SolidStart 2
Last reviewed Sep 24, 2026
Prompt Details
Prompt Composition
4prompts
- JavaScript ES2026102 lines · 3.1K tokens
- Solid 1.964 lines · 3K tokens
- Node.js 24101 lines · 5.3K tokens
- SolidStart 261 lines · 3.4K tokens
Total328 lines · 14.8K tokens
CWE Coverage
- 20
- 22
- 59
- 78
- 79
- 88
- 89
- 95
- 113
- 117
- 201
- 208
- 209
- 214
- 250
- 295
- 297
- 306
- 315
- 319
- 323
- 330
- 338
- 346
- 347
- 352
- 354
- 362
- 367
- 377
- 426
- 444
- 459
- 471
- 488
- 494
- 502
- 524
- 525
- 532
- 552
- 598
- 601
- 602
- 613
- 614
- 639
- 653
- 732
- 770
- 772
- 799
- 807
- 829
- 838
- 862
- 863
- 908
- 915
- 916
- 918
- 922
- 942
- 943
- 1004
- 1275
- 1321
- 1333
Prompt Preview
Apply the Solid 1.9 and Node.js 24 prompts first. These additional rules target SolidStart 2 (@solidjs/start), its server functions, Solid Router integration, H3 request/session helpers, SSR, and deployment boundaries, and were checked against 2.0.4.
Version and build boundaries
- Use a maintained Node.js 24 patch for this runtime profile; SolidStart 2.0.4 requires Node.js
>=24. Resolve Vite within^8 || ^9and, when using Solid Router,@solidjs/routerwithin>=0.16.0 <2.0.0-0. Check a non-Node deployment plugin's runtime separately from the Node build requirement. - Keep every bundled or deployed
serovalandseroval-pluginscopy, including the onesolid-jsuses for hydration, on Seroval's newest release, and check them withnpm ls seroval seroval-pluginsafter each upgrade. Seroval supports only its newest release and publishes each advisory about a month after the release that fixes it, and published Seroval advisories can be missing from the datanpm auditand OSV read, so a clean audit says little here. SolidStart's caret range can stay at an old release in an old lockfile untilnpm update seroval seroval-pluginsrefreshes it;solid-jsdeclares a tilde range that stays on one Seroval minor, so add anoverridesentry when that range can't reach the newest release. Validate any override with its callers and rebuild both server and browser output; JSON mode and request-size limits don't replace a deserializer fix. - Configure
solidStart()from@solidjs/start/configinvite.config.tswith one deployment plugin. For Nitro v3, use