Skip to content

chore(deps): bump the minor-and-patch group across 1 directory with 20 updates - #468

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/minor-and-patch-8e448d1eba
Open

chore(deps): bump the minor-and-patch group across 1 directory with 20 updates#468
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/minor-and-patch-8e448d1eba

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 10, 2026

Copy link
Copy Markdown
Contributor

Bumps the minor-and-patch group with 20 updates in the / directory:

Package From To
hash-wasm 4.12.0 4.13.0
@biomejs/biome 2.6.3 2.6.6
@electric-sql/pglite 0.5.13 0.5.15
@electric-sql/pglite-socket 0.2.16 0.2.18
@playwright/test 1.64.1 1.65.0
dependency-cruiser 18.7.0 18.7.2
@aws-sdk/client-s3 3.1158.0 3.1164.0
@swc/helpers 0.5.23 0.5.24
@tailwindcss/postcss 4.3.3 4.3.5
next 16.4.3 16.4.5
tailwindcss 4.3.3 4.3.5
marked 18.1.2 18.1.3
mermaid 12.2.0 12.3.0
shiki 4.5.0 4.6.0
@aws-sdk/s3-request-presigner 3.1158.0 3.1164.0
@opentelemetry/api 1.9.1 1.10.0
@opentelemetry/exporter-trace-otlp-http 0.222.0 0.301.0
@opentelemetry/semantic-conventions 1.43.0 1.45.0
nodemailer 10.2.1 10.3.1
redis 6.3.0 6.3.1

Updates hash-wasm from 4.12.0 to 4.13.0

Release notes

Sourced from hash-wasm's releases.

v4.13.0

  • Fix bcrypt() and bcryptVerify() silently truncating passwords at the first zero byte. Passwords containing zero bytes now use their full binary representation; hashes previously generated from those passwords must be regenerated. Add zero-byte regression tests for bcrypt, HMAC, and PBKDF2. Thanks to the PLSE Group for reporting this issue (#84).
  • Fix IDataType referencing Node.js Buffer typings in browser projects. Native Node.js Buffers remain supported through Uint8Array (#68).
  • Update to TypeScript 6 and remove deprecated compiler options. Use a dedicated declaration-build configuration and preserve compatibility with older TypeScript consumers (#81).
  • Update development dependencies, including Rollup 4.68, Binaryen 132, Jest 30, and TypeScript tooling and typings.
  • Update the WASM build image from Alpine 3.20.3 to 3.24.4 (Clang/LLD 17.0.6 to 22.1.3) and rebuild all 22 WASM modules. Use explicit carry arithmetic in xxHash3/xxHash128 to avoid the unavailable __multi3 runtime helper without compiler-rt, and fail builds on unresolved symbols.
  • Replace rollup-plugin-terser with the maintained @rollup/plugin-terser and update the Binaryen optimizer script to load its ESM API.
  • Update CI to Node.js 24 and run builds/tests on pull requests without publishing or uploading coverage.
  • Remove the obsolete npm run webpack script (#75).
  • Document the Chrome DevTools WebAssembly performance issue and the fresh-tab workaround in the README (#47).
Changelog

Sourced from hash-wasm's changelog.

4.13.0 (November 7, 2026)

  • Fix bcrypt() and bcryptVerify() silently truncating passwords at the first zero byte. Passwords containing zero bytes now use their full binary representation; hashes previously generated from those passwords must be regenerated. Add zero-byte regression tests for bcrypt, HMAC, and PBKDF2. Thanks to the PLSE Group for reporting this issue (#84).
  • Fix IDataType referencing Node.js Buffer typings in browser projects. Native Node.js Buffers remain supported through Uint8Array (#68).
  • Update to TypeScript 6 and remove deprecated compiler options. Use a dedicated declaration-build configuration and preserve compatibility with older TypeScript consumers (#81).
  • Update development dependencies, including Rollup 4.68, Binaryen 132, Jest 30, and TypeScript tooling and typings.
  • Update the WASM build image from Alpine 3.20.3 to 3.24.4 (Clang/LLD 17.0.6 to 22.1.3) and rebuild all 22 WASM modules. Use explicit carry arithmetic in xxHash3/xxHash128 to avoid the unavailable __multi3 runtime helper without compiler-rt, and fail builds on unresolved symbols.
  • Replace rollup-plugin-terser with the maintained @rollup/plugin-terser and update the Binaryen optimizer script to load its ESM API.
  • Update CI to Node.js 24 and run builds/tests on pull requests without publishing or uploading coverage.
  • Remove the obsolete npm run webpack script (#75).
  • Document the Chrome DevTools WebAssembly performance issue and the fresh-tab workaround in the README (#47).
Commits

Updates @biomejs/biome from 2.6.3 to 2.6.6

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.6.6

2.6.6

Patch Changes

  • #12887 da0422e Thanks @​dyc3! - Added the new nursery rule noArrayMethodsOnArguments. It reports calls to array methods on the arguments object, which isn't an array, so these calls throw a TypeError when the code runs.

    function sum() {
  return arguments.reduce((total, value) => total + value, 0);
}

  • #12877 cd9e10f Thanks @​dyc3! - Added the nursery rule noConstantComparisons, which reports && and || conditions that can never be true, are always true, or contain a check with no effect.

    if (statusCode <= 400 && statusCode > 500) {}

  • #12876 a7c9586 Thanks @​dyc3! - Added the nursery rule noErasingOperation, which disallows operations with 0 that always result in zero: multiplying by 0, a bitwise AND with 0, and dividing 0 by a number. The other value in these operations has no effect on the result, which usually means the code has a mistake.

    const total = price * 0;

  • #12841 e954f55 Thanks @​dyc3! - Added the nursery rule noNegatedArrayPredicate, which reports negated calls to Array#some() and Array#every() and suggests moving the negation into the callback function.

    // Invalid: use `array.every((item) => !isUnicorn(item))` instead.
const isMissing = !array.some((item) => isUnicorn(item));

  • #12888 15039f7 Thanks @​dyc3! - Added the new nursery rule noNumberArgumentOutOfRange, which reports number literal arguments of toString(), toFixed(), toExponential() and toPrecision() that are outside the range the method accepts. These calls throw a RangeError at runtime.

    value.toString(64);

  • #12889 1cd7520 Thanks @​dyc3! - Added the nursery rule noSharedBranchCode, which reports code that is repeated at the start or end of every branch of an if statement. That code runs no matter which branch is taken, so it can be moved before or after the if statement.

    if (condition) {
  doSomething();
  cleanup();
} else {
  doSomethingElse();
  cleanup();
}

... (truncated)

Commits

Updates @electric-sql/pglite from 0.5.13 to 0.5.15

Release notes

Sourced from @​electric-sql/pglite's releases.

@​electric-sql/pglite@​0.5.15

Patch Changes

  • 649dc0e: Reject with TransactionAbortedError when committing an aborted transaction rolls it back instead of silently resolving.
  • fe8bdc2: Reduce initdb memory usage by passing a smaller WebAssembly.Memory object during initialization'
  • 7c62782: Upgrade tsup to 8.5.1
  • 84ce5ae: Upgrade emsdk to 6.0.13

@​electric-sql/pglite-prepopulatedfs@​0.5.15

Patch Changes

  • Updated dependencies [649dc0e]
  • Updated dependencies [fe8bdc2]
  • Updated dependencies [7c62782]
  • Updated dependencies [84ce5ae]
    • @​electric-sql/pglite@​0.5.15

@​electric-sql/pglite@​0.5.14

Patch Changes

  • 1cf7e86: Only build the pglite.wasm, initdb.wasm and pglite.data URLs when PGlite has to load them. Passing pgliteWasmModule, initdbWasmModule and fsBundle now works in bundles where import.meta.url is undefined, such as an esbuild IIFE build.
  • 48dd3fb: Use PROXYFS instead of dumping the data dir from the scratch PGlite used for initdb when the data dir is in memory.
  • 268929b: do not copy parsers on each query

@​electric-sql/pglite-prepopulatedfs@​0.5.14

Patch Changes

  • Updated dependencies [1cf7e86]
  • Updated dependencies [48dd3fb]
  • Updated dependencies [268929b]
    • @​electric-sql/pglite@​0.5.14
Changelog

Sourced from @​electric-sql/pglite's changelog.

0.5.15

Patch Changes

  • 649dc0e: Reject with TransactionAbortedError when committing an aborted transaction rolls it back instead of silently resolving.
  • fe8bdc2: Reduce initdb memory usage by passing a smaller WebAssembly.Memory object during initialization'
  • 7c62782: Upgrade tsup to 8.5.1
  • 84ce5ae: Upgrade emsdk to 6.0.13

0.5.14

Patch Changes

  • 1cf7e86: Only build the pglite.wasm, initdb.wasm and pglite.data URLs when PGlite has to load them. Passing pgliteWasmModule, initdbWasmModule and fsBundle now works in bundles where import.meta.url is undefined, such as an esbuild IIFE build.
  • 48dd3fb: Use PROXYFS instead of dumping the data dir from the scratch PGlite used for initdb when the data dir is in memory.
  • 268929b: do not copy parsers on each query
Commits

Updates @electric-sql/pglite-socket from 0.2.16 to 0.2.18

Release notes

Sourced from @​electric-sql/pglite-socket's releases.

@​electric-sql/pglite-socket@​0.2.18

Patch Changes

  • Updated dependencies [649dc0e]
  • Updated dependencies [fe8bdc2]
  • Updated dependencies [7c62782]
  • Updated dependencies [84ce5ae]
    • @​electric-sql/pglite@​0.5.15
    • @​electric-sql/pglite-age@​0.0.16
    • @​electric-sql/pglite-pg_hashids@0.0.16
    • @​electric-sql/pglite-pg_ivm@0.0.16
    • @​electric-sql/pglite-pg_textsearch@0.0.17
    • @​electric-sql/pglite-pg_uuidv7@0.0.16
    • @​electric-sql/pglite-pgtap@​0.0.16
    • @​electric-sql/pglite-pgvector@​0.0.16

@​electric-sql/pglite-socket@​0.2.17

Patch Changes

  • c6ee288: Stop a handler that stop() already detached from touching the database again. A client socket that closed in the same event-loop turn as stop() queued its own detach, which ran after db.close() and failed with an unhandled TypeError: Cannot read properties of undefined (reading '_IsTransactionBlock').
  • Updated dependencies [1cf7e86]
  • Updated dependencies [48dd3fb]
  • Updated dependencies [268929b]
    • @​electric-sql/pglite@​0.5.14
    • @​electric-sql/pglite-age@​0.0.15
    • @​electric-sql/pglite-pg_hashids@0.0.15
    • @​electric-sql/pglite-pg_ivm@0.0.15
    • @​electric-sql/pglite-pg_textsearch@0.0.16
    • @​electric-sql/pglite-pg_uuidv7@0.0.15
    • @​electric-sql/pglite-pgtap@​0.0.15
    • @​electric-sql/pglite-pgvector@​0.0.15
Changelog

Sourced from @​electric-sql/pglite-socket's changelog.

0.2.18

Patch Changes

  • Updated dependencies [649dc0e]
  • Updated dependencies [fe8bdc2]
  • Updated dependencies [7c62782]
  • Updated dependencies [84ce5ae]
    • @​electric-sql/pglite@​0.5.15
    • @​electric-sql/pglite-age@​0.0.16
    • @​electric-sql/pglite-pg_hashids@0.0.16
    • @​electric-sql/pglite-pg_ivm@0.0.16
    • @​electric-sql/pglite-pg_textsearch@0.0.17
    • @​electric-sql/pglite-pg_uuidv7@0.0.16
    • @​electric-sql/pglite-pgtap@​0.0.16
    • @​electric-sql/pglite-pgvector@​0.0.16

0.2.17

Patch Changes

  • c6ee288: Stop a handler that stop() already detached from touching the database again. A client socket that closed in the same event-loop turn as stop() queued its own detach, which ran after db.close() and failed with an unhandled TypeError: Cannot read properties of undefined (reading '_IsTransactionBlock').
  • Updated dependencies [1cf7e86]
  • Updated dependencies [48dd3fb]
  • Updated dependencies [268929b]
    • @​electric-sql/pglite@​0.5.14
    • @​electric-sql/pglite-age@​0.0.15
    • @​electric-sql/pglite-pg_hashids@0.0.15
    • @​electric-sql/pglite-pg_ivm@0.0.15
    • @​electric-sql/pglite-pg_textsearch@0.0.16
    • @​electric-sql/pglite-pg_uuidv7@0.0.15
    • @​electric-sql/pglite-pgtap@​0.0.15
    • @​electric-sql/pglite-pgvector@​0.0.15
Commits

Updates @playwright/test from 1.64.1 to 1.65.0

Release notes

Sourced from @​playwright/test's releases.

v1.65.0

🥟 Run tests with Bun

The test runner now runs under Bun. Bun transpiles your TypeScript test files itself, so Playwright does not use Babel or its compilation cache. Pass the --bun flag, because without it bunx playwright test runs on Node.js:

bunx --bun playwright test

Our CI runs the test runner tests under Bun 1.4.3 on Linux. Some features work differently under Bun:

  • There is no watch mode. UI mode does not run tests again when files change, and --only-changed does not follow imports.
  • Bun loads modules itself, so --tsconfig and the JSX options in tsconfig.json have no effect, and custom ESM loaders are not supported.
  • Stack traces do not include async frames, and API names do not include the class name: click instead of locator.click. This changes some step locations, step titles and error messages.
  • Console output of a test does not get into the trace and UI mode.

🚨 Reports with only failures

New failures reporter prints failures and successful retries as they occur, followed by a summary, without progress output.

New onlyFailures option of the HTML, JSON and JUnit reporters keeps only tests with unexpected outcomes, flaky tests and interrupted tests:

// playwright.config.ts
import { defineConfig } from '@playwright/test';
export default defineConfig({
reporter: [
['failures'],
['html', { onlyFailures: true }],
],
});

🎯 Test runner

  • New built-in -exclusive- test lock runs a test only when no other tests are running. All other tests continue to run in parallel with each other:

    test('restart the server', { lock: '-exclusive-' }, async () => {
  // No other test runs while this one is running.
});

  • test.skip(), test.fixme(), test.fail() and test.slow() now accept only a description. It is recorded in the test annotation:

    test('upload a file', async ({ page }) => {
  test.skip('Not implemented yet');
});

... (truncated)

Commits
  • a1f35e1 chore: mark v1.65.0 (#43925)
  • a99c1ab cherry-pick(#43918): Revert "fix(docker): use latest stable Chrome for Testin...
  • 6f9a7f5 cherry-pick(#43914): docs(release-notes): update Chromium version for 1.65
  • daf93bb cherry-pick(#43912): feat(chromium): roll to r1254
  • 6545e89 cherry-pick(#43902): chore(deps): bump runtime deps
  • 0347448 fix(test runner): track shared ESM dependencies for only-changed (#43837)
  • 86e6924 fix(clock): cancel real-time timer when replay ends paused (#43873)
  • d745ae0 fix(route): wait for all active handlers before disabling interception (#43889)
  • 6e3f5ff docs: release notes for v1.65 (#43874)
  • aa33d27 fix(chromium): honor Linux config directories for channel connections (#43884)
  • Additional commits viewable in compare view

Updates dependency-cruiser from 18.7.0 to 18.7.2

Release notes

Sourced from dependency-cruiser's releases.

v18.7.2

🐛 fixes

  • e65bb5b4 fix(extract/resolve): adds correctly handling 'bundledDependencies: true' (#1120) thanks to @​sebdanielsson for finding and filing the issue that led to this fix.

👷 maintenance

  • 4e2daa02 fix(manifest): updates contributor list with recent contributors
  • a37c1cf6 chore(test): bumps minimum branch coverage up to current HWM
  • 1ecdae89 build(npm): updates external dependencies

v18.7.1

🐛 fixes

  • 2a46eecf fix(main/resolve-options): resolves tsconfig paths without baseUrl from the tsconfig directory (#1116) Thanks to @​thirtytwobits for raising the issue and @​Johannes7549 for making the fixing pull request!
  • fd7889bf fix(extract/transpile): passes the file name to the typescript transpiler to prevent it choking on imports from './module' (#1118). Thanks to @​sebdanielsson for reporting the issue, finding the root cause and baking the fixing PR!

👷 maintenance

  • 00ca161c build(npm): updates external dependencies
  • 96a1dd35 doc(README): removes broken link
  • c5b97371 chore(npm): refreshes lock-file
  • dbe5e74e chore(Gort): makes agent instruction even more explicit
  • 5adda5b2 chore(gha): replaces last remnant of yarn with node --run
  • deea6a17 doc: corrects type references in jsdoc

Note for those eagerly awaiting typescript 7.1 support - thanks to @​buko106 there's a dependency-cruiser (beta) version that works with typescript 7.1 beta . The fixes in this (18.7.1) release combined with 7.1 beta support will be published as 18.8.0-beta-2.

Commits
  • f51bc48 18.7.2
  • 4e2daa0 fix(manifest): updates contributor list with recent contributors
  • a37c1cf chore(test): bumps minimum branch coverage up to current HWM
  • 1ecdae8 build(npm): updates external dependencies
  • e65bb5b fix(extract/resolve): adds correctly handling 'bundledDependencies: true' (#1...
  • 5173200 18.7.1
  • 00ca161 build(npm): updates external dependencies
  • fd7889b fix(extract/transpile): passes the file name to the typescript transpiler to ...
  • 96a1dd3 doc(README): removes broken link
  • 2a46eec fix(main/resolve-options): resolves tsconfig paths without baseUrl from the t...
  • Additional commits viewable in compare view

Updates @aws-sdk/client-s3 from 3.1158.0 to 3.1164.0

Release notes

Sourced from @​aws-sdk/client-s3's releases.

v3.1164.0

3.1164.0(2026-11-06)

Chores
  • util-endpoints:
  • endpoints: update endpoints model (aa699bbb)
  • models: update API models (51f69a86)
Documentation Changes
New Features
  • client-mediaconvert: Smart subtitling uses AWS Elemental Inference to generate captions from your content's audio, in embedded, burn-in, DVB-Sub, IMSC, SMI, SRT, teletext, TTML, or WebVTT outputs. Also fixes HEVC passthrough writing an incomplete codecs string to DASH and HLS manifests. (cfc598fc)
  • client-bedrock-agent: Add support for configuring searchability for metadata fields via UpdateKnowledgeBase request for Managed Knowledge Base. Once a field is marked as searchable it can be queried via query text and is factored into Managed Knowledge Base's ranking algorithm. (c980a42b)
  • client-connectcases: Amazon Connect Cases adds two Bulk Case Actions operations. BatchCreateRelatedItem adds a Comment-type related item to up to 100 cases per request, BatchUpdateCase updates fields (title, status, customer ID, custom) on up to 100 cases. Same domain, per-case success and failure results returned. (f44ef094)
  • client-auto-scaling: Amazon EC2 Auto Scaling now lets you exclude managed resources from describe API responses using the new optional IncludeManagedResources parameter. Set this parameter to false to exclude managed resources from the response. By default, managed resources are included. (5f8c11ac)
  • client-ram: Adds support for using managed permission template parameters, discovering shared customer-managed permissions, and managing customer-managed permission deprecation. (87c5566c)
  • client-datazone: Adds support for updating OAuth 2.0 connection settings with UpdateConnection. (b324b9a0)
  • client-athena: Added support for Athena System Tables which writes Athena usage data to AWS S3 managed tables in Apache Iceberg format. Adds CreateSystemTableConfiguration, UpdateSystemTableConfiguration, DeleteSystemTableConfiguration, GetSystemTableConfiguration, and ListSystemTableStatuses. (2f076d9e)
  • client-connect: Rules in Amazon Connect now support ending email contacts associated to a case based on case events. (cf923d5d)
  • client-lightsail: Marking fields as sensitive in GetInstanceAccessDetails, CreateKeyPair, DownloadDefaultKeyPair, CreateBucketAccessKey, CreateContainerServiceRegistryLogin, and GetRelationalDatabase responses. (da2578c3)
  • client-eks-auth: Added workloadIdentityProviderArn to the AssumeRoleForPodIdentity API response. (2ea374e6)
  • client-glue: Adds support for user-defined functions governed by AWS Lake Formation. (bc94b9f6)
  • client-ssm: AWS Systems Manager now provides two new APIs - RegisterDefaultHostManagementConfiguration and DeregisterDefaultHostManagementConfiguration - along with a new DefaultHostManagementConfiguration CloudFormation resource type. (99097cdf)

For list of updated packages, view updated-packages.md in assets-3.1164.0.zip

v3.1163.0

3.1163.0(2026-11-05)

New Features
  • clients: update client endpoints as of 2026-11-05 (57e9f143)
  • client-bedrock-agentcore-control: Adds support for OAuth2 Authorization Server Metadata (RFC 8414) discovery URLs in custom JWT authorizer and OAuth2 credential provider configurations. (950c852a)
  • client-sagemaker: Fixed the ImageDeleted and ImageVersionDeleted waiters to succeed on the ResourceNotFound error returned by DescribeImage and DescribeImageVersion (6cc77117)
  • client-wafv2: AWS WAF customers who monetize AI traffic on Web ACLs can now configure payments through connected accounts (Stripe). (9e7dd06f)
  • client-appintegrations: This release adds a LastModifiedRegion field to GetApplication and ListApplications so customers can see which Region an application was last modified in. (878faafe)
  • client-quicksight: Amazon QuickSight adds APIs to view account service role settings and switch to or replace a customer-managed IAM role. (98371e60)
  • client-lambda-microvms: AWS Lambda MicroVMs now support the x86-64 CPU architecture, which you can select in addition to ARM64 (Graviton) when launching a MicroVM. (928e07cc)
  • client-bedrock-agent-runtime: Amazon Bedrock Managed Knowledge Base now supports an optional mediaId parameter in GetDocumentContent that you can use to retrieve images embedded in source documents. (0740a76b)
  • client-securityagent: Adds support for IAM Identity Center groups as Agent Space members. CreateMembership, DeleteMembership, and ListMemberships now accept the GROUP member type. ListMemberships can filter by USER, GROUP, or ALL, and returns group display name and description. (a8e028e7)
  • client-cloudwatch-logs: Adds account-level retention policies with dry run preview and the Essentials log group class to Amazon CloudWatch Logs (da8a2a29)

... (truncated)

Changelog

Sourced from @​aws-sdk/client-s3's changelog.

3.1164.0 (2026-11-06)

Note: Version bump only for package @​aws-sdk/client-s3

3.1163.0 (2026-11-05)

Note: Version bump only for package @​aws-sdk/client-s3

3.1162.0 (2026-11-04)

Bug Fixes

  • codegen: drop redundant alias from node:stream Readable type import (#8402) (4e5ce5a)

3.1161.0 (2026-10-30)

Note: Version bump only for package @​aws-sdk/client-s3

3.1160.0 (2026-10-29)

Note: Version bump only for package @​aws-sdk/client-s3

3.1159.0 (2026-10-28)

Note: Version bump only for package @​aws-sdk/client-s3

Commits

Updates @swc/helpers from 0.5.23 to 0.5.24

Commits

Updates @tailwindcss/postcss from 4.3.3 to 4.3.5

Release notes

Sourced from @​tailwindcss/postcss's releases.

v4.3.5

Fixed

  • Canonicalization: improve performance in projects with many functional variant values (e.g. a matchVariant plugin with thousands of values) (#20663)
  • Don't crash or create a fallback with the wrong color for a color-mix(…) without a color interpolation method (e.g. color-mix(var(--color-red-500)) or color-mix(currentcolor 50%, transparent)) (#20658, #20666)
  • Ensure @tailwindcss/oxide-wasm32-wasi loads instead of hanging forever (e.g. with NAPI_RS_FORCE_WASI=error or in WebContainers) (#20667)
  • Remove as: '*.css' from the @tailwindcss/turbopack setup in its README, because it breaks CSS modules (#20660)
  • Ignore <!-- and --> between top-level rules in CSS instead of throwing or swallowing the next rule (e.g. a { color: red } --> b { color: blue }) (#20665)
  • Ensure @tailwindcss/oxide-wasm32-wasi detects changed and new source files after the first scan (e.g. in WebContainers) (#20487)
  • Prevent type errors with skipLibCheck: false caused by imports of unshipped modules in the @tailwindcss/node type declarations (#20632)

v4.3.4

Added

  • Add @tailwindcss/turbopack, a Turbopack loader for using Tailwind CSS with Next.js (#20367)

Fixed

  • Ensure watch mode detects changes to symlinked @source files whose real paths aren't otherwise scanned (#20356)
  • Ensure variants using @scope wrap generated utilities instead of nesting inside them (#20369)
  • Ensure nested @scope rules preserve their scoping semantics when flattened (#20369)
  • Preserve declarations directly inside @scope by wrapping them in :where(:scope) (#20369)
  • Ensure generated utilities include a space in empty var() fallbacks (e.g. var(--tw-blur,) → var(--tw-blur, )) (#20373)
  • Canonicalization: convert arbitrary breakpoint and container query variants to named equivalents (e.g. max-[64rem]:flex → max-lg:flex) (#20380)
  • Prevent @tailwindcss/vite from crashing on every edit under Vite's experimental bundledDev mode (#20379)
  • Ensure @tailwindcss/oxide falls back to WASM on platforms without native bindings (@tailwindcss/oxide-wasm32-wasi now installs on all platforms, but only loads when no native binding is available) (#20383)
  • Extract class candidates from Ruby %w and %W literals using angle brackets or custom delimiters (e.g. %w<flex>, %w|flex|), including in Slim and Haml templates (#20387)
  • Preserve whitespace in --default(…) values in functional @utility definitions (e.g. --default(box alphabetic) no longer becomes boxalphabetic) (#20392)
  • Ensure automatic source detection respects negation-based .gitignore files (e.g. /* followed by !/… patterns) (#20397)
  • Ensure root theme('…') namespace lookups in JavaScript plugins and config files return the full namespace object instead of the value of its DEFAULT key (#20399)
  • Skip ignored directories when generating watch globs instead of walking their contents on every rebuild (#20408)
  • Drop invalid UTF-8 candidates during class detection (#20389)
  • Prevent @tailwindcss/vite from forcing full-page reloads for scanned files that Vite does not handle as modules (e.g. .php files) (#20414)
  • Canonicalization: don't merge utilities that reference different theme variables set to CSS-wide keywords like unset (#20417)
  • Don't generate utilities when a modifier is used that would otherwise be silently ignored (e.g. rounded-sm/[5], shadow-sm/foo, stroke-2/50) (#20419)
  • Preserve and, or, and not inside selectors in supports-[…] variants (e.g. supports-[selector(a:not(.foo))]:flex) (#20420)
  • Don't warn about Angular's ::ng-deep and :host-context() when optimizing CSS (#20434)
  • Don't generate CSS for candidates containing an empty additional modifier (e.g. bg-red-500/50/ and group-hover/foo//bar:flex) (#20466)
  • Ensure min-*, max-*, and container query variants with decimal values are sorted numerically (e.g. min-[40.25rem] before min-[40.5rem]) (#20512)
  • Ensure CSS comments ending with \*/ are closed correctly instead of swallowing the CSS that follows (e.g. /* C:\temp\*/) (#20508)
  • Improve style invalidation performance of group-* and peer-* variants (#20513)
  • Ensure cached compilers release their loadModule and loadStylesheet callbacks after compilation (#20531)
  • Canonicalization: preserve & when moving a pseudo-element into * or ** (e.g. [&_::before]:flex → **:[&::before]:flex) (#20550)
  • Ensure the Set.prototype.intersection polyfill in canonicalizeCandidates(…) returns the intersection instead of the first set on Node.js < 22 (#20562)
  • Canonicalization: ensure inline theme(…) alphas with more than 2 decimals migrate to a percentage modifier with the same opacity (e.g. theme(colors.red.500/.12345) → text-red-500/[12.345%], not text-red-500/[12.345]) (#20563)
  • Canonicalization: preserve inline theme(…) alphas as an arbitrary percentage when a custom --opacity-* theme value would change the opacity (e.g. theme(colors.red.500/50%) → text-red-500/[50%] with --opacity-50: 10%) (#20563)
  • Ensure the @property fallback isn't applied in Safari versions that no longer support margin-trim: inline (#20569)
  • Treat viewport units like dvmin and svi and font-relative units like cap and rex as lengths in arbitrary values (e.g. text-[10dvmin] generates font-size instead of color) (#20516)
  • Write plugin logs to stderr in tailwindcss canonicalize so they don't end up in the results on stdout (#20561)
  • Extract class shorthands on later lines when Pug text, comments, or quoted attribute values contain unbalanced brackets, or a quote that doesn't start a string (e.g. input(pattern=/"/.source)) (#20547, #20572)

... (truncated)

Changelog

Sourced from @​tailwindcss/postcss's changelog.

[4.3.5] - 2026-11-06

Fixed

  • Canonicalization: improve performance in projects with many functional variant values (e.g. a matchVariant plugin with thousands of values) (#20663)
  • Don't crash or create a fallback with the wrong color for a color-mix(…) without a color interpolation method (e.g. color-mix(var(--color-red-500)) or color-mix(currentcolor 50%, transparent)) (#20658, #20666)
  • Ensure @tailwindcss/oxide-wasm32-wasi loads instead of hanging forever (e.g. with NAPI_RS_FORCE_WASI=error or in WebContainers) (#20667)
  • Remove as: '*.css' from the @tailwindcss/turbopack setup in its README, because it breaks CSS modules (#20660)
  • Ignore <!-- and --> between top-level rules in CSS instead of throwing or swallowing the next rule (e.g. a { color: red } --> b { color: blue }) (#20665)
  • Ensure @tailwindcss/oxide-wasm32-wasi detects changed and new source files after the first scan (e.g. in WebContainers) (#20487)
  • Prevent type errors with skipLibCheck: false caused by imports of unshipped modules in the @tailwindcss/node type declarations (#20632)

[4.3.4] - 2026-11-02

Added

  • Add @tailwindcss/turbopack, a Turbopack loader for using Tailwind CSS with Next.js (#20367)

Fixed

  • Ensure watch mode detects changes to symlinked @source files whose real paths aren't otherwise scanned (#20356)
  • Ensure variants using @scope wrap generated utilities instead of nesting inside them (#20369)
  • Ensure nested @scope rules preserve their scoping semantics when flattened (#20369)
  • Preserve declarations directly inside @scope by wrapping them in :where(:scope) (#20369)
  • Ensure generated utilities include a space in empty var() fallbacks (e.g. var(--tw-blur,) → var(--tw-blur, )) (#20373)
  • Canonicalization...

    Description has been truncated

@dependabot
chore(deps): bump the minor-and-patch group across 1 directory with 2…
c5504ab 
…0 updates

Bumps the minor-and-patch group with 20 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [hash-wasm](https://github.com/Daninet/hash-wasm) | `4.12.0` | `4.13.0` |
| [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome) | `2.6.3` | `2.6.6` |
| [@electric-sql/pglite](https://github.com/electric-sql/pglite/tree/HEAD/packages/pglite) | `0.5.13` | `0.5.15` |
| [@electric-sql/pglite-socket](https://github.com/electric-sql/pglite/tree/HEAD/packages/pglite-socket) | `0.2.16` | `0.2.18` |
| [@playwright/test](https://github.com/microsoft/playwright) | `1.64.1` | `1.65.0` |
| [dependency-cruiser](https://github.com/sverweij/dependency-cruiser) | `18.7.0` | `18.7.2` |
| [@aws-sdk/client-s3](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-s3) | `3.1158.0` | `3.1164.0` |
| [@swc/helpers](https://github.com/swc-project/swc/tree/HEAD/packages/helpers) | `0.5.23` | `0.5.24` |
| [@tailwindcss/postcss](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-postcss) | `4.3.3` | `4.3.5` |
| [next](https://github.com/vercel/next.js) | `16.4.3` | `16.4.5` |
| [tailwindcss](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss) | `4.3.3` | `4.3.5` |
| [marked](https://github.com/markedjs/marked) | `18.1.2` | `18.1.3` |
| [mermaid](https://github.com/mermaid-js/mermaid) | `12.2.0` | `12.3.0` |
| [shiki](https://github.com/shikijs/shiki/tree/HEAD/packages/shiki) | `4.5.0` | `4.6.0` |
| [@aws-sdk/s3-request-presigner](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/packages/s3-request-presigner) | `3.1158.0` | `3.1164.0` |
| [@opentelemetry/api](https://github.com/open-telemetry/opentelemetry-js) | `1.9.1` | `1.10.0` |
| [@opentelemetry/exporter-trace-otlp-http](https://github.com/open-telemetry/opentelemetry-js) | `0.222.0` | `0.301.0` |
| [@opentelemetry/semantic-conventions](https://github.com/open-telemetry/opentelemetry-js) | `1.43.0` | `1.45.0` |
| [nodemailer](https://github.com/nodemailer/nodemailer) | `10.2.1` | `10.3.1` |
| [redis](https://github.com/redis/node-redis) | `6.3.0` | `6.3.1` |



Updates `hash-wasm` from 4.12.0 to 4.13.0
- [Release notes](https://github.com/Daninet/hash-wasm/releases)
- [Changelog](https://github.com/Daninet/hash-wasm/blob/master/CHANGELOG.md)
- [Commits](Daninet/hash-wasm@v4.12.0...v4.13.0)

Updates `@biomejs/biome` from 2.6.3 to 2.6.6
- [Release notes](https://github.com/biomejs/biome/releases)
- [Changelog](https://github.com/biomejs/biome/blob/main/CHANGELOG_v1.md)
- [Commits](https://github.com/biomejs/biome/commits/@biomejs/biome@2.6.6/packages/@biomejs/biome)

Updates `@electric-sql/pglite` from 0.5.13 to 0.5.15
- [Release notes](https://github.com/electric-sql/pglite/releases)
- [Changelog](https://github.com/electric-sql/pglite/blob/main/packages/pglite/CHANGELOG.md)
- [Commits](https://github.com/electric-sql/pglite/commits/@electric-sql/pglite@0.5.15/packages/pglite)

Updates `@electric-sql/pglite-socket` from 0.2.16 to 0.2.18
- [Release notes](https://github.com/electric-sql/pglite/releases)
- [Changelog](https://github.com/electric-sql/pglite/blob/main/packages/pglite-socket/CHANGELOG.md)
- [Commits](https://github.com/electric-sql/pglite/commits/@electric-sql/pglite-socket@0.2.18/packages/pglite-socket)

Updates `@playwright/test` from 1.64.1 to 1.65.0
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](microsoft/playwright@v1.64.1...v1.65.0)

Updates `dependency-cruiser` from 18.7.0 to 18.7.2
- [Release notes](https://github.com/sverweij/dependency-cruiser/releases)
- [Changelog](https://github.com/sverweij/dependency-cruiser/blob/main/CHANGELOG.md)
- [Commits](sverweij/dependency-cruiser@v18.7.0...v18.7.2)

Updates `@aws-sdk/client-s3` from 3.1158.0 to 3.1164.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-s3/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1164.0/clients/client-s3)

Updates `@swc/helpers` from 0.5.23 to 0.5.24
- [Release notes](https://github.com/swc-project/swc/releases)
- [Changelog](https://github.com/swc-project/swc/blob/main/CHANGELOG-CORE.md)
- [Commits](https://github.com/swc-project/swc/commits/@swc/helpers@v0.5.24/packages/helpers)

Updates `@tailwindcss/postcss` from 4.3.3 to 4.3.5
- [Release notes](https://github.com/tailwindlabs/tailwindcss/releases)
- [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md)
- [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.3.5/packages/@tailwindcss-postcss)

Updates `next` from 16.4.3 to 16.4.5
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](vercel/next.js@v16.4.3...v16.4.5)

Updates `tailwindcss` from 4.3.3 to 4.3.5
- [Release notes](https://github.com/tailwindlabs/tailwindcss/releases)
- [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md)
- [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.3.5/packages/tailwindcss)

Updates `marked` from 18.1.2 to 18.1.3
- [Release notes](https://github.com/markedjs/marked/releases)
- [Commits](markedjs/marked@v18.1.2...v18.1.3)

Updates `mermaid` from 12.2.0 to 12.3.0
- [Release notes](https://github.com/mermaid-js/mermaid/releases)
- [Commits](https://github.com/mermaid-js/mermaid/compare/mermaid@12.2.0...mermaid@12.3.0)

Updates `shiki` from 4.5.0 to 4.6.0
- [Release notes](https://github.com/shikijs/shiki/releases)
- [Commits](https://github.com/shikijs/shiki/commits/v4.6.0/packages/shiki)

Updates `@aws-sdk/s3-request-presigner` from 3.1158.0 to 3.1164.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/packages/s3-request-presigner/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1164.0/packages/s3-request-presigner)

Updates `@opentelemetry/api` from 1.9.1 to 1.10.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-js@v1.9.1...v1.10.0)

Updates `@opentelemetry/exporter-trace-otlp-http` from 0.222.0 to 0.301.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-js@experimental/v0.222.0...experimental/v0.301.0)

Updates `@opentelemetry/semantic-conventions` from 1.43.0 to 1.45.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-js@semconv/v1.43.0...semconv/v1.45.0)

Updates `nodemailer` from 10.2.1 to 10.3.1
- [Release notes](https://github.com/nodemailer/nodemailer/releases)
- [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md)
- [Commits](nodemailer/nodemailer@v10.2.1...v10.3.1)

Updates `redis` from 6.3.0 to 6.3.1
- [Release notes](https://github.com/redis/node-redis/releases)
- [Changelog](https://github.com/redis/node-redis/blob/master/CHANGELOG.md)
- [Commits](https://github.com/redis/node-redis/compare/redis@6.3.0...redis@6.3.1)

---
updated-dependencies:
- dependency-name: hash-wasm
  dependency-version: 4.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@biomejs/biome"
  dependency-version: 2.6.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@electric-sql/pglite"
  dependency-version: 0.5.15
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@electric-sql/pglite-socket"
  dependency-version: 0.2.18
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@playwright/test"
  dependency-version: 1.65.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: dependency-cruiser
  dependency-version: 18.7.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@aws-sdk/client-s3"
  dependency-version: 3.1164.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@swc/helpers"
  dependency-version: 0.5.24
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@tailwindcss/postcss"
  dependency-version: 4.3.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: next
  dependency-version: 16.4.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: tailwindcss
  dependency-version: 4.3.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: marked
  dependency-version: 18.1.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: mermaid
  dependency-version: 12.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: shiki
  dependency-version: 4.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@aws-sdk/s3-request-presigner"
  dependency-version: 3.1164.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@opentelemetry/api"
  dependency-version: 1.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@opentelemetry/exporter-trace-otlp-http"
  dependency-version: 0.301.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@opentelemetry/semantic-conventions"
  dependency-version: 1.45.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: nodemailer
  dependency-version: 10.3.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: redis
  dependency-version: 6.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 10, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants