Skip to content

fix(web): drop the internal scriptNonce/styleNonce exports; examples on vite-plugin next.50 - #4036

Merged
ryansolid merged 1 commit into
nextfrom
claude/project-thread-xvubyg
Oct 13, 2026
Merged

ryansolid merged 1 commit into
nextfrom
claude/project-thread-xvubyg

Conversation

@ryansolid

Copy link
Copy Markdown
Member

Requested by Ryan · project thread

Before: @solidjs/web's server build still exports scriptNonce and styleNonce, marked @internal. They were kept only because @solidjs/vite-plugin ≤ 3.0.0-next.49's generated start-mode handler imports them (see #4016). The examples pin the plugin to exactly 3.0.0-next.49.

After: both exports are gone. The two internal call sites use the existing local destinationNonce. All 12 example package.json files pin @solidjs/vite-plugin 3.0.0-next.50, which projects the nonce itself (solidjs/solid-vite-plugin#409).

How: there's a patch changeset for @solidjs/web, and the lockfile was regenerated with pnpm install.

Testing:

  • Built solid-js, @solidjs/web and the compiler binding from this branch, then ran pnpm run build for the start-mode examples hackernews, todos-server, notes and board. All passed. These are the builds that broke when the exports were removed earlier.
  • packages/web pnpm test: client 1391/1391 and hydrate pass. Server has 1 failure, server-functions-adapter-request.spec.tsx "keeps a rebuild failure's own error…", which fails the same way with this change stashed, so it isn't caused by this PR.

🤖 Generated with Claude Code

https://claude.ai/code/session_01R2FCNsvaipU3xXx9p83VUs


Generated by Claude Code

…on vite-plugin next.50

@solidjs/vite-plugin 3.0.0-next.50 projects the CSP nonce locally
(solidjs/solid-vite-plugin#409), so nothing imports these helpers any
more. The examples move from their exact next.49 pin to next.50.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01R2FCNsvaipU3xXx9p83VUs
@changeset-bot

changeset-bot Bot commented Oct 13, 2026

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: 16c3ebc

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 13 packages
Name Type
@solidjs/web Patch
@solidjs/babel-plugin Patch
@solidjs/diagnostics Patch
@solidjs/element Patch
@solidjs/h Patch
@solidjs/html Patch
test-integration Patch
board-example Patch
todos-server-example Patch
@solidjs/compiler Patch
@solidjs/signals Patch
solid-js Patch
@solidjs/universal Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@ryansolid ryansolid self-assigned this Oct 13, 2026
@socket-security

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Updatednpm/​@​solidjs/​vite-plugin@​3.0.0-next.49 ⏵ 3.0.0-next.5098 +1100100 +197 +1100

View full report

@github-actions

Copy link
Copy Markdown

Size (brotli, eager entry chunk)

scenario head vs base minified vs base minified vs recorded cap lazy chunks (not counted)
signals: core floor (createSignal/Memo/Effect/Root/flush) 7.47 KB 0 B 0 B 0 B 7.48 KB ✅
signals: + createStore 14.93 KB 0 B 0 B 0 B 14.94 KB ✅
signals: + isPending/latest 9.75 KB 0 B 0 B 0 B 9.77 KB ✅
app: render + one signal (the simple-app floor) 9.97 KB 0 B 0 B 0 B 9.98 KB ✅
app: hydrating (no stores) with Show/For/Loading/Errored/lazy 17.89 KB 0 B 0 B −43 B 17.93 KB ✅ lazy-page.js 0.04 KB
app: hydrating + every store primitive family 29.51 KB 0 B 0 B 0 B 29.52 KB ✅ lazy-page.js 0.04 KB
app: CSR with Show/For/Loading/Errored/lazy 13.05 KB 0 B 0 B 0 B 13.07 KB ✅ lazy-page.js 0.04 KB
app: CSR, observe tier (same app on the observe artifacts) 14.62 KB 0 B 0 B 0 B 14.64 KB ✅ lazy-page.js 0.04 KB
app: CSR, observe tier + attribution engine enabled 29.23 KB 0 B 0 B 0 B 29.24 KB ✅ lazy-page.js 0.04 KB
app: compiled floor (one template, one text hole, one delegated click) 10.15 KB 0 B 0 B 0 B 10.17 KB ✅
app: compiled CSR (JSX todo app: spread/merge/omit, events, class/style, keyed For, Show, Loading + lazy, store) 25.74 KB 0 B 0 B 0 B 25.75 KB ✅ stats.js 0.18 KB
app: compiled hydrating (the same JSX todo app through hydrate(), compiled hydratable) 31.62 KB 0 B 0 B 0 B 31.64 KB ✅ stats.js 0.20 KB
frames: eager client consumer (frames client + transport, lazy codec) 11.43 KB 0 B 0 B 0 B 11.43 KB ✅
page: base server components (hydrating + dynamic + frames + sf reference) 34.08 KB 0 B 0 B −1580 B 34.33 KB ✅ assets.js 0.78 KB, bind.js 1.83 KB, decode.js 6.23 KB, lazy-page.js 0.04 KB, regions.js 0.80 KB, trace.js 8.99 KB, wire.js 0.93 KB
page: live server components (base + live/GET + action + isPending/latest) 37.87 KB 0 B 0 B −1648 B 38.15 KB ✅ assets.js 0.78 KB, bind.js 1.83 KB, decode.js 6.23 KB, lazy-page.js 0.04 KB, regions.js 0.80 KB, trace.js 8.99 KB, wire.js 0.93 KB
page: compiled base server components (the base page as JSX: templates with class/style/attributes/events, For/Show; no spread) 34.92 KB 0 B 0 B −2670 B 35.66 KB ✅ assets.js 0.78 KB, bind.js 1.83 KB, decode.js 6.23 KB, regions.js 0.80 KB, sc-comments.js 0.20 KB, trace.js 8.95 KB, wire.js 0.93 KB
page: compiled live server components (the compiled base page + live/GET + action + isPending/latest) 40.59 KB 0 B 0 B −2663 B 41.21 KB ✅ eager (counted): web.js 21.54 KB; assets.js 0.78 KB, bind.js 1.84 KB, decode.js 6.23 KB, regions.js 0.79 KB, sc-comments.js 0.19 KB, trace.js 8.93 KB, wire.js 0.93 KB
page: base + router (base page + @solidjs/router: createRouter, two routes, preload, useNavigate) 41.44 KB 0 B 0 B −1585 B 41.79 KB ✅ assets.js 0.78 KB, bind.js 1.85 KB, decode.js 6.23 KB, lazy-page.js 0.04 KB, regions.js 0.80 KB, server.js 1.02 KB, serverForms.js 3.58 KB, trace.js 8.98 KB, wire.js 0.94 KB
page: live + router (live page + @solidjs/router: createRouter, two routes, preload, useNavigate) 47.27 KB 0 B 0 B −1578 B 47.49 KB ✅ eager (counted): client.js 27.75 KB; assets.js 0.78 KB, bind.js 1.84 KB, decode.js 6.23 KB, lazy-page.js 0.04 KB, regions.js 0.81 KB, server.js 1.02 KB, serverForms.js 3.30 KB, trace.js 8.96 KB, wire.js 0.94 KB
server: floor (getRequestEvent + isServer) 1.33 KB 0 B 0 B 0 B 1.34 KB ✅
server: renderToString (the server-render floor) 20.47 KB 0 B 0 B 0 B 20.48 KB ✅

Bundled with Rolldown (what Vite ships), brotli q11, decimal KB. A scenario fails only when it is over its brotli cap and its minified size is more than 20 B over the minified recorded with the cap; over the cap within that allowance is brotli layout noise and passes with a warning. Caps and their recorded minified in scripts/size/scenarios.js; the floor and page caps in floor-caps.json are frozen (lower only, or Size-Exception: in the PR body). npm run ratchet lowers caps per RC; it never raises one (scripts/size/README.md).

@coveralls

Copy link
Copy Markdown

Coverage Report for CI Build 38460772654

Coverage remained the same at 77.515%

Details

  • Coverage remained the same as the base build.
  • Patch coverage: No coverable lines changed in this PR.
  • No coverage regressions found.

Uncovered Changes

No uncovered changes found.

Coverage Regressions

No coverage regressions found.


Coverage Stats

Coverage Status
Relevant Lines: 1326
Covered Lines: 1084
Line Coverage: 81.75%
Relevant Branches: 1040
Covered Branches: 750
Branch Coverage: 72.12%
Branches in Coverage %: Yes
Coverage Strength: 27.28 hits per line

💛 - Coveralls

@codspeed

codspeed Bot commented Oct 13, 2026

Copy link
Copy Markdown

Merging this PR will not alter performance

⚠️ 2 benchmarks spent significant time in system calls

System calls cannot be consistently instrumented, so they are not included in the measure, which understates the real cost. Please switch to the Walltime instrument to accurately measure system calls.

Measurement and system calls

✅ 195 untouched benchmarks


Comparing claude/project-thread-xvubyg (16c3ebc) with next (9f4174b)

Open in CodSpeed

@ryansolid
ryansolid merged commit 96b615d into next Oct 13, 2026
8 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants