SolidJS release notes, breaking changes, and upgrade notes.
Simple and performant reactivity for building user interfaces StackPulse turns upstream changelogs into scannable summaries with risky changes, deprecations, migration notes, and source links.
This release focuses on improvements to the attribution engine, type fixes, and handling of async iterators. Key changes include enhanced timeline records, better handling of `GET()` grants in dev builds, and closing serialized async iterators upon response abandonment.
affected
Developers using the attribution engine, SSR, or async iterators in SolidJS may need to update their code to align with the new changes.
action
Review the changes related to the attribution engine, `GET()` grants, and async iterators to ensure compatibility.
release_signals
+Enhanced timeline records in the attribution engine (`create`, `effect`, `flush`, `flight`, `fallback`).
This release primarily updates dependencies to align with solid-js@2.0.0-rc.10, with numerous patch changes listed but no specific features or breaking changes detailed.
This release introduces significant changes to the attribution engine with new tracking capabilities and shared-consumer patterns. It also restores 1.x cleanup order semantics which may affect production behavior.
affected
Developers using `onCleanup` in production may see changed cleanup order, and those using attribution features need to adapt to new engine behavior.
action
Test cleanup order changes in production-like environments and review attribution engine usage for compatibility with new hold/release semantics.
release_signals
-`onCleanup` callbacks now run in reverse registration order (unwind), restoring the 1.x semantics. This affects cleanup order in production where component bodies share the enclosing owner.
This release introduces several attribution engine improvements including new timeline records and hooks, fixes cleanup ordering, and renames compiler options. It includes breaking changes to compiler configuration and root disposal behavior.
affected
Developers using compiler options or creating roots within owners need to update their code.
action
Update compiler configurations and review root creation patterns if creating within owners.
release_signals
-`componentNames` compiler option renamed to `sourceNames` and now accepts `boolean | { components?: boolean }`. Old `componentNames` option will now fail as unknown.
This release focuses on internal optimizations and improvements to the `merge()` and `omit()` functions, making them more efficient by returning lazy views instead of copying objects. It also moves several internal protocols and seams behind the `solid-js/internal` subpath to clean up the public API surface.
affected
Developers using `merge()` and `omit()` functions or relying on internal protocols in `solid-js` may need to adjust their code due to breaking changes.
action
Review usage of `merge()` and `omit()` functions and update code to handle the new lazy view behavior.
release_signals
-Writes to `merge()` or `omit()` results are now no-ops; callers must copy the object if needed.
-Data properties on sources are read live through the view instead of being snapshotted.
This release introduces new diagnostics for async store setters, consolidates error handling across client and server, and improves hydration behavior. It also moves internal runtime seams behind `solid-js/internal` to clean up the public API surface.
affected
Developers using async store setters, error handling, or internal runtime seams are affected.
action
Update code to use `onError` for error handling and migrate internal runtime seams to `solid-js/internal`.
release_signals
-`onServerError` is removed; use `onError` for server error handling.
This release introduces several optimizations and fixes related to transaction handling, async memos, and store setters. It also includes new dev diagnostics and improvements to the attribution engine.
affected
Developers using async store setters or relying on the attribution engine's methods may need to update their code.
action
Review the updated documentation and ensure compatibility with the new dev diagnostics and attribution engine changes.
release_signals
+New dev diagnostic `ASYNC_STORE_SETTER` for store setter callbacks that return a Promise.
+Attribution engine's folds, queries, and formatters are now named exports.
+Attribution re-run records are serializable as emitted.
This release introduces significant performance optimizations for `merge()` and `omit()` by implementing lazy views instead of eager copies, with substantial speed improvements. Behavior changes include no-op writes to view results and live property reads through views.
affected
Developers using `merge()` or `omit()` with SolidJS may need to adjust code that relies on write behavior, snapshotting, or key order.
action
Review usage of `merge()` and `omit()` for compatibility with new view-based behavior and performance characteristics.
release_signals
-Writes to a `merge()` or `omit()` result are now no-ops (previously were for proxy forms only). Callers needing their own object must copy it (`{ ...merged }`).
This release introduces optimizations for `dynamic()` components, improves error handling context, and addresses compatibility issues with delegated events between Solid 1.x and 2.x. Several breaking changes require attention for users of `<Dynamic>` or custom error handling.
affected
Users of `<Dynamic>`, custom error handling, or delegated events in SolidJS applications are affected by these changes.
action
Migrate from `<Dynamic>` to `dynamic()` and update any direct accesses to delegated event properties to the new format.
release_signals
-`onServerError` is removed in favor of `onError` for server-side error handling. Existing `onError` functions will now receive all handled failures, with `context.handling` indicating the failure type.
This release introduces breaking changes in diagnostics and attribution, adds a new observe build tier, and fixes security issues including SSR XSS vulnerabilities. It also enforces ESM-only runtime packages requiring Node.js 22.12+.
affected
Developers using `@solidjs/web` in pre-release versions are affected by breaking changes in diagnostics, attribution, and module format.
action
Update to this version if you are using pre-release features and ensure compatibility with Node.js 22.12+.
release_signals
-`DEV.diagnostics` moved to a new `OBSERVE` export — `OBSERVE.diagnostics.{subscribe,capture,emit}`, `OBSERVE.subjectOf(event)`.
This release transitions all runtime packages to ESM-only format requiring Node.js 22.12+, while adding support for JSX-style comments in templates. It's a breaking change for users on older Node versions or certain CommonJS tooling.
affected
Users on Node.js versions below 22.12 or using CommonJS tooling that doesn't support ESM will be affected.
action
Upgrade Node.js to version 22.12 or later and update any affected tooling configurations.
release_signals
-All runtime packages are now ESM only and require Node.js 22.12 or later. CommonJS artifacts and CJS-specific paths have been removed.
This release introduces a new build tier for observability, moves diagnostics and attribution to separate exports, and enforces ESM-only runtime packages requiring Node 22.12+. It includes breaking changes for pre-release users and developers relying on CommonJS.
affected
Developers using pre-release features, CommonJS, or Node versions below 22.12 are affected.
action
Upgrade Node to 22.12+ and migrate to ESM if using CommonJS.
release_signals
-`DEV.diagnostics` moved to `OBSERVE.diagnostics`.
-Attribution engine moved to `solid-js/attribution`.
This release introduces router-agnostic navigation attribution, fixes for optimistic and derived stores, and adds a new core hook for tracking committed writes. It also includes several bug fixes for transaction handling and effect updates.
affected
Developers using SolidJS signals and routing features are affected by navigation attribution and hold census fixes.
action
Review navigation attribution and store handling if using advanced routing or optimistic updates.
release_signals
+Router-agnostic navigation attribution with `OBSERVE.attribution.withOrigin`
+New core hook `flushEnd` for tracking committed writes
+Improved handling of optimistic and derived stores with `deep()`
This release introduces breaking changes in diagnostics and attribution APIs, adds new features for component naming and observability, and fixes an SSR XSS vulnerability.
affected
Developers using SolidJS 2.0.0-rc.8 are affected by breaking changes in diagnostics and attribution APIs, and those using SSR need to be aware of the XSS fix.
action
Update any code using `DEV.diagnostics` or `DEV.attribution` to use the new `OBSERVE` and `solid-js/attribution` imports respectively.
release_signals
-`DEV.diagnostics` moved to a new `OBSERVE` export — `OBSERVE.diagnostics.{subscribe,capture,emit}`, `OBSERVE.subjectOf(event)`.
@solidjs/html@2.0.0-rc.7lowprereleaseSep 8, 2026
@solidjs/html@2.0.0-rc.7
This release primarily updates dependencies to align with @solidjs/web@2.0.0-rc.7, with no other notable changes mentioned.
This release renames legacy client dev artifacts and removes the experimental patch channel and patch-mode list driver, resulting in smaller bundle sizes.
affected
Developers deep-importing dev artifacts directly or using experimental patch channel features are affected.
action
Update imports and remove any dependencies on the removed patch channel features.
release_signals
-Renamed legacy client dev artifacts to `<entry>.dev.{js,cjs}` convention. Code deep-importing `dist/dev.js` directly (bypassing `exports`) is affected.
-Removed experimental patch channel and patch-mode list driver. Related exports (`registerPatch`, `registerRowOps`, etc.), compiler options (`patchDriver`), and internal structures have been deleted.
This release introduces significant security enhancements, including encrypted flash cookies and fixed GET grant vulnerabilities. It also adds detailed origin tracking for writes and improves debugging capabilities.
affected
Developers using deep imports of legacy dev artifacts or relying on synchronous flash cookie handling may need to update their code.
action
Update imports and ensure flash cookie handling is async to accommodate changes.
release_signals
-Renamed legacy client dev artifacts to `<entry>.dev.{js,cjs}` convention. Code deep-importing `dist/dev.js` directly (bypassing `exports`) is affected.
This release focuses on improving diagnostics, attribution, and developer tooling with new features like `feedback()` for measuring user wait times and enhanced error reporting. It also deprecates `createTrackedEffect` in favor of more modern alternatives.
affected
Developers using `createTrackedEffect` or relying on specific diagnostics and attribution features in development mode are affected.
action
Replace `createTrackedEffect` with `createEffect` or `onSettled` as recommended.
release_signals
!`createTrackedEffect` is marked as deprecated. Use `createEffect(compute, effect)` for side effects that follow reactive state and `onSettled` for one-time DOM work after render.
+Added `feedback()` for measuring user wait times and interaction costs.
This release focuses on improving diagnostics, attribution, and reactivity tracking in SolidJS. Key changes include enhanced feedback mechanisms for user interactions, improved write provenance tracking, and deprecation of `createTrackedEffect`.
affected
Developers using `createTrackedEffect` or deep-importing dev artifacts are affected.
action
Migrate from `createTrackedEffect` to `createEffect` or `onSettled` and update import paths for dev artifacts.
release_signals
-Renamed client dev artifacts to `<entry>.dev.{js,cjs}` convention, affecting deep imports bypassing `exports`.
+
Attribution engine improvements with shared-consumer foundation and combined option handling
Data properties on a source are now read live through the view rather than snapshotted at `merge()`/`omit()` time.
-Key order of a merged view now follows the merged order (position of the last source carrying the key), matching `ssrElement`'s array form.
-Sources are treated as own-keyed; keys added to a plain source after merging are not seen (consistent with previous copy behavior).
-Enumerating a view through traps (`for…in`, `Object.keys`, `{ ...view }`) now incurs a trap per key (internal consumers avoid this). Non-`Proxy` environments retain copy paths.
+`merge()` and `omit()` now always return lazy views (O(1) operations) over sources rather than eager copies.
+Predicate form for `omit()`: `omit(props, k => k[0] === "$")` hides keys by rule without enumeration.
+Composition improvements: nested `merge`/`omit` operations collapse into efficient leaf views.
+Performance gains: 3–7× faster construction at depth 1–7, ~2.4× faster SSR polymorphic-chain benchmarks.
+Internal optimizations: shared handler for proxies, direct leaf reads, and efficient store interactions.
migration_steps5 steps
01Replace direct writes to `merge()`/`omit()` results with object copies (`{ ...merged }`) if mutation was previously relied upon.
02Update code expecting snapshotted property values to handle live reads through views.
03Adjust key order expectations to match the new merged order behavior.
04Ensure post-merge key additions to plain objects are not relied upon (use merged sources directly if needed).
05For environments without `Proxy`, no changes needed as copy paths are retained.
-Delegated event handlers have been moved from `$$<type>` to `_$$<type>` to prevent conflicts between Solid 1.x and 2.x runtimes on the same page. Code directly accessing `el.$$click` must update to `el._$$click`.
!`<Dynamic>` and `DynamicProps` are deprecated in favor of `dynamic()`, which offers better performance and avoids prop merging overhead.
+`dynamic(source, { static })` and `isStatic(o, key)` allow optimization of `dynamic()` calls when the source is known to be static.
+`dynamic()` now supports `xmlns` prop for proper namespace handling when creating elements dynamically.
+Enhanced error context with `ownerPath` and `boundaryPath` to distinguish where errors were thrown versus where they were caught.
migration_steps2 steps
01Replace `<Dynamic component={...}>` with `dynamic()` calls, hoisting the factory where possible for better performance.
02Update any direct accesses to delegated event properties from `$$<type>` to `_$$<type>`.
-The attribution engine is now its own entry. `DEV.attribution.enable()` and friends are now `import { attribution } from "solid-js/attribution"`.
-All runtime packages are ESM only and declare `engines.node >= 22.12`. Every `.cjs` artifact, every `require` branch in the exports maps, and the `types-cjs/` declaration mirrors are gone.
!Fix SSR XSS: strings yielded by flow-control memos rendered unescaped.
!Flash cookie key is now derived with PBKDF2 instead of a single SHA-256 hash, making it 100,000 times more expensive to guess a weak `secret`.
+New build tier with observe artifacts for better debugging and observability.
+Flash cookie key derivation now uses PBKDF2 for enhanced security.
+Improved error handling for lazy hydration failures.
migration_steps2 steps
01Update imports for diagnostics and attribution features to use the new `OBSERVE` export and `solid-js/attribution` paths.
02Ensure your Node.js environment is version 22.12 or higher to support ESM-only runtime packages.
-`encodeFlashCookie`/`decodeFlashCookie` are now async due to encryption changes.
!Fixed cross-site GET execution vulnerability by binding `GET()` grants to function identity (#3237).
!Encrypted no-JS flash cookies to protect submitted form input (#3239).
!Fixed promise rejection handling in decoder to prevent process termination on malformed input (#3267).
!Guarded failure channels under non-enumerable Error slots to prevent data leakage (#3268).
+Added origin tracking for writes with `origin` in `ChangeRecord` to track imperative frames.
+Enhanced security by binding `GET()` grants to function identity to prevent cross-site GET execution vulnerabilities.
+Improved diagnostics with tagged JSX binding effects for better debugging.
+Added encryption for no-JS flash cookies using AES-GCM with a deployment secret.
+Enhanced error handling with non-enumerable slot guards for Error carriers.
migration_steps2 steps
01Update imports from `solid-js/dist/dev.*` to `dist/solid.dev.*`, `@solidjs/web/dist/dev.*` to `dist/web.dev.*`, and `@solidjs/universal/dist/dev.*` to `dist/universal.dev.*`.
02Ensure `encodeFlashCookie`/`decodeFlashCookie` calls are awaited if used.