build(deps-dev): bump eslint-plugin-solid from 0.14.5 to 0.17.0

[dependabot]

Bumps eslint-plugin-solid from 0.14.5 to 0.17.0.

Release notes

Sourced from eslint-plugin-solid's releases.

v0.17.0

Server functions are core in Solid 2.0, so the plugin now lints them. Four new rules cover the "use server" directive's silent failure modes — all enabled as errors in the v2 and v2-strict configs, and verified against the official Solid 2.0 templates (zero findings) and under Oxlint.

New Rules

• solid/valid-use-server. The compiler only honors "use server" in specific positions and silently ignores it everywhere else — often shipping database access or secrets to the client without any error. Flags directives that aren't in the directive prologue (after other statements, inside plain blocks), template-literal "directives", and directives in positions the compiler never extracts (object methods, getters/setters, class methods). For module-level directive files, also flags non-function exports (which fail at server boot) and calls to client declaration wrappers (GET, live, withMeta from @solidjs/web; query, action, liveQuery from @solidjs/router), whose client-side behavior is silently compiled out in such files. A clientWrappers option adds project-specific wrapper names, with * wildcard and /regex/ support.
• solid/require-async-server-function. On the client every server function call resolves a Promise, but during SSR the function is called in-process and returns synchronously — so a non-async server function observes two different return types, and TypeScript only sees one of them. Covers function-level directives and all exports of module-level directive files (including export { name } specifiers). Autofixes by inserting async.
• solid/no-invalid-server-capture. An editor-time mirror of the compiler's closure-capture validation: server functions cannot capture variables from intermediate scopes (component state, enclosing function parameters), because the extracted function is hoisted to module level on the server and becomes a network proxy on the client. The compiler already rejects this at build time; the rule reports the same captures as you type. Module top-level bindings, imports, globals, own params/locals, named-function-expression self-references, and TS type-only references are all allowed.
• solid/no-browser-globals-in-server-function. Flags unambiguous browser-only globals (window, document, localStorage, etc.) inside server functions, which only run on the server. The list is deliberately conservative — server runtimes provide fetch, crypto, URL, and even navigator, so those never warn — and shadowing bindings and typeof window guards are ignored. In module-level directive files, the whole module is checked.

Internal

• customReactiveFunctions-style pattern matching (exact names, * wildcards, /regex/ strings) was extracted into a shared createNameMatcher utility, now used by both solid/reactivity and solid/valid-use-server.

Full Changelog: solidjs-community/eslint-plugin-solid@v0.16.1...v0.17.0

v0.16.1

A precision pass over solid/reactivity, driven by the longest-standing false-positive reports in the tracker. Every fix landed with a regression test reproducing the original issue, and the Solid 2.0 templates still lint clean.

Fixes

• Context provider value gets a real explanation (#209). Passing a reactive expression to a provider's value prop previously produced the generic "should be used within JSX" message — nonsense for something that is in JSX. It now reports a dedicated message explaining that providers read value once, untracked, when created (true in both Solid 1.x and 2.0), and to pass the signal, memo, or store itself. Detection also now covers the Solid 2.0 form, where the context object is used directly as the provider (<MyContext value={...}>), by resolving JSX names to createContext() calls.
• createResource argument shapes (#199, #195). createResource(fetcher, options) no longer treats the fetcher as a tracked scope (so async fetchers with an options object stop reporting noAsyncTrackedScope), and in createResource(source, fetcher) the fetcher is now correctly treated as an untracked called function that may be async and read current values. The source remains a synchronous tracked scope.
• Destructuring props inside a tracked scope (#191). const { item } = props inside createMemo/createEffect re-runs on updates and no longer warns. Destructuring at component setup level still does.
• window.setTimeout and friends (#194). Timer and scheduling callbacks prefixed with window., globalThis., or self. now get the same called-function treatment as the bare globals.
• mergeProps/merge function arguments are tracked scopes (#179). Both wrap function sources in createMemo, so reactive reads inside them no longer warn.
• Memos passed to functions are as safe as signals (#182). Passing a createMemo accessor to a create*/use*/custom reactive function no longer warns, matching the existing allowance for signals.
• Directly-returned create* calls (#52). return createMemo(...) (or as an arrow body) no longer reports shouldAssign — the result is handed to the caller, like a custom primitive.
• Functions passed to calls inside tracked scopes (#197). An inline function passed to an unknown call inside an effect (doSomething(() => props.toggle)) no longer warns, matching the existing behavior for named functions: synchronous calls still run tracked, and later calls poll current values.

Features

• Patterns in customReactiveFunctions (#176). Entries now support * wildcards ("watch*") and regexes written as "/pattern/" strings, in addition to exact names.

v0.16.0

The complete Solid 2.0 lint surface: version-aware rules, new v2 / v2-strict configs, and a full set of 2.0-specific rules, all vetted against the official Solid 2.0 templates (which lint clean with zero errors and zero warnings under the v2 config).

Features

• settings.solid.version. Rules can now read the targeted Solid major version from ESLint settings (settings: { solid: { version: 2 } }). Unset means the permissive dual-version behavior from 0.15. The new configs preset it; any custom config can opt in with one line.
• New v2 config (eslint-plugin-solid/configs/v2, also solid.configs.v2): what the official Solid 2.0 templates ship. Sets the version setting, switches existing rules to strict 2.0 semantics, and enables the new 2.0 rules — errors are reserved for near-certain bugs, heuristics stay warnings.
• New v2-strict config (eslint-plugin-solid/configs/v2-strict): everything in v2 plus

... (truncated)

Commits

• 85e168a Merge pull request #218 from solidjs-community/server-function-rules
• 07ebef6 v0.17.0
• 8e5dc00 feat: add server function rules for Solid 2.0
• 3c01fbd Merge pull request #217 from solidjs-community/reactivity-precision-0.16.1
• a892c77 v0.16.1
• 0aa7bc8 fix(reactivity): precision pass over long-standing false positives
• cbd3c8a Merge pull request #216 from solidjs-community/reactivity-object-destructuring
• b123632 test: drop type assertion missing its import from object-destructuring cases
• f1ba27b merge main
• c608685 Merge pull request #215 from solidjs-community/rule-confidence-audit
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for eslint-plugin-solid since your current version.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
bridget	Ready	Preview	Sep 11, 2026 4:22am UTC