chore(deps): bump the npm-minor-patch group across 1 directory with 21 updates

[dependabot]

Bumps the npm-minor-patch group with 20 updates in the /frontend directory:

Package	From	To
mermaid	11.15.0	11.16.0
sanitize-html	2.17.4	2.17.6
@inlang/paraglide-js	2.18.2	2.21.0
@playwright/test	1.60.0	1.61.1
@sveltejs/adapter-node	5.5.4	5.5.7
@sveltejs/kit	2.63.1	2.69.2
@tailwindcss/vite	4.3.0	4.3.2
@testing-library/svelte	5.3.1	5.4.2
@unocss/extractor-svelte	66.7.0	66.7.5
@unocss/preset-icons	66.7.0	66.7.5
@unocss/preset-wind4	66.7.0	66.7.5
eslint	10.4.1	10.7.0
eslint-plugin-svelte	3.19.0	3.20.0
globals	17.6.0	17.7.0
prettier	3.8.3	3.9.5
svelte	5.56.3	5.56.4
svelte-check	4.6.0	4.7.2
typescript-eslint	8.60.1	8.63.0
unocss	66.7.0	66.7.5
vitest	4.1.8	4.1.10

Updates mermaid from 11.15.0 to 11.16.0

Release notes

Sourced from mermaid's releases.

mermaid@11.16.0

Minor Changes

• #7535 ea1c48f Thanks @​ragelink! - feat(cynefin): Adds the Cynefin framework as a new diagram type (beta) to Mermaid (available as cynefin-beta). The Cynefin framework, created by Dave Snowden, is a decision-making framework that categorizes problems into five complexity domains, widely used in agile, incident management, strategy, and organizational design.

• #7721 f45cc2c Thanks @​notionparallax! - feat(treeView): add box-drawing character input support for treeView diagrams

• #7550 f1f4d45 Thanks @​DominicBurkart! - feat(xychart): add per-point text labels for xychart line plots

• #7527 b4d0442 Thanks @​notionparallax! - feat(treeView): Extends the existing treeView-beta diagram with features useful for representing file/directory structures.

• #7793 a6f097d Thanks @​SSDWGG! - feat(er): support optional ER attribute types with a ? suffix

• #7772 37f2e36 Thanks @​devareddy05! - feat(gantt): support multiple excludes / includes lines so long exclusion lists can be split into commented groups (#6270)

• #7708 4e63e9d Thanks @​txmxthy! - feat(architecture): add align row|column {ids…} directive to architecture-beta diagrams so authors can declare horizontal or vertical alignment of services explicitly.

• #7760 05223be Thanks @​ngdaniels! - feat(pie): Enhance Pie Chart - Enable donut chart, Set legend position, and highlight slice

• #7251 216e4e9 Thanks @​ydah! - feat(railroad): Add support for Railroad Diagrams (Syntax Diagrams) with four input syntaxes: IR (railroad-beta), EBNF (railroad-ebnf-beta), ABNF (railroad-abnf-beta), and PEG (railroad-peg-beta).

• #7774 e5c75e6 Thanks @​ngdaniels! - feat(xychart): enable rotate label on X-axis

• #7791 974fa7b Thanks @​knsv-bot! - feat(swimlane): add swimlane as a standalone diagram type with a dedicated layered orthogonal layout algorithm

Patch Changes

• #7744 633c261 Thanks @​ashishjain0512! - fix(architecture): add architecture.seed config option to make architecture diagrams render deterministically. Resolves #7729.

• #7732 c8ba156 Thanks @​rkdfx! - fix: tolerate leading horizontal whitespace before YAML frontmatter delimiters. Closes mermaid-js/mermaid#7613

• #7314 4e4e6c4 Thanks @​darshanr0107! - fix(flowchart): Prevent crash when flowchart node shape is undefined

• #7762 cfd2391 Thanks @​Dharya-dev! - fix(class): support styling and callbacks for generic classes

• #7284 c1f116d Thanks @​darshanr0107! - fix(gantt): Render gantt vertical markers without affecting row layout or chart height

• #7786 72fbab1 Thanks @​knsv-bot! - fix(er): allow special characters (e.g. dots) in ER diagram attribute names and types by escaping them with backticks

• #7672 4887e97 Thanks @​sjackson0109! - fix(flowchart): respect per-subgraph direction keyword in Dagre layout. Fixes #4648

• #7734 a4c1e50 Thanks @​OfirHaf! - fix(block): read block padding and sanitize config dynamically instead of at module load time

• #7674 cc75089 Thanks @​cyphercodes! - fix(block): respect current DOMPurify config when sanitizing labels

• #7711 be2e282 Thanks @​Jinacker! - fix(flowchart): render flowchart and state self-loop edges as a single SVG path.

• #7781 d945968 Thanks @​Dharya-dev! - fix(radar): align axis labels based on angular position to prevent clipping

• #7661 2f5e9e8 Thanks @​nabila401! - fix(venn): fix 3-circle venn diagram union rendering

... (truncated)

Commits

• 7c0cafc Version Packages: v11.16.0 (#7916)
• 26acd1a Merge pull request #7915 from mermaid-js/release/11.16.0
• 5a8eae7 Merge branch 'master' into release/11.16.0
• dd5ea77 Merge pull request #7913 from mermaid-js/pebr/fix-changesets
• 658ee66 docs: fix missing bumps of @mermaid-js/parser
• 04259a1 docs: fix author and commit on examples changeset
• c9dcfb1 docs: update changeset diagram scopes
• a34dab9 docs: remove swimlane/cynefin bugfix changesets
• e81f31f docs: remove local-editor changeset
• 7223f03 Minor correction
• Additional commits viewable in compare view

Updates sanitize-html from 2.17.4 to 2.17.6

Changelog

Sourced from sanitize-html's changelog.

2.17.6 (2026-07-10)

Fixes

• Allow transformTags to emit text when textFilter is set, even if the tag is initially empty. This is consistent with the documentation. Thanks to spokodev for the fix.

Security

• Fixed an XSS/allowlist bypass in which the contents of a raw-text element (textarea or xmp) nested inside an svg or math root were re-emitted without HTML-escaping. sanitize-html treated that content as inert raw text because htmlparser2 10.x classified raw-text elements by tag name and ignored the namespace, but a real HTML5 parser treats textarea/xmp as ordinary foreign elements inside SVG/MathML and re-parses their contents as live markup. As a result, markup and event-handler attributes that the allowlist never permitted (for example <svg><textarea><img src=x onerror=alert(1)>) could survive sanitization and execute in the browser. This is now fixed on two fronts: htmlparser2 was upgraded to 12.x, which is namespace-aware and parses textarea/xmp inside SVG/MathML as ordinary elements, so their non-allowlisted children (such as the injected img) are dropped by the allowlist instead of being preserved as raw text; and any raw-text content sanitize-html still emits for these tags (at HTML integration points such as foreignObject/mtext, or outside foreign content) is always HTML-escaped. The default configuration is not affected; the precondition is an allowedTags that includes svg or math together with textarea or xmp. Thanks to khoadb175 for responsibly disclosing the vulnerability.
• Fixed a mutation-XSS / allowedTags bypass affecting configurations that allow the textarea or xmp raw-text tags. htmlparser2 10.x did not recognize an end tag with a trailing solidus (e.g. </textarea/>) as closing the element, so it kept the following markup as raw text, but a spec-compliant browser treats </textarea/> as a valid close and parses that markup as a live element. Because raw-text content was re-emitted without escaping, a payload such as <textarea></textarea/><img src=x onerror=...> could smuggle non-allowlisted, executable markup through the sanitizer. The default configuration was not affected. This is now defended at two layers: htmlparser2 was upgraded to 12.x, whose tokenizer closes these end tags correctly, and the raw text sanitize-html emits for these tags is always escaped so no < can reopen a tag when the output is re-parsed (textarea, an RCDATA element whose entities htmlparser2 decodes, is escaped like normal text, while xmp, a raw-text element, has only its angle brackets escaped to avoid double-encoding already-encoded entities). Because htmlparser2 is ESM-only from version 11 onward, sanitize-html now requires Node.js >=22.12.0 (the first 22.x release in which require() of an ES module is available unflagged). Thanks to bibu123456 for reporting the vulnerability and Kayiz-PT for coordinating the disclosure (GHSA-jxwj-j7wr-gfrw).

2.17.5 (2026-06-10)

Security

• Added a number of new attributes to be protected against unsafe URLs, e.g. javascript: and similar. None of these are used in the default configuration of sanitize-html or apostrophe or likely to be used there, and some attributes, like an action for a form, are inherently unsafe to allow if XSS protection is your goal. Nevertheless it makes sense to block certain URL types where they are not appropriate. Some attributes are not supported at all by modern browsers but are included for completeness. Thanks to crattack for reporting the vulnerability.
• Address a potential vulnerability when nonTextTags is configured in a nonstandard way. While it is never a good idea to remove known non-text tags from the standard list e.g. script, styles, etc., this change ensures that doing so does not result in nested tags being passed through without sanitization when they are not expressly allowed. (ApostropheCMS would never trigger this situation.) Thanks to Dipanshu singh for pointing out the issue and contributing the fix.

Commits

• See full diff in compare view

Updates @inlang/paraglide-js from 2.18.2 to 2.21.0

Changelog

Sourced from @​inlang/paraglide-js's changelog.

2.21.0

Minor Changes

• ab5bfc7: fix emitTsDeclarations with TypeScript 7 opral/paraglide-js#711

  TypeScript 7 (the Go-based compiler) no longer ships the in-process compiler API that Paraglide used to generate .d.ts files, which made paraglide-js compile --emit-ts-declarations fail with TypeError: Cannot read properties of undefined (reading 'ESNext'). Paraglide now detects this and invokes TypeScript's tsc CLI instead. TypeScript 5 and 6 keep using the compiler API as before.

  Note that the declaration output of TypeScript 7 differs cosmetically from TypeScript 5/6 (quote style, declaration ordering, export declare const vs export const) but is semantically equivalent.

2.20.2

Patch Changes

• a48e767: Cache client cookie locale extraction for synchronous message bursts.

2.20.1

Patch Changes

• 8c3493d: Fix server cookie locale parsing when Cookie headers omit whitespace after semicolons.

2.20.0

Minor Changes

• 2c34351: Emit messages/package.json with { "type": "module", "sideEffects": false } for message-modules output, declaring the generated message modules side-effect-free.

  This lets bundlers (notably Vite 8 / Rolldown) drop unused re-exports from the m barrel per entry, instead of bundling every message used anywhere in the app into one shared chunk that every entry downloads. Without it, per-page JS scales with the union of all messages used across the app rather than with the messages a given route actually uses.

  The declaration is scoped to messages/, so runtime.js (which has real side effects) is unaffected. type: "module" is included because the package.json creates a new module scope for messages/; without it, the generated ESM files would default to CommonJS (a package.json without type is CJS in Node, even when the consuming project is type: "module").

  See opral/paraglide-js#668

Patch Changes

• 921c3be: experimentalMiddlewareLocaleSplitting: the injected inline script now reuses the nonce from the response's Content-Security-Policy header, so it is allowed under a strict CSP instead of being blocked and breaking hydration. Automatic - no configuration needed.

2.19.0

Minor Changes

• 67a8942: Compile pattern-level function-reference annotations to registry calls

  Annotations attached directly to pattern expressions (e.g. i18next's {{count, number}} imported via plugin-i18next) were silently dropped and compiled to plain interpolation. They now compile through the same registry.* path as local-variable annotations:

  // before
  const en_views = (i) => `${i?.count} views`;
  // after

... (truncated)

Commits

• See full diff in compare view

Updates @playwright/test from 1.60.0 to 1.61.1

Release notes

Sourced from @​playwright/test's releases.

v1.61.1

Bug Fixes

• #41365 [Bug]: Expect.Extend matcher with same name as default matcher in same expect instance overrides default matchers implementation to custom matcher
• #41351 [Bug]: Playwright UI mode: apiRequestContext._wrapApiCall reports unexpected number of bytes (same test passes in headed mode)
• #41360 [Bug]: Trace viewer: message times in websockets are downscaled by 1000
• #41311 [Bug]: [Regression]: Sync loader throws "context.conditions?.includes is not a function" on Node 22.15
• #41371 [Regression]: Sync ESM loader (registerHooks) fails to resolve extensionless .ts subpath imports across pnpm workspace symlinks

v1.61.0

🔑 WebAuthn passkeys

New Credentials virtual authenticator, available via browserContext.credentials, lets tests register passkeys and answer navigator.credentials.create() / navigator.credentials.get() ceremonies in the page — no real hardware key required, works in all browsers:

const context = await browser.newContext();
// Seed a passkey your backend provisioned for a test user.
await context.credentials.create('example.com', {
id: credentialId,
userHandle,
privateKey,
publicKey,
});
await context.credentials.install();
const page = await context.newPage();
await page.goto('https://example.com/login');
// The page's navigator.credentials.get() is answered with the seeded passkey.

You can also let the app register a passkey once in a setup test, read it back with credentials.get(), and seed it into later tests — see Credentials for details.

🗃️ Web Storage

New WebStorage API, available via page.localStorage and page.sessionStorage, reads and writes the page's storage for the current origin:

await page.localStorage.setItem('token', 'abc');
const token = await page.localStorage.getItem('token');
const items = await page.sessionStorage.items();

New APIs

Network

• apiResponse.securityDetails() and apiResponse.serverAddr() mirror the browser-side response.securityDetails() and response.serverAddr().

Browser and Screencast

... (truncated)

Commits

• 39e3553 cherry-pick(#41399): fix(test): load require-reached files as commonjs in syn...
• 4328122 chore: mark v1.61.1 (#41404)
• 2c29a94 fix(tracing): stop recording websocket frames outside of chunks (#41398)
• 4324b19 cherry-pick(#41367): fix(test): keep builtin expect matchers on base extend
• 041e7e3 cherry-pick(#41364): fix(har): WebSocket message timestamps should be in mi...
• b8a0fc3 cherry-pick(#41309, #43149): Revert "fix(firefox): treat `navigationCommitted...
• b5a3175 cherry-pick(#41319): fix(loader): support other node versions
• d4724a9 cherry-pick(#41290): feat(docker): add Ubuntu 26.04 (Resolute Raccoon) image
• 1cc5a90 cherry-pick(#41295): chore: PLAYWRIGHT_TRACING_NO_WEBSOCKET_FRAMES and PLAYWR...
• a6772bd cherry-pick(#41280): Revert "fix(trace-viewer): add keyboard navigation to `N...
• Additional commits viewable in compare view

Updates @sveltejs/adapter-node from 5.5.4 to 5.5.7

Release notes

Sourced from @​sveltejs/adapter-node's releases.

@​sveltejs/adapter-node@​5.5.7

Patch Changes

• fix: add X-Accel-Buffering: no header to text/event-stream responses to prevent reverse proxies such as nginx from buffering streamed responses (#16156)

• fix: delete existing socket file on startup (#15449)

• Updated dependencies [c426c6e, 81f253e, 8d3c865, 6bde3b6, 9161740, 2184960, 5e319b6, e82a0a8]:

  • @​sveltejs/kit@​2.68.0

@​sveltejs/adapter-node@​5.5.6

Patch Changes

• fix: avoid circular dependency between server initialisation and hook retrieval that causes the app to crash on start (#16115)

• fix: correctly resolve root directory on the server (#16114)

• fix: ensure ENV_PREFIX is defined (#16106)

• Updated dependencies [cf15fa0, 5c76121, 2992e17]:

  • @​sveltejs/kit@​2.67.0

@​sveltejs/adapter-node@​5.5.5

Patch Changes

• fix: bundle entrypoints alongside app code (#16069)

• fix: log the actual adapter-node listening address (#15899)

• Updated dependencies [63f1b0b, 1dbff3f, 961ba01, d2e108c, d2e108c, d2e108c, 860b3c7, f8c842c, d3aa5fe, 0dd7659, 03e9f66, 57b7b7b, 4eabadc, 6fbf2b6, 276744d, 8740132, f430a68, 1c7a8dc]:

  • @​sveltejs/kit@​2.66.0

Changelog

Sourced from @​sveltejs/adapter-node's changelog.

5.5.7

Patch Changes

• fix: add X-Accel-Buffering: no header to text/event-stream responses to prevent reverse proxies such as nginx from buffering streamed responses (#16156)

• fix: delete existing socket file on startup (#15449)

• Updated dependencies [c426c6e, 81f253e, 8d3c865, 6bde3b6, 9161740, 2184960, 5e319b6, e82a0a8]:

  • @​sveltejs/kit@​2.68.0

5.5.6

Patch Changes

• fix: avoid circular dependency between server initialisation and hook retrieval that causes the app to crash on start (#16115)

• fix: correctly resolve root directory on the server (#16114)

• fix: ensure ENV_PREFIX is defined (#16106)

• Updated dependencies [cf15fa0, 5c76121, 2992e17]:

  • @​sveltejs/kit@​2.67.0

5.5.5

Patch Changes

• fix: bundle entrypoints alongside app code (#16069)

• fix: log the actual adapter-node listening address (#15899)

• Updated dependencies [63f1b0b, 1dbff3f, 961ba01, d2e108c, d2e108c, d2e108c, 860b3c7, f8c842c, d3aa5fe, 0dd7659, 03e9f66, 57b7b7b, 4eabadc, 6fbf2b6, 276744d, 8740132, f430a68, 1c7a8dc]:

  • @​sveltejs/kit@​2.66.0

Commits

• fef1827 Version Packages (#16142)
• 2633f6a fix: add X-Accel-Buffering: no header to text/event-stream responses (#16...
• c6c0d6b fix: EADDRINUSE: address already in use - when a stale SOCKET_PATH file alrea...
• 118af9d chore: move Node adapter e2e tests to platform tests (#16136)
• c5d0e83 Version Packages (#16086)
• c54613f chore: add failing tests for adapter-node (#16104)
• 6ddf670 fix: avoid circular dependency (#16115)
• 6261b50 fix: ensure server root directory is resolved correctly (#16114)
• 8e418cf chore: add descriptions to Node adapter options (#16105)
• ea309d4 fix: ensure ENV_PREFIX.length works (#16106)
• Additional commits viewable in compare view

Updates @sveltejs/kit from 2.63.1 to 2.69.2

Release notes

Sourced from @​sveltejs/kit's releases.

@​sveltejs/kit@​2.69.2

Patch Changes

• fix: set define values on globalThis when running Vitest (#16246)

@​sveltejs/kit@​2.69.1

Patch Changes

• fix: prevent prototype pollution when deleting file inputs (#16218)

• fix: prevent unhandled promise rejection (#16219)

@​sveltejs/kit@​2.69.0

Minor Changes

• feat: expose submitted property of remote forms (#14811)

Patch Changes

• fix: clear issues and touched states on form reset (#16163)

• fix: return undefined from fields.branch.issues() when only fields.branch.leaf has issues (#16187)

@​sveltejs/kit@​2.68.0

Minor Changes

• feat: expose RemoteFormEnhanceInstance and RemoteFormEnhanceCallback types (#15816)

• feat: set value of submit fields when form is submitted (#15979)

Patch Changes

• fix: skip native_navigation when __data.json returns 404 on a static fallback page (#16135)

• fix: ignore third-party monkeypatches in pushState/replaceState warning detection (#15267)

• fix: snapshot form fields on read (#16150)

... (truncated)

Changelog

Sourced from @​sveltejs/kit's changelog.

2.69.2

Patch Changes

• fix: set define values on globalThis when running Vitest (#16246)

2.69.1

Patch Changes

• fix: prevent prototype pollution when deleting file inputs (#16218)

• fix: prevent unhandled promise rejection (#16219)

2.69.0

Minor Changes

• feat: expose submitted property of remote forms (#14811)

Patch Changes

• fix: clear issues and touched states on form reset (#16163)

• fix: return undefined from fields.branch.issues() when only fields.branch.leaf has issues (#16187)

2.68.0

Minor Changes

• feat: expose RemoteFormEnhanceInstance and RemoteFormEnhanceCallback types (#15816)

• feat: set value of submit fields when form is submitted (#15979)

Patch Changes

• fix: skip native_navigation when __data.json returns 404 on a static fallback page (#16135)

• fix: ignore third-party monkeypatches in pushState/replaceState warning detection (#15267)

• fix: snapshot form fields on read (#16150)

... (truncated)

Commits

• 1b4adcc Version Packages (#16250)
• a5bd7e2 fix: set define values on globalThis when running Vitest (#16246)
• d89edcc Version Packages (#16221)
• 82b0370 fix: prevent unhandled promise rejection (#16219)
• df32f6f fix: prevent prototype pollution when deleting file inputs (#16218)
• 18801ae Version Packages (#16167)
• fd628a5 fix: return undefined from fields.branch.issues() when only `fields.branc...
• 4f6bcbb feat(remote form): expose submitted property (#14811)
• 53d37f9 fix: clear issues and touched states on form reset (#16163)
• fef1827 Version Packages (#16142)
• Additional commits viewable in compare view

Updates @tailwindcss/vite from 4.3.0 to 4.3.2

Release notes

Sourced from @​tailwindcss/vite's releases.

v4.3.2

Fixed

• Support bare spacing values for auto-rows-* and auto-cols-* utilities (e.g. auto-rows-12 and auto-cols-16) (#20229)
• Prevent @tailwindcss/cli in --watch mode from crashing on Windows when @source points to a directory that doesn't exist (#20242)
• Prevent @tailwindcss/vite from crashing in Deno v2.8.x when context.parentURL is not a valid URL (#20245)
• Ensure @tailwindcss/cli in --watch mode rebuilds when the input CSS file changes in an ignored directory (#20246)
• Allow @variant rules used in addBase(…) to use custom variants defined later (#20247)
• Prevent @tailwindcss/vite from crashing during HMR when scanned files or directories are deleted (#20259)
• Generate font-size instead of color declarations for text-[--spacing(…)] (#20260)
• Prevent @source patterns from scanning unrelated sibling files and folders (#20263)
• Extract class candidates adjacent to Template Toolkit delimiters like %]…[% in .tt, .tt2, and .tx files (#20269)
• Extract class candidates from conditional Maud syntax like p.text-black[condition] (#20269)
• Prevent @position-try rules from triggering unknown at-rule warnings when optimizing CSS (#20277)
• Support class suggestions for named opacity modifiers from --opacity theme values (#20287)
• Prevent type errors in @tailwindcss/postcss when used with newer PostCSS patch releases (#20289)

v4.3.1

Added

• Add --silent option to suppress output in @tailwindcss/cli (#20100)

Fixed

• Remove deprecation warnings by using Module#registerHooks instead of Module#register on Node 26+ (#20028)
• Canonicalization: don't crash when plugin utilities throw for unsupported values (#20052)
• Allow @apply to be used with CSS mixins (#19427)
• Ensure not-* correctly negates @container queries, including style(…) queries (#20059)
• Ensure drop-shadow-* color utilities work with custom shadow values containing calc(…) (#20080)
• Fix 'Sourcemap is likely to be incorrect' warnings when using @tailwindcss/vite (#20103)
• Ensure @tailwindcss/webpack can be installed in Rspack projects without requiring webpack as a peer dependency (#20027)
• Canonicalization: don't suggest invalid calc(…) expressions (e.g. px-[calc(1rem+0px)] → px-[calc(1rem+0)]) (#20127)
• Canonicalization: avoid suggesting large spacing-scale values for arbitrary lengths (e.g. left-[99999px] → left-[99999px], not left-24999.75) (#20130)
• Ensure @tailwindcss/cli in --watch mode recovers when a tracked dependency is deleted and restored (#20137)
• Ensure standalone @tailwindcss/cli binaries are ignored when scanning for class candidates (#20139)
• Ensure class candidates are extracted from Twig addClass(…) and removeClass(…) calls (#20198)
• Don't crash in the Ruby or Vue preprocessors when scanning files containing invalid UTF-8 bytes (#19588)
• Allow @variant to be used inside addBase (#19480)
• Ensure @source globs with symlinks are preserved (#20203)
• Ensure later @source rules can re-include files excluded by earlier @source not rules (#20203)
• Upgrade: don't migrate empty class rules to invalid @utility rules (#20205)
• Ensure transitions between inset-shadow-none and other inset shadows work correctly (#20208)
• Ensure explicitly referenced @source directories are scanned even when ignored by git (#20214)
• Ensure @source globs ending in **/* preserve dynamic path segments to avoid scanning too many files (#20217)
• Canonicalization: don't fold calc(…) divisions when the result would require high precision (e.g. w-[calc(100%/3.5)] → w-[calc(100%/3.5)], not w-[28.571428571428573%]) (#20221)
• Serve ESM type declarations to ESM importers of @tailwindcss/postcss (#20228)

Changed

• Generate 0 instead of calc(var(--spacing) * 0) for spacing utilities like m-0 and left-0 (#20196)

... (truncated)

Changelog

Sourced from @​tailwindcss/vite's changelog.

[4.3.2] - 2026-06-26

Fixed

• Support bare spacing values for auto-rows-* and auto-cols-* utilities (e.g. auto-rows-12 and auto-cols-16) (#20229)
• Prevent @tailwindcss/cli in --watch mode from crashing on Windows when @source points to a directory that doesn't exist (#20242)
• Prevent @tailwindcss/vite from crashing in Deno v2.8.x when context.parentURL is not a valid URL (#20245)
• Ensure @tailwindcss/cli in --watch mode rebuilds when the input CSS file changes in an ignored directory (#20246)
• Allow @variant rules used in addBase(…) to use custom variants defined later (#20247)
• Prevent @tailwindcss/vite from crashing during HMR when scanned files or directories are deleted (#20259)
• Generate font-size instead of color declarations for text-[--spacing(…)] (#20260)
• Prevent @source patterns from scanning unrelated sibling files and folders (#20263)
• Extract class candidates adjacent to Template Toolkit delimiters like %]…[% in .tt, .tt2, and .tx files (#20269)
• Extract class candidates from conditional Maud syntax like p.text-black[condition] (#20269)
• Prevent @position-try rules from triggering unknown at-rule warnings when optimizing CSS (#20277)
• Support class suggestions for named opacity modifiers from --opacity theme values (#20287)
• Prevent type errors in @tailwindcss/postcss when used with newer PostCSS patch releases (#20289)

[4.3.1] - 2026-06-12

Added

• Add --silent option to suppress output in @tailwindcss/cli (#20100)

Fixed

• Remove deprecation warnings by using Module#registerHooks instead of Module#register on Node 26+ (#20028)
• Canonicalization: don't crash when plugin utilities throw for unsupported values (#20052)
• Allow @apply to be used with CSS mixins (#19427)
• Ensure not-* correctly negates @container queries, including style(…) queries (#20059)
• Ensure drop-shadow-* color utilities work with custom shadow values containing calc(…) (#20080)
• Fix 'Sourcemap is likely to be incorrect' warnings when using @tailwindcss/vite (#20103)
• Ensure @tailwindcss/webpack can be installed in Rspack projects without requiring webpack as a peer dependency (#20027)
• Canonicalization: don't suggest invalid calc(…) expressions (e.g. px-[calc(1rem+0px)] → px-[calc(1rem+0)]) (#20127)
• Canonicalization: avoid suggesting large spacing-scale values for arbitrary lengths (e.g. left-[99999px] → left-[99999px], not left-24999.75) (