[dependabot]

Bumps the minor-and-patch group with 3 updates: oxlint, tsdown and @solidjs/start.

Updates oxlint from 1.89.0 to 1.90.0

Release notes

Sourced from oxlint's releases.

oxlint v1.90.0

🚀 Features

• cf34678 oxlint: Export Oxlintrc type (#28132) (Sysix)
• 831cdf1 oxlint: Require mininum oxlint-tsgolint version v7.0.2005 (#28118) (camc314)
• d1b00f4 linter/typescript: Implement no-unsafe-enum-assignment rule (#28117) (camc314)
• 165c91f linter/typescript/await-thenable: Support allowMixedPromiseArrays option (#28116) (camc314)

🐛 Bug Fixes

• 7f3c908 linter/eslint/array-callback-return: Check callbacks passed with extra arguments (#28133) (sarankumar)
• 53be530 linter: Filter by type aware rules when looking up tsgolint rule severity (#28138) (NavpreetSSidhu)
• e0f8937 react-compiler: Compile a try whose catch is unreachable instead of panicking (#28066) (Dunqing)
• f5b625f linter/eslint/no-useless-concat: See through parenthesized expressions (#27984) (Rahul Kashyap)
• 4629bb2 linter/jest/no-conditional-expect: Check function expression callbacks (#28055) (camc314)
• 5c84098 semantic,linter: Report names with lone surrogates in enum and lint checks (#27991) (Dunqing)
• f3705a9 linter/eslint/prefer-const: Skip fixers if any declarator is reassigned (#28008) (Prince Jain)
• 4c0fa90 minifier,linter: Keep delete of constant members and later JSX keys (#27990) (Dunqing)
• 0298062 linter/arrow-body-style: Keep type assertions when adding a block body (#27978) (Yan Almeida)

Changelog

Sourced from oxlint's changelog.

[1.90.0] - 2026-10-27

🚀 Features

• 831cdf1 oxlint: Require mininum oxlint-tsgolint version v7.0.2005 (#28118) (camc314)
• d1b00f4 linter/typescript: Implement no-unsafe-enum-assignment rule (#28117) (camc314)
• 165c91f linter/typescript/await-thenable: Support allowMixedPromiseArrays option (#28116) (camc314)

Commits

• 9b6fff4 release(apps): oxlint v1.90.0 && oxfmt v0.75.0 (#28191)
• 831cdf1 feat(oxlint): require mininum oxlint-tsgolint version v7.0.2005 (#28118)
• d1b00f4 feat(linter/typescript): implement no-unsafe-enum-assignment rule (#28117)
• 165c91f feat(linter/typescript/await-thenable): support allowMixedPromiseArrays opt...
• See full diff in compare view

Updates tsdown from 0.23.1 to 0.23.3

Release notes

Sourced from tsdown's releases.

v0.23.3

   🐞 Bug Fixes

• Downgrade rolldown-plugin-dts to 0.28 to restore TypeScript 7.0 support  -  by @​sxzz and @​sxzzbot in rolldown/tsdown#1107 (0344c)

    View changes on GitHub

v0.23.2

   🚀 Features

• Add JSON schema for config  -  by @​Sandbye and @​sxzz in rolldown/tsdown#1074 (2410e)

   🐞 Bug Fixes

• css: Respect Lightning CSS modules options  -  by @​sxzz in rolldown/tsdown#1103 (490ec)

    View changes on GitHub

Commits

• 53638e8 chore: release v0.23.3
• 0344c4f fix: downgrade rolldown-plugin-dts to 0.28 to restore TypeScript 7.0 support ...
• 3c0c854 chore: release v0.23.2
• 76fbfbf chore: upgrade deps
• 490ecd6 fix(css): respect Lightning CSS modules options (#1103)
• 2410ef3 feat: add JSON schema for config (#1074)
• c626e4a chore: upgrade deps
• 3b5f4ee chore(deps): update dependency void to v1 (#1102)
• b46c0d4 test: prune redundant utils tests and fold lookup tables (#1099)
• 3a51daa chore(deps): update pnpm to v12.11.2 (#1081)
• Additional commits viewable in compare view

Updates @solidjs/start from 2.0.6 to 2.1.0

Release notes

Sourced from @​solidjs/start's releases.

@​solidjs/start@​2.1.0

Minor Changes

• ad92979: Add ssr: "data-only". The app renders on the client without hydration, as with ssr: false, but the server runs the requested page's route preloads and streams their query results with the HTML shell, so the client doesn't fetch that data again.

Patch Changes

• 5de5afd: Bump seroval and seroval-plugins to 1.6.11.

• c30a825: Support a full URL in Vite's base so assets can be served from a CDN, completing the base URL prefixing from 2.0.3. Entry, stylesheet, modulepreload and serialized manifest paths no longer collapse https:// into https:/, and server functions post to the path the app is mounted at (server.baseURL, else Vite's base when it is a plain path, else /) instead of the asset base. There is no CDN in development: Vite serves the assets itself, including the public directory, under the URL's path, while the app stays at the root. Root-relative links to public files therefore differ between dev and a build; setting the CDN base for production builds only avoids that.

• 2ff5882: Let a clientOnly loader resolve to the component itself, so a named export works without wrapping it in { default }:

  const Chart = clientOnly(() => import("./chart").then(({ Chart }) => Chart));

  Destructuring the export inside the loader also lets the bundler leave the module's other exports out of the chunk.

• 45bacdb: Stop the dev toolbar's CSS from shipping in production builds. The error boundary statically imports the dev toolbar, whose module imports its stylesheet as a side effect. The toolbar is dead code in production, but the stylesheet survived because the package declared no sideEffects, so its styles were bundled into the client CSS. The package now marks only CSS files as having side effects, letting the bundler drop the toolbar and its styles from production output.

• 9ce2a5d: Add an earlyHints option that sends the page's assets as 103 Early Hints, so the browser can start downloading them while the server is still rendering. It covers the app's entry assets and the assets of the routes being rendered. On runtimes other than Node, the same hints are added as Link headers on the response. Off by default, and only applies to production builds.

• 6c9b0c9: Fall back to client rendering when the browser's path or query changes before hydration starts, preventing hydration mismatches and stale server data after early navigation.

• a235891: Speed up the server function and lazy transforms.

  • Modules without "use server" are no longer parsed by the server function transform.
  • The server build no longer parses a module with Babel only to add its lazy id.
  • Modules with many server functions compile about 4 times faster.
  • A module with a server function no longer fails to compile when it has an unused for...of or for...in loop variable, or a chain of unused declarations.

• 017001e: Keep the result of a form submitted without JavaScript when its form data is too large for the flash cookie. Browsers silently drop cookies over 4096 bytes, so a large textarea used to make useSubmission() come back empty on the page the action redirected to. The form data is now left out of the cookie when it would not fit, the result and error still come through, and a warning is logged on the server.

• e0e6f6d: Reload the browser when entry-server or the middleware changes in dev. Both are server-only, so Vite had nothing to send the browser and the page kept showing the previously rendered output until it was refreshed by hand.

• 6a9fb75: Reload the page once when a route's code fails to load during client-side navigation, such as when a deploy replaced it while the page was open. Before, the navigation ended on an error page until the user refreshed by hand. The page now reloads at the destination and loads the new version. A route that still fails right after the reload shows the error instead of reloading again. This only applies to production builds, and can be turned off with reloadOnRouteChunkError: false.

• 207cfd2: Make solid-js a peer dependency instead of a regular one. When an app's solid-js version was outside the range SolidStart asked for, package managers installed a second copy just for SolidStart. The two copies did not share reactive context, so client-side navigation broke with TypeError: Cannot read properties of null (reading 'push'). SolidStart now uses the app's solid-js, and a version outside the supported range shows up as a peer dependency warning at install time.

• eb50f39: Serve pages in SPA mode (ssr: false) when a route file exports both a page and an API handler, such as a [...404].tsx with a GET. The server treated those routes as API-only, so a GET that returned nothing gave a 404 for every URL the route matched.

• ad92979: Export getServerFunctionMeta, decorateHandler and decorateMiddleware from @solidjs/start/server in SPA mode (ssr: false), so apps using them build.

Changelog

Sourced from @​solidjs/start's changelog.

2.1.0

Minor Changes

• ad92979: Add ssr: "data-only". The app renders on the client without hydration, as with ssr: false, but the server runs the requested page's route preloads and streams their query results with the HTML shell, so the client doesn't fetch that data again.

Patch Changes

• 5de5afd: Bump seroval and seroval-plugins to 1.6.11.

• c30a825: Support a full URL in Vite's base so assets can be served from a CDN, completing the base URL prefixing from 2.0.3. Entry, stylesheet, modulepreload and serialized manifest paths no longer collapse https:// into https:/, and server functions post to the path the app is mounted at (server.baseURL, else Vite's base when it is a plain path, else /) instead of the asset base. There is no CDN in development: Vite serves the assets itself, including the public directory, under the URL's path, while the app stays at the root. Root-relative links to public files therefore differ between dev and a build; setting the CDN base for production builds only avoids that.

• 2ff5882: Let a clientOnly loader resolve to the component itself, so a named export works without wrapping it in { default }:

  const Chart = clientOnly(() => import("./chart").then(({ Chart }) => Chart));

  Destructuring the export inside the loader also lets the bundler leave the module's other exports out of the chunk.

• 45bacdb: Stop the dev toolbar's CSS from shipping in production builds. The error boundary statically imports the dev toolbar, whose module imports its stylesheet as a side effect. The toolbar is dead code in production, but the stylesheet survived because the package declared no sideEffects, so its styles were bundled into the client CSS. The package now marks only CSS files as having side effects, letting the bundler drop the toolbar and its styles from production output.

• 9ce2a5d: Add an earlyHints option that sends the page's assets as 103 Early Hints, so the browser can start downloading them while the server is still rendering. It covers the app's entry assets and the assets of the routes being rendered. On runtimes other than Node, the same hints are added as Link headers on the response. Off by default, and only applies to production builds.

• 6c9b0c9: Fall back to client rendering when the browser's path or query changes before hydration starts, preventing hydration mismatches and stale server data after early navigation.

• a235891: Speed up the server function and lazy transforms.

  • Modules without "use server" are no longer parsed by the server function transform.
  • The server build no longer parses a module with Babel only to add its lazy id.
  • Modules with many server functions compile about 4 times faster.
  • A module with a server function no longer fails to compile when it has an unused for...of or for...in loop variable, or a chain of unused declarations.

• 017001e: Keep the result of a form submitted without JavaScript when its form data is too large for the flash cookie. Browsers silently drop cookies over 4096 bytes, so a large textarea used to make useSubmission() come back empty on the page the action redirected to. The form data is now left out of the cookie when it would not fit, the result and error still come through, and a warning is logged on the server.

• e0e6f6d: Reload the browser when entry-server or the middleware changes in dev. Both are server-only, so Vite had nothing to send the browser and the page kept showing the previously rendered output until it was refreshed by hand.

• 6a9fb75: Reload the page once when a route's code fails to load during client-side navigation, such as when a deploy replaced it while the page was open. Before, the navigation ended on an error page until the user refreshed by hand. The page now reloads at the destination and loads the new version. A route that still fails right after the reload shows the error instead of reloading again. This only applies to production builds, and can be turned off with reloadOnRouteChunkError: false.

• 207cfd2: Make solid-js a peer dependency instead of a regular one. When an app's solid-js version was outside the range SolidStart asked for, package managers installed a second copy just for SolidStart. The two copies did not share reactive context, so client-side navigation broke with TypeError: Cannot read properties of null (reading 'push'). SolidStart now uses the app's solid-js, and a version outside the supported range shows up as a peer dependency warning at install time.

• eb50f39: Serve pages in SPA mode (ssr: false) when a route file exports both a page and an API handler, such as a [...404].tsx with a GET. The server treated those routes as API-only, so a GET that returned nothing gave a 404 for every URL the route matched.

• ad92979: Export getServerFunctionMeta, decorateHandler and decorateMiddleware from @solidjs/start/server in SPA mode (ssr: false), so apps using them build.

Commits

• fbf559d chore: release (#2337)
• 5de5afd chore(start): bump seroval to 1.6.11 (#2358)
• 207cfd2 fix(start): make solid-js a peer dependency (#2343)
• ad92979 feat: add ssr: "data-only" (#2352)
• 9ce2a5d feat(server): add an earlyHints option for 103 Early Hints (#2350)
• 6a9fb75 feat(router): reload once when a route chunk fails to load (#2348)
• 2ff5882 feat(client-only): accept a loader that resolves to the component (#2346)
• eb50f39 fix: serve pages in SPA mode when the route also has an API handler (#2354)
• e0e6f6d fix: reload the browser when the server entry or middleware changes in dev (#...
• c30a825 CDN assets support (#2319)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
solid-route-progress	Ready	Preview	Nov 1, 2026 1:47am UTC