Skip to content

chore(deps): bump the bun-minor-and-patch group with 9 updates - #61

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bun/bun-minor-and-patch-d175503afc
Open

chore(deps): bump the bun-minor-and-patch group with 9 updates#61
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bun/bun-minor-and-patch-d175503afc

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 11, 2026

Copy link
Copy Markdown
Contributor

Bumps the bun-minor-and-patch group with 9 updates:

Package From To
@tailwindcss/vite 4.3.3 4.3.5
@vitejs/plugin-react 6.1.2 6.2.1
@xyflow/react 12.12.0 12.12.1
i18next-browser-languagedetector 8.2.4 8.3.0
i18next-http-backend 4.0.7 4.0.10
lucide-react 1.66.0 1.70.0
tailwindcss 4.3.3 4.3.5
zustand 5.0.16 5.1.0
vite 8.3.5 8.3.6

Updates @tailwindcss/vite from 4.3.3 to 4.3.5

Release notes

Sourced from @​tailwindcss/vite's releases.

v4.3.5

Fixed

  • Canonicalization: improve performance in projects with many functional variant values (e.g. a matchVariant plugin with thousands of values) (#20663)
  • Don't crash or create a fallback with the wrong color for a color-mix(…) without a color interpolation method (e.g. color-mix(var(--color-red-500)) or color-mix(currentcolor 50%, transparent)) (#20658, #20666)
  • Ensure @tailwindcss/oxide-wasm32-wasi loads instead of hanging forever (e.g. with NAPI_RS_FORCE_WASI=error or in WebContainers) (#20667)
  • Remove as: '*.css' from the @tailwindcss/turbopack setup in its README, because it breaks CSS modules (#20660)
  • Ignore <!-- and --> between top-level rules in CSS instead of throwing or swallowing the next rule (e.g. a { color: red } --> b { color: blue }) (#20665)
  • Ensure @tailwindcss/oxide-wasm32-wasi detects changed and new source files after the first scan (e.g. in WebContainers) (#20487)
  • Prevent type errors with skipLibCheck: false caused by imports of unshipped modules in the @tailwindcss/node type declarations (#20632)

v4.3.4

Added

  • Add @tailwindcss/turbopack, a Turbopack loader for using Tailwind CSS with Next.js (#20367)

Fixed

  • Ensure watch mode detects changes to symlinked @source files whose real paths aren't otherwise scanned (#20356)
  • Ensure variants using @scope wrap generated utilities instead of nesting inside them (#20369)
  • Ensure nested @scope rules preserve their scoping semantics when flattened (#20369)
  • Preserve declarations directly inside @scope by wrapping them in :where(:scope) (#20369)
  • Ensure generated utilities include a space in empty var() fallbacks (e.g. var(--tw-blur,) → var(--tw-blur, )) (#20373)
  • Canonicalization: convert arbitrary breakpoint and container query variants to named equivalents (e.g. max-[64rem]:flex → max-lg:flex) (#20380)
  • Prevent @tailwindcss/vite from crashing on every edit under Vite's experimental bundledDev mode (#20379)
  • Ensure @tailwindcss/oxide falls back to WASM on platforms without native bindings (@tailwindcss/oxide-wasm32-wasi now installs on all platforms, but only loads when no native binding is available) (#20383)
  • Extract class candidates from Ruby %w and %W literals using angle brackets or custom delimiters (e.g. %w<flex>, %w|flex|), including in Slim and Haml templates (#20387)
  • Preserve whitespace in --default(…) values in functional @utility definitions (e.g. --default(box alphabetic) no longer becomes boxalphabetic) (#20392)
  • Ensure automatic source detection respects negation-based .gitignore files (e.g. /* followed by !/… patterns) (#20397)
  • Ensure root theme('…') namespace lookups in JavaScript plugins and config files return the full namespace object instead of the value of its DEFAULT key (#20399)
  • Skip ignored directories when generating watch globs instead of walking their contents on every rebuild (#20408)
  • Drop invalid UTF-8 candidates during class detection (#20389)
  • Prevent @tailwindcss/vite from forcing full-page reloads for scanned files that Vite does not handle as modules (e.g. .php files) (#20414)
  • Canonicalization: don't merge utilities that reference different theme variables set to CSS-wide keywords like unset (#20417)
  • Don't generate utilities when a modifier is used that would otherwise be silently ignored (e.g. rounded-sm/[5], shadow-sm/foo, stroke-2/50) (#20419)
  • Preserve and, or, and not inside selectors in supports-[…] variants (e.g. supports-[selector(a:not(.foo))]:flex) (#20420)
  • Don't warn about Angular's ::ng-deep and :host-context() when optimizing CSS (#20434)
  • Don't generate CSS for candidates containing an empty additional modifier (e.g. bg-red-500/50/ and group-hover/foo//bar:flex) (#20466)
  • Ensure min-*, max-*, and container query variants with decimal values are sorted numerically (e.g. min-[40.25rem] before min-[40.5rem]) (#20512)
  • Ensure CSS comments ending with \*/ are closed correctly instead of swallowing the CSS that follows (e.g. /* C:\temp\*/) (#20508)
  • Improve style invalidation performance of group-* and peer-* variants (#20513)
  • Ensure cached compilers release their loadModule and loadStylesheet callbacks after compilation (#20531)
  • Canonicalization: preserve & when moving a pseudo-element into * or ** (e.g. [&_::before]:flex → **:[&::before]:flex) (#20550)
  • Ensure the Set.prototype.intersection polyfill in canonicalizeCandidates(…) returns the intersection instead of the first set on Node.js < 22 (#20562)
  • Canonicalization: ensure inline theme(…) alphas with more than 2 decimals migrate to a percentage modifier with the same opacity (e.g. theme(colors.red.500/.12345) → text-red-500/[12.345%], not text-red-500/[12.345]) (#20563)
  • Canonicalization: preserve inline theme(…) alphas as an arbitrary percentage when a custom --opacity-* theme value would change the opacity (e.g. theme(colors.red.500/50%) → text-red-500/[50%] with --opacity-50: 10%) (#20563)
  • Ensure the @property fallback isn't applied in Safari versions that no longer support margin-trim: inline (#20569)
  • Treat viewport units like dvmin and svi and font-relative units like cap and rex as lengths in arbitrary values (e.g. text-[10dvmin] generates font-size instead of color) (#20516)
  • Write plugin logs to stderr in tailwindcss canonicalize so they don't end up in the results on stdout (#20561)
  • Extract class shorthands on later lines when Pug text, comments, or quoted attribute values contain unbalanced brackets, or a quote that doesn't start a string (e.g. input(pattern=/"/.source)) (#20547, #20572)

... (truncated)

Changelog

Sourced from @​tailwindcss/vite's changelog.

[4.3.5] - 2026-11-06

Fixed

  • Canonicalization: improve performance in projects with many functional variant values (e.g. a matchVariant plugin with thousands of values) (#20663)
  • Don't crash or create a fallback with the wrong color for a color-mix(…) without a color interpolation method (e.g. color-mix(var(--color-red-500)) or color-mix(currentcolor 50%, transparent)) (#20658, #20666)
  • Ensure @tailwindcss/oxide-wasm32-wasi loads instead of hanging forever (e.g. with NAPI_RS_FORCE_WASI=error or in WebContainers) (#20667)
  • Remove as: '*.css' from the @tailwindcss/turbopack setup in its README, because it breaks CSS modules (#20660)
  • Ignore <!-- and --> between top-level rules in CSS instead of throwing or swallowing the next rule (e.g. a { color: red } --> b { color: blue }) (#20665)
  • Ensure @tailwindcss/oxide-wasm32-wasi detects changed and new source files after the first scan (e.g. in WebContainers) (#20487)
  • Prevent type errors with skipLibCheck: false caused by imports of unshipped modules in the @tailwindcss/node type declarations (#20632)

[4.3.4] - 2026-11-02

Added

  • Add @tailwindcss/turbopack, a Turbopack loader for using Tailwind CSS with Next.js (#20367)

Fixed

  • Ensure watch mode detects changes to symlinked @source files whose real paths aren't otherwise scanned (#20356)
  • Ensure variants using @scope wrap generated utilities instead of nesting inside them (#20369)
  • Ensure nested @scope rules preserve their scoping semantics when flattened (#20369)
  • Preserve declarations directly inside @scope by wrapping them in :where(:scope) (#20369)
  • Ensure generated utilities include a space in empty var() fallbacks (e.g. var(--tw-blur,) → var(--tw-blur, )) (#20373)
  • Canonicalization: convert arbitrary breakpoint and container query variants to named equivalents (e.g. max-[64rem]:flex → max-lg:flex) (#20380)
  • Prevent @tailwindcss/vite from crashing on every edit under Vite's experimental bundledDev mode (#20379)
  • Ensure @tailwindcss/oxide falls back to WASM on platforms without native bindings (@tailwindcss/oxide-wasm32-wasi now installs on all platforms, but only loads when no native binding is available) (#20383)
  • Extract class candidates from Ruby %w and %W literals using angle brackets or custom delimiters (e.g. %w<flex>, %w|flex|), including in Slim and Haml templates (#20387)
  • Preserve whitespace in --default(…) values in functional @utility definitions (e.g. --default(box alphabetic) no longer becomes boxalphabetic) (#20392)
  • Ensure automatic source detection respects negation-based .gitignore files (e.g. /* followed by !/… patterns) (#20397)
  • Ensure root theme('…') namespace lookups in JavaScript plugins and config files return the full namespace object instead of the value of its DEFAULT key (#20399)
  • Skip ignored directories when generating watch globs instead of walking their contents on every rebuild (#20408)
  • Drop invalid UTF-8 candidates during class detection (#20389)
  • Prevent @tailwindcss/vite from forcing full-page reloads for scanned files that Vite does not handle as modules (e.g. .php files) (#20414)
  • Canonicalization: don't merge utilities that reference different theme variables set to CSS-wide keywords like unset (#20417)
  • Don't generate utilities when a modifier is used that would otherwise be silently ignored (e.g. rounded-sm/[5], shadow-sm/foo, stroke-2/50) (#20419)
  • Preserve and, or, and not inside selectors in supports-[…] variants (e.g. supports-[selector(a:not(.foo))]:flex) (#20420)
  • Don't warn about Angular's ::ng-deep and :host-context() when optimizing CSS (#20434)
  • Don't generate CSS for candidates containing an empty additional modifier (e.g. bg-red-500/50/ and group-hover/foo//bar:flex) (#20466)
  • Ensure min-*, max-*, and container query variants with decimal values are sorted numerically (e.g. min-[40.25rem] before min-[40.5rem]) (#20512)
  • Ensure CSS comments ending with \*/ are closed correctly instead of swallowing the CSS that follows (e.g. /* C:\temp\*/) (#20508)
  • Improve style invalidation performance of group-* and peer-* variants (#20513)
  • Ensure cached compilers release their loadModule and loadStylesheet callbacks after compilation (#20531)
  • Canonicalization: preserve & when moving a pseudo-element into * or ** (e.g. [&_::before]:flex → **:[&::before]:flex) (#20550)
  • Ensure the Set.prototype.intersection polyfill in canonicalizeCandidates(…) returns the intersection instead of the first set on Node.js < 22 (#20562)
  • Canonicalization: ensure inline theme(…) alphas with more than 2 decimals migrate to a percentage modifier with the same opacity (e.g. theme(colors.red.500/.12345) → text-red-500/[12.345%], not text-red-500/[12.345]) (#20563)
  • Canonicalization: preserve inline theme(…) alphas as an arbitrary percentage when a custom --opacity-* theme value would change the opacity (e.g. theme(colors.red.500/50%) → text-red-500/[50%] with --opacity-50: 10%) (#20563)
  • Ensure the @property fallback isn't applied in Safari versions that no longer support margin-trim: inline (#20569)
  • Treat viewport units like dvmin and svi and font-relative units like cap and rex as lengths in arbitrary values (e.g. text-[10dvmin] generates font-size instead of color) (#20516)

... (truncated)

Commits

Updates @vitejs/plugin-react from 6.1.2 to 6.2.1

Release notes

Sourced from @​vitejs/plugin-react's releases.

plugin-react@6.2.1

Fix refreshInclude and refreshExclude options not working (#1543)

Fix mistake from #1516

plugin-react@6.2.0

Add refreshInclude and refreshExclude options (#1516)

Add refreshInclude and refreshExclude options to skip fast refresh for certain files that won't run in the browser.

Expand oxc-transform-react peer dependency range (#1540)

The peer dependency version range for oxc-transform-react was expanded from ^0.152.0 to >=0.152.0 <0.157.0.

Expand @rolldown/plugin-babel peer dependency range (#1541)

The peer dependency version range for @rolldown/plugin-babel was expanded from ^0.1.7 || ^0.2.0 to ^0.1.7 || ^0.2.0 || ^0.3.0.

Changelog

Sourced from @​vitejs/plugin-react's changelog.

6.2.1 (2026-11-02)

Fix refreshInclude and refreshExclude options not working (#1543)

Fix mistake from #1516

6.2.0 (2026-11-02)

Add refreshInclude and refreshExclude options (#1516)

Add refreshInclude and refreshExclude options to skip fast refresh for certain files that won't run in the browser.

Expand oxc-transform-react peer dependency range (#1540)

The peer dependency version range for oxc-transform-react was expanded from ^0.152.0 to >=0.152.0 <0.157.0.

Expand @rolldown/plugin-babel peer dependency range (#1541)

The peer dependency version range for @rolldown/plugin-babel was expanded from ^0.1.7 || ^0.2.0 to ^0.1.7 || ^0.2.0 || ^0.3.0.

Commits
  • 29efd1c release: plugin-react@6.2.1 (#1544)
  • 22079fa fix(plugin-react): fix new refreshInclude option (#1543)
  • d0f7234 release: plugin-react@6.2.0 (#1542)
  • 186d1e8 feat(plugin-react): expand @rolldown/plugin-babel peer dep range (#1541)
  • a554a33 feat(plugin-react): expand oxc-transform-react peer dep range (#1540)
  • ef758ba fix(deps): update all non-major dependencies (#1531)
  • 304a92a feat(plugin-react): add refreshInclude and refreshExclude options (#1516)
  • b3e9835 fix(deps): update all non-major dependencies (#1517)
  • 65a1dd5 fix(deps): update react 19.3.1 (#1509)
  • 443be64 chore(deps): update dependency typescript to v7 (#1422)
  • Additional commits viewable in compare view

Updates @xyflow/react from 12.12.0 to 12.12.1

Release notes

Sourced from @​xyflow/react's releases.

@​xyflow/react@​12.12.1

Patch Changes

  • #6068 7813eeb - Cancel a pending click connection when clicking the pane and call onClickConnectEnd / onclickconnectend

  • #6097 d150c38 - Don't mutate the internal selection state

  • #5650 f7cddb9 - Infer the type of pathOptions in EdgeProps from the edge type instead of using any.

  • #6090 b235ea0 - Respect nodeOrigin in isNodeIntersecting and getIntersectingNodes when you pass a node object instead of { id }

  • #6054 c7d0fcb - Disconnect the ResizeObservers when a flow unmounts

  • Updated dependencies [d150c38, 8483a2f, c7d0fcb, 9dcbd29, cba335d]:

    • @​xyflow/system@​0.0.84
Changelog

Sourced from @​xyflow/react's changelog.

12.12.1

Patch Changes

  • #6068 7813eeb - Cancel a pending click connection when clicking the pane and call onClickConnectEnd / onclickconnectend

  • #6097 d150c38 - Don't mutate the internal selection state

  • #5650 f7cddb9 - Infer the type of pathOptions in EdgeProps from the edge type instead of using any.

  • #6090 b235ea0 - Respect nodeOrigin in isNodeIntersecting and getIntersectingNodes when you pass a node object instead of { id }

  • #6054 c7d0fcb - Disconnect the ResizeObservers when a flow unmounts

  • Updated dependencies [d150c38, 8483a2f, c7d0fcb, 9dcbd29, cba335d]:

    • @​xyflow/system@​0.0.84
Commits
  • 7599c7f chore(packages): bump
  • d4bc936 Merge pull request #5650 from keepmhwn/fix/path-options-type
  • c4fdcb1 Merge pull request #6097 from xyflow/fix/internal-selection
  • 5c90af4 fix(react): cleanup internal selection handling #6096
  • 93b7a91 chore(pane): cleanup
  • 7abb6f0 Add Svelte pane cancellation and merge latest main
  • b235ea0 fix: respect flow nodeOrigin in root node intersections
  • 22388df chore(useResizeHandler): cleanup
  • 7813eeb fix(react): cancel click connections on pane click
  • c7d0fcb fix: disconnect ResizeObservers when a flow unmounts
  • See full diff in compare view

Updates i18next-browser-languagedetector from 8.2.4 to 8.3.0

Changelog

Sourced from i18next-browser-languagedetector's changelog.

8.3.0

  • security: a detected language must now have the shape i18next 26.7 accepts for a language code from outside (its isSafeLanguageCode): letters, digits, -, _, @ and . (no ..), at most 128 characters. It replaces the list of XSS patterns, which missed values like <b>x</b> or " onmouseover="x() from the query string, a cookie or storage, which then became the language; apps put it into <html lang="...">. Compatibility note: a value with other characters (spaces, slashes, quotes) is now skipped and the next detector is used; codes like en_US, zh_Hant_TW or sr@latin still pass, and i18next 27 refuses such codes from outside as well.
Commits

Updates i18next-http-backend from 4.0.7 to 4.0.10

Changelog

Sourced from i18next-http-backend's changelog.

4.0.10

Security release. See advisory GHSA-qh2f-jh77-hfwf.

  • security: refuse a request URL whose scheme or authority (host, port, userinfo) differs from what the loadPath / addPath template gives when the lng and ns values are plain data. With a template that puts {{ns}} in the host, e.g. https://{{ns}}.cdn.example.com/{{lng}}.json, an ns value of @evil.example/x (@ ends the userinfo, since 4.0.1) or evil.example/x (/ ends the host, since 3.0.6) sent the request, with its customHeaders, to evil.example. / and @ stay allowed in ns for nested and scoped namespaces such as @org/pkg, and they keep working in the path. The check runs for read and create, and for loadPath / addPath functions that return a template. It includes the 4.0.3 check for a leading //, which it replaces. The default /locales/{{lng}}/{{ns}}.json and other templates with the placeholders in the path were not affected. A value in the host may now only contain letters, digits and -._~!*'().

4.0.9

  • fix: with i18next 26.7.1 or later, reloadInterval reloads everything i18next loaded or tried to load through the backend: the current languages and the languages loaded for clones (one per request on a server), and it retries the bundles that failed. 4.0.8 passed the fallback and preload languages to i18next's reloadResources(), which skipped a bundle that had failed to load, so a language missing after an outage at startup stayed missing (the backend's own reload before 4.0.8 read it again). With older i18next nothing changes.

4.0.8

  • fix: with i18next 26.7.0 or later, create gets its callback. i18next 26.7.0 deprecates guessing the calling convention of a backend from the number of parameters of its methods; the backend now declares it with callbackApi, so i18next calls read and create with a callback (and passes create its options), and debug mode no longer logs the deprecation notice. Older i18next versions ignore it. create(languages, namespace, key, fallbackValue, callback) has five parameters, the number i18next reserved for the form without a callback, so i18next passed its options object as callback, and with a refused lng or ns value create called that object (a TypeError that i18next swallowed).
  • reloadInterval reloads through services.utils.reloadResources with i18next 26.7.0 or later (with i18next's retries and the loaded event) instead of calling i18next's internal backend connector. It reloads the same languages as before: the fallback and preload languages. With older i18next nothing changes.
Commits
  • 69b683a 4.0.10
  • cf0fc90 security: refuse URLs whose scheme or host a lng/ns value changes (GHSA-qh2f-...
  • 645ad0c 4.0.9
  • a6085ce build
  • f615d3e changelog for 4.0.9
  • 8784f12 fix: hand the reload to i18next 26.7.1 or later, which retries bundles that f...
  • b674794 4.0.8
  • 03366f9 build
  • 31d62d8 changelog for 4.0.8
  • 334dc53 fix: declare callbackApi, so i18next 26.7 calls create with its callback; rel...
  • Additional commits viewable in compare view

Updates lucide-react from 1.66.0 to 1.70.0

Release notes

Sourced from lucide-react's releases.

Version 1.70.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.69.0...1.70.0

Version 1.69.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.68.0...1.69.0

Version 1.68.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.67.0...1.68.0

Version 1.67.0

What's Changed

... (truncated)

Commits

Updates tailwindcss from 4.3.3 to 4.3.5

Release notes

Sourced from tailwindcss's releases.

v4.3.5

Fixed

  • Canonicalization: improve performance in projects with many functional variant values (e.g. a matchVariant plugin with thousands of values) (#20663)
  • Don't crash or create a fallback with the wrong color for a color-mix(…) without a color interpolation method (e.g. color-mix(var(--color-red-500)) or color-mix(currentcolor 50%, transparent)) (#20658, #20666)
  • Ensure @tailwindcss/oxide-wasm32-wasi loads instead of hanging forever (e.g. with NAPI_RS_FORCE_WASI=error or in WebContainers) (#20667)
  • Remove as: '*.css' from the @tailwindcss/turbopack setup in its README, because it breaks CSS modules (#20660)
  • Ignore <!-- and --> between top-level rules in CSS instead of throwing or swallowing the next rule (e.g. a { color: red } --> b { color: blue }) (#20665)
  • Ensure @tailwindcss/oxide-wasm32-wasi detects changed and new source files after the first scan (e.g. in WebContainers) (#20487)
  • Prevent type errors with skipLibCheck: false caused by imports of unshipped modules in the @tailwindcss/node type declarations (#20632)

v4.3.4

Added

  • Add @tailwindcss/turbopack, a Turbopack loader for using Tailwind CSS with Next.js (#20367)

Fixed

  • Ensure watch mode detects changes to symlinked @source files whose real paths aren't otherwise scanned (#20356)
  • Ensure variants using @scope wrap generated utilities instead of nesting inside them (#20369)
  • Ensure nested @scope rules preserve their scoping semantics when flattened (#20369)
  • Preserve declarations directly inside @scope by wrapping them in :where(:scope) (#20369)
  • Ensure generated utilities include a space in empty var() fallbacks (e.g. var(--tw-blur,) → var(--tw-blur, )) (#20373)
  • Canonicalization: convert arbitrary breakpoint and container query variants to named equivalents (e.g. max-[64rem]:flex → max-lg:flex) (#20380)
  • Prevent @tailwindcss/vite from crashing on every edit under Vite's experimental bundledDev mode (#20379)
  • Ensure @tailwindcss/oxide falls back to WASM on platforms without native bindings (@tailwindcss/oxide-wasm32-wasi now installs on all platforms, but only loads when no native binding is available) (#20383)
  • Extract class candidates from Ruby %w and %W literals using angle brackets or custom delimiters (e.g. %w<flex>, %w|flex|), including in Slim and Haml templates (#20387)
  • Preserve whitespace in --default(…) values in functional @utility definitions (e.g. --default(box alphabetic) no longer becomes boxalphabetic) (#20392)
  • Ensure automatic source detection respects negation-based .gitignore files (e.g. /* followed by !/… patterns) (#20397)
  • Ensure root theme('…') namespace lookups in JavaScript plugins and config files return the full namespace object instead of the value of its DEFAULT key (#20399)
  • Skip ignored directories when generating watch globs instead of walking their contents on every rebuild (#20408)
  • Drop invalid UTF-8 candidates during class detection (#20389)
  • Prevent @tailwindcss/vite from forcing full-page reloads for scanned files that Vite does not handle as modules (e.g. .php files) (#20414)
  • Canonicalization: don't merge utilities that reference different theme variables set to CSS-wide keywords like unset (#20417)
  • Don't generate utilities when a modifier is used that would otherwise be silently ignored (e.g. rounded-sm/[5], shadow-sm/foo, stroke-2/50) (#20419)
  • Preserve and, or, and not inside selectors in supports-[…] variants (e.g. supports-[selector(a:not(.foo))]:flex) (#20420)
  • Don't warn about Angular's ::ng-deep and :host-context() when optimizing CSS (#20434)
  • Don't generate CSS for candidates containing an empty additional modifier (e.g. bg-red-500/50/ and group-hover/foo//bar:flex) (#20466)
  • Ensure min-*, max-*, and container query variants with decimal values are sorted numerically (e.g. min-[40.25rem] before min-[40.5rem]) (#20512)
  • Ensure CSS comments ending with \*/ are closed correctly instead of swallowing the CSS that follows (e.g. /* C:\temp\*/) (#20508)
  • Improve style invalidation performance of group-* and peer-* variants (#20513)
  • Ensure cached compilers release their loadModule and loadStylesheet callbacks after compilation (#20531)
  • Canonicalization: preserve & when moving a pseudo-element into * or ** (e.g. [&_::before]:flex → **:[&::before]:flex) (#20550)
  • Ensure the Set.prototype.intersection polyfill in canonicalizeCandidates(…) returns the intersection instead of the first set on Node.js < 22 (#20562)
  • Canonicalization: ensure inline theme(…) alphas with more than 2 decimals migrate to a percentage modifier with the same opacity (e.g. theme(colors.red.500/.12345) → text-red-500/[12.345%], not text-red-500/[12.345]) (#20563)
  • Canonicalization: preserve inline theme(…) alphas as an arbitrary percentage when a custom --opacity-* theme value would change the opacity (e.g. theme(colors.red.500/50%) → text-red-500/[50%] with --opacity-50: 10%) (#20563)
  • Ensure the @property fallback isn't applied in Safari versions that no longer support margin-trim: inline (#20569)
  • Treat viewport units like dvmin and svi and font-relative units like cap and rex as lengths in arbitrary values (e.g. text-[10dvmin] generates font-size instead of color) (#20516)
  • Write plugin logs to stderr in tailwindcss canonicalize so they don't end up in the results on stdout (#20561)
  • Extract class shorthands on later lines when Pug text, comments, or quoted attribute values contain unbalanced brackets, or a quote that doesn't start a string (e.g. input(pattern=/"/.source)) (#20547, #20572)

... (truncated)

Changelog

Sourced from tailwindcss's changelog.

[4.3.5] - 2026-11-06

Fixed

  • Canonicalization: improve performance in projects with many functional variant values (e.g. a matchVariant plugin with thousands of values) (#20663)
  • Don't crash or create a fallback with the wrong color for a color-mix(…) without a color interpolation method (e.g. color-mix(var(--color-red-500)) or color-mix(currentcolor 50%, transparent)) (#20658, #20666)
  • Ensure @tailwindcss/oxide-wasm32-wasi loads instead of hanging forever (e.g. with NAPI_RS_FORCE_WASI=error or in WebContainers) (#20667)
  • Remove as: '*.css' from the @tailwindcss/turbopack setup in its README, because it breaks CSS modules (#20660)
  • Ignore <!-- and --> between top-level rules in CSS instead of throwing or swallowing the next rule (e.g. a { color: red } --> b { color: blue }) (#20665)
  • Ensure @tailwindcss/oxide-wasm32-wasi detects changed and new source files after the first scan (e.g. in WebContainers) (<...

    Description has been truncated

@dependabot
chore(deps): bump the bun-minor-and-patch group with 9 updates
2731ea6 
Bumps the bun-minor-and-patch group with 9 updates:

| Package | From | To |
| --- | --- | --- |
| [@tailwindcss/vite](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-vite) | `4.3.3` | `4.3.5` |
| [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) | `6.1.2` | `6.2.1` |
| [@xyflow/react](https://github.com/xyflow/xyflow/tree/HEAD/packages/react) | `12.12.0` | `12.12.1` |
| [i18next-browser-languagedetector](https://github.com/i18next/i18next-browser-languageDetector) | `8.2.4` | `8.3.0` |
| [i18next-http-backend](https://github.com/i18next/i18next-http-backend) | `4.0.7` | `4.0.10` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.66.0` | `1.70.0` |
| [tailwindcss](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss) | `4.3.3` | `4.3.5` |
| [zustand](https://github.com/pmndrs/zustand) | `5.0.16` | `5.1.0` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.3.5` | `8.3.6` |


Updates `@tailwindcss/vite` from 4.3.3 to 4.3.5
- [Release notes](https://github.com/tailwindlabs/tailwindcss/releases)
- [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md)
- [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.3.5/packages/@tailwindcss-vite)

Updates `@vitejs/plugin-react` from 6.1.2 to 6.2.1
- [Release notes](https://github.com/vitejs/vite-plugin-react/releases)
- [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.2.1/packages/plugin-react)

Updates `@xyflow/react` from 12.12.0 to 12.12.1
- [Release notes](https://github.com/xyflow/xyflow/releases)
- [Changelog](https://github.com/xyflow/xyflow/blob/main/packages/react/CHANGELOG.md)
- [Commits](https://github.com/xyflow/xyflow/commits/@xyflow/react@12.12.1/packages/react)

Updates `i18next-browser-languagedetector` from 8.2.4 to 8.3.0
- [Changelog](https://github.com/i18next/i18next-browser-languageDetector/blob/master/CHANGELOG.md)
- [Commits](i18next/i18next-browser-languageDetector@v8.2.4...v8.3.0)

Updates `i18next-http-backend` from 4.0.7 to 4.0.10
- [Changelog](https://github.com/i18next/i18next-http-backend/blob/master/CHANGELOG.md)
- [Commits](i18next/i18next-http-backend@v4.0.7...v4.0.10)

Updates `lucide-react` from 1.66.0 to 1.70.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.70.0/packages/lucide-react)

Updates `tailwindcss` from 4.3.3 to 4.3.5
- [Release notes](https://github.com/tailwindlabs/tailwindcss/releases)
- [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md)
- [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.3.5/packages/tailwindcss)

Updates `zustand` from 5.0.16 to 5.1.0
- [Release notes](https://github.com/pmndrs/zustand/releases)
- [Commits](pmndrs/zustand@v5.0.16...v5.1.0)

Updates `vite` from 8.3.5 to 8.3.6
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.3.6/packages/vite)

---
updated-dependencies:
- dependency-name: "@tailwindcss/vite"
  dependency-version: 4.3.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: bun-minor-and-patch
- dependency-name: "@vitejs/plugin-react"
  dependency-version: 6.2.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: bun-minor-and-patch
- dependency-name: "@xyflow/react"
  dependency-version: 12.12.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: bun-minor-and-patch
- dependency-name: i18next-browser-languagedetector
  dependency-version: 8.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: bun-minor-and-patch
- dependency-name: i18next-http-backend
  dependency-version: 4.0.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: bun-minor-and-patch
- dependency-name: lucide-react
  dependency-version: 1.70.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: bun-minor-and-patch
- dependency-name: tailwindcss
  dependency-version: 4.3.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: bun-minor-and-patch
- dependency-name: zustand
  dependency-version: 5.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: bun-minor-and-patch
- dependency-name: vite
  dependency-version: 8.3.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: bun-minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 11, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants