From aba4975b622471af98a20d5b8bd5fb8a5c4ccca6 Mon Sep 17 00:00:00 2001 From: Atila Fassina Date: Sat, 21 Feb 2026 10:52:28 +0100 Subject: [PATCH 1/7] add a fixture for more easily test Seroval modes / add JSDoc for config --- apps/fixtures/serialization-modes/README.md | 19 ++ .../serialization-modes/app.config.ts | 8 + .../fixtures/serialization-modes/package.json | 21 ++ .../serialization-modes/public/favicon.ico | Bin 0 -> 664 bytes apps/fixtures/serialization-modes/src/app.css | 39 +++ apps/fixtures/serialization-modes/src/app.tsx | 22 ++ .../src/components/Counter.css | 21 ++ .../src/components/Counter.tsx | 11 + .../serialization-modes/src/entry-client.tsx | 4 + .../serialization-modes/src/entry-server.tsx | 21 ++ .../serialization-modes/src/global.d.ts | 1 + .../serialization-modes/src/middleware.ts | 26 ++ .../src/routes/[...404].tsx | 19 ++ .../serialization-modes/src/routes/about.tsx | 10 + .../serialization-modes/src/routes/index.tsx | 49 ++++ .../serialization-modes/tsconfig.json | 19 ++ apps/tests/src/middleware.ts | 27 ++ .../src/routes/actions/use-submission.tsx | 35 +++ packages/start/config/index.d.ts | 13 +- packages/start/config/index.js | 9 +- pnpm-lock.yaml | 251 +++++++++++++++++- pnpm-workspace.yaml | 7 +- 22 files changed, 621 insertions(+), 11 deletions(-) create mode 100644 apps/fixtures/serialization-modes/README.md create mode 100644 apps/fixtures/serialization-modes/app.config.ts create mode 100644 apps/fixtures/serialization-modes/package.json create mode 100644 apps/fixtures/serialization-modes/public/favicon.ico create mode 100644 apps/fixtures/serialization-modes/src/app.css create mode 100644 apps/fixtures/serialization-modes/src/app.tsx create mode 100644 apps/fixtures/serialization-modes/src/components/Counter.css create mode 100644 apps/fixtures/serialization-modes/src/components/Counter.tsx create mode 100644 apps/fixtures/serialization-modes/src/entry-client.tsx create mode 100644 apps/fixtures/serialization-modes/src/entry-server.tsx create mode 100644 apps/fixtures/serialization-modes/src/global.d.ts create mode 100644 apps/fixtures/serialization-modes/src/middleware.ts create mode 100644 apps/fixtures/serialization-modes/src/routes/[...404].tsx create mode 100644 apps/fixtures/serialization-modes/src/routes/about.tsx create mode 100644 apps/fixtures/serialization-modes/src/routes/index.tsx create mode 100644 apps/fixtures/serialization-modes/tsconfig.json create mode 100644 apps/tests/src/middleware.ts create mode 100644 apps/tests/src/routes/actions/use-submission.tsx diff --git a/apps/fixtures/serialization-modes/README.md b/apps/fixtures/serialization-modes/README.md new file mode 100644 index 000000000..5d4d4b9a2 --- /dev/null +++ b/apps/fixtures/serialization-modes/README.md @@ -0,0 +1,19 @@ +# Serialization checks + +this fixture is designed to point out the differences between Seroval 2 modes. + +```ts +export default defineConfig({ + middleware: "./src/middleware.ts", + serialization: { + mode: "js" // "json" + } +}); +``` + +On JS mode, seroval will use a custom serializer, while this improves performance and reduces payload size, it runs an `eval()` on client-side, +so a strict CSP will block deserialization. On JSON mode, the payload will be slightly larger, but deserialization happens via `JSON.parse` and thus CSP will not block it. + +> [!IMPORTANT] +> For backwards compatibility, `v1` has "js" as the default. +> On `v2`, "json" is the new default. diff --git a/apps/fixtures/serialization-modes/app.config.ts b/apps/fixtures/serialization-modes/app.config.ts new file mode 100644 index 000000000..313ebbb2d --- /dev/null +++ b/apps/fixtures/serialization-modes/app.config.ts @@ -0,0 +1,8 @@ +import { defineConfig } from "@solidjs/start/config"; + +export default defineConfig({ + middleware: "./src/middleware.ts", + serialization: { + mode: "js" + } +}); diff --git a/apps/fixtures/serialization-modes/package.json b/apps/fixtures/serialization-modes/package.json new file mode 100644 index 000000000..dba9fe8af --- /dev/null +++ b/apps/fixtures/serialization-modes/package.json @@ -0,0 +1,21 @@ +{ + "name": "fixture-csp-strong", + "type": "module", + "scripts": { + "dev": "vinxi dev", + "build": "vinxi build", + "start": "vinxi start", + "version": "vinxi version" + }, + "dependencies": { + "@solidjs/meta": "^0.29.4", + "@solidjs/router": "^0.15.0", + "@solidjs/start": "workspace:*", + "shieldwall": "^0.4.0", + "solid-js": "^1.9.5", + "vinxi": "^0.5.7" + }, + "engines": { + "node": ">=22" + } +} diff --git a/apps/fixtures/serialization-modes/public/favicon.ico b/apps/fixtures/serialization-modes/public/favicon.ico new file mode 100644 index 0000000000000000000000000000000000000000..fb282da0719ef6ab4c1732df93be6216b0d85520 GIT binary patch literal 664 zcmV;J0%!e+P)m9ebk1R zejT~~6f_`?;`cEd!+`7(hw@%%2;?RN8gX-L?z6cM( zKoG@&w+0}f@Pfvwc+deid)qgE!L$ENKYjViZC_Zcr>L(`2oXUT8f0mRQ(6-=HN_Ai zeBBEz3WP+1Cw`m!49Wf!MnZzp5bH8VkR~BcJ1s-j90TAS2Yo4j!J|KodxYR%3Numw zA?gq6e`5@!W~F$_De3yt&uspo&2yLb$(NwcPPI-4LGc!}HdY%jfq@AFs8LiZ4k(p} zZ!c9o+qbWYs-Mg zgdyTALzJX&7QXHdI_DPTFL33;w}88{e6Zk)MX0kN{3DX9uz#O_L58&XRH$Nvvu;fO zf&)7@?C~$z1K<>j0ga$$MIg+5xN;eQ?1-CA=`^Y169@Ab6!vcaNP=hxfKN%@Ly^R* zK1iv*s1Yl6_dVyz8>ZqYhz6J4|3fQ@2LQeX@^%W(B~8>=MoEmBEGGD1;gHXlpX>!W ym)!leA2L@`cpb^hy)P75=I!`pBYxP7<2VfQ3j76qLgzIA0000 ( + + SolidStart - Basic + Index + About + {props.children} + + )} + > + + + ); +} diff --git a/apps/fixtures/serialization-modes/src/components/Counter.css b/apps/fixtures/serialization-modes/src/components/Counter.css new file mode 100644 index 000000000..220e17946 --- /dev/null +++ b/apps/fixtures/serialization-modes/src/components/Counter.css @@ -0,0 +1,21 @@ +.increment { + font-family: inherit; + font-size: inherit; + padding: 1em 2em; + color: #335d92; + background-color: rgba(68, 107, 158, 0.1); + border-radius: 2em; + border: 2px solid rgba(68, 107, 158, 0); + outline: none; + width: 200px; + font-variant-numeric: tabular-nums; + cursor: pointer; +} + +.increment:focus { + border: 2px solid #335d92; +} + +.increment:active { + background-color: rgba(68, 107, 158, 0.2); +} \ No newline at end of file diff --git a/apps/fixtures/serialization-modes/src/components/Counter.tsx b/apps/fixtures/serialization-modes/src/components/Counter.tsx new file mode 100644 index 000000000..091fc5d0b --- /dev/null +++ b/apps/fixtures/serialization-modes/src/components/Counter.tsx @@ -0,0 +1,11 @@ +import { createSignal } from "solid-js"; +import "./Counter.css"; + +export default function Counter() { + const [count, setCount] = createSignal(0); + return ( + + ); +} diff --git a/apps/fixtures/serialization-modes/src/entry-client.tsx b/apps/fixtures/serialization-modes/src/entry-client.tsx new file mode 100644 index 000000000..0ca4e3c30 --- /dev/null +++ b/apps/fixtures/serialization-modes/src/entry-client.tsx @@ -0,0 +1,4 @@ +// @refresh reload +import { mount, StartClient } from "@solidjs/start/client"; + +mount(() => , document.getElementById("app")!); diff --git a/apps/fixtures/serialization-modes/src/entry-server.tsx b/apps/fixtures/serialization-modes/src/entry-server.tsx new file mode 100644 index 000000000..401eff83f --- /dev/null +++ b/apps/fixtures/serialization-modes/src/entry-server.tsx @@ -0,0 +1,21 @@ +// @refresh reload +import { createHandler, StartServer } from "@solidjs/start/server"; + +export default createHandler(() => ( + ( + + + + + + {assets} + + +
{children}
+ {scripts} + + + )} + /> +)); diff --git a/apps/fixtures/serialization-modes/src/global.d.ts b/apps/fixtures/serialization-modes/src/global.d.ts new file mode 100644 index 000000000..dc6f10c22 --- /dev/null +++ b/apps/fixtures/serialization-modes/src/global.d.ts @@ -0,0 +1 @@ +/// diff --git a/apps/fixtures/serialization-modes/src/middleware.ts b/apps/fixtures/serialization-modes/src/middleware.ts new file mode 100644 index 000000000..b00d186a8 --- /dev/null +++ b/apps/fixtures/serialization-modes/src/middleware.ts @@ -0,0 +1,26 @@ +import { createMiddleware } from "@solidjs/start/middleware"; +import { csp } from "shieldwall/start"; +import { UNSAFE_INLINE } from "shieldwall/start/csp"; + +export default createMiddleware({ + onRequest: [ + csp({ + extend: "production_basic", + config: { + withNonce: false, + reportOnly: false, + value: { + "default-src": ["self"], + "script-src": ["self", UNSAFE_INLINE, "http:"], + "style-src": ["self", UNSAFE_INLINE], + "img-src": ["self", "data:", "https:", "http:"], + "font-src": ["self"], + "connect-src": ["self", "ws://localhost:*", "http://localhost:*"], + "frame-src": ["self"], + "base-uri": ["self"] + // "form-action": ["self"] + } + } + }) + ] +}); diff --git a/apps/fixtures/serialization-modes/src/routes/[...404].tsx b/apps/fixtures/serialization-modes/src/routes/[...404].tsx new file mode 100644 index 000000000..4ea71ec7f --- /dev/null +++ b/apps/fixtures/serialization-modes/src/routes/[...404].tsx @@ -0,0 +1,19 @@ +import { Title } from "@solidjs/meta"; +import { HttpStatusCode } from "@solidjs/start"; + +export default function NotFound() { + return ( +
+ Not Found + +

Page Not Found

+

+ Visit{" "} + + start.solidjs.com + {" "} + to learn how to build SolidStart apps. +

+
+ ); +} diff --git a/apps/fixtures/serialization-modes/src/routes/about.tsx b/apps/fixtures/serialization-modes/src/routes/about.tsx new file mode 100644 index 000000000..c1c2dcf5a --- /dev/null +++ b/apps/fixtures/serialization-modes/src/routes/about.tsx @@ -0,0 +1,10 @@ +import { Title } from "@solidjs/meta"; + +export default function About() { + return ( +
+ About +

About

+
+ ); +} diff --git a/apps/fixtures/serialization-modes/src/routes/index.tsx b/apps/fixtures/serialization-modes/src/routes/index.tsx new file mode 100644 index 000000000..906827c0d --- /dev/null +++ b/apps/fixtures/serialization-modes/src/routes/index.tsx @@ -0,0 +1,49 @@ +import { Title } from "@solidjs/meta"; +import { createEffect } from "solid-js"; +import Counter from "~/components/Counter"; + +// const getDate = action(async () => { +// "use server"; + +// console.log("Page query executed"); + +// return new Date(); +// }, "date"); + +const breakval = () => { + "use server"; + + return new Date(); +}; + +export default function Home() { + createEffect(() => { + console.log(breakval()); + }); + + // setTimeout(() => { + // eval("console.log('This should not execute')"); + // }, 3000); + return ( +
+ Hello World +

Hello world!

+ + {/*
+ +
+ + Loading...

}> +

Current date: {String(data())}

+ + */} +

+ Visit{" "} + + start.solidjs.com + {" "} + to learn how to build SolidStart apps. +

+
+ ); +} diff --git a/apps/fixtures/serialization-modes/tsconfig.json b/apps/fixtures/serialization-modes/tsconfig.json new file mode 100644 index 000000000..7d5871a07 --- /dev/null +++ b/apps/fixtures/serialization-modes/tsconfig.json @@ -0,0 +1,19 @@ +{ + "compilerOptions": { + "target": "ESNext", + "module": "ESNext", + "moduleResolution": "bundler", + "allowSyntheticDefaultImports": true, + "esModuleInterop": true, + "jsx": "preserve", + "jsxImportSource": "solid-js", + "allowJs": true, + "strict": true, + "noEmit": true, + "types": ["vinxi/types/client"], + "isolatedModules": true, + "paths": { + "~/*": ["./src/*"] + } + } +} diff --git a/apps/tests/src/middleware.ts b/apps/tests/src/middleware.ts new file mode 100644 index 000000000..31554158e --- /dev/null +++ b/apps/tests/src/middleware.ts @@ -0,0 +1,27 @@ +import { createMiddleware } from "@solidjs/start/middleware"; +import { csp, csrf, securityHeaders } from "shieldwall/start"; + +export default createMiddleware({ + onRequest: [ + csrf, + securityHeaders(), + csp({ + extend: "production_basic", + config: { + withNonce: true, + reportOnly: true, + value: { + "default-src": ["self"], + "script-src": ["self"], + "style-src": ["self"], + "img-src": ["self", "data:", "https:"], + "font-src": ["self"], + "connect-src": ["self", "ws://localhost:3000"], + "frame-src": ["self"], + "base-uri": ["self"], + "form-action": ["self"] + } + } + }) + ] +}); diff --git a/apps/tests/src/routes/actions/use-submission.tsx b/apps/tests/src/routes/actions/use-submission.tsx new file mode 100644 index 000000000..0a0591608 --- /dev/null +++ b/apps/tests/src/routes/actions/use-submission.tsx @@ -0,0 +1,35 @@ +import { Title } from "@solidjs/meta"; +import { action, useSubmission } from "@solidjs/router"; +import { Show } from "solid-js"; + +const TEXT = ` +Roses are red, +Violets are blue, +SolidStart is shiny, +And so are you. + +Code flows like rivers, +Logic sings in rhyme, +Building with passion, +One commit at a time. +`; + +const actionStuff = action(async () => { + "use server"; + + return "Hello world!"; +}, "actionStuff"); + +export default function Home() { + const actionData = useSubmission(actionStuff); + return ( +
+ Hello World +
+ +
+ + {result =>

{result().result}

} +
+ ); +} diff --git a/packages/start/config/index.d.ts b/packages/start/config/index.d.ts index 7b00c1814..fa4d634ce 100644 --- a/packages/start/config/index.d.ts +++ b/packages/start/config/index.d.ts @@ -27,9 +27,16 @@ type SolidStartInlineConfig = { islands?: boolean; }; serialization?: { - // This only matters for server function responses - mode?: 'js' | 'json'; - } + /** + * The serialization mode to use for server functions. + * The "js" mode uses a custom binary format that is more efficient than JSON, but requires a custom deserializer (with `eval()`) on the client. + * The "json" mode uses JSON for serialization, which is less efficient but can be deserialized with `JSON.parse` on the client. + * + * @default "js" + * @warning on v2, "json" will be the default. + */ + mode?: "js" | "json"; + }; vite?: | ViteCustomizableConfig | ((options: { router: "server" | "client" | "server-function" }) => ViteCustomizableConfig); diff --git a/packages/start/config/index.js b/packages/start/config/index.js index de76a5784..afc40039e 100644 --- a/packages/start/config/index.js +++ b/packages/start/config/index.js @@ -89,6 +89,7 @@ export function defineConfig(baseConfig = {}) { } } }); + const routeDir = join(start.appRoot, start.routeDir); let server = start.server; if (!start.ssr) { @@ -99,6 +100,8 @@ export function defineConfig(baseConfig = {}) { entryExtension = ".jsx"; } + const serializationMode = start.serialization?.mode || 'js' + return createApp({ server: { compressPublicAssets: { @@ -167,7 +170,7 @@ export function defineConfig(baseConfig = {}) { "import.meta.env.SSR": JSON.stringify(true), "import.meta.env.START_SSR": JSON.stringify(start.ssr), "import.meta.env.START_DEV_OVERLAY": JSON.stringify(start.devOverlay), - "import.meta.env.SEROVAL_MODE": JSON.stringify(start.serialization?.mode || 'json'), + "import.meta.env.SEROVAL_MODE": JSON.stringify(serializationMode), ...userConfig.define } }) @@ -235,7 +238,7 @@ export function defineConfig(baseConfig = {}) { "import.meta.env.START_SSR": JSON.stringify(start.ssr), "import.meta.env.START_DEV_OVERLAY": JSON.stringify(start.devOverlay), "import.meta.env.SERVER_BASE_URL": JSON.stringify(server?.baseURL ?? ""), - "import.meta.env.SEROVAL_MODE": JSON.stringify(start.serialization?.mode || 'json'), + "import.meta.env.SEROVAL_MODE": JSON.stringify(serializationMode), ...userConfig.define } }) @@ -295,7 +298,7 @@ export function defineConfig(baseConfig = {}) { "import.meta.env.SSR": JSON.stringify(true), "import.meta.env.START_SSR": JSON.stringify(start.ssr), "import.meta.env.START_DEV_OVERLAY": JSON.stringify(start.devOverlay), - "import.meta.env.SEROVAL_MODE": JSON.stringify(start.serialization?.mode || 'json'), + "import.meta.env.SEROVAL_MODE": JSON.stringify(serializationMode), ...userConfig.define } }) diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index f17d8a90b..8e93bea21 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -29,6 +29,132 @@ importers: apps/fixtures: {} + apps/fixtures/bare: + dependencies: + '@solidjs/start': + specifier: ^1.1.0 + version: 1.2.1(@testing-library/jest-dom@6.8.0)(solid-js@1.9.9)(vinxi@0.5.8(@types/node@25.0.3)(db0@0.3.2)(ioredis@5.7.0)(jiti@2.6.0)(terser@5.44.1)(yaml@2.8.1))(vite@6.3.6(@types/node@25.0.3)(jiti@2.6.0)(terser@5.44.1)(yaml@2.8.1)) + solid-js: + specifier: ^1.9.5 + version: 1.9.9 + vinxi: + specifier: ^0.5.7 + version: 0.5.8(@types/node@25.0.3)(db0@0.3.2)(ioredis@5.7.0)(jiti@2.6.0)(terser@5.44.1)(yaml@2.8.1) + + apps/fixtures/basic: + dependencies: + '@solidjs/meta': + specifier: ^0.29.4 + version: 0.29.4(solid-js@1.9.9) + '@solidjs/router': + specifier: ^0.15.0 + version: 0.15.3(solid-js@1.9.9) + '@solidjs/start': + specifier: ^1.1.0 + version: 1.2.1(@testing-library/jest-dom@6.8.0)(solid-js@1.9.9)(vinxi@0.5.8(@types/node@25.0.3)(db0@0.3.2)(ioredis@5.7.0)(jiti@2.6.0)(terser@5.44.1)(yaml@2.8.1))(vite@6.3.6(@types/node@25.0.3)(jiti@2.6.0)(terser@5.44.1)(yaml@2.8.1)) + solid-js: + specifier: ^1.9.5 + version: 1.9.9 + vinxi: + specifier: ^0.5.7 + version: 0.5.8(@types/node@25.0.3)(db0@0.3.2)(ioredis@5.7.0)(jiti@2.6.0)(terser@5.44.1)(yaml@2.8.1) + + apps/fixtures/experiments: + dependencies: + '@solidjs/meta': + specifier: ^0.29.4 + version: 0.29.4(solid-js@1.9.9) + '@solidjs/router': + specifier: ^0.15.0 + version: 0.15.3(solid-js@1.9.9) + '@solidjs/start': + specifier: ^1.1.0 + version: 1.2.1(@testing-library/jest-dom@6.8.0)(solid-js@1.9.9)(vinxi@0.5.8(@types/node@25.0.3)(db0@0.3.2)(ioredis@5.7.0)(jiti@2.6.0)(terser@5.44.1)(yaml@2.8.1))(vite@6.3.6(@types/node@25.0.3)(jiti@2.6.0)(terser@5.44.1)(yaml@2.8.1)) + solid-js: + specifier: ^1.9.5 + version: 1.9.9 + vinxi: + specifier: ^0.5.7 + version: 0.5.8(@types/node@25.0.3)(db0@0.3.2)(ioredis@5.7.0)(jiti@2.6.0)(terser@5.44.1)(yaml@2.8.1) + + apps/fixtures/hackernews: + dependencies: + '@solidjs/router': + specifier: ^0.15.0 + version: 0.15.3(solid-js@1.9.9) + '@solidjs/start': + specifier: ^1.1.0 + version: 1.2.1(@testing-library/jest-dom@6.8.0)(solid-js@1.9.9)(vinxi@0.5.8(@types/node@25.0.3)(db0@0.3.2)(ioredis@5.7.0)(jiti@2.6.0)(terser@5.44.1)(yaml@2.8.1))(vite@6.3.6(@types/node@25.0.3)(jiti@2.6.0)(terser@5.44.1)(yaml@2.8.1)) + solid-js: + specifier: ^1.9.5 + version: 1.9.9 + vinxi: + specifier: ^0.5.7 + version: 0.5.8(@types/node@25.0.3)(db0@0.3.2)(ioredis@5.7.0)(jiti@2.6.0)(terser@5.44.1)(yaml@2.8.1) + + apps/fixtures/notes: + dependencies: + '@solidjs/router': + specifier: ^0.15.0 + version: 0.15.3(solid-js@1.9.9) + '@solidjs/start': + specifier: ^1.1.0 + version: 1.2.1(@testing-library/jest-dom@6.8.0)(solid-js@1.9.9)(vinxi@0.5.8(@types/node@25.0.3)(db0@0.3.2)(ioredis@5.7.0)(jiti@2.6.0)(terser@5.44.1)(yaml@2.8.1))(vite@6.3.6(@types/node@25.0.3)(jiti@2.6.0)(terser@5.44.1)(yaml@2.8.1)) + date-fns: + specifier: ^3.6.0 + version: 3.6.0 + marked: + specifier: ^12.0.1 + version: 12.0.2 + solid-js: + specifier: ^1.9.5 + version: 1.9.9 + unstorage: + specifier: 1.10.2 + version: 1.10.2(ioredis@5.7.0) + vinxi: + specifier: ^0.5.7 + version: 0.5.8(@types/node@25.0.3)(db0@0.3.2)(ioredis@5.7.0)(jiti@2.6.0)(terser@5.44.1)(yaml@2.8.1) + + apps/fixtures/serialization-modes: + dependencies: + '@solidjs/meta': + specifier: ^0.29.4 + version: 0.29.4(solid-js@1.9.9) + '@solidjs/router': + specifier: ^0.15.0 + version: 0.15.3(solid-js@1.9.9) + '@solidjs/start': + specifier: workspace:* + version: link:../../../packages/start + shieldwall: + specifier: ^0.4.0 + version: 0.4.0(@solidjs/start@packages+start) + solid-js: + specifier: ^1.9.5 + version: 1.9.9 + vinxi: + specifier: ^0.5.7 + version: 0.5.8(@types/node@25.0.3)(db0@0.3.2)(ioredis@5.7.0)(jiti@2.6.0)(terser@5.44.1)(yaml@2.8.1) + + apps/fixtures/todomvc: + dependencies: + '@solidjs/router': + specifier: ^0.15.0 + version: 0.15.3(solid-js@1.9.9) + '@solidjs/start': + specifier: ^1.1.0 + version: 1.2.1(@testing-library/jest-dom@6.8.0)(solid-js@1.9.9)(vinxi@0.5.8(@types/node@25.0.3)(db0@0.3.2)(ioredis@5.7.0)(jiti@2.6.0)(terser@5.44.1)(yaml@2.8.1))(vite@6.3.6(@types/node@25.0.3)(jiti@2.6.0)(terser@5.44.1)(yaml@2.8.1)) + solid-js: + specifier: ^1.9.5 + version: 1.9.9 + unstorage: + specifier: 1.10.2 + version: 1.10.2(ioredis@5.7.0) + vinxi: + specifier: ^0.5.7 + version: 0.5.8(@types/node@25.0.3)(db0@0.3.2)(ioredis@5.7.0)(jiti@2.6.0)(terser@5.44.1)(yaml@2.8.1) + apps/landing-page: dependencies: '@solidjs/meta': @@ -1568,6 +1694,11 @@ packages: peerDependencies: solid-js: ^1.8.6 + '@solidjs/start@1.2.1': + resolution: {integrity: sha512-O5E7rcCwm2f8GlXKgS2xnU37Ld5vMVXJgo/qR7UI5iR5uFo9V2Ac+SSVNXkM98CeHKHt55h1UjbpxxTANEsHmA==} + peerDependencies: + vinxi: ^0.5.7 + '@solidjs/testing-library@0.8.10': resolution: {integrity: sha512-qdeuIerwyq7oQTIrrKvV0aL9aFeuwTd86VYD3afdq5HYEwoox1OBTJy4y8A3TFZr8oAR0nujYgCzY/8wgHGfeQ==} engines: {node: '>= 14'} @@ -2400,6 +2531,10 @@ packages: crossws@0.3.5: resolution: {integrity: sha512-ojKiDvcmByhwa8YYqbQI/hg7MEU0NC03+pSdEq4ZUnZR9xXpwk7E43SMNGkn+JxJGPFtNvQ48+vV2p+P1ml5PA==} + csp-header@5.2.1: + resolution: {integrity: sha512-qOJNu39JZkPrbrAM40a1tQCePEPYVIoI6nMDhX4RA07QjU8efS+zyd/zE83XJu85KKazH9NjKlvvlswFMteMgg==} + engines: {node: '>=10'} + css.escape@1.5.1: resolution: {integrity: sha512-YUifsXXuknHlUsmlgyY0PKzgPOr7/FjCePfHNt0jxm83wHZi44VDMQ7/fGNkjY3/jV1MC+1CmZbaHzugyeRtpg==} @@ -2436,8 +2571,12 @@ packages: resolution: {integrity: sha512-ZYP5VBHshaDAiVZxjbRVcFJpc+4xGgT0bK3vzy1HLN8jTO975HEbuYzZJcHoQEY5K1a0z8YayJkyVETa08eNTg==} engines: {node: '>=18'} + date-fns@3.6.0: + resolution: {integrity: sha512-fRHTG8g/Gif+kSh50gaGEdToemgfj74aRX3swtiouboip5JDLAyDE9F11nHMIcvOaXeOC6D7SpNhi7uFyB7Uww==} + dax-sh@0.43.2: resolution: {integrity: sha512-uULa1sSIHgXKGCqJ/pA0zsnzbHlVnuq7g8O2fkHokWFNwEGIhh5lAJlxZa1POG5En5ba7AU4KcBAvGQWMMf8rg==} + deprecated: This package has moved to simply be 'dax' instead of 'dax-sh' dayjs@1.11.13: resolution: {integrity: sha512-oaMBel6gjolK862uaPQOVTA7q3TZhuSvuMQAAglQDOWYO9A91IrAOUJEyKVlqJlHE0vq5p5UXxzdPfMH/x6xNg==} @@ -2962,11 +3101,12 @@ packages: glob@10.4.5: resolution: {integrity: sha512-7Bv8RF0k6xjo7d4A/PxYLbUCfb6c+Vpd2/mB2yRDlew7Jb5hEXiCD9ibfO7wpk8i4sevK6DFny9h7EYbM3/sHg==} + deprecated: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me hasBin: true glob@7.2.3: resolution: {integrity: sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q==} - deprecated: Glob versions prior to v9 are no longer supported + deprecated: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me global-dirs@3.0.1: resolution: {integrity: sha512-NBcGGFbBA9s1VzD41QXDG+3++t9Mn5t1FpLdhESY6oKY4gYTFpX4wO3sqGUa0Srjtbfj3szX0RnemmrVRUdULA==} @@ -3452,6 +3592,11 @@ packages: resolution: {integrity: sha512-hXdUTZYIVOt1Ex//jAQi+wTZZpUpwBj/0QsOzqegb3rGMMeJiSEu5xLHnYfBrRV4RH2+OCSOO95Is/7x1WJ4bw==} engines: {node: '>=10'} + marked@12.0.2: + resolution: {integrity: sha512-qXUm7e/YKFoqFPYPa3Ukg9xlI5cyAtGmyEIzMfW//m6kXwCy2Ps9DYf5ioijFKQ8qyuscrHoY04iJGctu2Kg0Q==} + engines: {node: '>= 18'} + hasBin: true + math-intrinsics@1.1.0: resolution: {integrity: sha512-/IXtbwEk5HTPyEwyKX6hGkYXxM9nbj64B+ilVJnC/R6B0pH5G4V3b0pVbL7DBj4tkhBAppbQUlf6F6Xl9LHu1g==} engines: {node: '>= 0.4'} @@ -4196,6 +4341,11 @@ packages: resolution: {integrity: sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A==} engines: {node: '>=8'} + shieldwall@0.4.0: + resolution: {integrity: sha512-3IO6SxrRUlL7BGWnfhdACnuG8bqa+kKzSgtuW0daZpdF9iGoEW9EroY2djuP1AjY/R3SCbql6xCJ1CtX+GDMRw==} + peerDependencies: + '@solidjs/start': ^1.1.1 + shiki@1.29.2: resolution: {integrity: sha512-njXuliz/cP+67jU2hukkxCNuH1yUi4QfdZZY+sMr5PPrIyXSu5iTb/qYC4BiWWB0vZ+7TbdvYUCeL23zpwCfbg==} @@ -4442,6 +4592,7 @@ packages: tar@7.4.4: resolution: {integrity: sha512-O1z7ajPkjTgEgmTGz0v9X4eqeEXTDREPTO77pVC1Nbs86feBU1Zhdg+edzavPmYW1olxkwsqA2v4uOw6E8LeDg==} engines: {node: '>=18'} + deprecated: Old versions of tar are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me term-size@2.2.1: resolution: {integrity: sha512-wK0Ri4fOGjv/XPy8SBHZChl8CM7uMc5VML7SqiQ0zG7+J5Vr+RMQDoHa2CNT6KHUnTGIXH34UDMkPzAUyapBZg==} @@ -4689,6 +4840,50 @@ packages: resolution: {integrity: sha512-6NCPkv1ClwH+/BGE9QeoTIl09nuiAt0gS28nn1PvYXsGKRwM2TCbFA2QiilmehPDTXIe684k4rZI1yl3A1PCUw==} engines: {node: '>=18.12.0'} + unstorage@1.10.2: + resolution: {integrity: sha512-cULBcwDqrS8UhlIysUJs2Dk0Mmt8h7B0E6mtR+relW9nZvsf/u4SkAYyNliPiPW7XtFNb5u3IUMkxGxFTTRTgQ==} + peerDependencies: + '@azure/app-configuration': ^1.5.0 + '@azure/cosmos': ^4.0.0 + '@azure/data-tables': ^13.2.2 + '@azure/identity': ^4.0.1 + '@azure/keyvault-secrets': ^4.8.0 + '@azure/storage-blob': ^12.17.0 + '@capacitor/preferences': ^5.0.7 + '@netlify/blobs': ^6.5.0 || ^7.0.0 + '@planetscale/database': ^1.16.0 + '@upstash/redis': ^1.28.4 + '@vercel/kv': ^1.0.1 + idb-keyval: ^6.2.1 + ioredis: ^5.3.2 + peerDependenciesMeta: + '@azure/app-configuration': + optional: true + '@azure/cosmos': + optional: true + '@azure/data-tables': + optional: true + '@azure/identity': + optional: true + '@azure/keyvault-secrets': + optional: true + '@azure/storage-blob': + optional: true + '@capacitor/preferences': + optional: true + '@netlify/blobs': + optional: true + '@planetscale/database': + optional: true + '@upstash/redis': + optional: true + '@vercel/kv': + optional: true + idb-keyval: + optional: true + ioredis: + optional: true + unstorage@1.17.1: resolution: {integrity: sha512-KKGwRTT0iVBCErKemkJCLs7JdxNVfqTPc/85ae1XES0+bsHbc/sFBfVi5kJp156cc51BHinIH2l3k0EZ24vOBQ==} peerDependencies: @@ -4931,6 +5126,7 @@ packages: whatwg-encoding@3.1.1: resolution: {integrity: sha512-6qN4hJdMwfYBtE3YBTTHhoeuUrDBPZmbQaxWAqSALV/MeEnR5z1xd8UKud2RAkFoPkmB+hli1TZSnyi84xz1vQ==} engines: {node: '>=18'} + deprecated: Use @exodus/bytes instead for a more spec-conformant and faster implementation whatwg-mimetype@4.0.0: resolution: {integrity: sha512-QaKxh0eNIi2mE9p2vEdzfagOKHCcj1pJ56EEHGQOVxp8r9/iszLUUV7v89x9O1p/T+NlTM5W7jW6+cz4Fq1YVg==} @@ -6647,6 +6843,30 @@ snapshots: dependencies: solid-js: 1.9.9 + '@solidjs/start@1.2.1(@testing-library/jest-dom@6.8.0)(solid-js@1.9.9)(vinxi@0.5.8(@types/node@25.0.3)(db0@0.3.2)(ioredis@5.7.0)(jiti@2.6.0)(terser@5.44.1)(yaml@2.8.1))(vite@6.3.6(@types/node@25.0.3)(jiti@2.6.0)(terser@5.44.1)(yaml@2.8.1))': + dependencies: + '@tanstack/server-functions-plugin': 1.121.21(vite@6.3.6(@types/node@25.0.3)(jiti@2.6.0)(terser@5.44.1)(yaml@2.8.1)) + '@vinxi/plugin-directives': 0.5.1(vinxi@0.5.8(@types/node@25.0.3)(db0@0.3.2)(ioredis@5.7.0)(jiti@2.6.0)(terser@5.44.1)(yaml@2.8.1)) + '@vinxi/server-components': 0.5.1(vinxi@0.5.8(@types/node@25.0.3)(db0@0.3.2)(ioredis@5.7.0)(jiti@2.6.0)(terser@5.44.1)(yaml@2.8.1)) + cookie-es: 2.0.0 + defu: 6.1.4 + error-stack-parser: 2.1.4 + html-to-image: 1.11.13 + radix3: 1.1.2 + seroval: 1.4.1 + seroval-plugins: 1.4.0(seroval@1.4.1) + shiki: 1.29.2 + source-map-js: 1.2.1 + terracotta: 1.0.6(solid-js@1.9.9) + tinyglobby: 0.2.15 + vinxi: 0.5.8(@types/node@25.0.3)(db0@0.3.2)(ioredis@5.7.0)(jiti@2.6.0)(terser@5.44.1)(yaml@2.8.1) + vite-plugin-solid: 2.11.8(@testing-library/jest-dom@6.8.0)(solid-js@1.9.9)(vite@6.3.6(@types/node@25.0.3)(jiti@2.6.0)(terser@5.44.1)(yaml@2.8.1)) + transitivePeerDependencies: + - '@testing-library/jest-dom' + - solid-js + - supports-color + - vite + '@solidjs/testing-library@0.8.10(@solidjs/router@0.15.3(solid-js@1.9.9))(solid-js@1.9.9)': dependencies: '@testing-library/dom': 10.4.1 @@ -6836,7 +7056,7 @@ snapshots: consola: 3.4.2 defu: 6.1.4 get-port-please: 3.2.0 - h3: 1.15.3 + h3: 1.15.4 http-shutdown: 1.2.2 jiti: 1.21.7 mlly: 1.8.0 @@ -7588,6 +7808,8 @@ snapshots: dependencies: uncrypto: 0.1.3 + csp-header@5.2.1: {} + css.escape@1.5.1: {} cssesc@3.0.0: {} @@ -7667,6 +7889,8 @@ snapshots: whatwg-mimetype: 4.0.0 whatwg-url: 14.2.0 + date-fns@3.6.0: {} + dax-sh@0.43.2: dependencies: '@deno/shim-deno': 0.19.2 @@ -8671,6 +8895,8 @@ snapshots: dependencies: semver: 7.7.2 + marked@12.0.2: {} + math-intrinsics@1.1.0: {} mdast-util-to-hast@13.2.0: @@ -9508,6 +9734,12 @@ snapshots: shebang-regex@3.0.0: {} + shieldwall@0.4.0(@solidjs/start@packages+start): + dependencies: + '@solidjs/start': link:packages/start + csp-header: 5.2.1 + h3: 1.15.4 + shiki@1.29.2: dependencies: '@shikijs/core': 1.29.2 @@ -10051,6 +10283,21 @@ snapshots: picomatch: 4.0.3 webpack-virtual-modules: 0.6.2 + unstorage@1.10.2(ioredis@5.7.0): + dependencies: + anymatch: 3.1.3 + chokidar: 3.6.0 + destr: 2.0.5 + h3: 1.15.4 + listhen: 1.9.0 + lru-cache: 10.4.3 + mri: 1.2.0 + node-fetch-native: 1.6.7 + ofetch: 1.4.1 + ufo: 1.6.1 + optionalDependencies: + ioredis: 5.7.0 + unstorage@1.17.1(db0@0.3.2)(ioredis@5.7.0): dependencies: anymatch: 3.1.3 diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index a52b018da..0202392bf 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -1,11 +1,12 @@ packages: - packages/* - apps/* - - '!**/.tmp/**' + - apps/fixtures/* + - "!**/.tmp/**" ignoredBuiltDependencies: - - '@prisma/client' - - '@prisma/engines' + - "@prisma/client" + - "@prisma/engines" - better-sqlite3 - msw - prisma From 34376124f40976d35d95771f13fdfed2079604a5 Mon Sep 17 00:00:00 2001 From: Atila Fassina Date: Sat, 21 Feb 2026 11:01:48 +0100 Subject: [PATCH 2/7] update the JSDoc description to include CSP --- packages/start/config/index.d.ts | 2 ++ 1 file changed, 2 insertions(+) diff --git a/packages/start/config/index.d.ts b/packages/start/config/index.d.ts index fa4d634ce..bb1613f64 100644 --- a/packages/start/config/index.d.ts +++ b/packages/start/config/index.d.ts @@ -30,9 +30,11 @@ type SolidStartInlineConfig = { /** * The serialization mode to use for server functions. * The "js" mode uses a custom binary format that is more efficient than JSON, but requires a custom deserializer (with `eval()`) on the client. + * A strong CSP should block `eval()` executions, which would prevent the "js" mode from working. * The "json" mode uses JSON for serialization, which is less efficient but can be deserialized with `JSON.parse` on the client. * * @default "js" + * @ * @warning on v2, "json" will be the default. */ mode?: "js" | "json"; From 8137b52a1814809dc9928926568ad2f6e2e04c11 Mon Sep 17 00:00:00 2001 From: Atila Fassina Date: Sat, 21 Feb 2026 11:16:38 +0100 Subject: [PATCH 3/7] fix package name Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> --- apps/fixtures/serialization-modes/package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apps/fixtures/serialization-modes/package.json b/apps/fixtures/serialization-modes/package.json index dba9fe8af..9ce41c5d5 100644 --- a/apps/fixtures/serialization-modes/package.json +++ b/apps/fixtures/serialization-modes/package.json @@ -1,5 +1,5 @@ { - "name": "fixture-csp-strong", + "name": "fixture-serialization-modes", "type": "module", "scripts": { "dev": "vinxi dev", From be9828c4803fa475f7de194928683c5031e744d9 Mon Sep 17 00:00:00 2001 From: Atila Fassina Date: Sat, 21 Feb 2026 11:17:04 +0100 Subject: [PATCH 4/7] remove middelware from e2e. It's not used. Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> --- apps/tests/src/middleware.ts | 24 +----------------------- 1 file changed, 1 insertion(+), 23 deletions(-) diff --git a/apps/tests/src/middleware.ts b/apps/tests/src/middleware.ts index 31554158e..ad8bab262 100644 --- a/apps/tests/src/middleware.ts +++ b/apps/tests/src/middleware.ts @@ -1,27 +1,5 @@ import { createMiddleware } from "@solidjs/start/middleware"; -import { csp, csrf, securityHeaders } from "shieldwall/start"; export default createMiddleware({ - onRequest: [ - csrf, - securityHeaders(), - csp({ - extend: "production_basic", - config: { - withNonce: true, - reportOnly: true, - value: { - "default-src": ["self"], - "script-src": ["self"], - "style-src": ["self"], - "img-src": ["self", "data:", "https:"], - "font-src": ["self"], - "connect-src": ["self", "ws://localhost:3000"], - "frame-src": ["self"], - "base-uri": ["self"], - "form-action": ["self"] - } - } - }) - ] + onRequest: [] }); From 209d950c56f423cff9fec3fbff9c953667427b4c Mon Sep 17 00:00:00 2001 From: Atila Fassina Date: Sat, 21 Feb 2026 11:17:13 +0100 Subject: [PATCH 5/7] typo Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> --- apps/fixtures/serialization-modes/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apps/fixtures/serialization-modes/README.md b/apps/fixtures/serialization-modes/README.md index 5d4d4b9a2..a117e56c4 100644 --- a/apps/fixtures/serialization-modes/README.md +++ b/apps/fixtures/serialization-modes/README.md @@ -1,6 +1,6 @@ # Serialization checks -this fixture is designed to point out the differences between Seroval 2 modes. +This fixture is designed to point out the differences between Seroval 2 modes. ```ts export default defineConfig({ From a67d8328bc48fe632b86c2a04608c6a4859d09fd Mon Sep 17 00:00:00 2001 From: Atila Fassina Date: Sat, 21 Feb 2026 11:18:08 +0100 Subject: [PATCH 6/7] remaining dead code... bye Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> --- apps/tests/src/routes/actions/use-submission.tsx | 12 ------------ 1 file changed, 12 deletions(-) diff --git a/apps/tests/src/routes/actions/use-submission.tsx b/apps/tests/src/routes/actions/use-submission.tsx index 0a0591608..e1cb69d3b 100644 --- a/apps/tests/src/routes/actions/use-submission.tsx +++ b/apps/tests/src/routes/actions/use-submission.tsx @@ -2,18 +2,6 @@ import { Title } from "@solidjs/meta"; import { action, useSubmission } from "@solidjs/router"; import { Show } from "solid-js"; -const TEXT = ` -Roses are red, -Violets are blue, -SolidStart is shiny, -And so are you. - -Code flows like rivers, -Logic sings in rhyme, -Building with passion, -One commit at a time. -`; - const actionStuff = action(async () => { "use server"; From 950405a1a315cf2cf7b6e31d9765981a29306d76 Mon Sep 17 00:00:00 2001 From: Atila Fassina Date: Sat, 21 Feb 2026 11:19:58 +0100 Subject: [PATCH 7/7] remove more useless code --- .../serialization-modes/src/routes/about.tsx | 10 ---------- .../serialization-modes/src/routes/index.tsx | 19 ------------------- 2 files changed, 29 deletions(-) delete mode 100644 apps/fixtures/serialization-modes/src/routes/about.tsx diff --git a/apps/fixtures/serialization-modes/src/routes/about.tsx b/apps/fixtures/serialization-modes/src/routes/about.tsx deleted file mode 100644 index c1c2dcf5a..000000000 --- a/apps/fixtures/serialization-modes/src/routes/about.tsx +++ /dev/null @@ -1,10 +0,0 @@ -import { Title } from "@solidjs/meta"; - -export default function About() { - return ( -
- About -

About

-
- ); -} diff --git a/apps/fixtures/serialization-modes/src/routes/index.tsx b/apps/fixtures/serialization-modes/src/routes/index.tsx index 906827c0d..a08ccf229 100644 --- a/apps/fixtures/serialization-modes/src/routes/index.tsx +++ b/apps/fixtures/serialization-modes/src/routes/index.tsx @@ -2,14 +2,6 @@ import { Title } from "@solidjs/meta"; import { createEffect } from "solid-js"; import Counter from "~/components/Counter"; -// const getDate = action(async () => { -// "use server"; - -// console.log("Page query executed"); - -// return new Date(); -// }, "date"); - const breakval = () => { "use server"; @@ -21,22 +13,11 @@ export default function Home() { console.log(breakval()); }); - // setTimeout(() => { - // eval("console.log('This should not execute')"); - // }, 3000); return (
Hello World

Hello world!

- {/*
- -
- - Loading...

}> -

Current date: {String(data())}

- - */}

Visit{" "}