WIP: Upgrade to solidjs beta.14

.github/CODEOWNERS

@@ -0,0 +1,7 @@
+.github/ @TanStack/tanstack-core
+.nx/ @TanStack/tanstack-core
+nx.json @TanStack/tanstack-core
+/scripts/nx @TanStack/tanstack-core 
+.changeset/config.json @TanStack/tanstack-core
+scripts/ @TanStack/tanstack-core
+.npmrc @TanStack/tanstack-core

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -6,14 +6,14 @@ body:
       value: |
         Thank you for reporting an issue :pray:.
 
-        This issue tracker is for reporting bugs found in `router` (https://github.com/tanstack/router).
+        This issue tracker is for reporting bugs found in TanStack Router and/or Start.
         If you have a question about how to achieve something and are struggling, please post a question
         inside of `router` Discussions tab: https://github.com/tanstack/router/discussions
 
         Before submitting a new bug/issue, please check the links below to see if there is a solution or question posted there already:
-         - `router` Issues tab: https://github.com/tanstack/router/issues?q=is%3Aissue+is%3Aopen+sort%3Aupdated-desc
-         - `router` closed issues tab: https://github.com/tanstack/router/issues?q=is%3Aissue+sort%3Aupdated-desc+is%3Aclosed
-         - `router` Discussions tab: https://github.com/tanstack/router/discussions
+         - Issues tab: https://github.com/tanstack/router/issues?q=is%3Aissue+is%3Aopen+sort%3Aupdated-desc
+         - closed issues tab: https://github.com/tanstack/router/issues?q=is%3Aissue+sort%3Aupdated-desc+is%3Aclosed
+         - Discussions tab: https://github.com/tanstack/router/discussions
 
         The more information you fill in, the better the community can help you.
   - type: dropdown
@@ -36,21 +36,22 @@ body:
   - type: input
     id: link
     attributes:
-      label: Your Example Website or App
+      label: Complete minimal reproducer
       description: |
-        Which website or app were you using when the bug happened?
-        Note:
-        - Please provide a link via our pre-configured Stackblitz project ([file-based routes](https://stackblitz.com/github/tanstack/router/tree/main/examples/react/quickstart-file-based?file=src%2Fmain.tsx)|[code-based routes](https://stackblitz.com/github/tanstack/router/tree/main/examples/react/quickstart?file=src%2Fmain.tsx)) or a link to a repo that can reproduce the issue.
-        - Your bug will may get fixed much faster if we can run your code and it doesn't have dependencies other than the `router` npm package / dependency.
-        - To create a shareable code example you can use Stackblitz. Please no localhost URLs.
-        - Please read these tips for providing a minimal example: https://stackoverflow.com/help/mcve.
+        Bug reports need a complete minimal reproducer project.
+        The reproducer project must be 
+        - either a Stackblitz project (use this pre-configured Stackblitz project ([file-based routes](https://stackblitz.com/github/tanstack/router/tree/main/examples/react/quickstart-file-based?file=src%2Fmain.tsx)|[code-based routes](https://stackblitz.com/github/tanstack/router/tree/main/examples/react/quickstart?file=src%2Fmain.tsx)))
+        - or a public git repo.
+        In case of a git repo, the issue must be reproducible **directly** after cloning and installing dependencies.
+
+        If you dont supply a reproducer that meets the above requirements, this issue will be closed.
       placeholder: reproduction URL
     validations:
       required: true
   - type: textarea
     id: steps
     attributes:
-      label: Steps to Reproduce the Bug or Issue
+      label: Steps to Reproduce the Bug
       description: Describe the steps we have to take to reproduce the behavior.
       placeholder: |
         1. Go to '...'

.github/renovate.json

@@ -3,6 +3,7 @@
   "configMigration": true,
   "extends": [
     "config:recommended",
+    "helpers:pinGitHubActionDigests",
     "group:allNonMajor",
     "schedule:weekly",
     ":approveMajorUpdates",

.github/workflows/autofix.yml

@@ -19,9 +19,11 @@ jobs:
     if: ${{ github.event_name == 'push' || !github.event.pull_request.draft }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
       - name: Setup Tools
-        uses: TanStack/config/.github/setup@main
+        uses: TanStack/config/.github/setup@e4b48f16568324f76f467aa4c2aac2f05db632c3 # main
       - name: Fix formatting
         run: pnpm format
       - name: Generate labeler config

.github/workflows/bundle-size.yml

@@ -1,10 +1,10 @@
 name: Bundle Size
 
 on:
-  # We use `pull_request_target` to split trust boundaries across jobs:
+  # We use `pull_request` to split trust boundaries across jobs:
   # - `benchmark-pr` checks out PR merge code and runs it as untrusted with read-only permissions.
   # - `comment-pr` runs trusted base-repo code with limited write access to upsert the PR comment.
-  pull_request_target:
+  pull_request:
     paths:
       - 'packages/**'
       - 'benchmarks/**'
@@ -27,20 +27,20 @@ env:
 jobs:
   benchmark-pr:
     name: Benchmark PR
-    if: github.event_name == 'pull_request_target'
+    if: github.event_name == 'pull_request'
     runs-on: ubuntu-latest
     outputs:
       current_json_b64: ${{ steps.capture.outputs.current_json_b64 }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: refs/pull/${{ github.event.pull_request.number }}/merge
           fetch-depth: 0
           persist-credentials: false
 
       - name: Setup Tools
-        uses: TanStack/config/.github/setup@main
+        uses: TanStack/config/.github/setup@e4b48f16568324f76f467aa4c2aac2f05db632c3 # main
 
       - name: Measure Bundle Size
         run: pnpm nx run @benchmarks/bundle-size:build --outputStyle=stream --skipRemoteCache
@@ -54,15 +54,15 @@ jobs:
 
   comment-pr:
     name: Upsert PR Comment
-    if: github.event_name == 'pull_request_target'
+    if: github.event_name == 'pull_request'
     runs-on: ubuntu-latest
     needs: benchmark-pr
     permissions:
       contents: read
       pull-requests: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -87,13 +87,17 @@ jobs:
           fi
 
       - name: Build PR Report
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          REPOSITORY_NAME: ${{ github.event.repository.name }}
+          REPOSITORY_OWNER: ${{ github.repository_owner }}
         run: |
           node scripts/benchmarks/bundle-size/pr-report.mjs \
             --current benchmarks/bundle-size/results/current.json \
             --history benchmarks/bundle-size/results/history-data.js \
             --output benchmarks/bundle-size/results/pr-comment.md \
-            --base-sha "${{ github.event.pull_request.base.sha }}" \
-            --dashboard-url "https://${{ github.repository_owner }}.github.io/${{ github.event.repository.name }}/benchmarks/bundle-size/"
+            --base-sha "$BASE_SHA" \
+            --dashboard-url "https://${REPOSITORY_OWNER}.github.io/${REPOSITORY_NAME}/benchmarks/bundle-size/"
 
       - name: Upsert Sticky PR Comment
         env:
@@ -111,12 +115,13 @@ jobs:
       contents: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Setup Tools
-        uses: TanStack/config/.github/setup@main
+        uses: TanStack/config/.github/setup@e4b48f16568324f76f467aa4c2aac2f05db632c3 # main
 
       - name: Measure Bundle Size
         run: pnpm nx run @benchmarks/bundle-size:build --outputStyle=stream --skipRemoteCache