Route path-addressed server function calls by ryansolid · Pull Request #332 · solidjs/solid-vite-plugin

ryansolid · 2026-08-27T08:31:48Z

Summary

Downstream adoption of solidjs/solid#3076: a server function call's address is now <endpoint>/<id> with arguments in the query, and the X-Server-Function-Id header and ?id= fallback left the wire.

Dev middleware (server-functions/index.ts): the endpoint gate matched the pathname exactly, so path-addressed calls fell through to SSR. It now matches by mount prefix (exact or endpoint + '/'), for both the base-prefixed and base-stripped forms. The module-preload function id comes from the path segment; the header and ?id= forms stay as fallbacks for a client runtime older than the addressing change.
Generated dispatch gate (ssr/index.ts): the emitted dispatchRequest composed server functions only at pathname === endpoint; it now prefix-matches the same way. A bare-mount request still routes to the runtime handler, which answers the 404 — a misaddressed post fails through the endpoint rather than rendering a page at it.

Draft until

@solidjs/web publishes the addressing change (anything newer than 2.0.0-rc.3). The plugin change is backward-compatible on its own — exact-match and the fallback id channels keep an older runtime working.

Test plan

Verified end-to-end against the fullstack-tanstack template with the solid next runtime linked in: GET-declared reads over /_server/<id> (GET returns data + default no-store, HEAD returns bodyless 200), undeclared reads gated (403/405), and the unscripted no-JS form POST flow (303 + flash cookie) all dispatch through the dev middleware.
Cypress example suite against the published @solidjs/web@2.0.0-rc.4 (dist-tag next), plus the full release gate: ssr 12/12 + boundary 8/8, css-matrix 82/82 + bridge 19/19, start-ssr 366/366 + http-bridge 10/10, start-client 45/45, start-env 47/47, vite-8 vitest 1/1, cypress 1/1. The ride commit moves the workspace catalog to ^2.0.0-rc.4 and switches the start-ssr suite's synthetic dispatches to the path form — rc.4's published handler resolves the id from the path alone, so the legacy ?id= shape it used no longer answers.

Companion PR: solidjs/solid-router#590.

Made with Cursor

solidjs/solid#3076 moved the function id into the path (`<endpoint>/<id>`), retiring the X-Server-Function-Id header and the `?id=` query fallback. The dev middleware and the generated dispatchRequest gate matched the endpoint pathname exactly, so the new addresses fell through to SSR; both now match by mount prefix (exact or `endpoint + '/'`). The dev middleware's module-preload id comes from the path segment, with the header and `?id=` forms kept as fallbacks for a client runtime older than the addressing change. Verified end-to-end against the fullstack-tanstack template with the solid `next` runtime linked in: GET-declared reads (GET and HEAD), 405/403 gating, and the unscripted no-JS form POST flow (303 + flash) all dispatch through the new addresses in dev. Co-authored-by: Cursor <cursoragent@cursor.com>

changeset-bot · 2026-08-27T08:31:52Z

🦋 Changeset detected

Latest commit: eaea1d4

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@solidjs/vite-plugin	Minor

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

pkg-pr-new · 2026-08-27T08:32:25Z

Open in StackBlitz

npm i https://pkg.pr.new/@solidjs/vite-plugin@332

commit: eaea1d4

…table Co-authored-by: Cursor <cursoragent@cursor.com>

ryansolid · 2026-08-27T08:44:16Z

Per review: the header/?id= fallbacks in the dev middleware are marked TRANSITIONAL and scoped to the RC window only — they get dropped before the 3.0 stable release. Path addressing is the only wire format from stable on.

rc.4 publishes the path-addressed server function calls this branch routes (solidjs/solid#3076): the client computes `<endpoint>/<id>` and the published server handler resolves the id from the path alone — the X-Server-Function-Id header and `?id=` forms are gone from the runtime, not just retired client-side. The workspace catalog moves to ^2.0.0-rc.4 (minimumReleaseAgeExclude extended per the existing pattern), and the start-ssr suite's synthetic dispatches switch from `?id=` to the path form, since the published handler no longer answers the legacy shape. The plugin's own transitional fallbacks stay: they serve runtimes older than the addressing change, which the peer range still admits. Full gate green against published rc.4 (no linking): ssr 12/12 + boundary 8/8, css-matrix 82/82 + bridge 19/19, start-ssr 366/366 + http-bridge 10/10, start-client 45/45, start-env 47/47, vite-8 vitest 1/1, cypress e2e 1/1. Co-authored-by: Cursor <cursoragent@cursor.com>

socket-security · 2026-08-28T21:59:26Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@solidjs/diagnostics@2.0.0-rc.4

View full report

socket-security · 2026-08-28T21:59:28Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Low adoption: npm `@solidjs/diagnostics` Location:Package overview From:package.json → `npm/@solidjs/diagnostics@2.0.0-rc.4` ℹ Read more on: This package \| This alert \| What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@solidjs/diagnostics@2.0.0-rc.4`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

ryansolid · 2026-08-27T08:31:48Z

Summary

Downstream adoption of solidjs/solid#3076: a server function call's address is now <endpoint>/<id> with arguments in the query, and the X-Server-Function-Id header and ?id= fallback left the wire.

Dev middleware (server-functions/index.ts): the endpoint gate matched the pathname exactly, so path-addressed calls fell through to SSR. It now matches by mount prefix (exact or endpoint + '/'), for both the base-prefixed and base-stripped forms. The module-preload function id comes from the path segment; the header and ?id= forms stay as fallbacks for a client runtime older than the addressing change.
Generated dispatch gate (ssr/index.ts): the emitted dispatchRequest composed server functions only at pathname === endpoint; it now prefix-matches the same way. A bare-mount request still routes to the runtime handler, which answers the 404 — a misaddressed post fails through the endpoint rather than rendering a page at it.

Draft until

@solidjs/web publishes the addressing change (anything newer than 2.0.0-rc.3). The plugin change is backward-compatible on its own — exact-match and the fallback id channels keep an older runtime working.

Test plan

Verified end-to-end against the fullstack-tanstack template with the solid next runtime linked in: GET-declared reads over /_server/<id> (GET returns data + default no-store, HEAD returns bodyless 200), undeclared reads gated (403/405), and the unscripted no-JS form POST flow (303 + flash cookie) all dispatch through the dev middleware.
Cypress example suite against the published @solidjs/web@2.0.0-rc.4 (dist-tag next), plus the full release gate: ssr 12/12 + boundary 8/8, css-matrix 82/82 + bridge 19/19, start-ssr 366/366 + http-bridge 10/10, start-client 45/45, start-env 47/47, vite-8 vitest 1/1, cypress 1/1. The ride commit moves the workspace catalog to ^2.0.0-rc.4 and switches the start-ssr suite's synthetic dispatches to the path form — rc.4's published handler resolves the id from the path alone, so the legacy ?id= shape it used no longer answers.

Companion PR: solidjs/solid-router#590.

Made with Cursor

solidjs/solid#3076 moved the function id into the path (`<endpoint>/<id>`), retiring the X-Server-Function-Id header and the `?id=` query fallback. The dev middleware and the generated dispatchRequest gate matched the endpoint pathname exactly, so the new addresses fell through to SSR; both now match by mount prefix (exact or `endpoint + '/'`). The dev middleware's module-preload id comes from the path segment, with the header and `?id=` forms kept as fallbacks for a client runtime older than the addressing change. Verified end-to-end against the fullstack-tanstack template with the solid `next` runtime linked in: GET-declared reads (GET and HEAD), 405/403 gating, and the unscripted no-JS form POST flow (303 + flash) all dispatch through the new addresses in dev. Co-authored-by: Cursor <cursoragent@cursor.com>

changeset-bot · 2026-08-27T08:31:52Z

🦋 Changeset detected

Latest commit: eaea1d4

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@solidjs/vite-plugin	Minor

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

pkg-pr-new · 2026-08-27T08:32:25Z

Open in StackBlitz

npm i https://pkg.pr.new/@solidjs/vite-plugin@332

commit: eaea1d4

…table Co-authored-by: Cursor <cursoragent@cursor.com>

ryansolid · 2026-08-27T08:44:16Z

Per review: the header/?id= fallbacks in the dev middleware are marked TRANSITIONAL and scoped to the RC window only — they get dropped before the 3.0 stable release. Path addressing is the only wire format from stable on.

rc.4 publishes the path-addressed server function calls this branch routes (solidjs/solid#3076): the client computes `<endpoint>/<id>` and the published server handler resolves the id from the path alone — the X-Server-Function-Id header and `?id=` forms are gone from the runtime, not just retired client-side. The workspace catalog moves to ^2.0.0-rc.4 (minimumReleaseAgeExclude extended per the existing pattern), and the start-ssr suite's synthetic dispatches switch from `?id=` to the path form, since the published handler no longer answers the legacy shape. The plugin's own transitional fallbacks stay: they serve runtimes older than the addressing change, which the peer range still admits. Full gate green against published rc.4 (no linking): ssr 12/12 + boundary 8/8, css-matrix 82/82 + bridge 19/19, start-ssr 366/366 + http-bridge 10/10, start-client 45/45, start-env 47/47, vite-8 vitest 1/1, cypress e2e 1/1. Co-authored-by: Cursor <cursoragent@cursor.com>

socket-security · 2026-08-28T21:59:26Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@solidjs/diagnostics@2.0.0-rc.4

View full report

socket-security · 2026-08-28T21:59:28Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Low adoption: npm `@solidjs/diagnostics` Location:Package overview From:package.json → `npm/@solidjs/diagnostics@2.0.0-rc.4` ℹ Read more on: This package \| This alert \| What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@solidjs/diagnostics@2.0.0-rc.4`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

ryansolid · 2026-08-27T08:31:48Z

Summary

Downstream adoption of solidjs/solid#3076: a server function call's address is now <endpoint>/<id> with arguments in the query, and the X-Server-Function-Id header and ?id= fallback left the wire.

Dev middleware (server-functions/index.ts): the endpoint gate matched the pathname exactly, so path-addressed calls fell through to SSR. It now matches by mount prefix (exact or endpoint + '/'), for both the base-prefixed and base-stripped forms. The module-preload function id comes from the path segment; the header and ?id= forms stay as fallbacks for a client runtime older than the addressing change.
Generated dispatch gate (ssr/index.ts): the emitted dispatchRequest composed server functions only at pathname === endpoint; it now prefix-matches the same way. A bare-mount request still routes to the runtime handler, which answers the 404 — a misaddressed post fails through the endpoint rather than rendering a page at it.

Draft until

@solidjs/web publishes the addressing change (anything newer than 2.0.0-rc.3). The plugin change is backward-compatible on its own — exact-match and the fallback id channels keep an older runtime working.

Test plan

Verified end-to-end against the fullstack-tanstack template with the solid next runtime linked in: GET-declared reads over /_server/<id> (GET returns data + default no-store, HEAD returns bodyless 200), undeclared reads gated (403/405), and the unscripted no-JS form POST flow (303 + flash cookie) all dispatch through the dev middleware.
Cypress example suite against the published @solidjs/web@2.0.0-rc.4 (dist-tag next), plus the full release gate: ssr 12/12 + boundary 8/8, css-matrix 82/82 + bridge 19/19, start-ssr 366/366 + http-bridge 10/10, start-client 45/45, start-env 47/47, vite-8 vitest 1/1, cypress 1/1. The ride commit moves the workspace catalog to ^2.0.0-rc.4 and switches the start-ssr suite's synthetic dispatches to the path form — rc.4's published handler resolves the id from the path alone, so the legacy ?id= shape it used no longer answers.

Companion PR: solidjs/solid-router#590.

Made with Cursor

solidjs/solid#3076 moved the function id into the path (`<endpoint>/<id>`), retiring the X-Server-Function-Id header and the `?id=` query fallback. The dev middleware and the generated dispatchRequest gate matched the endpoint pathname exactly, so the new addresses fell through to SSR; both now match by mount prefix (exact or `endpoint + '/'`). The dev middleware's module-preload id comes from the path segment, with the header and `?id=` forms kept as fallbacks for a client runtime older than the addressing change. Verified end-to-end against the fullstack-tanstack template with the solid `next` runtime linked in: GET-declared reads (GET and HEAD), 405/403 gating, and the unscripted no-JS form POST flow (303 + flash) all dispatch through the new addresses in dev. Co-authored-by: Cursor <cursoragent@cursor.com>

changeset-bot · 2026-08-27T08:31:52Z

🦋 Changeset detected

Latest commit: eaea1d4

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@solidjs/vite-plugin	Minor

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

pkg-pr-new · 2026-08-27T08:32:25Z

Open in StackBlitz

npm i https://pkg.pr.new/@solidjs/vite-plugin@332

commit: eaea1d4

…table Co-authored-by: Cursor <cursoragent@cursor.com>

ryansolid · 2026-08-27T08:44:16Z

Per review: the header/?id= fallbacks in the dev middleware are marked TRANSITIONAL and scoped to the RC window only — they get dropped before the 3.0 stable release. Path addressing is the only wire format from stable on.

rc.4 publishes the path-addressed server function calls this branch routes (solidjs/solid#3076): the client computes `<endpoint>/<id>` and the published server handler resolves the id from the path alone — the X-Server-Function-Id header and `?id=` forms are gone from the runtime, not just retired client-side. The workspace catalog moves to ^2.0.0-rc.4 (minimumReleaseAgeExclude extended per the existing pattern), and the start-ssr suite's synthetic dispatches switch from `?id=` to the path form, since the published handler no longer answers the legacy shape. The plugin's own transitional fallbacks stay: they serve runtimes older than the addressing change, which the peer range still admits. Full gate green against published rc.4 (no linking): ssr 12/12 + boundary 8/8, css-matrix 82/82 + bridge 19/19, start-ssr 366/366 + http-bridge 10/10, start-client 45/45, start-env 47/47, vite-8 vitest 1/1, cypress e2e 1/1. Co-authored-by: Cursor <cursoragent@cursor.com>

socket-security · 2026-08-28T21:59:26Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@solidjs/diagnostics@2.0.0-rc.4

View full report

socket-security · 2026-08-28T21:59:28Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Low adoption: npm `@solidjs/diagnostics` Location:Package overview From:package.json → `npm/@solidjs/diagnostics@2.0.0-rc.4` ℹ Read more on: This package \| This alert \| What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@solidjs/diagnostics@2.0.0-rc.4`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

ryansolid · 2026-08-27T08:31:48Z

Summary

Downstream adoption of solidjs/solid#3076: a server function call's address is now <endpoint>/<id> with arguments in the query, and the X-Server-Function-Id header and ?id= fallback left the wire.

Dev middleware (server-functions/index.ts): the endpoint gate matched the pathname exactly, so path-addressed calls fell through to SSR. It now matches by mount prefix (exact or endpoint + '/'), for both the base-prefixed and base-stripped forms. The module-preload function id comes from the path segment; the header and ?id= forms stay as fallbacks for a client runtime older than the addressing change.
Generated dispatch gate (ssr/index.ts): the emitted dispatchRequest composed server functions only at pathname === endpoint; it now prefix-matches the same way. A bare-mount request still routes to the runtime handler, which answers the 404 — a misaddressed post fails through the endpoint rather than rendering a page at it.

Draft until

@solidjs/web publishes the addressing change (anything newer than 2.0.0-rc.3). The plugin change is backward-compatible on its own — exact-match and the fallback id channels keep an older runtime working.

Test plan

Verified end-to-end against the fullstack-tanstack template with the solid next runtime linked in: GET-declared reads over /_server/<id> (GET returns data + default no-store, HEAD returns bodyless 200), undeclared reads gated (403/405), and the unscripted no-JS form POST flow (303 + flash cookie) all dispatch through the dev middleware.
Cypress example suite against the published @solidjs/web@2.0.0-rc.4 (dist-tag next), plus the full release gate: ssr 12/12 + boundary 8/8, css-matrix 82/82 + bridge 19/19, start-ssr 366/366 + http-bridge 10/10, start-client 45/45, start-env 47/47, vite-8 vitest 1/1, cypress 1/1. The ride commit moves the workspace catalog to ^2.0.0-rc.4 and switches the start-ssr suite's synthetic dispatches to the path form — rc.4's published handler resolves the id from the path alone, so the legacy ?id= shape it used no longer answers.

Companion PR: solidjs/solid-router#590.

Made with Cursor

solidjs/solid#3076 moved the function id into the path (`<endpoint>/<id>`), retiring the X-Server-Function-Id header and the `?id=` query fallback. The dev middleware and the generated dispatchRequest gate matched the endpoint pathname exactly, so the new addresses fell through to SSR; both now match by mount prefix (exact or `endpoint + '/'`). The dev middleware's module-preload id comes from the path segment, with the header and `?id=` forms kept as fallbacks for a client runtime older than the addressing change. Verified end-to-end against the fullstack-tanstack template with the solid `next` runtime linked in: GET-declared reads (GET and HEAD), 405/403 gating, and the unscripted no-JS form POST flow (303 + flash) all dispatch through the new addresses in dev. Co-authored-by: Cursor <cursoragent@cursor.com>

changeset-bot · 2026-08-27T08:31:52Z

🦋 Changeset detected

Latest commit: eaea1d4

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@solidjs/vite-plugin	Minor

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

pkg-pr-new · 2026-08-27T08:32:25Z

Open in StackBlitz

npm i https://pkg.pr.new/@solidjs/vite-plugin@332

commit: eaea1d4

…table Co-authored-by: Cursor <cursoragent@cursor.com>

ryansolid · 2026-08-27T08:44:16Z

Per review: the header/?id= fallbacks in the dev middleware are marked TRANSITIONAL and scoped to the RC window only — they get dropped before the 3.0 stable release. Path addressing is the only wire format from stable on.

rc.4 publishes the path-addressed server function calls this branch routes (solidjs/solid#3076): the client computes `<endpoint>/<id>` and the published server handler resolves the id from the path alone — the X-Server-Function-Id header and `?id=` forms are gone from the runtime, not just retired client-side. The workspace catalog moves to ^2.0.0-rc.4 (minimumReleaseAgeExclude extended per the existing pattern), and the start-ssr suite's synthetic dispatches switch from `?id=` to the path form, since the published handler no longer answers the legacy shape. The plugin's own transitional fallbacks stay: they serve runtimes older than the addressing change, which the peer range still admits. Full gate green against published rc.4 (no linking): ssr 12/12 + boundary 8/8, css-matrix 82/82 + bridge 19/19, start-ssr 366/366 + http-bridge 10/10, start-client 45/45, start-env 47/47, vite-8 vitest 1/1, cypress e2e 1/1. Co-authored-by: Cursor <cursoragent@cursor.com>

socket-security · 2026-08-28T21:59:26Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@solidjs/diagnostics@2.0.0-rc.4

View full report

socket-security · 2026-08-28T21:59:28Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Low adoption: npm `@solidjs/diagnostics` Location:Package overview From:package.json → `npm/@solidjs/diagnostics@2.0.0-rc.4` ℹ Read more on: This package \| This alert \| What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@solidjs/diagnostics@2.0.0-rc.4`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

ryansolid · 2026-08-27T08:31:48Z

Summary

Downstream adoption of solidjs/solid#3076: a server function call's address is now <endpoint>/<id> with arguments in the query, and the X-Server-Function-Id header and ?id= fallback left the wire.

Dev middleware (server-functions/index.ts): the endpoint gate matched the pathname exactly, so path-addressed calls fell through to SSR. It now matches by mount prefix (exact or endpoint + '/'), for both the base-prefixed and base-stripped forms. The module-preload function id comes from the path segment; the header and ?id= forms stay as fallbacks for a client runtime older than the addressing change.
Generated dispatch gate (ssr/index.ts): the emitted dispatchRequest composed server functions only at pathname === endpoint; it now prefix-matches the same way. A bare-mount request still routes to the runtime handler, which answers the 404 — a misaddressed post fails through the endpoint rather than rendering a page at it.

Draft until

@solidjs/web publishes the addressing change (anything newer than 2.0.0-rc.3). The plugin change is backward-compatible on its own — exact-match and the fallback id channels keep an older runtime working.

Test plan

Verified end-to-end against the fullstack-tanstack template with the solid next runtime linked in: GET-declared reads over /_server/<id> (GET returns data + default no-store, HEAD returns bodyless 200), undeclared reads gated (403/405), and the unscripted no-JS form POST flow (303 + flash cookie) all dispatch through the dev middleware.
Cypress example suite against the published @solidjs/web@2.0.0-rc.4 (dist-tag next), plus the full release gate: ssr 12/12 + boundary 8/8, css-matrix 82/82 + bridge 19/19, start-ssr 366/366 + http-bridge 10/10, start-client 45/45, start-env 47/47, vite-8 vitest 1/1, cypress 1/1. The ride commit moves the workspace catalog to ^2.0.0-rc.4 and switches the start-ssr suite's synthetic dispatches to the path form — rc.4's published handler resolves the id from the path alone, so the legacy ?id= shape it used no longer answers.

Companion PR: solidjs/solid-router#590.

Made with Cursor

solidjs/solid#3076 moved the function id into the path (`<endpoint>/<id>`), retiring the X-Server-Function-Id header and the `?id=` query fallback. The dev middleware and the generated dispatchRequest gate matched the endpoint pathname exactly, so the new addresses fell through to SSR; both now match by mount prefix (exact or `endpoint + '/'`). The dev middleware's module-preload id comes from the path segment, with the header and `?id=` forms kept as fallbacks for a client runtime older than the addressing change. Verified end-to-end against the fullstack-tanstack template with the solid `next` runtime linked in: GET-declared reads (GET and HEAD), 405/403 gating, and the unscripted no-JS form POST flow (303 + flash) all dispatch through the new addresses in dev. Co-authored-by: Cursor <cursoragent@cursor.com>

changeset-bot · 2026-08-27T08:31:52Z

🦋 Changeset detected

Latest commit: eaea1d4

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@solidjs/vite-plugin	Minor

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

pkg-pr-new · 2026-08-27T08:32:25Z

Open in StackBlitz

npm i https://pkg.pr.new/@solidjs/vite-plugin@332

commit: eaea1d4

…table Co-authored-by: Cursor <cursoragent@cursor.com>

ryansolid · 2026-08-27T08:44:16Z

Per review: the header/?id= fallbacks in the dev middleware are marked TRANSITIONAL and scoped to the RC window only — they get dropped before the 3.0 stable release. Path addressing is the only wire format from stable on.

rc.4 publishes the path-addressed server function calls this branch routes (solidjs/solid#3076): the client computes `<endpoint>/<id>` and the published server handler resolves the id from the path alone — the X-Server-Function-Id header and `?id=` forms are gone from the runtime, not just retired client-side. The workspace catalog moves to ^2.0.0-rc.4 (minimumReleaseAgeExclude extended per the existing pattern), and the start-ssr suite's synthetic dispatches switch from `?id=` to the path form, since the published handler no longer answers the legacy shape. The plugin's own transitional fallbacks stay: they serve runtimes older than the addressing change, which the peer range still admits. Full gate green against published rc.4 (no linking): ssr 12/12 + boundary 8/8, css-matrix 82/82 + bridge 19/19, start-ssr 366/366 + http-bridge 10/10, start-client 45/45, start-env 47/47, vite-8 vitest 1/1, cypress e2e 1/1. Co-authored-by: Cursor <cursoragent@cursor.com>

socket-security · 2026-08-28T21:59:26Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@solidjs/diagnostics@2.0.0-rc.4

View full report

socket-security · 2026-08-28T21:59:28Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Low adoption: npm `@solidjs/diagnostics` Location:Package overview From:package.json → `npm/@solidjs/diagnostics@2.0.0-rc.4` ℹ Read more on: This package \| This alert \| What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@solidjs/diagnostics@2.0.0-rc.4`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

ryansolid · 2026-08-27T08:31:48Z

Summary

Downstream adoption of solidjs/solid#3076: a server function call's address is now <endpoint>/<id> with arguments in the query, and the X-Server-Function-Id header and ?id= fallback left the wire.

Dev middleware (server-functions/index.ts): the endpoint gate matched the pathname exactly, so path-addressed calls fell through to SSR. It now matches by mount prefix (exact or endpoint + '/'), for both the base-prefixed and base-stripped forms. The module-preload function id comes from the path segment; the header and ?id= forms stay as fallbacks for a client runtime older than the addressing change.
Generated dispatch gate (ssr/index.ts): the emitted dispatchRequest composed server functions only at pathname === endpoint; it now prefix-matches the same way. A bare-mount request still routes to the runtime handler, which answers the 404 — a misaddressed post fails through the endpoint rather than rendering a page at it.

Draft until

@solidjs/web publishes the addressing change (anything newer than 2.0.0-rc.3). The plugin change is backward-compatible on its own — exact-match and the fallback id channels keep an older runtime working.

Test plan

Verified end-to-end against the fullstack-tanstack template with the solid next runtime linked in: GET-declared reads over /_server/<id> (GET returns data + default no-store, HEAD returns bodyless 200), undeclared reads gated (403/405), and the unscripted no-JS form POST flow (303 + flash cookie) all dispatch through the dev middleware.
Cypress example suite against the published @solidjs/web@2.0.0-rc.4 (dist-tag next), plus the full release gate: ssr 12/12 + boundary 8/8, css-matrix 82/82 + bridge 19/19, start-ssr 366/366 + http-bridge 10/10, start-client 45/45, start-env 47/47, vite-8 vitest 1/1, cypress 1/1. The ride commit moves the workspace catalog to ^2.0.0-rc.4 and switches the start-ssr suite's synthetic dispatches to the path form — rc.4's published handler resolves the id from the path alone, so the legacy ?id= shape it used no longer answers.

Companion PR: solidjs/solid-router#590.

Made with Cursor

solidjs/solid#3076 moved the function id into the path (`<endpoint>/<id>`), retiring the X-Server-Function-Id header and the `?id=` query fallback. The dev middleware and the generated dispatchRequest gate matched the endpoint pathname exactly, so the new addresses fell through to SSR; both now match by mount prefix (exact or `endpoint + '/'`). The dev middleware's module-preload id comes from the path segment, with the header and `?id=` forms kept as fallbacks for a client runtime older than the addressing change. Verified end-to-end against the fullstack-tanstack template with the solid `next` runtime linked in: GET-declared reads (GET and HEAD), 405/403 gating, and the unscripted no-JS form POST flow (303 + flash) all dispatch through the new addresses in dev. Co-authored-by: Cursor <cursoragent@cursor.com>

changeset-bot · 2026-08-27T08:31:52Z

🦋 Changeset detected

Latest commit: eaea1d4

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@solidjs/vite-plugin	Minor

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

pkg-pr-new · 2026-08-27T08:32:25Z

Open in StackBlitz

npm i https://pkg.pr.new/@solidjs/vite-plugin@332

commit: eaea1d4

…table Co-authored-by: Cursor <cursoragent@cursor.com>

ryansolid · 2026-08-27T08:44:16Z

Per review: the header/?id= fallbacks in the dev middleware are marked TRANSITIONAL and scoped to the RC window only — they get dropped before the 3.0 stable release. Path addressing is the only wire format from stable on.

rc.4 publishes the path-addressed server function calls this branch routes (solidjs/solid#3076): the client computes `<endpoint>/<id>` and the published server handler resolves the id from the path alone — the X-Server-Function-Id header and `?id=` forms are gone from the runtime, not just retired client-side. The workspace catalog moves to ^2.0.0-rc.4 (minimumReleaseAgeExclude extended per the existing pattern), and the start-ssr suite's synthetic dispatches switch from `?id=` to the path form, since the published handler no longer answers the legacy shape. The plugin's own transitional fallbacks stay: they serve runtimes older than the addressing change, which the peer range still admits. Full gate green against published rc.4 (no linking): ssr 12/12 + boundary 8/8, css-matrix 82/82 + bridge 19/19, start-ssr 366/366 + http-bridge 10/10, start-client 45/45, start-env 47/47, vite-8 vitest 1/1, cypress e2e 1/1. Co-authored-by: Cursor <cursoragent@cursor.com>

socket-security · 2026-08-28T21:59:26Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@solidjs/diagnostics@2.0.0-rc.4

View full report

socket-security · 2026-08-28T21:59:28Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Low adoption: npm `@solidjs/diagnostics` Location:Package overview From:package.json → `npm/@solidjs/diagnostics@2.0.0-rc.4` ℹ Read more on: This package \| This alert \| What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@solidjs/diagnostics@2.0.0-rc.4`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

ryansolid · 2026-08-27T08:31:48Z

Summary

Downstream adoption of solidjs/solid#3076: a server function call's address is now <endpoint>/<id> with arguments in the query, and the X-Server-Function-Id header and ?id= fallback left the wire.

Dev middleware (server-functions/index.ts): the endpoint gate matched the pathname exactly, so path-addressed calls fell through to SSR. It now matches by mount prefix (exact or endpoint + '/'), for both the base-prefixed and base-stripped forms. The module-preload function id comes from the path segment; the header and ?id= forms stay as fallbacks for a client runtime older than the addressing change.
Generated dispatch gate (ssr/index.ts): the emitted dispatchRequest composed server functions only at pathname === endpoint; it now prefix-matches the same way. A bare-mount request still routes to the runtime handler, which answers the 404 — a misaddressed post fails through the endpoint rather than rendering a page at it.

Draft until

@solidjs/web publishes the addressing change (anything newer than 2.0.0-rc.3). The plugin change is backward-compatible on its own — exact-match and the fallback id channels keep an older runtime working.

Test plan

Verified end-to-end against the fullstack-tanstack template with the solid next runtime linked in: GET-declared reads over /_server/<id> (GET returns data + default no-store, HEAD returns bodyless 200), undeclared reads gated (403/405), and the unscripted no-JS form POST flow (303 + flash cookie) all dispatch through the dev middleware.
Cypress example suite against the published @solidjs/web@2.0.0-rc.4 (dist-tag next), plus the full release gate: ssr 12/12 + boundary 8/8, css-matrix 82/82 + bridge 19/19, start-ssr 366/366 + http-bridge 10/10, start-client 45/45, start-env 47/47, vite-8 vitest 1/1, cypress 1/1. The ride commit moves the workspace catalog to ^2.0.0-rc.4 and switches the start-ssr suite's synthetic dispatches to the path form — rc.4's published handler resolves the id from the path alone, so the legacy ?id= shape it used no longer answers.

Companion PR: solidjs/solid-router#590.

Made with Cursor

solidjs/solid#3076 moved the function id into the path (`<endpoint>/<id>`), retiring the X-Server-Function-Id header and the `?id=` query fallback. The dev middleware and the generated dispatchRequest gate matched the endpoint pathname exactly, so the new addresses fell through to SSR; both now match by mount prefix (exact or `endpoint + '/'`). The dev middleware's module-preload id comes from the path segment, with the header and `?id=` forms kept as fallbacks for a client runtime older than the addressing change. Verified end-to-end against the fullstack-tanstack template with the solid `next` runtime linked in: GET-declared reads (GET and HEAD), 405/403 gating, and the unscripted no-JS form POST flow (303 + flash) all dispatch through the new addresses in dev. Co-authored-by: Cursor <cursoragent@cursor.com>

changeset-bot · 2026-08-27T08:31:52Z

🦋 Changeset detected

Latest commit: eaea1d4

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@solidjs/vite-plugin	Minor

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

pkg-pr-new · 2026-08-27T08:32:25Z

Open in StackBlitz

npm i https://pkg.pr.new/@solidjs/vite-plugin@332

commit: eaea1d4

…table Co-authored-by: Cursor <cursoragent@cursor.com>

ryansolid · 2026-08-27T08:44:16Z

Per review: the header/?id= fallbacks in the dev middleware are marked TRANSITIONAL and scoped to the RC window only — they get dropped before the 3.0 stable release. Path addressing is the only wire format from stable on.

rc.4 publishes the path-addressed server function calls this branch routes (solidjs/solid#3076): the client computes `<endpoint>/<id>` and the published server handler resolves the id from the path alone — the X-Server-Function-Id header and `?id=` forms are gone from the runtime, not just retired client-side. The workspace catalog moves to ^2.0.0-rc.4 (minimumReleaseAgeExclude extended per the existing pattern), and the start-ssr suite's synthetic dispatches switch from `?id=` to the path form, since the published handler no longer answers the legacy shape. The plugin's own transitional fallbacks stay: they serve runtimes older than the addressing change, which the peer range still admits. Full gate green against published rc.4 (no linking): ssr 12/12 + boundary 8/8, css-matrix 82/82 + bridge 19/19, start-ssr 366/366 + http-bridge 10/10, start-client 45/45, start-env 47/47, vite-8 vitest 1/1, cypress e2e 1/1. Co-authored-by: Cursor <cursoragent@cursor.com>

socket-security · 2026-08-28T21:59:26Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@solidjs/diagnostics@2.0.0-rc.4

View full report

socket-security · 2026-08-28T21:59:28Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Low adoption: npm `@solidjs/diagnostics` Location:Package overview From:package.json → `npm/@solidjs/diagnostics@2.0.0-rc.4` ℹ Read more on: This package \| This alert \| What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@solidjs/diagnostics@2.0.0-rc.4`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

ryansolid · 2026-08-27T08:31:48Z

Summary

Downstream adoption of solidjs/solid#3076: a server function call's address is now <endpoint>/<id> with arguments in the query, and the X-Server-Function-Id header and ?id= fallback left the wire.

Dev middleware (server-functions/index.ts): the endpoint gate matched the pathname exactly, so path-addressed calls fell through to SSR. It now matches by mount prefix (exact or endpoint + '/'), for both the base-prefixed and base-stripped forms. The module-preload function id comes from the path segment; the header and ?id= forms stay as fallbacks for a client runtime older than the addressing change.
Generated dispatch gate (ssr/index.ts): the emitted dispatchRequest composed server functions only at pathname === endpoint; it now prefix-matches the same way. A bare-mount request still routes to the runtime handler, which answers the 404 — a misaddressed post fails through the endpoint rather than rendering a page at it.

Draft until

@solidjs/web publishes the addressing change (anything newer than 2.0.0-rc.3). The plugin change is backward-compatible on its own — exact-match and the fallback id channels keep an older runtime working.

Test plan

Verified end-to-end against the fullstack-tanstack template with the solid next runtime linked in: GET-declared reads over /_server/<id> (GET returns data + default no-store, HEAD returns bodyless 200), undeclared reads gated (403/405), and the unscripted no-JS form POST flow (303 + flash cookie) all dispatch through the dev middleware.
Cypress example suite against the published @solidjs/web@2.0.0-rc.4 (dist-tag next), plus the full release gate: ssr 12/12 + boundary 8/8, css-matrix 82/82 + bridge 19/19, start-ssr 366/366 + http-bridge 10/10, start-client 45/45, start-env 47/47, vite-8 vitest 1/1, cypress 1/1. The ride commit moves the workspace catalog to ^2.0.0-rc.4 and switches the start-ssr suite's synthetic dispatches to the path form — rc.4's published handler resolves the id from the path alone, so the legacy ?id= shape it used no longer answers.

Companion PR: solidjs/solid-router#590.

Made with Cursor

solidjs/solid#3076 moved the function id into the path (`<endpoint>/<id>`), retiring the X-Server-Function-Id header and the `?id=` query fallback. The dev middleware and the generated dispatchRequest gate matched the endpoint pathname exactly, so the new addresses fell through to SSR; both now match by mount prefix (exact or `endpoint + '/'`). The dev middleware's module-preload id comes from the path segment, with the header and `?id=` forms kept as fallbacks for a client runtime older than the addressing change. Verified end-to-end against the fullstack-tanstack template with the solid `next` runtime linked in: GET-declared reads (GET and HEAD), 405/403 gating, and the unscripted no-JS form POST flow (303 + flash) all dispatch through the new addresses in dev. Co-authored-by: Cursor <cursoragent@cursor.com>

changeset-bot · 2026-08-27T08:31:52Z

🦋 Changeset detected

Latest commit: eaea1d4

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@solidjs/vite-plugin	Minor

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

pkg-pr-new · 2026-08-27T08:32:25Z

Open in StackBlitz

npm i https://pkg.pr.new/@solidjs/vite-plugin@332

commit: eaea1d4

…table Co-authored-by: Cursor <cursoragent@cursor.com>

ryansolid · 2026-08-27T08:44:16Z

Per review: the header/?id= fallbacks in the dev middleware are marked TRANSITIONAL and scoped to the RC window only — they get dropped before the 3.0 stable release. Path addressing is the only wire format from stable on.

rc.4 publishes the path-addressed server function calls this branch routes (solidjs/solid#3076): the client computes `<endpoint>/<id>` and the published server handler resolves the id from the path alone — the X-Server-Function-Id header and `?id=` forms are gone from the runtime, not just retired client-side. The workspace catalog moves to ^2.0.0-rc.4 (minimumReleaseAgeExclude extended per the existing pattern), and the start-ssr suite's synthetic dispatches switch from `?id=` to the path form, since the published handler no longer answers the legacy shape. The plugin's own transitional fallbacks stay: they serve runtimes older than the addressing change, which the peer range still admits. Full gate green against published rc.4 (no linking): ssr 12/12 + boundary 8/8, css-matrix 82/82 + bridge 19/19, start-ssr 366/366 + http-bridge 10/10, start-client 45/45, start-env 47/47, vite-8 vitest 1/1, cypress e2e 1/1. Co-authored-by: Cursor <cursoragent@cursor.com>

socket-security · 2026-08-28T21:59:26Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@solidjs/diagnostics@2.0.0-rc.4

View full report

socket-security · 2026-08-28T21:59:28Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Low adoption: npm `@solidjs/diagnostics` Location:Package overview From:package.json → `npm/@solidjs/diagnostics@2.0.0-rc.4` ℹ Read more on: This package \| This alert \| What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@solidjs/diagnostics@2.0.0-rc.4`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

ryansolid mentioned this pull request Aug 27, 2026
Adopt path-based server function addressing solidjs/solid-router#590
Merged
2 tasks

Mark legacy addressing fallbacks as RC-transitional, to drop before s…
027ff50
…table Co-authored-by: Cursor <cursoragent@cursor.com>

frenzzy mentioned this pull request Aug 27, 2026
feat(web): let an app supply the fetch server function calls go through solidjs/solid#3080
Merged

ryansolid marked this pull request as ready for review August 28, 2026 22:00

ryansolid merged commit 54fcdfb into nextAug 28, 2026
6 checks passed