chore: release

packages/start/CHANGELOG.md

@@ -1,5 +1,33 @@
 # @solidjs/start
 
+## 2.0.6
+
+### Patch Changes
+
+- a4ed2a4: Stop `client-only` from failing the build for lazily imported client components.
+
+  A module that imported `client-only` and was loaded through `clientOnly(() => import(...))` failed the server build, even though it only ever runs in the browser. The server build resolves every dynamic import to emit its chunk, so it resolved the `client-only` module and rejected it, though that module never runs on the server. `client-only` no longer fails the build. `server-only` is unchanged and still fails a client build.
+
+- 048f5a9: Stop a no-JS server function POST from returning a 500 when the body is not a form.
+
+  A POST to a server function without the client runtime, carrying an empty body or a non-form content type, left a value that is not a `FormData` as the last argument. Building the flash cookie called `.entries()` on it and threw, and the error handler rethrew the same way, so the request failed with a 500. The response is now the normal redirect, and the flash cookie is best effort so it can no longer take down the error path.
+
+- 378cbcd: Reject cross-site server function requests to prevent CSRF.
+
+  A `"use server"` function could be invoked by another site with the visitor's cookies, over a GET or a form POST, because the request was not checked. Requests to server functions are now allowed only from the same origin or same site. The check trusts the `Sec-Fetch-Site` header and falls back to comparing `Origin` against the request host, so a cross-site page can no longer trigger a server function. Same-origin calls, user-initiated navigations, and no-JS form submissions are unaffected. A separate origin that needs to call your backend should use an API route with explicit CORS.
+
+- 9d3cbec: Report server functions that cannot work instead of compiling them into broken output.
+
+  - A `"use server"` function that reads a variable from an enclosing function now fails the build. The function is moved to the top level of its module, so the variable is not in scope when it runs.
+  - The same check covers `this` and `arguments` in an arrow function, `super`, and private class members.
+  - A `"use server"` directive in an object or class method now fails the build. It was ignored before, which shipped the method body and the modules it imports to the browser.
+  - A `"use server"` string that is not the first statement of a module or a function body now logs a warning. It has no effect there.
+  - An export a `"use server"` module cannot serve now logs a warning that names it. These exports are still left out of the client build.
+  - A `"use server"` module can now export an anonymous default function. Both `export default async () => {}` and `export default async function () {}` work.
+  - Server function ids are now built from the names a function is nested under, such as `Page.load`, instead of the order the functions appear in. An id no longer changes when another server function is added to the same file, and two functions that share a name are told apart by the names around them. Production ids stay opaque.
+  - Server functions are now compiled in `.mts` and `.cts` files.
+  - Build errors now point at the full path of the file, not just its name.
+
 ## 2.0.5
 
 ### Patch Changes

packages/start/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solidjs/start",
-  "version": "2.0.5",
+  "version": "2.0.6",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/solidjs/solid-start.git",