[dependabot]

Bumps the minor-and-patch group with 3 updates: @solidjs/start, @shikijs/rehype and shiki.

Updates @solidjs/start from 2.1.0 to 2.2.1

Release notes

Sourced from @​solidjs/start's releases.

@​solidjs/start@​2.2.1

Patch Changes

• 2f009ff: Keep the metadata of files and blobs sent to server functions. A blob arrives as a Blob instead of a File named blob, an empty type stays empty instead of application/octet-stream, and a file keeps its exact name and its lastModified. The server still reads uploads from clients that send only the part index.

@​solidjs/start@​2.2.0

Minor Changes

• 876881b: Add serverFunctions.skewProtection. When it is on, a page loaded before a deploy can no longer call the new server's functions with an outdated client. The server answers such a call with 409 instead of running the function, and the page reloads once to load the new version. Each build gets a random ID, or pass { buildId } (such as a commit hash) when several machines build the same deploy. Only applies to production builds, and is off by default.
• d329369: Let server functions take files and blobs anywhere in their arguments, not only as the only argument. A call like upload(file, { tags }), or one with files in arrays, objects, maps, sets or form data, sends them as parts of multipart form data next to the serialized arguments, and the server function gets them as File values. Calls without files are sent as before.

Patch Changes

• 6a7a496: Bump seroval and seroval-plugins to 1.7.0.
• ecc390b: Keep the API route matcher out of the client bundle. It is only used on the server, but the client loaded it with the page routes, which added about 2.5 KB of unused code. Routes that only export an OPTIONS handler are now matched as API routes.
• e8bd8c0: Keep Vite's default resolve conditions ("module", "browser") in the client environment: since 2.1.0, packages exposing a "browser" export condition (e.g. @sentry/solidstart) resolved to their Node build in the browser. The dev overlay's @jridgewell/trace-mapping is now pre-bundled, as the "browser" condition makes it import a UMD build.
• 6280546: Resolve the server function filter and the ids of lazily loaded modules against Vite's root instead of the working directory. On Windows a working directory entered through a junction or symlink keeps that path, while Vite (8.2 and later) resolves the root and every module id to the real path. The filter then matched no module, so no "use server" function was compiled: its body shipped in the client bundle, and the build failed with Attempt to import 'server-only' in a client module once one of them imported server-only code such as @solidjs/start/http. The ids of lazily loaded route components matched no client manifest entry either, so their CSS was missing from the server-rendered HTML. Relative patterns in the serverFunctions.filter option now resolve against Vite's root too.

Changelog

Sourced from @​solidjs/start's changelog.

2.2.1

Patch Changes

• 2f009ff: Keep the metadata of files and blobs sent to server functions. A blob arrives as a Blob instead of a File named blob, an empty type stays empty instead of application/octet-stream, and a file keeps its exact name and its lastModified. The server still reads uploads from clients that send only the part index.

2.2.0

Minor Changes

• 876881b: Add serverFunctions.skewProtection. When it is on, a page loaded before a deploy can no longer call the new server's functions with an outdated client. The server answers such a call with 409 instead of running the function, and the page reloads once to load the new version. Each build gets a random ID, or pass { buildId } (such as a commit hash) when several machines build the same deploy. Only applies to production builds, and is off by default.
• d329369: Let server functions take files and blobs anywhere in their arguments, not only as the only argument. A call like upload(file, { tags }), or one with files in arrays, objects, maps, sets or form data, sends them as parts of multipart form data next to the serialized arguments, and the server function gets them as File values. Calls without files are sent as before.

Patch Changes

• 6a7a496: Bump seroval and seroval-plugins to 1.7.0.
• ecc390b: Keep the API route matcher out of the client bundle. It is only used on the server, but the client loaded it with the page routes, which added about 2.5 KB of unused code. Routes that only export an OPTIONS handler are now matched as API routes.
• e8bd8c0: Keep Vite's default resolve conditions ("module", "browser") in the client environment: since 2.1.0, packages exposing a "browser" export condition (e.g. @sentry/solidstart) resolved to their Node build in the browser. The dev overlay's @jridgewell/trace-mapping is now pre-bundled, as the "browser" condition makes it import a UMD build.
• 6280546: Resolve the server function filter and the ids of lazily loaded modules against Vite's root instead of the working directory. On Windows a working directory entered through a junction or symlink keeps that path, while Vite (8.2 and later) resolves the root and every module id to the real path. The filter then matched no module, so no "use server" function was compiled: its body shipped in the client bundle, and the build failed with Attempt to import 'server-only' in a client module once one of them imported server-only code such as @solidjs/start/http. The ids of lazily loaded route components matched no client manifest entry either, so their CSS was missing from the server-rendered HTML. Relative patterns in the serverFunctions.filter option now resolve against Vite's root too.

Commits

• f331543 chore: release (#2373)
• 2f009ff fix(start): keep file and blob metadata in server function uploads (#2370)
• 998ff3a chore: release (#2366)
• 876881b feat(start): add skew protection for server functions (#2363)
• ecc390b fix(server): keep the API route matcher out of the client bundle (#2362)
• 6a7a496 chore(start): bump seroval to 1.7.0 (#2368)
• e8bd8c0 fix(config): keep Vite's default client resolve conditions (#2365)
• d329369 feat: send files anywhere in server function arguments (#2359)
• 6280546 fix(start): resolve the server function filter and lazy ids against Vite's ro...
• See full diff in compare view

Updates @shikijs/rehype from 4.5.0 to 4.6.0

Release notes

Sourced from @​shikijs/rehype's releases.

v4.6.0

   🐞 Bug Fixes

• primitive: Apply injections loaded after their target grammar  -  by @​Yahiro025 in shikijs/shiki#1333 (28817)
• rehype: Avoid cache key collisions between code blocks  -  by @​Don-Yin in shikijs/shiki#1343 (f8f63)
• stream: Align ShikiStreamTokenizer offsets and CRLF handling with codeToTokens  -  by @​xyrolle in shikijs/shiki#1335 (f8aba)
• transformers: Also convert single-theme inline token styles to classes  -  by @​harsh-thakkar7 in shikijs/shiki#1344 (6319e)
• vitepress-twoslash: Keep drag guard working with floating-vue 5.4  -  by @​0froq in shikijs/shiki#1340 (5a174)

   🏎 Performance

• core: Render many decorations in linear time  -  by @​DaniPopes in shikijs/shiki#1338 (f07d3)
• engine-oniguruma: Compress Wasm binary with gzip and load asynchronously  -  by @​jeremy-code in shikijs/shiki#1331 (a1fea)

    View changes on GitHub

Commits

• 167a38f chore: release v4.6.0
• 0d7f97f chore: update deps (#1346)
• f8f6335 fix(rehype): avoid cache key collisions between code blocks (#1343)
• See full diff in compare view

Updates shiki from 4.5.0 to 4.6.0

Release notes

Sourced from shiki's releases.

v4.6.0

   🐞 Bug Fixes

• primitive: Apply injections loaded after their target grammar  -  by @​Yahiro025 in shikijs/shiki#1333 (28817)
• rehype: Avoid cache key collisions between code blocks  -  by @​Don-Yin in shikijs/shiki#1343 (f8f63)
• stream: Align ShikiStreamTokenizer offsets and CRLF handling with codeToTokens  -  by @​xyrolle in shikijs/shiki#1335 (f8aba)
• transformers: Also convert single-theme inline token styles to classes  -  by @​harsh-thakkar7 in shikijs/shiki#1344 (6319e)
• vitepress-twoslash: Keep drag guard working with floating-vue 5.4  -  by @​0froq in shikijs/shiki#1340 (5a174)

   🏎 Performance

• core: Render many decorations in linear time  -  by @​DaniPopes in shikijs/shiki#1338 (f07d3)
• engine-oniguruma: Compress Wasm binary with gzip and load asynchronously  -  by @​jeremy-code in shikijs/shiki#1331 (a1fea)

    View changes on GitHub

Commits

• 167a38f chore: release v4.6.0
• 0d7f97f chore: update deps (#1346)
• f07d3f9 perf(core): render many decorations in linear time (#1338)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
solid-route-progress	Ready	Preview	Nov 8, 2026 1:45am UTC