. The two copies did not share reactive context, so client-side navigation broke with TypeError: Cannot read properties of null (reading 'push'). SolidStart now uses the app's solid-js, and a version outside the supported range shows up as a peer dependency warning at install time.
eb50f39: Serve pages in SPA mode (ssr: false) when a route file exports both a page and an API handler, such as a [...404].tsx with a GET. The server treated those routes as API-only, so a GET that returned nothing gave a 404 for every URL the route matched.
ad92979: Export getServerFunctionMeta, decorateHandler and decorateMiddleware from @solidjs/start/server in SPA mode (ssr: false), so apps using them build.

`v2.0.6`

Compare Source

Patch Changes

a4ed2a4: Stop client-only from failing the build for lazily imported client components.

A module that imported client-only and was loaded through clientOnly(() => import(...)) failed the server build, even though it only ever runs in the browser. The server build resolves every dynamic import to emit its chunk, so it resolved the client-only module and rejected it, though that module never runs on the server. client-only no longer fails the build. server-only is unchanged and still fails a client build.
048f5a9: Stop a no-JS server function POST from returning a 500 when the body is not a form.

A POST to a server function without the client runtime, carrying an empty body or a non-form content type, left a value that is not a FormData as the last argument. Building the flash cookie called .entries() on it and threw, and the error handler rethrew the same way, so the request failed with a 500. The response is now the normal redirect, and the flash cookie is best effort so it can no longer take down the error path.
59e7dc7: Make reading server function streams safer and faster.
- A malformed chunk after the first one is now logged instead of causing an unhandled promise rejection. On hosts that do not catch unhandled rejections, one bad request could stop the server process.
- The stream is cancelled when a chunk cannot be read or parsed.
- Chunk headers are now checked strictly, and a server rejects chunks over 64MB that a client sends.
- Large payloads that arrive in many small pieces are read in linear time. A 16MB chunk read in 16KB pieces took about 2 seconds and now takes about 30ms.
d34acf5: Require seroval and seroval-plugins 1.6.8 or newer.
d34acf5: Send Cache-Control: no-store on server function responses by default.

Server function responses, including calls made with GET, carried no Cache-Control, so a shared cache configured to store them could serve one caller's result to another. Every response from the server function handler now defaults to no-store: results, errors, redirects, no-JS redirects, raw Response passthroughs, and the handler's own refusals. A Cache-Control the function sets itself, on a returned Response or on the event's response headers, is kept as is, and a 304 is never given one.
d34acf5: Reject cross-site server function requests.

A "use server" function could be invoked from another site with the visitor's cookies, over a GET or a form POST, because the request's origin was not checked. Requests to server functions are now allowed only from the same origin or same site. The check trusts the Sec-Fetch-Site header and falls back to comparing Origin against the request host, so a page on another site receives a 403 instead of running the function. Same-origin calls, user-initiated navigations, and no-JS form submissions are unaffected. A separate origin that needs to call your backend should use an API route with explicit CORS.
9d3cbec: Report server functions that cannot work instead of compiling them into broken output.
- A "use server" function that reads a variable from an enclosing function now fails the build. The function is moved to the top level of its module, so the variable is not in scope when it runs.
- The same check covers this and arguments in an arrow function, super, and private class members.
- A "use server" directive in an object or class method now fails the build. It was ignored before, which shipped the method body and the modules it imports to the browser.
- A "use server" string that is not the first statement of a module or a function body now logs a warning. It has no effect there.
- An export a "use server" module cannot serve now logs a warning that names it. These exports are still left out of the client build.
- A "use server" module can now export an anonymous default function. Both export default async () => {} and export default async function () {} work.
- Server function ids are now built from the names a function is nested under, such as Page.load, instead of the order the functions appear in. An id no longer changes when another server function is added to the same file, and two functions that share a name are told apart by the names around them. Production ids stay opaque.
- Server functions are now compiled in .mts and .cts files.
- Build errors now point at the full path of the file, not just its name.
d34acf5: Treat a server function request with Origin: null and no Sec-Fetch-Site as cross-site.

Browsers send Origin: null from opaque origins, such as sandboxed iframes and some cross-origin redirect chains. When Sec-Fetch-Site was absent, the handler skipped the Origin comparison for that value and allowed the request. It is now refused with a 403. Requests that carry neither header, such as those from non-browser clients, are still allowed.
d34acf5: Settle server function values that are still waiting on the stream when its body ends.

A seroval body can reference a promise or stream that a later frame settles. If the body ended before that frame arrived, the value stayed pending forever, so a server function awaiting such an argument never answered. A malformed later frame also surfaced as an unhandled rejection. When the body ends or fails, every promise still waiting on it now rejects (with the failure, or with "Server function stream ended unexpectedly.") and every open stream errors. Decoded promises that nobody awaits no longer report unhandled rejections; code that awaits them still sees the rejection.

`v2.0.5`

Compare Source

Patch Changes

eca4cc4: Only strip a whole index segment when mapping route files to paths. Route files whose names merely end in "index", such as routes/reindex.tsx, were previously served at /re instead of /reindex.

`v2.0.4`

Compare Source

Patch Changes

ac3f321: Parse stack traces in the dev toolbar's error overlay with error-stack-parser-es/lite instead of error-stack-parser. The lite entry point is a much smaller, ESM-only parser that returns plain frame objects rather than class instances, and it no longer pulls in the stackframe package. Errors that carry no stack are now handled as an empty frame list instead of throwing.
ac3f321: Redesign the dev toolbar. The toolbar and its panels share a common set of design tokens, giving them a consistent dark palette, translucent surfaces, and elevation. The server function inspector is now a master-detail split with a persistent call list beside the request/response pane, and the error overlay places the stack frame list beside a code preview that fills the panel. Headers, form data, and URL search params render as aligned key-value tables, the hex viewer gains an offset gutter with the ASCII column aligned per row, and blobs are shown as file cards with their type and size. The seroval body inspector is now an expandable tree with collapsed previews, syntax-colored values, cycle detection, and live promise and stream state, replacing the previous column-based drill-down.

Along with the redesign, the toolbar only starts a drag from the toolbar itself rather than from its panels, unhandled promise rejections are captured by the error overlay, the code preview shows more surrounding lines, and a stack frame whose source cannot be loaded now stays listed and reports that its source is unavailable instead of silently rendering nothing.
ac3f321: Use @jridgewell/trace-mapping instead of source-map-js to resolve original sources in the dev toolbar's error overlay. It decodes mappings lazily, so only the positions actually inspected are resolved, it is significantly smaller in the browser bundle, and it understands indexed source maps.
f619c7f: Pre-bundle the dev toolbar's CommonJS dependencies so it no longer throws on every dev page load
d43ad1b: Update Solid to 1.9.15 to include the latest lazy loading and hydration fixes

`v2.0.3`

Compare Source

Patch Changes

91fc972: Prefix production entry scripts, stylesheets, modulepreloads, and serialized manifest paths with Vite's configured base URL.

`v2.0.2`

Compare Source

Patch Changes

e21fadf: fix potentially incomplete first chunk for chunk readers
d78288f: Declare an explicit Content-Type: text/plain; charset=utf-8 on seroval-stream server function responses (success and error paths) so intermediaries cannot content-sniff a type onto them

`v2.0.1`

Compare Source

Patch Changes

fd5e2ae: Delegate vite preview to Nitro when its preview plugin is active, including for static builds that intentionally have no server entry.

typescript-eslint/typescript-eslint (@typescript-eslint/eslint-plugin)

`v8.72.1`

Compare Source

🩹 Fixes

eslint-plugin: [no-unnecessary-type-assertion] bound recursive type traversal instead of catching stack overflows (#13039)
eslint-plugin: [no-unnecessary-condition] false positives on unresolved conditional types (#13062)

❤️ Thank You

Evyatar Daud @StyleShit
Josh Ghoulberg 👻

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

`v8.72.0`

Compare Source

🚀 Features

eslint-plugin: [await-thenable] add allowMixedPromiseArrays option (#12992)
eslint-plugin: lazy load rules (#13010)

🩹 Fixes

type-utils: discriminateAnyType crashes when calling getAwaitedType on awaited type in TS < 5.0 (#13054)
eslint-plugin: [require-array-sort-compare] ignore extra this type argument on TS < 5.1 (#13055)
eslint-plugin: [require-array-sort-compare] check tuples (#13058)
eslint-plugin: use isTypeLiteralType instead of type.isLiteral() to include bigint literals on TS < 5.0 (#13053)
eslint-plugin: [no-deprecated] report deprecated properties in object literals (#12704)
eslint-plugin: [prefer-readonly-parameter-types] check where allowed type aliases are declared (#13016)
typescript-estree: include leading and trailing comments & whitespace in Program range (#12991)

❤️ Thank You

Evyatar Daud @StyleShit
Junichiro Kasuya @jksy
Mitch Fultz @fitchmultz

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

`v8.71.2`

Compare Source

🩹 Fixes

eslint-plugin: [prefer-optional-chain] safe fix when the chain ends with a strict null comparison (#12805)
eslint-plugin: [no-unnecessary-type-parameters] parenthesize constraint in optional tuple elements (#12995)
eslint-plugin: [no-unused-vars] ignore type-only refs for after-used (#12977)
eslint-plugin: [no-unnecessary-type-parameters] count instantiated mapped type templates (#12974)
eslint-plugin: [no-unused-vars] avoid false-positives when not using our parser (#12989)

❤️ Thank You

Abraham Guo
Brad Zacher @bradzacher
Josh Goldberg
Vinccool96
Younsang Na @nayounsang

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

`v8.71.1`

Compare Source

🩹 Fixes

eslint-plugin: [no-unnecessary-type-parameters] count instantiated mapped type constraints (#12941)
eslint-plugin: [prefer-optional-chain] check the constrained type (#12953)
eslint-plugin: [no-confusing-void-expression] don't autofix when declared return type is unknown (#12930)
eslint-plugin: [no-unsafe-enum-assignment] skip identical types and bound deep type walks (#12957)
eslint-plugin: [require-array-sort-compare] use array argument type constraint (#12919)
eslint-plugin: [no-unused-vars] report usedOnlyAsType for partially exported merged declarations (#12892)
eslint-plugin: [no-misused-promises] skip argument checks for calls without arguments (#12923)

❤️ Thank You

Diptajoy Mistry @diptomistry
Evyatar Daud @StyleShit
Josh Goldberg
Josh Goldberg ✨
Medhansh Poojari

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

`v8.71.0`

Compare Source

🚀 Features

eslint-plugin: [no-unsafe-enum-assignment] add rule (#12732)

🩹 Fixes

eslint-plugin: [no-misused-promises] handle a return outside of any function (#12912)
eslint-plugin: [no-unnecessary-type-assertion] specialize generic assertion report message (#12832)
eslint-plugin: [unbound-method] respect this: void on class properties (7fce9127d)
eslint-plugin: [switch-exhaustiveness-check] always sort literal cases in stable order (#12885)

❤️ Thank You

Evyatar Daud @StyleShit
Fatih Çakır @wfatih
Josh Goldberg
Josh Goldberg ✨
Zamiell @Zamiell

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

`v8.70.1`

Compare Source

🩹 Fixes

eslint-plugin: [no-misused-promises] handle multiple Promise constituents (#12904)
eslint-plugin: [no-useless-default-assignment] convert the fixer to a suggestion fixer (#12826)
eslint-plugin: [no-unnecessary-condition] handle union-keyed index access on the left-hand side of nullish assignment (#12747)
eslint-plugin: [unbound-method] treat Intl.Collator.prototype.compare as spec-bound (#12845)
eslint-plugin: [no-unnecessary-parameter-property-assignment] account for parameter reassignment (#12880)
eslint-plugin: [await-thenable] prevent autofix from breaking code when removing await (#12716)
eslint-plugin: [no-meaningless-void-operator] allow void on assignment expressions (#12873)
eslint-plugin: [no-unnecessary-type-assertion] false positive for empty object asserted to a type alias of Record (#12869)
eslint-plugin: [no-misused-spread] omit WeakMap spread suggestions (#12850)
eslint-plugin: [no-generated-empty-object-type] don't report a mapped type whose keys are not resolved yet (#12854)
eslint-plugin: [no-explicit-any] use unknown[] for bare any rest parameters (#12818)
eslint-plugin: [no-unnecessary-type-parameters] handle type precedence in the suggestion fixer (#12637)
eslint-plugin: [no-useless-default-assignment] avoid false positives on tuples with a rest element (#12768)

❤️ Thank You

Brad Zacher @bradzacher
Diptajoy Mistry @diptomistry
Grit @Grit03
Hugo @hugop95
Michael Naumov @mnaoumov
Mikhail Baev @baevm
Om Rawat
Sanath @sansynx
Shinji
Vinccool96
김채영 @cchaeyoung
송재욱

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

`v8.70.0`

Compare Source

🚀 Features

eslint-plugin: [no-generated-empty-object-type] add rule (#12730)

🩹 Fixes

eslint-plugin: [no-deprecated] report deprecated imported values used in object shorthand properties (#12780)
eslint-plugin: [no-unnecessary-condition] no false positive on RHS of a nested logical expression (#12728)
eslint-plugin: [member-ordering] don't report fields that read fields declared before them (#12729)

❤️ Thank You

Josh Goldberg ✨ @JoshuaKGoldberg
Ulrich Stark @ulrichstark

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

`v8.69.0`

Compare Source

🚀 Features

eslint-plugin: [no-misused-promises] add flagUnions option for checkConditionals (#12603)

🩹 Fixes

eslint-plugin: [no-meaningless-void-operator] report void on non-call expressions (#12727)
eslint-plugin: [unified-signatures] compare type parameters by constraint instead of name (#12741)
eslint-plugin: [no-mixed-enums] use scope analysis instead of type checking for merged namespaces (#12731)

❤️ Thank You

Abdu Alim Arlikhozhaev @Arlikhozhaev
Evyatar Daud @StyleShit
Josh Goldberg ✨
wonbeanie @wonbeanie

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

`v8.68.0`

Compare Source

🚀 Features

eslint-plugin: [strict-void-return] add fix suggestions (#12086)

🩹 Fixes

eslint-plugin: [no-empty-object-type] ignore suggestions that result in invalid interfaces and export defaults (#12739)
eslint-plugin: [no-floating-promises] setting ignoreVoid: false results in false negative in ArrowFunctionExpression (#12646)
eslint-plugin: [no-unnecessary-type-assertion] prevent stack overflow in recursive types (#12711)
eslint-plugin: [unified-signatures] report identical signatures (#12678)
eslint-plugin: [return-await] prevent autofix from breaking code in arrow-functions (#12707)
eslint-plugin: [unified-signatures] deduplicate types in report (#12656)

❤️ Thank You

Evyatar Daud @StyleShit
Hugo @hugop95
Niki @phaux
Younsang Na @nayounsang

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

`v8.67.0`

Compare Source

This was a version bump only for eslint-plugin to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

`v8.66.0`

Compare Source

🩹 Fixes

eslint-plugin: [class-literal-property-style] preserve type annotations and don't drop decorators (#12617)
eslint-plugin: [no-unnecessary-type-parameters] check MappedType key remapping (#12588)
eslint-plugin: [no-useless-default-assignment] don't report defaults used by other overloads (#12607)
eslint-plugin: [prefer-nullish-coalescing] handle shadowed Boolean calls (#12591)
eslint-plugin: [no-unnecessary-type-conversion] ignore shadowed built-ins (#12590)

❤️ Thank You

Evyatar Daud @StyleShit
송재욱

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

typescript-eslint/typescript-eslint (@typescript-eslint/parser)