Skip to content

Highlight error sources with twinkleplop, update to Solid rc.9 - #20

Open
lxsmnsyc wants to merge 5 commits into
mainfrom
shiki-to-twinklepop
Open

lxsmnsyc wants to merge 5 commits into
mainfrom
shiki-to-twinklepop

Conversation

@lxsmnsyc

Copy link
Copy Markdown
Member
  • Replace shiki with twinkleplop. Highlighting is synchronous and ships no WebAssembly, so the build drops from 8.1 MB to 3.6 MB.
  • Mark the frame's line with the focus directive and the word it points at with err.
  • Highlight the whole file, then keep 25 lines on each side of the frame, so a block comment above the window no longer breaks the colours.
  • Update every dev dependency, including Solid 2.0.0-rc.9, which needs @solidjs/compiler in place of @dom-expressions/compiler.

🤖 Generated with Claude Code

lxsmnsyc and others added 5 commits September 23, 2026 22:18
Replace shiki with twinkleplop. The highlighter runs synchronously, so a
stack frame's source appears with the panel instead of a moment later,
and the package no longer carries a WebAssembly grammar engine: the build
drops from 8.1 MB to 3.6 MB.

The error line and the word the frame points at are marked with the `hl`
and `err` directives, written as comments on their own lines above the
snippet. The code is never edited to carry a marker, and a line holding
only a marker is dropped from the output.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The code view cut the file down to the window it shows before highlighting
it. A window that starts inside a block comment or a template literal left
the highlighter reading an opening it never saw, and every line after that
read as comment.

The whole file is highlighted now, and the lines outside the window are
hidden through render overlays instead of cut away. The frame's line is
marked with the `focus` directive, so the lines around it can step back.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The view showed fifteen lines on each side of the frame, while its
scrollbar reaches about twenty-five, so the reader could scroll into
lines that were not there.

It now keeps far more of the file than the scrollbar can reach and opens
on the frame's line. The bound is only there to stop a very large file
from putting every one of its lines in the page.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The code view keeps a window that matches how far it scrolls, so the
reader never scrolls into lines that are missing and the panel never
holds a whole file.

The window is cut after highlighting, not before, so a block comment or
template literal above it still reads correctly. Lines outside it are
tagged through the renderer's line hook and dropped from the markup,
which the hide overlays did not do at the offsets they were given.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Update every dev dependency to its latest release, including Solid
2.0.0-rc.9, Vite 8.3, Vitest 5 and Changesets 3.

Solid rc.9 compiles JSX with @solidjs/compiler. The runtime reads event
handlers under a new key, so markup from @dom-expressions/compiler
rendered but never responded to a click. The build and the test fixture
now use the new compiler.

solid-js also ships a development build for Node now, which keeps dev
hooks and error messages. The production-path registry test takes the
hooks away itself, and the end-to-end tests run Node with the
development condition, the same one that selects the toolbar's server
build.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@socket-security

Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn Medium
Low adoption: npm @twinkleplop/annotation

Location: Package overview

From: package.json → npm/@twinkleplop/annotation@0.1.4

ℹ Read more on: This package | This alert | What are unpopular packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Unpopular packages may have less maintenance and contain other problems.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@twinkleplop/annotation@0.1.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Medium
Low adoption: npm @twinkleplop/css

Location: Package overview

From: pnpm-lock.yaml → npm/@twinkleplop/css@0.1.4

ℹ Read more on: This package | This alert | What are unpopular packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Unpopular packages may have less maintenance and contain other problems.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@twinkleplop/css@0.1.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Medium
Low adoption: npm @twinkleplop/html

Location: Package overview

From: pnpm-lock.yaml → npm/@twinkleplop/html@0.1.4

ℹ Read more on: This package | This alert | What are unpopular packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Unpopular packages may have less maintenance and contain other problems.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@twinkleplop/html@0.1.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Medium
Low adoption: npm @twinkleplop/theme-github

Location: Package overview

From: package.json → npm/@twinkleplop/theme-github@0.2.1

ℹ Read more on: This package | This alert | What are unpopular packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Unpopular packages may have less maintenance and contain other problems.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@twinkleplop/theme-github@0.2.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Medium
Low adoption: npm @twinkleplop/tsx

Location: Package overview

From: package.json → npm/@twinkleplop/tsx@0.1.4

ℹ Read more on: This package | This alert | What are unpopular packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Unpopular packages may have less maintenance and contain other problems.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@twinkleplop/tsx@0.1.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Medium
Low adoption: npm @twinkleplop/typescript

Location: Package overview

From: package.json → npm/@twinkleplop/typescript@0.1.4

ℹ Read more on: This package | This alert | What are unpopular packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Unpopular packages may have less maintenance and contain other problems.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@twinkleplop/typescript@0.1.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant