SolidStart 1

Last reviewed Oct 11, 2026

Export as PDF

Prompt Details

Prompt Composition

4prompts
  1. JavaScript ES2026102 lines · 3.1K tokens
  2. Solid 1.964 lines · 3K tokens
  3. Node.js 22114 lines · 3.7K tokens
  4. SolidStart 199 lines · 5.1K tokens
Total379 lines · 15K tokens

CWE Coverage

  • 15
  • 20
  • 22
  • 59
  • 78
  • 79
  • 89
  • 93
  • 95
  • 113
  • 117
  • 201
  • 208
  • 209
  • 214
  • 250
  • 295
  • 297
  • 306
  • 315
  • 319
  • 323
  • 327
  • 338
  • 346
  • 347
  • 352
  • 354
  • 362
  • 367
  • 377
  • 384
  • 426
  • 444
  • 459
  • 471
  • 488
  • 494
  • 502
  • 522
  • 524
  • 525
  • 532
  • 552
  • 565
  • 598
  • 601
  • 602
  • 613
  • 614
  • 639
  • 653
  • 732
  • 770
  • 772
  • 799
  • 807
  • 829
  • 838
  • 862
  • 863
  • 908
  • 915
  • 916
  • 918
  • 922
  • 942
  • 943
  • 1004
  • 1275
  • 1321
  • 1333

Prompt Preview

Apply the Solid 1.9 and Node.js 22 prompts first, including their JavaScript baseline. Apply these additional rules to SolidStart 1 (@solidjs/start) and its Vinxi/Nitro 2 integration; they were checked against 1.3.2.

Runtime and dependency boundary

  • Use a current patched Node.js 22 runtime. The tagged monorepo's tooling requires Node.js >=22, but the published Start package declares no engines; verify the resolved build tools and deployment preset separately before choosing another runtime.
  • Lock @solidjs/start and its Vinxi peer in the lockfile, and rebuild client and server together after changing either. Upgrading Start doesn't refresh vulnerable transitive dependencies, so apply the dependency rules below on every upgrade.
  • Keep every seroval and seroval-plugins copy, including the one solid-js brings in, on Seroval's newest release, which is the only one it supports, applying the Solid prompt's checks and override rules to Start's copies too. npm update seroval seroval-plugins refreshes Start's caret-range copy; when solid-js's tilde range needs an overrides entry, test hydration and server functions against the overridden copy.
  • Check every H3 1.x copy with npm ls h3, including the one under vinxi. Vinxi depends on one exact h3 release, so an H3 fix reaches the app only through a Vinxi release that changes that pin or an overrides entry for the release the H3 advisory lists as fixed; test that override through vinxi/http, request-body parsing, static files, and event streams.
  • Keep Vinxi, Router, Seroval plugins, nitropack,