Bump the build-and-tooling group across 1 directory with 11 updates by dependabot[bot] · Pull Request #31 · SynapBytes/haqak

dependabot · 2026-04-24T14:50:48Z

Bumps the build-and-tooling group with 11 updates in the / directory:

Package	From	To
dompurify	`3.4.0`	`3.4.11`
@types/node	`22.19.15`	`26.1.0`
eslint	`9.39.4`	`10.6.0`
eslint-plugin-react-hooks	`5.2.0`	`7.1.1`
eslint-plugin-react-refresh	`0.4.26`	`0.5.3`
postcss	`8.5.15`	`8.5.16`
tailwindcss	`3.4.19`	`4.3.2`
typescript	`5.9.3`	`6.0.3`
typescript-eslint	`8.57.2`	`8.62.1`
vite	`6.4.2`	`8.1.3`
vitest	`4.1.8`	`4.1.9`

Updates dompurify from 3.4.0 to 3.4.11

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.11

Fixed an issue with a leaky config for hooks via setConfig, thanks @trace37labs

Bumped vulnerable development dependencies to arrive at plain 0 with npm audit

Updated the osv-scanner suppression list as no vulnerable dependencies are left for now

Updated up the linting tool-chain and removed now-redundant lint directives

Updated the documentation is several spots, README, wiki, etc.

Bumped several dependencies where possible

DOMPurify 3.4.10

Refactored codebase for clarity: extracted the public type declarations into types.ts

Decomposed the three largest sanitizer functions into focused helpers

Removed duplicated defaults and dead branches, consolidated SAFE_FOR_TEMPLATES scrubbing into single shared path

Improved per-node performance by hoisting the mXSS probe regexes and testing textContent before innerHTML

Added a deterministic micro-benchmark harness (npm run bench) with a --compare mode

Reduced CI cost by running the full three-engine browser suite once per PR

Refreshed the demos/ folder so every demo runs again, and added a SVG-via-<img> demo

Documented the bench and test:happydom scripts in the README

Completed the Attack Classes & Bypass History wiki page

Bumped several dependencies where possible

DOMPurify 3.4.9

Further improved the handling of Trusted Types config options, thanks @offset

Further improved the handling of IN_PLACE sanitization, thanks @mozfreddyb

Added more test coverage for IN_PLACE and Trusted Types related usage

Bumped several dependencies where possible

Updated README and wiki with more accurate documentation & attack samples

DOMPurify 3.4.8

Cleaned up the repository root, renamed some and removed unneeded files

Fixed an issue with handling of Trusted Types policies, thanks @fulstadev

Fixed the node iterator for better template scrubbing, thanks @IamLeandrooooo

Included formerly missing LICENSE-MPL in published npm package, thanks @asamuzaK

Bumped several dependencies where possible

DOMPurify 3.4.7

Hardened the handling of Shadow Roots when using IN_PLACE, thanks @GameZoneHacker

Removed a problem leading to permanent hook pollution, thanks @offset

Refactored the test suite and expanded test coverage significantly

DOMPurify 3.4.6

Fixed several issues with DOM Clobbering in IN_PLACE mode, thanks @offset & @Bankde

Hardened the checks for cross-realm IN_PLACE and Shadow DOM sanitization, thanks @offset & @Bankde

Added more test coverage for IN_PLACE and general DOM Clobbering attacks

Bumped several dependencies where possible

DOMPurify 3.4.5

Fixed a bypass caused by the new HTML element selectedcontent added in 3.4.4, thanks @KabirAcharya

Note that this is a security release for an issue introduced in 3.4.4 and should be upgraded to immediately.

... (truncated)

Commits

0cae518 release: 3.4.11 (#1494)
6ee5716 release: 3.4.10 (#1478)
5210247 release: 3.4.9 (#1459)
bcdd828 release: 3.4.8 (#1439)
ca30f07 release: 3.4.7 (#1414)
bb7739e release: 3.4.6 (#1394)
011b0c7 release: 3.4.5 (#1382)
5817ad9 release: 3.4.4 (#1374)
520edb0 release: 3.4.3 (#1352)
6f67fd3 Sync/3.4.2 (#1322)
Additional commits viewable in compare view

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Updates @types/node from 22.19.15 to 26.1.0

Commits

See full diff in compare view

Updates eslint from 9.39.4 to 10.6.0

Release notes

Sourced from eslint's releases.

v10.6.0

Features

b1f9106 feat: detect Symbol() and BigInt() in no-constant-binary-expression (#20981) (Taejin Kim)

f291007 feat: add checkRelationalComparisons to no-constant-binary-expression (#20948) (sethamus)

Bug Fixes

6b05784 fix: prefer-exponentiation-operator invalid autofix at statement start (#20997) (Milos Djermanovic)

bb9eb2a fix: account for shadowed Boolean in no-extra-boolean-cast (#21013) (den$)

8fd8741 fix: don't report shadowed undefined in radix rule (#21011) (Pixel)

5784980 fix: don't report shadowed undefined in no-throw-literal (#21010) (Pixel)

9cd1e6d fix: suppress invalid class suggestion in no-promise-executor-return (#21008) (Pixel)

d4eb2dc fix: don't report shadowed undefined in prefer-promise-reject-errors (#21006) (Pixel)

2360464 fix: prefer-promise-reject-errors false positives for shadowed Promise (#21003) (den$)

63d52d2 fix: restore max-classes-per-file report range (#21002) (Pixel)

7feaff0 fix: callback detection logic for IIFEs in max-nested-callbacks (#20979) (fnx)

399a2ec fix: don't report inner non-callbacks in max-nested-callbacks (#20995) (Milos Djermanovic)

Documentation

a83683d docs: Update README (GitHub Actions Bot)

f5449f9 docs: document userland patterns for global assertionOptions in RuleT… (#20986) (playgirl)

bea49f7 docs: Update README (GitHub Actions Bot)

e5f70f9 docs: update code-path diagrams (#20984) (Tanuj Kanti)

8890c2d docs: add TypeScript config guidance for MCP server (#20796) (Pierluigi Lenoci)

3eb3d9b docs: Update README (GitHub Actions Bot)

c5bb59c docs: Update README (GitHub Actions Bot)

eb3c97c docs: fix grammar in prefer-const rule description (#20983) (lumir)

Chores

6a42034 ci: run ecosystem tests on main branch (#20891) (sethamus)

3dbacdb ci: bump actions/checkout from 6 to 7 (#21014) (dependabot[bot])

c3abfca chore: correct JSDoc param types in html formatter (#21018) (Minseon Kim)

a832320 ci: split ecosystem tests into separate jobs (#21001) (xbinaryx)

27166e7 chore: update ecosystem plugins (#21005) (ESLint Bot)

865d76e ci: bump pnpm/action-setup from 6.0.8 to 6.0.9 (#20989) (dependabot[bot])

27a88c9 chore: update dependency markdown-it to v14 in root (#20994) (Milos Djermanovic)

970cea6 chore: update dependency markdown-it to v14 (#20993) (Milos Djermanovic)

b482120 chore: update dependency prettier to v3.8.4 (#20990) (renovate[bot])

6993fb3 chore: update ecosystem plugins (#20985) (ESLint Bot)

v10.5.0

Features

5ca8c52 feat: correct stack tracking in max-nested-callbacks (#20973) (Pixel998)

b565783 feat: report no-with violations at the with keyword (#20971) (Pixel998)

2ce032f feat: report max-lines-per-function violations at function head (#20966) (Pixel998)

732cb3e feat: report max-nested-callbacks violations at function head (#20967) (Pixel998)

f9c138a feat: report max-depth violations on keywords (#20943) (Pixel998)

bdb496c feat: correct max-depth handling for else-if chains (#20944) (Pixel998)

c296873 feat: update error loc in max-statements to function header (#20907) (Taejin Kim)

Documentation

... (truncated)

Commits

5d12a04 10.6.0
f7ca54b Build: changelog update for 10.6.0
6a42034 ci: run ecosystem tests on main branch (#20891)
b1f9106 feat: detect Symbol() and BigInt() in no-constant-binary-expression (#20981)
3dbacdb ci: bump actions/checkout from 6 to 7 (#21014)
c3abfca chore: correct JSDoc param types in html formatter (#21018)
a83683d docs: Update README
a832320 ci: split ecosystem tests into separate jobs (#21001)
6b05784 fix: prefer-exponentiation-operator invalid autofix at statement start (#20997)
bb9eb2a fix: account for shadowed Boolean in no-extra-boolean-cast (#21013)
Additional commits viewable in compare view

Updates eslint-plugin-react-hooks from 5.2.0 to 7.1.1

Release notes

Sourced from eslint-plugin-react-hooks's releases.

eslint-plugin-react-hooks@7.1.1 (April 17, 2026)

Note: 7.1.0 accidentally removed the component-hook-factories rule, causing errors for users who referenced it in their ESLint config. This is now fixed.

Add deprecated no-op component-hook-factories rule for backwards compatibility. (@mofeiZ in #36307)

eslint-plugin-react-hooks@7.1.0 (April 16, 2026)

This release adds ESLint v10 support, improves performance by skipping compilation for non-React files, and includes compiler lint improvements including better set-state-in-effect detection, improved ref validation, and more helpful error reporting.

Add ESLint v10 support. (@azat-io in #35720)

Skip compilation for non-React files to improve performance. (@josephsavona in #35589)

Fix exhaustive deps bug with Flow type casting. (@jorge-cab in #35691)

Fix useEffectEvent checks in component syntax. (@jbrown215 in #35041)

Improved set-state-in-effect validation with fewer false negatives. (@jorge-cab in #35134, @josephsavona in #35147, @jackpope in #35214, @chesnokov-tony in #35419, @jsleitor in #36107)

Improved ref validation for non-mutating functions and event handler props. (@josephsavona in #35893, @kolvian in #35062)

Compiler now reports all errors instead of stopping at the first. (@josephsavona in #35873–#35884)

Improved source locations and error display in compiler diagnostics. (@nathanmarks in #35348, @josephsavona in #34963)

Changelog

Sourced from eslint-plugin-react-hooks's changelog.

7.1.1

Note: 7.1.0 accidentally removed the component-hook-factories rule, causing errors for users who referenced it in their ESLint config. This is now fixed.

Add deprecated no-op component-hook-factories rule for backwards compatibility. (@mofeiZ in #36307)

7.1.0

This release adds ESLint v10 support, improves performance by skipping compilation for non-React files, and includes compiler lint improvements including better set-state-in-effect detection, improved ref validation, and more helpful error reporting.

Add ESLint v10 support. (@azat-io in #35720)

Skip compilation for non-React files to improve performance. (@josephsavona in #35589)

Fix exhaustive deps bug with Flow type casting. (@jorge-cab in #35691)

Fix useEffectEvent checks in component syntax. (@jbrown215 in #35041)

Improved set-state-in-effect validation with fewer false negatives. (@jorge-cab in #35134, @josephsavona in #35147, @jackpope in #35214, @chesnokov-tony in #35419, @jsleitor in #36107)

Improved ref validation for non-mutating functions and event handler props. (@josephsavona in #35893, @kolvian in #35062)

Compiler now reports all errors instead of stopping at the first. (@josephsavona in #35873–#35884)

Improved source locations and error display in compiler diagnostics. (@nathanmarks in #35348, @josephsavona in #34963)

7.0.1

Disallowed passing inline useEffectEvent values as JSX props to guard against accidental propagation. (#34820 by @jf-eirinha)

Switch to export = so eslint-plugin-react-hooks emits correct types for consumers in Node16 ESM projects. (#34949 by @karlhorky)

Tightened the typing of configs.flat so the configs export is always defined. (#34950 by @poteto)

Fix named import runtime errors. (#34951, #34953 by @karlhorky)

7.0.0

This release slims down presets to just 2 configurations (recommended and recommended-latest), and all compiler rules are enabled by default.

Breaking: Removed recommended-latest-legacy and flat/recommended configs. The plugin now provides recommended (legacy and flat configs with all recommended rules), and recommended-latest (legacy and flat configs with all recommended rules plus new bleeding edge experimental compiler rules). (@poteto in #34757)

6.1.1

Note: 6.1.0 accidentally allowed use of recommended without flat config, causing errors when used with ESLint v9's defineConfig() helper. This has been fixed in 6.1.1.

Fix recommended config for flat config compatibility. The recommended config has been converted to flat config format. Non-flat config users should use recommended-legacy instead. (@poteto in #34700)

Add recommended-latest and recommended-latest-legacy configs that include React Compiler rules. (@poteto in #34675)

Remove unused NoUnusedOptOutDirectives rule. (@poteto in #34703)

Remove hermes-parser and dependency. (@poteto in #34719)

Remove @babel/plugin-proposal-private-methods dependency. (@ArnaudBarre and @josephsavona in #34715)

Update for Zod v3/v4 compatibility. (@kolian and @josephsavona in #34717)

6.1.0

Note: Version 6.0.0 was mistakenly released and immediately deprecated and untagged on npm. This is the first official 6.x major release and includes breaking changes.

Breaking: Require Node.js 18 or newer. (@michaelfaith in #32458)

Breaking: Flat config is now the default recommended preset. Legacy config moved to recommended-legacy. (@michaelfaith in #32457)

New Violations: Disallow calling use within try/catch blocks. (@poteto in #34040)

... (truncated)

Commits

See full diff in compare view

Updates eslint-plugin-react-refresh from 0.4.26 to 0.5.3

Release notes

Sourced from eslint-plugin-react-refresh's releases.

v0.5.3

Fix check for non component class exported via export { } #110 (fixes #109)

v0.5.2

Support nested function calls for extraHOCs (actually fixes #104)

v0.5.1

Mark ESLint v10 as supported

Support false positives with TypeScript function overloading (fixes #105)

Support nested function calls for extraHOCs (fixes #104)

v0.5.0

Breaking changes

The package now ships as ESM and requires ESLint 9 + node 20. Because legacy config doesn't support ESM, this requires to use flat config

A new reactRefresh export is available and prefered over the default export. It's an object with two properties:

plugin: The plugin object with the rules

configs: An object containing configuration presets, each exposed as a function. These functions accept your custom options, merge them with sensible defaults for that config, and return the final config object.

customHOCs option was renamed to extraHOCs

Validation of HOCs calls is now more strict, you may need to add some HOCs to the extraHOCs option (like connect or styled)

Config example:
import { defineConfig } from "eslint/config";
import { reactRefresh } from "eslint-plugin-react-refresh";
export default defineConfig(
/* Main config */
reactRefresh.configs.vite({ extraHOCs: ["someLibHOC"] }),
);
Config example without config:
import { defineConfig } from "eslint/config";
import { reactRefresh } from "eslint-plugin-react-refresh";
export default defineConfig({
files: ["/*.ts", "/*.tsx"],
plugins: {
// other plugins
"react-refresh": reactRefresh.plugin,
},
rules: {
// other rules
"react-refresh/only-export-components": [
"warn",
{ extraHOCs: ["someLibHOC"] },
</tr></table>

... (truncated)

Changelog

Sourced from eslint-plugin-react-refresh's changelog.

0.5.3

Fix check for non component class exported via export { } #110 (fixes #109)

0.5.2

Support nested function calls for extraHOCs (actually fixes #104)

0.5.1

Mark ESLint v10 as supported

Support false positives with TypeScript function overloading (fixes #105)

Support nested function calls for extraHOCs (fixes #104)

0.5.0

Breaking changes

The package now ships as ESM and requires ESLint 9 + node 20. Because legacy config doesn't support ESM, this requires to use flat config

A new reactRefresh export is available and prefered over the default export. It's an object with two properties:

plugin: The plugin object with the rules

configs: An object containing configuration presets, each exposed as a function. These functions accept your custom options, merge them with sensible defaults for that config, and return the final config object.

customHOCs option was renamed to extraHOCs

Validation of HOCs calls is now more strict, you may need to add some HOCs to the extraHOCs option

Config example:
import { defineConfig } from "eslint/config";
import { reactRefresh } from "eslint-plugin-react-refresh";
export default defineConfig(
/* Main config */
reactRefresh.configs.vite({ extraHOCs: ["someLibHOC"] }),
);
Config example without config:
import { defineConfig } from "eslint/config";
import { reactRefresh } from "eslint-plugin-react-refresh";
export default defineConfig({
files: ["/*.ts", "/*.tsx"],
plugins: {
// other plugins
"react-refresh": reactRefresh.plugin,
},
rules: {
</tr></table>

... (truncated)

Commits

00818e9 v0.5.3 [publish]
202fc4a Fix PascalCase class exported via export { Name } incorrectly treated as Re...
c0317bf Fix support for nested function calls for extraHOCs [publish]
42a1805 Explicit v10 support (fixes #106) [publish]
199793e Support nested function calls for extraHOCs (fixes #104)
26b3c15 Support false positives with TypeScript function overloading (fixes #105)
daa2efb Revamp logic to catch more cases [publish] (#97)
See full diff in compare view

Updates postcss from 8.5.15 to 8.5.16

Release notes

Sourced from postcss's releases.

8.5.16

Fixed Input#origin() position (by @mizdra).

Fixed raws after rehydrating a JSON AST (by @sarathfrancis90).

Fixed putting parent-less node in nodes of new node (by @MahinAnowar).

Fixed computing offset in positionBy() (by @greymoth-jp).

Fixed rangeBy() on index: 0 (by @sarathfrancis90).

Changelog

Sourced from postcss's changelog.

8.5.16

Fixed Input#origin() position (by @mizdra).

Fixed raws after rehydrating a JSON AST (by @sarathfrancis90).

Fixed putting parent-less node in nodes of new node (by @MahinAnowar).

Fixed computing offset in positionBy() (by @greymoth-jp).

Fixed rangeBy() on index: 0 (by @sarathfrancis90).

Commits

92ccc93 Release 8.5.16 version
818bdd6 Update formatting
46e4510 Fix Input#origin() returning incorrect position (#2036)
34942ce Fix tests
d4feed6 Don't clone root-less child nodes in container constructor (#2097)
da323fc Revert version update to fix old Node.js on CI
8863369 Update dependencies
3828982 Preserve node raws when rehydrating a JSON AST (#2100)
d1e80b8 Fix Node#rangeBy() ignoring index 0 (#2091)
b91e4a6 Fix Node.js 26 tests
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for postcss since your current version.

Updates tailwindcss from 3.4.19 to 4.3.2

Release notes

Sourced from tailwindcss's releases.

v4.3.2

Fixed

Support bare spacing values for auto-rows-* and auto-cols-* utilities (e.g. auto-rows-12 and auto-cols-16) (#20229)

Prevent @tailwindcss/cli in --watch mode from crashing on Windows when @source points to a directory that doesn't exist (#20242)

Prevent @tailwindcss/vite from crashing in Deno v2.8.x when context.parentURL is not a valid URL (#20245)

Ensure @tailwindcss/cli in --watch mode rebuilds when the input CSS file changes in an ignored directory (#20246)

Allow @variant rules used in addBase(…) to use custom variants defined later (#20247)

Prevent @tailwindcss/vite from crashing during HMR when scanned files or directories are deleted (#20259)

Generate font-size instead of color declarations for text-[--spacing(…)] (#20260)

Prevent @source patterns from scanning unrelated sibling files and folders (#20263)

Extract class candidates adjacent to Template Toolkit delimiters like %]…[% in .tt, .tt2, and .tx files (#20269)

Extract class candidates from conditional Maud syntax like p.text-black[condition] (#20269)

Prevent @position-try rules from triggering unknown at-rule warnings when optimizing CSS (#20277)

Support class suggestions for named opacity modifiers from --opacity theme values (#20287)

Prevent type errors in @tailwindcss/postcss when used with newer PostCSS patch releases (#20289)

v4.3.1

Added

Add --silent option to suppress output in @tailwindcss/cli (#20100)

Fixed

Remove deprecation warnings by using Module#registerHooks instead of Module#register on Node 26+ (#20028)

Canonicalization: don't crash when plugin utilities throw for unsupported values (#20052)

Allow @apply to be used with CSS mixins (#19427)

Ensure not-* correctly negates @container queries, including style(…) queries (#20059)

Ensure drop-shadow-* color utilities work with custom shadow values containing calc(…) (#20080)

Fix 'Sourcemap is likely to be incorrect' warnings when using @tailwindcss/vite (#20103)

Ensure @tailwindcss/webpack can be installed in Rspack projects without requiring webpack as a peer dependency (#20027)

Canonicalization: don't suggest invalid calc(…) expressions (e.g. px-[calc(1rem+0px)] → px-[calc(1rem+0)]) (#20127)

Canonicalization: avoid suggesting large spacing-scale values for arbitrary lengths (e.g. left-[99999px] → left-[99999px], not left-24999.75) (#20130)

Ensure @tailwindcss/cli in --watch mode recovers when a tracked dependency is deleted and restored (#20137)

Ensure standalone @tailwindcss/cli binaries are ignored when scanning for class candidates (#20139)

Ensure class candidates are extracted from Twig addClass(…) and removeClass(…) calls (#20198)

Don't crash in the Ruby or Vue preprocessors when scanning files containing invalid UTF-8 bytes (#19588)

Allow @variant to be used inside addBase (#19480)

Ensure @source globs with symlinks are preserved (#20203)

Ensure later @source rules can re-include files excluded by earlier @source not rules (#20203)

Upgrade: don't migrate empty class rules to invalid @utility rules (#20205)

Ensure transitions between inset-shadow-none and other inset shadows work correctly (#20208)

Ensure explicitly referenced @source directories are scanned even when ignored by git (#20214)

Ensure @source globs ending in **/* preserve dynamic path segments to avoid scanning too many files (#20217)

Canonicalization: don't fold calc(…) divisions when the result would require high precision (e.g. w-[calc(100%/3.5)] → w-[calc(100%/3.5)], not w-[28.571428571428573%]) (#20221)

Serve ESM type declarations to ESM importers of @tailwindcss/postcss (#20228)

Changed

Generate 0 instead of calc(var(--spacing) * 0) for spacing utilities like m-0 and left-0 (#20196)

... (truncated)

Changelog

Sourced from tailwindcss's changelog.

[4.3.2] - 2026-06-26

Fixed

Support bare spacing values for auto-rows-* and auto-cols-* utilities (e.g. auto-rows-12 and auto-cols-16) (#20229)

Prevent @tailwindcss/cli in --watch mode from crashing on Windows when @source points to a directory that doesn't exist (#20242)

Prevent @tailwindcss/vite from crashing in Deno v2.8.x when context.parentURL is not a valid URL (#20245)

Ensure @tailwindcss/cli in --watch mode rebuilds when the input CSS file changes in an ignored directory (#20246)

Allow @variant rules used in addBase(…) to use custom variants defined later (#20247)

Prevent @tailwindcss/vite from crashing during HMR when scanned files or directories are deleted (#20259)

Generate font-size instead of color declarations for text-[--spacing(…)] (#20260)

Prevent @source patterns from scanning unrelated sibling files and folders (#20263)

Extract class candidates adjacent to Template Toolkit delimiters like %]…[% in .tt, .tt2, and .tx files (#20269)

Extract class candidates from conditional Maud syntax like p.text-black[condition] (#20269)

Prevent @position-try rules from triggering unknown at-rule warnings when optimizing CSS (#20277)

Support class suggestions for named opacity modifiers from --opacity theme values (#20287)

Prevent type errors in @tailwindcss/postcss when used with newer PostCSS patch releases (#20289)

[4.3.1] - 2026-06-12

Added

Add --silent option to suppress output in @tailwindcss/cli (#20100)

Fixed

Remove deprecation warnings by using Module#registerHooks instead of Module#register on Node 26+ (#20028)

Canonicalization: don't crash when plugin utilities throw for unsupported values (#20052)

Allow @apply to be used with CSS mixins (#19427)

Ensure not-* correctly negates @container queries, including style(…) queries (#20059)

Ensure drop-shadow-* color utilities work with custom shadow values containing calc(…) (#20080)

Fix 'Sourcemap is likely to be incorrect' warnings when using @tailwindcss/vite (#20103)

Ensure @tailwindcss/webpack can be installed in Rspack projects without requiring webpack as a peer dependency (#20027)

Canonicalization: don't suggest invalid calc(…) expressions (e.g. px-[calc(1rem+0px)] → px-[calc(1rem+0)]) (#20127)

Canonicalization: avoid suggesting large spacing-scale values for arbitrary lengths (e.g. left-[99999px] → left-[99999px], not left-24999.75) (#20130)

Ensure @tailwindcss/cli in --watch mode recovers when a tracked dependency is deleted and restored (#20137)

Ensure standalone @tailwindcss/cli binaries are ignored when scanning for class candidates (#20139)

Ensure class candidates are extracted from Twig addClass(…) and removeClass(…) calls (#20198)

Don't crash in the Ruby or Vue preprocessors when scanning files containing invalid UTF-8 bytes (#19588)

Allow @variant to be used inside addBase (#19480)

Ensure @source globs with symlinks are preserved (#20203)

Ensure later @source rules can re-include files excluded by earlier @source not rules (#20203)

Upgrade: don't migrate empty class rules to invalid @utility rules (#20205)

Ensure transitions between inset-shadow-none and other inset shadows work correctly (#20208)

Ensure explicitly referenced @source directories are scanned even when ignored by git (#20214)

Ensure @source globs ending in **/* preserve dynamic path segments to avoid scanning too many files (#20217)

Canonicalization: don't fold calc(…) divisions when the result would require high precision (e.g. w-[calc(100%/3.5)] → w-[calc(100%/3.5)], not w-[28.571428571428573%]) (#20221)

Serve ESM type declarations to ESM importers of @tailwindcss/postcss (#20228)

Changed

... (truncated)

Commits

056a155 4.3.2 (#20281)
c8b081d Add suggestions for named opacity modifiers (#20287)
c46f654 Ensure --alpha(…) is seen as a color, and --spacing(…) is seen as a `le...
5e9f66e Ensure @variant can be used in JS based APIs (#20252)
707c23b Ensure custom variants can be used via @variant in addBase (#20247)
127d170 Add bare value support for auto-rows-* and auto-cols-* (#20229)
8a14a71 4.3.1 (#20226)
12833aa Fix canonicalization bug where we end up with a high precision number (#20221)
97a5b3a docs: fix double word 'to to' in test comment (#20216)
d01e103 Add missing inset keyword for inset-shadow-none (#20208)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for tailwindcss since your current version.

Updates typescript from 5.9.3 to 6.0.3

Release notes

Sourced from typescript's releases.

TypeScript 6.0.3

For release notes, check out the ...
Description has been truncated

dependabot · 2026-04-24T14:50:49Z

Labels

The following labels could not be found: dependencies, security. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

dependabot · 2026-05-02T17:55:37Z