[lxsmnsyc]

What and why

@solidjs/web 2.0.0-rc.20 changed enableRichArguments(): a call whose arguments hold a File or Blob now sends multipart/form-data with X-Server-Function-Format: 0. The encoded arguments go in an args part, and each file goes in its own part (file0, file1, ...). In rc.13 these calls sent a plain serialized string.

The server functions panel checked the Serialized format first and passed the multipart body to ChunkReader. ChunkReader threw Malformed server function stream., so the request had no body in the panel and the page logged an unhandled rejection. The copied report had the same problem.

Changes

• body-format.ts: new isUploadBody (Serialized format and a multipart content type) and splitUploadBody (the args text, and the form without it).
• Panel: an upload body shows its arguments in SerovalViewer and its files in FormDataViewer.
• Report: an upload body is written as seroval with files: the redacted arguments, then the list of files.
• Dev dependencies move to solid-js, @solidjs/web and @solidjs/compiler 2.0.0-rc.20, and @solidjs/vite-plugin 3.0.0-next.55. The minimumReleaseAgeExclude entries are updated to match. The peer ranges stay at ^2.0.0-rc.13, which already includes rc.20.
• Changeset: patch.

Compatibility with rc.20

I compared the published rc.13 and rc.20 packages. These are unchanged: the X-Server-Function-Format header, the __server_function_file__ key, format codes 0 to 8, the CallEvent, CallLive and CallRequestEvent types and OBSERVE.records. ChunkReader.next() returns the same { done, value }. The multipart upload body is the only new format the panel had to handle.

Proof

• New e2e test shows the arguments and files of an upload call. It fails with the panel change removed (the seroval tree stays empty) and passes with it.
• New unit test reads the arguments and files of an upload covers the report, including redaction.
• Local checks on the rebased branch: build, tsc, vitest (151 passed), Playwright (16 passed), oxfmt --check, publint and attw.

Cost

Only adds one header check before the existing format switch. Performance pass skipped: this is a fix with no measurable cost.

Risk

Low. Only Serialized bodies with a multipart content type take the new path. Every other body is read as before.

Not done

• If a multipart body has no args part, the panel's rejection is not caught. The existing FormDataViewer behaves the same way.
• No body view yet for format 9 (Void) or for text/event-stream responses from live(). Both gaps were already there in rc.13.

🤖 Generated with Claude Code

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​solidjs/​web@​2.0.0-rc.13 ⏵ 2.0.0-rc.20			+1	+1
	solid-js@​2.0.0-rc.13 ⏵ 2.0.0-rc.20	+1		+1	+1
	@​solidjs/​compiler@​2.0.0-rc.13 ⏵ 2.0.0-rc.20	+3		+1	+2
	@​solidjs/​vite-plugin@​3.0.0-next.46 ⏵ 3.0.0-next.55	+3			+1

View full report