solid-v2/with-tsrx: route modules are .tsrx too

[ryansolid]

Summary

Removes the last .tsx-with-JSX holdout from the TSRX template: all 4 route modules (index, users, users/[id], [...404]) are now idiomatic .tsrx (statement-container bodies; route config exports stay plain top-level TypeScript). The app now has zero non-test .tsx files.

Enabled by filesystem-routing@0.3.0 (solidjs/filesystem-routing#8): the route export analyzer routes by filename — .tsrx modules parse through @tsrx/oxc's parser facade (an optional peer, loaded lazily), everything else keeps the exact oxc-parser path — and tsrx joined the Vite adapter's default extensions.

• filesystem-routing 0.2.1 → 0.3.0; @tsrx/oxc added as a devDependency (the optional peer that powers .tsrx route analysis)
• filesystem-routing added to minimumReleaseAgeExclude (Solid-family lockstep, per the existing comment's rationale)
• README / AGENTS.md / vite.config.ts: the routes-must-stay-.tsx constraint documentation is removed (no longer true)
• file-routes.d.ts regenerated: .tsrx refs use the generic fallback (same as .md/.mdx) since plain typeof import can't resolve the extension; tsrx-tsc passes

Note: @tsrx/oxc ships its own oxlint bin; the stock oxlint package's own bin wins in node_modules/.bin, so pnpm lint behavior is unchanged (verified 1.79.0).

Verification (full bar)

• pnpm install clean; vite build green — routes code-split per module, scoped CSS extracted
• vitest 3/3, oxlint clean, tsrx-tsc --noEmit clean
• Dev-boot browser smoke (Playwright): home .tsrx route renders, scoped CSS applies, client-side nav home → /users → /users/1 → /users/2 (query preload data loads), [...404].tsrx renders, HMR edit on index.tsrx hot-applies without full reload, no console errors

Made with Cursor

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​tsrx/​oxc@​0.9.0
	filesystem-routing@​0.3.0

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Low adoption: npm @tsrx/oxc-darwin-arm64 Location: Package overview From: solid-v2/with-tsrx/pnpm-lock.yaml → npm/@tsrx/oxc@0.9.0 → npm/@tsrx/oxc-darwin-arm64@0.9.0 ℹ Read more on: This package | This alert | What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@tsrx/oxc-darwin-arm64@0.9.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Low adoption: npm @tsrx/oxc-darwin-x64 Location: Package overview From: solid-v2/with-tsrx/pnpm-lock.yaml → npm/@tsrx/oxc@0.9.0 → npm/@tsrx/oxc-darwin-x64@0.9.0 ℹ Read more on: This package | This alert | What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@tsrx/oxc-darwin-x64@0.9.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Low adoption: npm @tsrx/oxc-linux-arm64-gnu Location: Package overview From: solid-v2/with-tsrx/pnpm-lock.yaml → npm/@tsrx/oxc@0.9.0 → npm/@tsrx/oxc-linux-arm64-gnu@0.9.0 ℹ Read more on: This package | This alert | What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@tsrx/oxc-linux-arm64-gnu@0.9.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Low adoption: npm @tsrx/oxc-linux-arm64-musl Location: Package overview From: solid-v2/with-tsrx/pnpm-lock.yaml → npm/@tsrx/oxc@0.9.0 → npm/@tsrx/oxc-linux-arm64-musl@0.9.0 ℹ Read more on: This package | This alert | What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@tsrx/oxc-linux-arm64-musl@0.9.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Low adoption: npm @tsrx/oxc-linux-x64-gnu Location: Package overview From: solid-v2/with-tsrx/pnpm-lock.yaml → npm/@tsrx/oxc@0.9.0 → npm/@tsrx/oxc-linux-x64-gnu@0.9.0 ℹ Read more on: This package | This alert | What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@tsrx/oxc-linux-x64-gnu@0.9.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Low adoption: npm @tsrx/oxc-linux-x64-musl Location: Package overview From: solid-v2/with-tsrx/pnpm-lock.yaml → npm/@tsrx/oxc@0.9.0 → npm/@tsrx/oxc-linux-x64-musl@0.9.0 ℹ Read more on: This package | This alert | What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@tsrx/oxc-linux-x64-musl@0.9.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Low adoption: npm @tsrx/oxc-win32-arm64-msvc Location: Package overview From: solid-v2/with-tsrx/pnpm-lock.yaml → npm/@tsrx/oxc@0.9.0 → npm/@tsrx/oxc-win32-arm64-msvc@0.9.0 ℹ Read more on: This package | This alert | What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@tsrx/oxc-win32-arm64-msvc@0.9.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Low adoption: npm @tsrx/oxc-win32-x64-msvc Location: Package overview From: solid-v2/with-tsrx/pnpm-lock.yaml → npm/@tsrx/oxc@0.9.0 → npm/@tsrx/oxc-win32-x64-msvc@0.9.0 ℹ Read more on: This package | This alert | What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@tsrx/oxc-win32-x64-msvc@0.9.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Low adoption: npm @tsrx/oxc Location: Package overview From: solid-v2/with-tsrx/package.json → npm/@tsrx/oxc@0.9.0 ℹ Read more on: This package | This alert | What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@tsrx/oxc@0.9.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report