build(deps-dev): bump @solidjs/vite-plugin from 3.0.0-next.47 to 3.0.0-next.49

[dependabot]

Bumps @solidjs/vite-plugin from 3.0.0-next.47 to 3.0.0-next.49.

Release notes

Sourced from @​solidjs/vite-plugin's releases.

@​solidjs/vite-plugin@​3.0.0-next.49

Patch Changes

• be766d6: dev: false now serves Solid's production builds under vite dev, as documented (#62). The plugin already dropped its own development condition, but Vite's default development|production condition resolves to development in any non-production mode, so the client still pre-bundled solid.dev.js / web.dev.js and SSR loaded server.dev.js. With dev: false the plugin now rewrites that condition to production under vite dev; vitest runs and vite build keep Vite's default resolution. Vite conditions apply per environment, so other packages that ship a development export also get their production builds in that case. It also stops emitting HMR refresh wrappers and pre-bundling solid-js/refresh, because the production refresh runtime is an inert stub that only warns; edits fall back to a full reload. The diagnostics bridge also stays off with dev: false unless observe is on, since its channels exist only in the dev and observe builds.
• af79dd8: Plain .ts and .js modules now get lazy callsite module URLs and, on the server, a $$moduleUrl export. Non-JSX files used to return before that pipeline, so a routes.ts of lazy(() => import(...)) never told SSR which module to preload.

@​solidjs/vite-plugin@​3.0.0-next.48

Minor Changes

• 1702a19: BREAKING: start-mode middleware is event-first, (event, next) => Response | Promise<Response>, with the request at event.request. The plugin composes the chain itself. next() takes no arguments — assign event.request before calling it to substitute the request downstream; next(request) throws a migration error. Per-request render inputs live on the event, set before next() (the render runs inside it): event.nonce (a string or { script, style }) and event.renderMode ('stream' | 'async'). handleRequest(request, { nonce, renderMode }) is seeded onto the event before the chain and wins over a middleware write, then the event field, then static start.renderMode, then 'stream'. Invalid host options reject the call before the chain. Generated entries pass event.nonce to renderToStream; authored entries must forward the context.nonce the handler passes them. The injected client-entry script, redirect fallback, dev head, dev styles, and (when there is a style nonce) a <meta property="csp-nonce"> carry it too. The start.renderMode module form, which only shipped in 3.0.0-next prereleases, is removed — a path is a config error pointing at event.renderMode in middleware. The static 'stream' | 'async' shorthand stays. A nonce set while prerendering the client-mode shell is not baked into dist/client/index.html (the build warns). In dev, changing event.nonce or event.renderMode after the render has read them warns.

Patch Changes

• c41d013: Chunk and asset names derived from file names no longer carry runs of dots. A catch-all route module such as [...404].tsx built to _...404_-<hash>.js, and hosts, CDNs or middleware that reject any URL containing .. refused that chunk, so the lazy route failed to hydrate. Builds now run the configured output.sanitizeFileName (or the bundler default) and then collapse every run of dots in the last segment of the name to one: the chunk becomes _.404_-<hash>.js. Directories are left alone: with preserveModules they are part of the name. The server build is named the same way, so the asset URLs it writes into server-rendered markup keep pointing at the files the client build wrote. A custom sanitizeFileName still runs, with the collapse applied after it, whether it comes from the config or from another plugin's outputOptions hook; sanitizeFileName: false is left alone. Fixes #391.
• 9f5b744: Use the resolved client and server build directories when prerendering client-mode shells and serving preview requests. Preserve the SSR service for host build orchestrators such as Nitro, including client mode without server functions, while standalone client builds still produce only static output.
• 970bc19: handleRequest(request, { nonce }) accepts the { script, style } form of @solidjs/web's CSPNonce and uses its script value for the scripts the handler writes: the injected client-entry tag and the post-flush redirect fallback. A pair used to throw TypeError: value.replace is not a function. A value outside CSPNonce (anything but a string or a { script, style } object with both keys, each a non-empty string or false) now rejects the call up front with an error naming the option, before the middleware chain runs; an empty value (undefined, null or '') still means no nonce. The option is now declared in the virtual:solid-ssr-handler types.
• ec428e1: A hand-written lazy() moduleUrl with a leading slash (lazy(() => import("./Page"), undefined, "/src/Page.tsx")) now resolves like the project-relative key src/Page.tsx (#390). In dev the asset resolver built a protocol-relative //src/Page.tsx URL, so the preload failed and hydration fell back to a client render; in production the virtual:solid-manifest lookup missed, no client assets or root module map were emitted, and hydration threw "was not preloaded before hydration". The dev resolver (in-process, HTTP bridge, and the generated fallback) now strips the leading slash before building the URL and walking the module graph, and the baked build manifest answers slash-prefixed lookups through non-enumerable aliases, so for…in, Object.keys, and JSON consumers see the manifest unchanged.
• efdaf56: The Start handler now settles failures that escape the middleware chain instead of letting them reject to the host. A thrown Response, or the Response a thrown respond() envelope carries, becomes the response in dev and production, so throw redirect() works from middleware. In a production build any other failure (a middleware throw, a start.setup or start.renderMode module failure) is reported once to the configureServerErrors hook as { kind: 'render', handling: 'failed' } with the request event, or logged with console.error without a hook, and answered with a bodyless 500. That 500 keeps the headers and cookies written to the request event while the response head is still open, that is, unless next() already returned a rendered page. In dev those failures still reject, so the dev server sees the original error. An invalid renderMode passed to handleRequest still rejects the call. A client-mode build now fails when prerendering the shell answers a non-2xx status, instead of writing that response to index.html.
• c3a47d5: The dependency scanner settings now reach every environment, not just client (#387). Vite seeds only the client environment from the top-level optimizeDeps, so an ssr (or other server) environment with discovery turned back on — as @cloudflare/vite-plugin does for workerd SSR — scanned Solid TSX with Rolldown's default React automatic runtime. The scan failed on an unresolvable react/jsx-dev-runtime and pre-bundling was skipped for that environment, which showed up as duplicate Solid instances in the app. configEnvironment now gives non-client environments the classic scanner JSX runtime (unless the app set its own per-environment transform.jsx), the .tsrx extension, and the tsrx scan plugin.
• 9548326: The build now defines __SOLID_SERVER_COMPONENTS__ so libraries can drop server-component-only client code (#396). The value is "true" when serverFunctions.components is set (including 'external') and "false" otherwise, and it is always defined — an absent identifier cannot be eliminated. It is set on Vite's define (build, and dev source via /@vite/env) and on every environment's optimizeDeps.rolldownOptions.transform.define, because the optimizer ignores top-level define and only the client environment inherits top-level optimizeDeps. A user-provided define value wins, and so does a value already set on that environment's optimizer.
• 2a714d4: With serverFunctions on, the dev server now pre-bundles the server-function client runtime even without components (@solidjs/web/server-functions, or runtime.client when it names a package), so a cold cache no longer re-optimizes and reloads on the first "use server" module. In Vitest browser mode that reload showed up as "Vite unexpectedly reloaded a test".
• 5062f90: Require solid-js / @​solidjs/web 2.0.0-rc.14 (peer floor) and compile with @​solidjs/compiler / @​solidjs/babel-plugin rc.14 — runtime and compiler move in lockstep. rc.14 treats a lowercase on* name (onclick) as a plain attribute everywhere (both compilers, spread/assign, and the server spread walk); only on followed by an uppercase letter is an event handler, and a function handed to a lowercase on* attribute is escaped rather than bound. Server-component frame markup also moved: refetched content lands at the transition's commit. With the old ^2.0.0-rc.13 floor an existing lockfile could keep an rc.13 compiler while the app's runtime moved to rc.14, so compiled output and the frames runtime would disagree; the floor bump closes that window.
• ae8a8b0: Under vite dev the SSR environment now inlines seroval and seroval-plugins next to solid-js and @solidjs/web. Both ship a dist/dev build behind the development condition, and @solidjs/web imports both. Left external, seroval-plugins loaded through Node and its own import "seroval" resolved to the prod copy, while the inlined @solidjs/web got the runner's dev copy. Seroval detects streams with instanceof Stream, so the Stream that ReadableStreamPlugin builds from one copy was rejected by the other copy's serializer. This broke server components (serverFunctions: { components: true }) in dev when a component resolved after the shell flush (for example after an await in the server function): its sc:live ReadableStream failed with "Seroval caught an error during the parsing process … cannot be parsed/serialized", the <Loading> boundary contained the error, and the component only rendered on the client. Builds were unaffected because they bundle a single copy. A host that sets noExternal: true and Vitest projects are left alone, as before.

Changelog

Sourced from @​solidjs/vite-plugin's changelog.

3.0.0-next.49

Patch Changes

• be766d6: dev: false now serves Solid's production builds under vite dev, as documented (#62). The plugin already dropped its own development condition, but Vite's default development|production condition resolves to development in any non-production mode, so the client still pre-bundled solid.dev.js / web.dev.js and SSR loaded server.dev.js. With dev: false the plugin now rewrites that condition to production under vite dev; vitest runs and vite build keep Vite's default resolution. Vite conditions apply per environment, so other packages that ship a development export also get their production builds in that case. It also stops emitting HMR refresh wrappers and pre-bundling solid-js/refresh, because the production refresh runtime is an inert stub that only warns; edits fall back to a full reload. The diagnostics bridge also stays off with dev: false unless observe is on, since its channels exist only in the dev and observe builds.
• af79dd8: Plain .ts and .js modules now get lazy callsite module URLs and, on the server, a $$moduleUrl export. Non-JSX files used to return before that pipeline, so a routes.ts of lazy(() => import(...)) never told SSR which module to preload.

3.0.0-next.48

Minor Changes

• 1702a19: BREAKING: start-mode middleware is event-first, (event, next) => Response | Promise<Response>, with the request at event.request. The plugin composes the chain itself. next() takes no arguments — assign event.request before calling it to substitute the request downstream; next(request) throws a migration error. Per-request render inputs live on the event, set before next() (the render runs inside it): event.nonce (a string or { script, style }) and event.renderMode ('stream' | 'async'). handleRequest(request, { nonce, renderMode }) is seeded onto the event before the chain and wins over a middleware write, then the event field, then static start.renderMode, then 'stream'. Invalid host options reject the call before the chain. Generated entries pass event.nonce to renderToStream; authored entries must forward the context.nonce the handler passes them. The injected client-entry script, redirect fallback, dev head, dev styles, and (when there is a style nonce) a <meta property="csp-nonce"> carry it too. The start.renderMode module form, which only shipped in 3.0.0-next prereleases, is removed — a path is a config error pointing at event.renderMode in middleware. The static 'stream' | 'async' shorthand stays. A nonce set while prerendering the client-mode shell is not baked into dist/client/index.html (the build warns). In dev, changing event.nonce or event.renderMode after the render has read them warns.

Patch Changes

• c41d013: Chunk and asset names derived from file names no longer carry runs of dots. A catch-all route module such as [...404].tsx built to _...404_-<hash>.js, and hosts, CDNs or middleware that reject any URL containing .. refused that chunk, so the lazy route failed to hydrate. Builds now run the configured output.sanitizeFileName (or the bundler default) and then collapse every run of dots in the last segment of the name to one: the chunk becomes _.404_-<hash>.js. Directories are left alone: with preserveModules they are part of the name. The server build is named the same way, so the asset URLs it writes into server-rendered markup keep pointing at the files the client build wrote. A custom sanitizeFileName still runs, with the collapse applied after it, whether it comes from the config or from another plugin's outputOptions hook; sanitizeFileName: false is left alone. Fixes #391.
• 9f5b744: Use the resolved client and server build directories when prerendering client-mode shells and serving preview requests. Preserve the SSR service for host build orchestrators such as Nitro, including client mode without server functions, while standalone client builds still produce only static output.
• 970bc19: handleRequest(request, { nonce }) accepts the { script, style } form of @solidjs/web's CSPNonce and uses its script value for the scripts the handler writes: the injected client-entry tag and the post-flush redirect fallback. A pair used to throw TypeError: value.replace is not a function. A value outside CSPNonce (anything but a string or a { script, style } object with both keys, each a non-empty string or false) now rejects the call up front with an error naming the option, before the middleware chain runs; an empty value (undefined, null or '') still means no nonce. The option is now declared in the virtual:solid-ssr-handler types.
• ec428e1: A hand-written lazy() moduleUrl with a leading slash (lazy(() => import("./Page"), undefined, "/src/Page.tsx")) now resolves like the project-relative key src/Page.tsx (#390). In dev the asset resolver built a protocol-relative //src/Page.tsx URL, so the preload failed and hydration fell back to a client render; in production the virtual:solid-manifest lookup missed, no client assets or root module map were emitted, and hydration threw "was not preloaded before hydration". The dev resolver (in-process, HTTP bridge, and the generated fallback) now strips the leading slash before building the URL and walking the module graph, and the baked build manifest answers slash-prefixed lookups through non-enumerable aliases, so for…in, Object.keys, and JSON consumers see the manifest unchanged.
• efdaf56: The Start handler now settles failures that escape the middleware chain instead of letting them reject to the host. A thrown Response, or the Response a thrown respond() envelope carries, becomes the response in dev and production, so throw redirect() works from middleware. In a production build any other failure (a middleware throw, a start.setup or start.renderMode module failure) is reported once to the configureServerErrors hook as { kind: 'render', handling: 'failed' } with the request event, or logged with console.error without a hook, and answered with a bodyless 500. That 500 keeps the headers and cookies written to the request event while the response head is still open, that is, unless next() already returned a rendered page. In dev those failures still reject, so the dev server sees the original error. An invalid renderMode passed to handleRequest still rejects the call. A client-mode build now fails when prerendering the shell answers a non-2xx status, instead of writing that response to index.html.
• c3a47d5: The dependency scanner settings now reach every environment, not just client (#387). Vite seeds only the client environment from the top-level optimizeDeps, so an ssr (or other server) environment with discovery turned back on — as @cloudflare/vite-plugin does for workerd SSR — scanned Solid TSX with Rolldown's default React automatic runtime. The scan failed on an unresolvable react/jsx-dev-runtime and pre-bundling was skipped for that environment, which showed up as duplicate Solid instances in the app. configEnvironment now gives non-client environments the classic scanner JSX runtime (unless the app set its own per-environment transform.jsx), the .tsrx extension, and the tsrx scan plugin.
• 9548326: The build now defines __SOLID_SERVER_COMPONENTS__ so libraries can drop server-component-only client code (#396). The value is "true" when serverFunctions.components is set (including 'external') and "false" otherwise, and it is always defined — an absent identifier cannot be eliminated. It is set on Vite's define (build, and dev source via /@vite/env) and on every environment's optimizeDeps.rolldownOptions.transform.define, because the optimizer ignores top-level define and only the client environment inherits top-level optimizeDeps. A user-provided define value wins, and so does a value already set on that environment's optimizer.
• 2a714d4: With serverFunctions on, the dev server now pre-bundles the server-function client runtime even without components (@solidjs/web/server-functions, or runtime.client when it names a package), so a cold cache no longer re-optimizes and reloads on the first "use server" module. In Vitest browser mode that reload showed up as "Vite unexpectedly reloaded a test".
• 5062f90: Require solid-js / @​solidjs/web 2.0.0-rc.14 (peer floor) and compile with @​solidjs/compiler / @​solidjs/babel-plugin rc.14 — runtime and compiler move in lockstep. rc.14 treats a lowercase on* name (onclick) as a plain attribute everywhere (both compilers, spread/assign, and the server spread walk); only on followed by an uppercase letter is an event handler, and a function handed to a lowercase on* attribute is escaped rather than bound. Server-component frame markup also moved: refetched content lands at the transition's commit. With the old ^2.0.0-rc.13 floor an existing lockfile could keep an rc.13 compiler while the app's runtime moved to rc.14, so compiled output and the frames runtime would disagree; the floor bump closes that window.
• ae8a8b0: Under vite dev the SSR environment now inlines seroval and seroval-plugins next to solid-js and @solidjs/web. Both ship a dist/dev build behind the development condition, and @solidjs/web imports both. Left external, seroval-plugins loaded through Node and its own import "seroval" resolved to the prod copy, while the inlined @solidjs/web got the runner's dev copy. Seroval detects streams with instanceof Stream, so the Stream that ReadableStreamPlugin builds from one copy was rejected by the other copy's serializer. This broke server components (serverFunctions: { components: true }) in dev when a component resolved after the shell flush (for example after an await in the server function): its sc:live ReadableStream failed with "Seroval caught an error during the parsing process … cannot be parsed/serialized", the <Loading> boundary contained the error, and the component only rendered on the client. Builds were unaffected because they bundle a single copy. A host that sets noExternal: true and Vitest projects are left alone, as before.

Commits

• 44d90fd Merge pull request #408 from solidjs/changeset-release/next
• 5455118 Version Packages (next)
• f1ed4d4 Merge pull request #405 from solidjs/fix/62-dev-false-production-runtime
• 0caf9f6 Merge remote-tracking branch 'origin/next' into fix/62-dev-false-production-r...
• ed06a7e ci: retrigger checks for the dev false test
• c552d03 test: assert dev false resolves Solid's production builds
• 6053860 Merge pull request #407 from solidjs/fix/issue-406-ts-lazy-module-url
• af79dd8 fix: annotate non-JSX modules with lazy module URLs
• be766d6 fix: resolve production Solid builds under vite dev when dev is false
• 43d4071 Merge pull request #398 from solidjs/changeset-release/next
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)