[lxsmnsyc]

Moves the repo to the shared library setup (pnpm workspace, changesets, oxlint, oxfmt, check and release workflows) and migrates @solidjs/ogp to Solid 2.0.

Changes

• Move the package to packages/ogp in a pnpm workspace, and add changesets.
• Replace prettier with oxlint (@lxsmnsyc/oxlint-config) and oxfmt. The reformat is its own commit (style: format with oxfmt), so it can be skipped in review.
• Raise engines.node from >=20 to >=22, the lowest version the check workflow tests.
• Add check.yml (lint, format, types, tests; skips drafts) and release.yml (changesets, npm trusted publishing).
• Peer on solid-js and @solidjs/web ^2.0.0-rc.21, and use @solidjs/web as the JSX import source.
• The default compiler output targets Solid 2.0 server functions, as compiled by @solidjs/vite-plugin with serverFunctions on: each image server function is declared with GET(...) and its url comes from serverFunctionUrl(fn, ...values). The runtime value SolidStart is renamed to Solid, because SolidStart runs on Solid 1.x.
• parseSolidJSX reads Solid 2.0 SSR templates: it strips every _hk hydration key, joins a template whose t is a list, and throws when holes are still pending.
• OpenGraph calls useHead from @solidjs/web instead of <Meta>, so @solidjs/meta is no longer a peer dependency.
• Fix the oxlint findings across the sources. The compiler output is unchanged by that commit.

The setup and the Solid 2.0 migration share one PR on purpose: the compiler rewrite PR is stacked on this branch.

Changeset

• minor (solid-2-support.md): the first release, 0.0.0 to 0.1.0.

Checks

• Local: lint pass, format pass, typecheck pass, build pass, tests pass (41).
• npm pack --dry-run lists the same files as before the move.

Roadmap

• none

Cost

• New peer: @solidjs/web. Removed peer: @solidjs/meta.
• New dev dependency: @solidjs/vite-plugin@3.0.0-next.27, to compile JSX in the OpenGraph test.

Risk

• The Solid output has only been checked by the compiler fixtures and a render test of OpenGraph, not in a running Solid 2.0 app.
• @arethetypeswrong reports "CJS resolves to ESM" for the root entry. This was already the case before this PR: the JSX entry is ESM only on purpose.

Not done

• The TanStack Start output does not work with current TanStack Start. It is fixed in a separate PR.
• The package is not on npm yet. The name reservation (a 0.0.0-stage placeholder) and trusted publishing with provenance are set up separately, before the first release from CI.

🤖 Generated with Claude Code

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​lxsmnsyc/​oxlint-config@​0.1.3
	@​changesets/​cli@​2.31.1 ⏵ 3.0.3	+2		-25	-3
	@​solidjs/​vite-plugin@​3.0.0-next.27
	@​solidjs/​web@​2.0.0-rc.21
	oxfmt@​0.78.0
	oxlint@​1.93.0
	oxlint-tsgolint@​7.0.2006
	solid-js@​1.9.14 ⏵ 2.0.0-rc.21			-5	+1

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Priority	Alert  (click "▶" to expand/collapse)	Action
	Low adoption: npm @lxsmnsyc/oxlint-config Location: Package overview From: package.json → npm/@lxsmnsyc/oxlint-config@0.1.3 ℹ Read more on: This package | This alert | What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@lxsmnsyc/oxlint-config@0.1.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn

View full report