[ryansolid]

Picks up dom-expressions 0.40.12 (ryansolid/dom-expressions#592): SSR validates dynamic attribute and tag names, dropping spread keys the HTML parser would read as more than one name and throwing for an invalid tag name (as client document.createElement does, e.g. via <Dynamic component="...">), and escapes class and style names (plus ssrSpread class values) so a quote cannot end the quoted attribute. Output for valid names is unchanged.

• Pins: dom-expressions, hyper-dom-expressions and lit-dom-expressions go from 0.40.11 to 0.40.12. babel-plugin-jsx-dom-expressions was not republished (it stays at 0.40.11), so babel-preset-solid is unchanged.
• Lockfile: refreshed for the new pins. This also fixes the stale babel-preset-solid solid-js peer entry left by the 1.9.16 release (^1.9.15 → ^1.9.16) and prunes unused seroval 1.5.x entries; pnpm install --frozen-lockfile passes again.
• Changeset: solid-js patch.
• Tests: pnpm run build passes; solid-js client (487) and server (8) tests, test-types and babel-preset-solid tests all pass. The built web/dist/server.js / server.cjs drop invalid spread keys, escape ssrSpread class values, throw for an invalid <Dynamic> tag name, and render valid names exactly as before.

Prepared with Claude via Cursor

[changeset-bot]

🦋 Changeset detected

Latest commit: da5c337

The changes in this PR will be included in the next version bump.

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	hyper-dom-expressions@​0.40.11 ⏵ 0.40.12	+1			+2
	lit-dom-expressions@​0.40.11 ⏵ 0.40.12				+2
	dom-expressions@​0.40.11 ⏵ 0.40.12	+1		+1	+2
	solid-js@​1.9.15 ⏵ 1.9.16	+1			+1

View full report