chore: release

[github-actions]

This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.

Releases

@solidjs/start@2.0.6

Patch Changes

• 048f5a9: Stop a no-JS server function POST from returning a 500 when the body is not a form.

  A POST to a server function without the client runtime, carrying an empty body or a non-form content type, left a value that is not a FormData as the last argument. Building the flash cookie called .entries() on it and threw, and the error handler rethrew the same way, so the request failed with a 500. The response is now the normal redirect, and the flash cookie is best effort so it can no longer take down the error path.

• 378cbcd: Reject cross-site server function requests to prevent CSRF.

  A "use server" function could be invoked by another site with the visitor's cookies, over a GET or a form POST, because the request was not checked. Requests to server functions are now allowed only from the same origin or same site. The check trusts the Sec-Fetch-Site header and falls back to comparing Origin against the request host, so a cross-site page can no longer trigger a server function. Same-origin calls, user-initiated navigations, and no-JS form submissions are unaffected. A separate origin that needs to call your backend should use an API route with explicit CORS.

• 9d3cbec: Report server functions that cannot work instead of compiling them into broken output.

  • A "use server" function that reads a variable from an enclosing function now fails the build. The function is moved to the top level of its module, so the variable is not in scope when it runs.
  • The same check covers this and arguments in an arrow function, super, and private class members.
  • A "use server" directive in an object or class method now fails the build. It was ignored before, which shipped the method body and the modules it imports to the browser.
  • A "use server" string that is not the first statement of a module or a function body now logs a warning. It has no effect there.
  • An export a "use server" module cannot serve now logs a warning that names it. These exports are still left out of the client build.
  • A "use server" module can now export an anonymous default function. Both export default async () => {} and export default async function () {} work.
  • Server function ids are now built from the names a function is nested under, such as Page.load, instead of the order the functions appear in. An id no longer changes when another server function is added to the same file, and two functions that share a name are told apart by the names around them. Production ids stay opaque.
  • Server functions are now compiled in .mts and .cts files.
  • Build errors now point at the full path of the file, not just its name.

[netlify]

✅ Deploy Preview for solid-start-landing-page ready!

Name	Link
🔨 Latest commit	583adca
🔍 Latest deploy log	https://app.netlify.com/projects/solid-start-landing-page/deploys/6aac965bc1d607000848837d
😎 Deploy Preview	https://deploy-preview-2324--solid-start-landing-page.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.