SolidStart 2

Last reviewed Sep 24, 2026

Export as PDF

Prompt Details

Prompt Composition

4prompts
  1. JavaScript ES2026102 lines · 3.1K tokens
  2. Solid 1.964 lines · 3K tokens
  3. Node.js 24101 lines · 5.3K tokens
  4. SolidStart 261 lines · 3.4K tokens
Total328 lines · 14.8K tokens

CWE Coverage

  • 20
  • 22
  • 59
  • 78
  • 79
  • 88
  • 89
  • 95
  • 113
  • 117
  • 201
  • 208
  • 209
  • 214
  • 250
  • 295
  • 297
  • 306
  • 315
  • 319
  • 323
  • 330
  • 338
  • 346
  • 347
  • 352
  • 354
  • 362
  • 367
  • 377
  • 426
  • 444
  • 459
  • 471
  • 488
  • 494
  • 502
  • 524
  • 525
  • 532
  • 552
  • 598
  • 601
  • 602
  • 613
  • 614
  • 639
  • 653
  • 732
  • 770
  • 772
  • 799
  • 807
  • 829
  • 838
  • 862
  • 863
  • 908
  • 915
  • 916
  • 918
  • 922
  • 942
  • 943
  • 1004
  • 1275
  • 1321
  • 1333

Prompt Preview

Apply the Solid 1.9 and Node.js 24 prompts first. These additional rules target SolidStart 2 (@solidjs/start), its server functions, Solid Router integration, H3 request/session helpers, SSR, and deployment boundaries, and were checked against 2.0.4.

Version and build boundaries

  • Use a maintained Node.js 24 patch for this runtime profile; SolidStart 2.0.4 requires Node.js >=24. Resolve Vite within ^8 || ^9 and, when using Solid Router, @solidjs/router within >=0.16.0 <2.0.0-0. Check a non-Node deployment plugin's runtime separately from the Node build requirement.
  • Keep every bundled or deployed seroval and seroval-plugins copy, including the one solid-js uses for hydration, on Seroval's newest release, and check them with npm ls seroval seroval-plugins after each upgrade. Seroval supports only its newest release and publishes each advisory about a month after the release that fixes it, and published Seroval advisories can be missing from the data npm audit and OSV read, so a clean audit says little here. SolidStart's caret range can stay at an old release in an old lockfile until npm update seroval seroval-plugins refreshes it; solid-js declares a tilde range that stays on one Seroval minor, so add an overrides entry when that range can't reach the newest release. Validate any override with its callers and rebuild both server and browser output; JSON mode and request-size limits don't replace a deserializer fix.
  • Configure solidStart() from @solidjs/start/config in vite.config.ts with one deployment plugin. For Nitro v3, use