@solidjs/start 1.2.1 → 1.3.1

package/config/index.d.ts

@@ -26,6 +26,19 @@ type SolidStartInlineConfig = {
   experimental?: {
     islands?: boolean;
   };
+  serialization?: {
+    /**
+     * The serialization mode to use for server functions.
+     * The "js" mode uses a custom binary format that is more efficient than JSON, but requires a custom deserializer (with `eval()`) on the client.
+     * A strong CSP should block `eval()` executions, which would prevent the "js" mode from working.
+     * The "json" mode uses JSON for serialization, which is less efficient but can be deserialized with `JSON.parse` on the client.
+     *
+     * @default "js"
+     * @
+     * @warning on v2, "json" will be the default.
+     */
+    mode?: "js" | "json";
+  };
   vite?:
     | ViteCustomizableConfig
     | ((options: { router: "server" | "client" | "server-function" }) => ViteCustomizableConfig);

package/config/index.js

@@ -89,6 +89,7 @@ export function defineConfig(baseConfig = {}) {
       }
     }
   });
+  
   const routeDir = join(start.appRoot, start.routeDir);
   let server = start.server;
   if (!start.ssr) {
@@ -99,6 +100,8 @@ export function defineConfig(baseConfig = {}) {
     entryExtension = ".jsx";
   }
 
+  const serializationMode = start.serialization?.mode || 'js'
+
   return createApp({
     server: {
       compressPublicAssets: {
@@ -167,6 +170,7 @@ export function defineConfig(baseConfig = {}) {
                 "import.meta.env.SSR": JSON.stringify(true),
                 "import.meta.env.START_SSR": JSON.stringify(start.ssr),
                 "import.meta.env.START_DEV_OVERLAY": JSON.stringify(start.devOverlay),
+                "import.meta.env.SEROVAL_MODE": JSON.stringify(serializationMode),
                 ...userConfig.define
               }
             })
@@ -234,6 +238,7 @@ export function defineConfig(baseConfig = {}) {
                 "import.meta.env.START_SSR": JSON.stringify(start.ssr),
                 "import.meta.env.START_DEV_OVERLAY": JSON.stringify(start.devOverlay),
                 "import.meta.env.SERVER_BASE_URL": JSON.stringify(server?.baseURL ?? ""),
+                "import.meta.env.SEROVAL_MODE": JSON.stringify(serializationMode),
                 ...userConfig.define
               }
             })
@@ -293,6 +298,7 @@ export function defineConfig(baseConfig = {}) {
                 "import.meta.env.SSR": JSON.stringify(true),
                 "import.meta.env.START_SSR": JSON.stringify(start.ssr),
                 "import.meta.env.START_DEV_OVERLAY": JSON.stringify(start.devOverlay),
+                "import.meta.env.SEROVAL_MODE": JSON.stringify(serializationMode),
                 ...userConfig.define
               }
             })

package/dist/runtime/serialization.d.ts

@@ -0,0 +1,6 @@
+export declare function serializeToJSStream(id: string, value: any): ReadableStream<any>;
+export declare function serializeToJSONStream(value: any): ReadableStream<any>;
+export declare function serializeToJSONString(value: any): Promise<string>;
+export declare function deserializeFromJSONString(json: string): Promise<unknown>;
+export declare function deserializeJSONStream(response: Response | Request): Promise<unknown>;
+export declare function deserializeJSStream(id: string, response: Response): Promise<unknown>;

package/dist/runtime/serialization.js

@@ -0,0 +1,212 @@
+import { crossSerializeStream, deserialize, Feature, fromCrossJSON, fromJSON, getCrossReferenceHeader, toCrossJSONStream, toJSONAsync, } from "seroval";
+import { AbortSignalPlugin, CustomEventPlugin, DOMExceptionPlugin, EventPlugin, FormDataPlugin, HeadersPlugin, ReadableStreamPlugin, RequestPlugin, ResponsePlugin, URLPlugin, URLSearchParamsPlugin, } from "seroval-plugins/web";
+// TODO(Alexis): if we can, allow providing an option to extend these.
+const DEFAULT_PLUGINS = [
+    AbortSignalPlugin,
+    CustomEventPlugin,
+    DOMExceptionPlugin,
+    EventPlugin,
+    FormDataPlugin,
+    HeadersPlugin,
+    ReadableStreamPlugin,
+    RequestPlugin,
+    ResponsePlugin,
+    URLSearchParamsPlugin,
+    URLPlugin,
+];
+const MAX_SERIALIZATION_DEPTH_LIMIT = 64;
+const DISABLED_FEATURES = Feature.RegExp;
+/**
+ * Alexis:
+ *
+ * A "chunk" is a piece of data emitted by the streaming serializer.
+ * Each chunk is represented by a 32-bit value (encoded in hexadecimal),
+ * followed by the encoded string (8-bit representation). This format
+ * is important so we know how much of the chunk being streamed we
+ * are expecting before parsing the entire string data.
+ *
+ * This is sort of a bootleg "multipart/form-data" except it's bad at
+ * handling File/Blob LOL
+ *
+ * The format is as follows:
+ * ;0xFFFFFFFF;<string data>
+ */
+function createChunk(data) {
+    const encodeData = new TextEncoder().encode(data);
+    const bytes = encodeData.length;
+    const baseHex = bytes.toString(16);
+    const totalHex = "00000000".substring(0, 8 - baseHex.length) + baseHex; // 32-bit
+    const head = new TextEncoder().encode(`;0x${totalHex};`);
+    const chunk = new Uint8Array(12 + bytes);
+    chunk.set(head);
+    chunk.set(encodeData, 12);
+    return chunk;
+}
+export function serializeToJSStream(id, value) {
+    return new ReadableStream({
+        start(controller) {
+            crossSerializeStream(value, {
+                scopeId: id,
+                plugins: DEFAULT_PLUGINS,
+                onSerialize(data, initial) {
+                    controller.enqueue(createChunk(initial ? `(${getCrossReferenceHeader(id)},${data})` : data));
+                },
+                onDone() {
+                    controller.close();
+                },
+                onError(error) {
+                    controller.error(error);
+                },
+            });
+        },
+    });
+}
+export function serializeToJSONStream(value) {
+    return new ReadableStream({
+        start(controller) {
+            toCrossJSONStream(value, {
+                disabledFeatures: DISABLED_FEATURES,
+                depthLimit: MAX_SERIALIZATION_DEPTH_LIMIT,
+                plugins: DEFAULT_PLUGINS,
+                onParse(node) {
+                    controller.enqueue(createChunk(JSON.stringify(node)));
+                },
+                onDone() {
+                    controller.close();
+                },
+                onError(error) {
+                    controller.error(error);
+                },
+            });
+        },
+    });
+}
+class SerovalChunkReader {
+    reader;
+    buffer;
+    done;
+    constructor(stream) {
+        this.reader = stream.getReader();
+        this.buffer = new Uint8Array(0);
+        this.done = false;
+    }
+    async readChunk() {
+        // if there's no chunk, read again
+        const chunk = await this.reader.read();
+        if (!chunk.done) {
+            // repopulate the buffer
+            const newBuffer = new Uint8Array(this.buffer.length + chunk.value.length);
+            newBuffer.set(this.buffer);
+            newBuffer.set(chunk.value, this.buffer.length);
+            this.buffer = newBuffer;
+        }
+        else {
+            this.done = true;
+        }
+    }
+    async next() {
+        // Check if the buffer is empty
+        if (this.buffer.length === 0) {
+            // if we are already done...
+            if (this.done) {
+                return {
+                    done: true,
+                    value: undefined,
+                };
+            }
+            // Otherwise, read a new chunk
+            await this.readChunk();
+            return await this.next();
+        }
+        // Read the "byte header"
+        // The byte header tells us how big the expected data is
+        // so we know how much data we should wait before we
+        // deserialize the data
+        const head = new TextDecoder().decode(this.buffer.subarray(1, 11));
+        const bytes = Number.parseInt(head, 16); // ;0x00000000;
+        // Check if the buffer has enough bytes to be parsed
+        while (bytes > this.buffer.length - 12) {
+            // If it's not enough, and the reader is done
+            // then the chunk is invalid.
+            if (this.done) {
+                throw new Error("Malformed server function stream.");
+            }
+            // Otherwise, we read more chunks
+            await this.readChunk();
+        }
+        // Extract the exact chunk as defined by the byte header
+        const partial = new TextDecoder().decode(this.buffer.subarray(12, 12 + bytes));
+        // The rest goes to the buffer
+        this.buffer = this.buffer.subarray(12 + bytes);
+        // Deserialize the chunk
+        return {
+            done: false,
+            value: partial,
+        };
+    }
+    async drain(interpret) {
+        while (true) {
+            const result = await this.next();
+            if (result.done) {
+                break;
+            }
+            else {
+                interpret(result.value);
+            }
+        }
+    }
+}
+export async function serializeToJSONString(value) {
+    // const response = new Response(serializeToJSONStream(value));
+    // return await response.text();
+    return JSON.stringify(await toJSONAsync(value, {
+        plugins: DEFAULT_PLUGINS,
+        depthLimit: MAX_SERIALIZATION_DEPTH_LIMIT,
+        disabledFeatures: DISABLED_FEATURES,
+    }));
+}
+export async function deserializeFromJSONString(json) {
+    return fromJSON(JSON.parse(json), {
+        plugins: DEFAULT_PLUGINS,
+        disabledFeatures: DISABLED_FEATURES,
+    });
+}
+export async function deserializeJSONStream(response) {
+    if (!response.body) {
+        throw new Error("missing body");
+    }
+    const reader = new SerovalChunkReader(response.body);
+    const result = await reader.next();
+    if (!result.done) {
+        const refs = new Map();
+        function interpretChunk(chunk) {
+            const value = fromCrossJSON(JSON.parse(chunk), {
+                refs,
+                disabledFeatures: DISABLED_FEATURES,
+                depthLimit: MAX_SERIALIZATION_DEPTH_LIMIT,
+                plugins: DEFAULT_PLUGINS,
+            });
+            return value;
+        }
+        void reader.drain(interpretChunk);
+        return interpretChunk(result.value);
+    }
+    return undefined;
+}
+export async function deserializeJSStream(id, response) {
+    if (!response.body) {
+        throw new Error("missing body");
+    }
+    const reader = new SerovalChunkReader(response.body);
+    const result = await reader.next();
+    if (!result.done) {
+        reader.drain(deserialize).then(() => {
+            // @ts-ignore
+            delete $R[id];
+        }, () => {
+            // no-op
+        });
+        return deserialize(result.value);
+    }
+    return undefined;
+}

package/dist/runtime/server-handler.js

@@ -1,8 +1,5 @@
 /// <reference types="vinxi/types/server" />
 import { parseSetCookie } from "cookie-es";
-import { crossSerializeStream, fromJSON, getCrossReferenceHeader } from "seroval";
-// @ts-ignore
-import { CustomEventPlugin, DOMExceptionPlugin, EventPlugin, FormDataPlugin, HeadersPlugin, ReadableStreamPlugin, RequestPlugin, ResponsePlugin, URLPlugin, URLSearchParamsPlugin } from "seroval-plugins/web";
 import { sharedConfig } from "solid-js";
 import { renderToString } from "solid-js/web";
 import { provideRequestEvent } from "solid-js/web/storage";
@@ -13,47 +10,7 @@ import { getExpectedRedirectStatus } from "../server/handler";
 import { createPageEvent } from "../server/pageEvent";
 // @ts-ignore
 import serverFnManifest from "solidstart:server-fn-manifest";
-function createChunk(data) {
-    const encodeData = new TextEncoder().encode(data);
-    const bytes = encodeData.length;
-    const baseHex = bytes.toString(16);
-    const totalHex = "00000000".substring(0, 8 - baseHex.length) + baseHex; // 32-bit
-    const head = new TextEncoder().encode(`;0x${totalHex};`);
-    const chunk = new Uint8Array(12 + bytes);
-    chunk.set(head);
-    chunk.set(encodeData, 12);
-    return chunk;
-}
-function serializeToStream(id, value) {
-    return new ReadableStream({
-        start(controller) {
-            crossSerializeStream(value, {
-                scopeId: id,
-                plugins: [
-                    CustomEventPlugin,
-                    DOMExceptionPlugin,
-                    EventPlugin,
-                    FormDataPlugin,
-                    HeadersPlugin,
-                    ReadableStreamPlugin,
-                    RequestPlugin,
-                    ResponsePlugin,
-                    URLSearchParamsPlugin,
-                    URLPlugin
-                ],
-                onSerialize(data, initial) {
-                    controller.enqueue(createChunk(initial ? `(${getCrossReferenceHeader(id)},${data})` : data));
-                },
-                onDone() {
-                    controller.close();
-                },
-                onError(error) {
-                    controller.error(error);
-                }
-            });
-        }
-    });
-}
+import { deserializeFromJSONString, serializeToJSONStream, serializeToJSStream } from "./serialization";
 async function handleServerFunction(h3Event) {
     const event = getFetchEvent(h3Event);
     const request = event.request;
@@ -64,7 +21,7 @@ async function handleServerFunction(h3Event) {
     let functionId, name;
     if (serverReference) {
         invariant(typeof serverReference === "string", "Invalid server function");
-        [functionId, name] = serverReference.split("#");
+        [functionId, name] = decodeURIComponent(serverReference).split("#");
     }
     else {
         functionId = url.searchParams.get("id");
@@ -100,23 +57,10 @@ async function handleServerFunction(h3Event) {
     if (!instance || h3Event.method === "GET") {
         const args = url.searchParams.get("args");
         if (args) {
-            const json = JSON.parse(args);
-            (json.t
-                ? fromJSON(json, {
-                    plugins: [
-                        CustomEventPlugin,
-                        DOMExceptionPlugin,
-                        EventPlugin,
-                        FormDataPlugin,
-                        HeadersPlugin,
-                        ReadableStreamPlugin,
-                        RequestPlugin,
-                        ResponsePlugin,
-                        URLSearchParamsPlugin,
-                        URLPlugin
-                    ]
-                })
-                : json).forEach((arg) => parsed.push(arg));
+            const result = (await deserializeFromJSONString(args));
+            for (const arg of result) {
+                parsed.push(arg);
+            }
         }
     }
     if (h3Event.method === "POST") {
@@ -129,38 +73,26 @@ async function handleServerFunction(h3Event) {
         const isH3EventBodyStreamLocked = (isReadableStream && h3Request.locked) ||
             (hasReadableStream && h3Request.body.locked);
         const requestBody = isReadableStream ? h3Request : h3Request.body;
-        if (contentType?.startsWith("multipart/form-data") ||
+        // workaround for https://github.com/unjs/nitro/issues/1721
+        // (issue only in edge runtimes and netlify preset)
+        const tmpReq = isH3EventBodyStreamLocked
+            ? request
+            : new Request(request, { ...request, body: requestBody });
+        if (request.headers.get('x-serialized')) {
+            parsed = await deserializeFromJSONString(await tmpReq.text());
+        }
+        else if (contentType?.startsWith("multipart/form-data") ||
             contentType?.startsWith("application/x-www-form-urlencoded")) {
             // workaround for https://github.com/unjs/nitro/issues/1721
             // (issue only in edge runtimes and netlify preset)
-            parsed.push(await (isH3EventBodyStreamLocked
-                ? request
-                : new Request(request, { ...request, body: requestBody })).formData());
+            parsed.push(await tmpReq.formData());
             // what should work when #1721 is fixed
             // parsed.push(await request.formData);
         }
-        else if (contentType?.startsWith("application/json")) {
-            // workaround for https://github.com/unjs/nitro/issues/1721
-            // (issue only in edge runtimes and netlify preset)
-            const tmpReq = isH3EventBodyStreamLocked
-                ? request
-                : new Request(request, { ...request, body: requestBody });
+        else if (contentType?.startsWith('application/json')) {
             // what should work when #1721 is fixed
             // just use request.json() here
-            parsed = fromJSON(await tmpReq.json(), {
-                plugins: [
-                    CustomEventPlugin,
-                    DOMExceptionPlugin,
-                    EventPlugin,
-                    FormDataPlugin,
-                    HeadersPlugin,
-                    ReadableStreamPlugin,
-                    RequestPlugin,
-                    ResponsePlugin,
-                    URLSearchParamsPlugin,
-                    URLPlugin
-                ]
-            });
+            parsed = await tmpReq.json();
         }
     }
     try {
@@ -196,8 +128,12 @@ async function handleServerFunction(h3Event) {
         // handle no JS success case
         if (!instance)
             return handleNoJS(result, request, parsed);
-        setHeader(h3Event, "content-type", "text/javascript");
-        return serializeToStream(instance, result);
+        setHeader(h3Event, 'x-serialized', 'true');
+        if (import.meta.env.SEROVAL_MODE === 'js') {
+            setHeader(h3Event, "content-type", "text/javascript");
+            return serializeToJSStream(instance, result);
+        }
+        return serializeToJSONStream(result);
     }
     catch (x) {
         if (x instanceof Response) {
@@ -225,8 +161,12 @@ async function handleServerFunction(h3Event) {
             x = handleNoJS(x, request, parsed, true);
         }
         if (instance) {
-            setHeader(h3Event, "content-type", "text/javascript");
-            return serializeToStream(instance, x);
+            setHeader(h3Event, 'x-serialized', 'true');
+            if (import.meta.env.SEROVAL_MODE === 'js') {
+                setHeader(h3Event, "content-type", "text/javascript");
+                return serializeToJSStream(instance, x);
+            }
+            return serializeToJSONStream(x);
         }
         return x;
     }

package/dist/runtime/server-runtime.js

@@ -1,97 +1,5 @@
-import { deserialize, toJSONAsync } from "seroval";
-import { CustomEventPlugin, DOMExceptionPlugin, EventPlugin, FormDataPlugin, HeadersPlugin, ReadableStreamPlugin, RequestPlugin, ResponsePlugin, URLPlugin, URLSearchParamsPlugin } from "seroval-plugins/web";
 import { createIslandReference } from "../server/islands/index";
-class SerovalChunkReader {
-    reader;
-    buffer;
-    done;
-    constructor(stream) {
-        this.reader = stream.getReader();
-        this.buffer = new Uint8Array(0);
-        this.done = false;
-    }
-    async readChunk() {
-        // if there's no chunk, read again
-        const chunk = await this.reader.read();
-        if (!chunk.done) {
-            // repopulate the buffer
-            let newBuffer = new Uint8Array(this.buffer.length + chunk.value.length);
-            newBuffer.set(this.buffer);
-            newBuffer.set(chunk.value, this.buffer.length);
-            this.buffer = newBuffer;
-        }
-        else {
-            this.done = true;
-        }
-    }
-    async next() {
-        // Check if the buffer is empty
-        if (this.buffer.length === 0) {
-            // if we are already done...
-            if (this.done) {
-                return {
-                    done: true,
-                    value: undefined
-                };
-            }
-            // Otherwise, read a new chunk
-            await this.readChunk();
-            return await this.next();
-        }
-        // Read the "byte header"
-        // The byte header tells us how big the expected data is
-        // so we know how much data we should wait before we
-        // deserialize the data
-        const head = new TextDecoder().decode(this.buffer.subarray(1, 11));
-        const bytes = Number.parseInt(head, 16); // ;0x00000000;
-        if (Number.isNaN(bytes)) {
-            throw new Error(`Malformed server function stream header: ${head}`);
-        }
-        // Check if the buffer has enough bytes to be parsed
-        while (bytes > this.buffer.length - 12) {
-            // If it's not enough, and the reader is done
-            // then the chunk is invalid.
-            if (this.done) {
-                throw new Error("Malformed server function stream.");
-            }
-            // Otherwise, we read more chunks
-            await this.readChunk();
-        }
-        // Extract the exact chunk as defined by the byte header
-        const partial = new TextDecoder().decode(this.buffer.subarray(12, 12 + bytes));
-        // The rest goes to the buffer
-        this.buffer = this.buffer.subarray(12 + bytes);
-        // Deserialize the chunk
-        return {
-            done: false,
-            value: deserialize(partial)
-        };
-    }
-    async drain() {
-        while (true) {
-            const result = await this.next();
-            if (result.done) {
-                break;
-            }
-        }
-    }
-}
-async function deserializeStream(id, response) {
-    if (!response.body) {
-        throw new Error("missing body");
-    }
-    const reader = new SerovalChunkReader(response.body);
-    const result = await reader.next();
-    if (!result.done) {
-        reader.drain().then(() => {
-            // @ts-ignore
-            delete $R[id];
-        }, () => {
-            // no-op
-        });
-    }
-    return result.value;
-}
+import { deserializeJSONStream, deserializeJSStream, serializeToJSONString, } from "./serialization";
 let INSTANCE = 0;
 function createRequest(base, id, instance, options) {
     return fetch(base, {
@@ -99,23 +7,11 @@ function createRequest(base, id, instance, options) {
         ...options,
         headers: {
             ...options.headers,
-            "X-Server-Id": id,
+            "X-Server-Id": encodeURIComponent(id),
             "X-Server-Instance": instance
         }
     });
 }
-const plugins = [
-    CustomEventPlugin,
-    DOMExceptionPlugin,
-    EventPlugin,
-    FormDataPlugin,
-    HeadersPlugin,
-    ReadableStreamPlugin,
-    RequestPlugin,
-    ResponsePlugin,
-    URLSearchParamsPlugin,
-    URLPlugin
-];
 async function fetchServerFunction(base, id, options, args) {
     const instance = `server-fn:${INSTANCE++}`;
     const response = await (args.length === 0
@@ -126,12 +22,21 @@ async function fetchServerFunction(base, id, options, args) {
                 ? createRequest(base, id, instance, {
                     ...options,
                     body: args[0],
-                    headers: { ...options.headers, "Content-Type": "application/x-www-form-urlencoded" }
+                    headers: {
+                        ...options.headers,
+                        "Content-Type": "application/x-www-form-urlencoded",
+                    },
                 })
                 : createRequest(base, id, instance, {
                     ...options,
-                    body: JSON.stringify(await Promise.resolve(toJSONAsync(args, { plugins }))),
-                    headers: { ...options.headers, "Content-Type": "application/json" }
+                    body: await serializeToJSONString(args),
+                    // duplex: 'half',
+                    // body: serializeToJSONStream(args),
+                    headers: {
+                        ...options.headers,
+                        "x-serialized": "true",
+                        "Content-Type": "text/plain"
+                    },
                 }));
     if (response.headers.has("Location") ||
         response.headers.has("X-Revalidate") ||
@@ -139,21 +44,30 @@ async function fetchServerFunction(base, id, options, args) {
         if (response.body) {
             /* @ts-ignore-next-line */
             response.customBody = () => {
-                return deserializeStream(instance, response);
+                if (import.meta.env.SEROVAL_MODE === "js") {
+                    return deserializeJSStream(instance, response.clone());
+                }
+                return deserializeJSONStream(response.clone());
             };
         }
         return response;
     }
     const contentType = response.headers.get("Content-Type");
+    const cloned = response.clone();
     let result;
     if (contentType && contentType.startsWith("text/plain")) {
-        result = await response.text();
+        result = await cloned.text();
     }
     else if (contentType && contentType.startsWith("application/json")) {
-        result = await response.json();
+        result = await cloned.json();
     }
-    else {
-        result = await deserializeStream(instance, response);
+    else if (response.headers.get("x-serialized")) {
+        if (import.meta.env.SEROVAL_MODE === "js") {
+            result = await deserializeJSStream(instance, cloned);
+        }
+        else {
+            result = await deserializeJSONStream(cloned);
+        }
     }
     if (response.headers.has("X-Error")) {
         throw result;
@@ -178,7 +92,7 @@ export function createServerReference(fn, id, name) {
                         return fetchServerFunction(encodeArgs
                             ? url +
                                 (args.length
-                                    ? `&args=${encodeURIComponent(JSON.stringify(await Promise.resolve(toJSONAsync(args, { plugins }))))}`
+                                    ? `&args=${encodeURIComponent(await serializeToJSONString(args))}`
                                     : "")
                             : `${baseURL}/_server`, `${id}#${name}`, options, encodeArgs ? [] : args);
                     };
@@ -190,7 +104,7 @@ export function createServerReference(fn, id, name) {
         },
         apply(target, thisArg, args) {
             return fetchServerFunction(`${baseURL}/_server`, `${id}#${name}`, {}, args);
-        }
+        },
     });
 }
 export function createClientReference(Component, id, name) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solidjs/start",
-  "version": "1.2.1",
+  "version": "1.3.1",
   "type": "module",
   "author": "Ryan Carniato",
   "license": "MIT",
@@ -55,7 +55,7 @@
     }
   },
   "devDependencies": {
-    "solid-js": "^1.9.5",
+    "solid-js": "^1.9.11",
     "vinxi": "^0.5.7",
     "vitest": "3.0.5"
   },
@@ -68,13 +68,13 @@
     "error-stack-parser": "^2.1.4",
     "html-to-image": "^1.11.11",
     "radix3": "^1.1.0",
-    "seroval": "^1.4.1",
-    "seroval-plugins": "^1.4.0",
+    "seroval": "^1.5.0",
+    "seroval-plugins": "^1.5.0",
     "shiki": "^1.26.1",
     "source-map-js": "^1.0.2",
     "terracotta": "^1.0.4",
     "tinyglobby": "^0.2.2",
-    "vite-plugin-solid": "^2.11.1"
+    "vite-plugin-solid": "^2.11.10"
   },
   "peerDependencies": {
     "vinxi": "^0.5.7"