chore(deps-dev): bump eslint-plugin-solid from 0.15.0 to 0.18.0 in /extension

[dependabot]

Bumps eslint-plugin-solid from 0.15.0 to 0.18.0.

Release notes

Sourced from eslint-plugin-solid's releases.

v0.18.0

Four new correctness rules (from #219, thanks @​brenelz), a revived community rule (#145, thanks @​SarguelUnda), extensions to existing rules, and a batch of reactivity false-positive fixes. Verified against the official Solid 2.0 templates (zero findings).

New rules (enabled in v2/v2-strict)

• solid/no-write-in-pure-computation (error) — setter calls in createMemo callbacks, the compute half of createEffect(compute, effect), and component bodies, all pure owned scopes that throw on writes in Solid 2.0 dev. Honors ownedWrite: true; onSettled/createTrackedEffect/handlers/effect halves exempt by function boundary. Closes #79.
• solid/no-store-mutation-outside-setter (error) — mutating a store's read proxy is silently ignored by core (no error, no update); lint is the only guardrail today.
• solid/no-unused-signal (warn) — never-written or never-read createSignal/createStore/createOptimistic tuples, which unused-variable rules can't see.
• solid/no-boolean-enumerated-attribute (error) — booleans on enumerated attributes (draggable, spellcheck, contenteditable, translate, tristate aria-*) produce a different state than the string tokens; literals autofix. Closes #144/#145.

Reactivity false-positive fixes

• untrack(async () => ...) no longer reports an async tracked scope (#188)
• this.state = state is a reference escape, not a snapshot (#184)
• makePersisted(createSignal(...))-style wrappers analyze as pass-through (#190)

New setting

• settings.solid.moduleSources registers custom renderers/re-export wrappers as Solid primitive sources (#183)

Full details in the changelog.

v0.17.1

Bug fixes only. Thanks to @​jynxio and @​brenelz for the reports and PRs.

Fixes

• solid/reactivity regression from 0.16.1 (#223). The staleCapture check flagged captures read inside synchronous array-method callbacks (items.filter((item) => item.includes(q))) within createMemo/createEffect bodies. A function passed as a call argument doesn't escape through a return below it — only the call's result does — so these callbacks run during the computation, where the capture is fresh. IIFEs are exempt for the same reason.
• solid/imports type mappings for Solid 2.0 (#220, #221, #222). The JSX namespace only exists in @solidjs/web in 2.0; the rule was autofixing correct imports into a module that doesn't export it. ValidComponent/ComponentProps are now accepted from both solid-js (DOM-independent) and @solidjs/web (DOM-aware) since the two packages export genuinely different types. The fixer also no longer produces a duplicate type modifier (import type { type JSX }) when moving inline type specifiers.
• renderToStringAsync is a removed API, not a misplaced one. It no longer exists in Solid 2.0 (renderToString awaits async content). Dropped from the v2 imports map — which was autofixing imports into a dead end — and added to solid/removed-api with migration guidance. solid/removed-api now also scans @solidjs/web imports, so a mechanically source-rewritten import of a removed API is still reported.

Also verified fixed and closed: #193 (signals passed as create* arguments stopped warning with the 0.16.1 accessor-passing work).

v0.17.0

Server functions are core in Solid 2.0, so the plugin now lints them. Four new rules cover the "use server" directive's silent failure modes — all enabled as errors in the v2 and v2-strict configs, and verified against the official Solid 2.0 templates (zero findings) and under Oxlint.

New Rules

• solid/valid-use-server. The compiler only honors "use server" in specific positions and silently ignores it everywhere else — often shipping database access or secrets to the client without any error. Flags directives that aren't in the directive prologue (after other statements, inside plain blocks), template-literal "directives", and directives in positions the compiler never extracts (object methods, getters/setters, class methods). For module-level directive files, also flags non-function exports (which fail at server boot) and calls to client declaration wrappers (GET, live, withMeta from @solidjs/web; query, action, liveQuery from @solidjs/router), whose client-side behavior is silently compiled out in such files. A clientWrappers option adds project-specific wrapper names, with * wildcard and /regex/ support.
• solid/require-async-server-function. On the client every server function call resolves a Promise, but during SSR the function is called in-process and returns synchronously — so a non-async server function observes two different return types, and TypeScript only sees one of them. Covers function-level directives and all exports of module-level directive files (including export { name } specifiers). Autofixes by inserting async.
• solid/no-invalid-server-capture. An editor-time mirror of the compiler's closure-capture validation: server functions cannot capture variables from intermediate scopes (component state, enclosing function parameters), because the extracted function is hoisted to module level on the server and becomes a network proxy on the client. The compiler already rejects this at build time; the rule reports the same captures as you type. Module top-level bindings, imports, globals, own params/locals, named-function-expression self-references, and TS type-only references are all allowed.
• solid/no-browser-globals-in-server-function. Flags unambiguous browser-only globals (window, document, localStorage, etc.) inside server functions, which only run on the server. The list is deliberately conservative — server runtimes provide fetch, crypto, URL, and even navigator, so those never warn — and shadowing bindings and typeof window guards are ignored. In module-level directive files, the whole module is checked.

Internal

• customReactiveFunctions-style pattern matching (exact names, * wildcards, /regex/ strings) was extracted into a shared createNameMatcher utility, now used by both solid/reactivity and solid/valid-use-server.

Full Changelog: solidjs-community/eslint-plugin-solid@v0.16.1...v0.17.0

v0.16.1

... (truncated)

Commits

• 84ddb05 v0.18.0
• 061eee0 Merge 0.18.0: four correctness rules (#219 by @​brenelz), no-boolean-enumerate...
• 3100db5 chore: release 0.18.0
• 8b4b59d feat: 0.18.0 rule batch — component-body writes, enumerated attributes, store...
• fbd900f no-write-in-pure-computation: resolve ownedWrite through const indirection
• b9f13d5 review amendments: drop no-async-effect-half, honor ownedWrite, correct store...
• e3f7b1c Merge pull request #224 from solidjs-community/patch-0.17.1
• 893c5f7 v0.17.1
• abc08ea fix: 0.17.1 patch bucket — staleCapture regression, imports type maps, render...
• d3cc0d9 Merge pull request #220 from jynxio/main
• Additional commits viewable in compare view

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Advanced

Run ID: 506af702-d23f-4359-bf01-91428d7c84d2

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[dependabot]

Superseded by #656.