build(deps): bump the minor-and-patch group with 6 updates by dependabot[bot] · Pull Request #207 · GeiserX/Pumperly

dependabot · 2026-11-06T20:05:42Z

Bumps the minor-and-patch group with 6 updates:

Package	From	To
next	`16.4.3`	`16.4.5`
@tailwindcss/postcss	`4.3.3`	`4.3.4`
@vitest/coverage-v8	`5.0.5`	`5.1.0`
eslint-config-next	`16.4.3`	`16.4.5`
tailwindcss	`4.3.3`	`4.3.4`
vitest	`5.0.5`	`5.1.0`

Updates next from 16.4.3 to 16.4.5

Release notes

Sourced from next's releases.

v16.4.5

This release contains security fixes for the following advisories:

Moderate

Cross-tenant sensitive information disclosure in Next.js 'use cache' when called through unstable_cache

Cache leak across root param values in nested 'use cache' functions (follow-up)

Cache poisoning of shared fallback shells in Cache Components via request-supplied placeholder route params

Cross-user cache disclosure and poisoning in Next.js use cache with binary arguments

Cross-client response injection and disclosure in self-hosted Next.js applications forwarding fetched responses

SVG rejection bypass in Next.js image optimization

HttpOnly cookie exposure through internal response header on Next.js Edge runtime routes

v16.4.4

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary. The announced security released for November will be published tomorrow.

Core Changes

[lts-active] test: disable the reads fallback params after a client navigation deployment test (#100668)

[lts-active] Reload on missed Turbopack startup CSS updates (#100619)

[lts-active] Revert "Optimize strict module factory chunks (#98421)" (#100866)

[lts-active] Emit the Turbopack shared-runtime bootstrap in the PPR resume so it gets the CSP nonce (#100907)

[lts-active] [ci] Pin deploy test deployments to Node.js 22.x (#100886)

[lts-active] fix(analyze): use route summaries as the analyzer route index (#100974)

[lts-active] Use fast-jwt instead of jsonwebtoken (#100885)

Credits

Huge thanks to @icyJoseph, @mischnic, @wbinnssmith, @lukesandberg, and @eps1lon for helping!

Commits

4e5335a v16.4.5
809be72 [lts-active] Strip internal middleware cookie headers from edge responses (#282)
2842833 [lts-active] Fix stale compressed framing for forwarded fetch responses (#281)
6596840 [lts-active] [use cache] Fix cache key when binary args are used (#280)
18eeffb [lts-active] Fix shared shell poisoning from request-supplied placeholder par...
e66e656 [lts-active] [next/image] Fix false-positive AVIF/HEIC detection (#278)
d605874 [lts-active] Fix unstable_cache leaking cold 'use cache' fills across roo...
80c96ed [lts-active] Fix outer 'use cache' entries reused across root param values ...
b175f52 v16.4.4
ba4a4c1 [lts-active] Use fast-jwt instead of jsonwebtoken (#100885)
Additional commits viewable in compare view

Updates @tailwindcss/postcss from 4.3.3 to 4.3.4

Release notes

Sourced from @tailwindcss/postcss's releases.

v4.3.4

Added

Add @tailwindcss/turbopack, a Turbopack loader for using Tailwind CSS with Next.js (#20367)

Fixed

Ensure watch mode detects changes to symlinked @source files whose real paths aren't otherwise scanned (#20356)

Ensure variants using @scope wrap generated utilities instead of nesting inside them (#20369)

Ensure nested @scope rules preserve their scoping semantics when flattened (#20369)

Preserve declarations directly inside @scope by wrapping them in :where(:scope) (#20369)

Ensure generated utilities include a space in empty var() fallbacks (e.g. var(--tw-blur,) → var(--tw-blur, )) (#20373)

Canonicalization: convert arbitrary breakpoint and container query variants to named equivalents (e.g. max-[64rem]:flex → max-lg:flex) (#20380)

Prevent @tailwindcss/vite from crashing on every edit under Vite's experimental bundledDev mode (#20379)

Ensure @tailwindcss/oxide falls back to WASM on platforms without native bindings (#20383)

Extract class candidates from Ruby %w and %W literals using angle brackets or custom delimiters (e.g. %w<flex>, %w|flex|), including in Slim and Haml templates (#20387)

Preserve whitespace in --default(…) values in functional @utility definitions (e.g. --default(box alphabetic) no longer becomes boxalphabetic) (#20392)

Ensure automatic source detection respects negation-based .gitignore files (e.g. /* followed by !/… patterns) (#20397)

Ensure root theme('…') namespace lookups in JavaScript plugins and config files return the full namespace object instead of the value of its DEFAULT key (#20399)

Skip ignored directories when generating watch globs instead of walking their contents on every rebuild (#20408)

Drop invalid UTF-8 candidates during class detection (#20389)

Prevent @tailwindcss/vite from forcing full-page reloads for scanned files that Vite does not handle as modules (e.g. .php files) (#20414)

Canonicalization: don't merge utilities that reference different theme variables set to CSS-wide keywords like unset (#20417)

Don't generate utilities when a modifier is used that would otherwise be silently ignored (e.g. rounded-sm/[5], shadow-sm/foo, stroke-2/50) (#20419)

Preserve and, or, and not inside selectors in supports-[…] variants (e.g. supports-[selector(a:not(.foo))]:flex) (#20420)

Don't warn about Angular's ::ng-deep and :host-context() when optimizing CSS (#20434)

Don't generate CSS for candidates containing an empty additional modifier (e.g. bg-red-500/50/ and group-hover/foo//bar:flex) (#20466)

Ensure min-*, max-*, and container query variants with decimal values are sorted numerically (e.g. min-[40.25rem] before min-[40.5rem]) (#20512)

Ensure CSS comments ending with \*/ are closed correctly instead of swallowing the CSS that follows (e.g. /* C:\temp\*/) (#20508)

Improve style invalidation performance of group-* and peer-* variants (#20513)

Ensure cached compilers release their loadModule and loadStylesheet callbacks after compilation (#20531)

Canonicalization: preserve & when moving a pseudo-element into * or ** (e.g. [&_::before]:flex → **:[&::before]:flex) (#20550)

Ensure the Set.prototype.intersection polyfill in canonicalizeCandidates(…) returns the intersection instead of the first set on Node.js < 22 (#20562)

Canonicalization: ensure inline theme(…) alphas with more than 2 decimals migrate to a percentage modifier with the same opacity (e.g. theme(colors.red.500/.12345) → text-red-500/[12.345%], not text-red-500/[12.345]) (#20563)

Canonicalization: preserve inline theme(…) alphas as an arbitrary percentage when a custom --opacity-* theme value would change the opacity (e.g. theme(colors.red.500/50%) → text-red-500/[50%] with --opacity-50: 10%) (#20563)

Ensure the @property fallback isn't applied in Safari versions that no longer support margin-trim: inline (#20569)

Treat viewport units like dvmin and svi and font-relative units like cap and rex as lengths in arbitrary values (e.g. text-[10dvmin] generates font-size instead of color) (#20516)

Write plugin logs to stderr in tailwindcss canonicalize so they don't end up in the results on stdout (#20561)

Extract class shorthands on later lines when Pug text, comments, or quoted attribute values contain unbalanced brackets, or a quote that doesn't start a string (e.g. input(pattern=/"/.source)) (#20547, #20572)

Underline the correct occurrence of an unsupported data type in --value(…) warnings (#20554)

Canonicalization: prefer an existing candidate when collapsing utilities over another utility with the same default theme value (e.g. text-foreground text-primary → text-primary, not text-card-checked-border) (#20540)

Canonicalization: don't collapse utilities into a utility that uses another theme variable with the same default value (e.g. mt-card mb-card → my-card, not my-4) (#20574)

Ensure @tailwindcss/postcss rewrites relative url(…)s of stylesheets that are inlined before it runs (e.g. @imports in Vite) in optimized builds (#20576)

Drop nested rules that put a combinator after a pseudo-element when using pseudo-element variants (e.g. selection:* on a utility with a nested & > * rule) (#20575)

Don't generate CSS for arbitrary values with unbalanced parentheses or brackets (e.g. w-[calc(1px] or [--x:a[b]) (#20577)

Canonicalization: prevent collapse: true from taking exponentially longer when classes are linked through a utility that sets many properties (e.g. sr-only) (#20558)

Ensure & is substituted inside :-moz-any(…) and :-webkit-any(…) in custom variants (e.g. @custom-variant firefox (:-moz-any(&));) (#20486)

Ensure the standalone macOS binaries have a valid code signature, so macOS 27 no longer kills them at launch (#20578)

Ensure @tailwindcss/turbopack and @tailwindcss/webpack rebuild when the input CSS changes (e.g. next dev with Turbopack no longer serves the CSS of the previous edit) (#20582)

Canonicalization: don't drop a utility that sets a --tw-* variable when an unrelated property has the same value (e.g. link mt-4 no longer becomes mt-4 when link sets margin-top: 16px and --tw-translate-x: 16px) (#20593)

... (truncated)

Changelog

Sourced from @tailwindcss/postcss's changelog.

[4.3.4] - 2026-11-02

Added

Add @tailwindcss/turbopack, a Turbopack loader for using Tailwind CSS with Next.js (#20367)

Fixed

Ensure watch mode detects changes to symlinked @source files whose real paths aren't otherwise scanned (#20356)

Ensure variants using @scope wrap generated utilities instead of nesting inside them (#20369)

Ensure nested @scope rules preserve their scoping semantics when flattened (#20369)

Preserve declarations directly inside @scope by wrapping them in :where(:scope) (#20369)

Ensure generated utilities include a space in empty var() fallbacks (e.g. var(--tw-blur,) → var(--tw-blur, )) (#20373)

Canonicalization: convert arbitrary breakpoint and container query variants to named equivalents (e.g. max-[64rem]:flex → max-lg:flex) (#20380)

Prevent @tailwindcss/vite from crashing on every edit under Vite's experimental bundledDev mode (#20379)

Ensure @tailwindcss/oxide falls back to WASM on platforms without native bindings (#20383)

Extract class candidates from Ruby %w and %W literals using angle brackets or custom delimiters (e.g. %w<flex>, %w|flex|), including in Slim and Haml templates (#20387)

Preserve whitespace in --default(…) values in functional @utility definitions (e.g. --default(box alphabetic) no longer becomes boxalphabetic) (#20392)

Ensure automatic source detection respects negation-based .gitignore files (e.g. /* followed by !/… patterns) (#20397)

Ensure root theme('…') namespace lookups in JavaScript plugins and config files return the full namespace object instead of the value of its DEFAULT key (#20399)

Skip ignored directories when generating watch globs instead of walking their contents on every rebuild (#20408)

Drop invalid UTF-8 candidates during class detection (#20389)

Prevent @tailwindcss/vite from forcing full-page reloads for scanned files that Vite does not handle as modules (e.g. .php files) (#20414)

Canonicalization: don't merge utilities that reference different theme variables set to CSS-wide keywords like unset (#20417)

Don't generate utilities when a modifier is used that would otherwise be silently ignored (e.g. rounded-sm/[5], shadow-sm/foo, stroke-2/50) (#20419)

Preserve and, or, and not inside selectors in supports-[…] variants (e.g. supports-[selector(a:not(.foo))]:flex) (#20420)

Don't warn about Angular's ::ng-deep and :host-context() when optimizing CSS (#20434)

Don't generate CSS for candidates containing an empty additional modifier (e.g. bg-red-500/50/ and group-hover/foo//bar:flex) (#20466)

Ensure min-*, max-*, and container query variants with decimal values are sorted numerically (e.g. min-[40.25rem] before min-[40.5rem]) (#20512)

Ensure CSS comments ending with \*/ are closed correctly instead of swallowing the CSS that follows (e.g. /* C:\temp\*/) (#20508)

Improve style invalidation performance of group-* and peer-* variants (#20513)

Ensure cached compilers release their loadModule and loadStylesheet callbacks after compilation (#20531)

Canonicalization: preserve & when moving a pseudo-element into * or ** (e.g. [&_::before]:flex → **:[&::before]:flex) (#20550)

Ensure the Set.prototype.intersection polyfill in canonicalizeCandidates(…) returns the intersection instead of the first set on Node.js < 22 (#20562)

Canonicalization: ensure inline theme(…) alphas with more than 2 decimals migrate to a percentage modifier with the same opacity (e.g. theme(colors.red.500/.12345) → text-red-500/[12.345%], not text-red-500/[12.345]) (#20563)

Canonicalization: preserve inline theme(…) alphas as an arbitrary percentage when a custom --opacity-* theme value would change the opacity (e.g. theme(colors.red.500/50%) → text-red-500/[50%] with --opacity-50: 10%) (#20563)

Ensure the @property fallback isn't applied in Safari versions that no longer support margin-trim: inline (#20569)

Treat viewport units like dvmin and svi and font-relative units like cap and rex as lengths in arbitrary values (e.g. text-[10dvmin] generates font-size instead of color) (#20516)

Write plugin logs to stderr in tailwindcss canonicalize so they don't end up in the results on stdout (#20561)

Extract class shorthands on later lines when Pug text, comments, or quoted attribute values contain unbalanced brackets, or a quote that doesn't start a string (e.g. input(pattern=/"/.source)) (#20547, #20572)

Underline the correct occurrence of an unsupported data type in --value(…) warnings (#20554)

Canonicalization: prefer an existing candidate when collapsing utilities over another utility with the same default theme value (e.g. text-foreground text-primary → text-primary, not text-card-checked-border) (#20540)

Canonicalization: don't collapse utilities into a utility that uses another theme variable with the same default value (e.g. mt-card mb-card → my-card, not my-4) (#20574)

Ensure @tailwindcss/postcss rewrites relative url(…)s of stylesheets that are inlined before it runs (e.g. @imports in Vite) in optimized builds (#20576)

Drop nested rules that put a combinator after a pseudo-element when using pseudo-element variants (e.g. selection:* on a utility with a nested & > * rule) (#20575)

Don't generate CSS for arbitrary values with unbalanced parentheses or brackets (e.g. w-[calc(1px] or [--x:a[b]) (#20577)

Canonicalization: prevent collapse: true from taking exponentially longer when classes are linked through a utility that sets many properties (e.g. sr-only) (#20558)

Ensure & is substituted inside :-moz-any(…) and :-webkit-any(…) in custom variants (e.g. @custom-variant firefox (:-moz-any(&));) (#20486)

Ensure the standalone macOS binaries have a valid code signature, so macOS 27 no longer kills them at launch (#20578)

Ensure @tailwindcss/turbopack and @tailwindcss/webpack rebuild when the input CSS changes (e.g. next dev with Turbopack no longer serves the CSS of the previous edit) (#20582)

... (truncated)

Commits

2626ae6 4.3.4 (#20447)
e8f8b19 Rewrite url(…)s of stylesheets inlined before @tailwindcss/postcss in opt...
931db16 Use margin-trim: block in the @property fallback detection (#20569)
05c3a87 Bump dependencies (#20381)
See full diff in compare view

Updates @vitest/coverage-v8 from 5.0.5 to 5.1.0

Release notes

Sourced from @vitest/coverage-v8's releases.

v5.1.0

🚀 Features

Add --last-failed to run only failed tests - by @sheremet-va in vitest-dev/vitest#11558 (82f63)

Support Temporal.Instant and Temporal.ZonedDateTime in vi.setSystemTime() - by @Prajwal2246, Prajwal2246, Claude Opus 5.5 (1M context), @hi-ogawa and Codex (GPT-6) in vitest-dev/vitest#11321 (f150f)

Introduce --since-last-run flag - by @sheremet-va in vitest-dev/vitest#11516 (08bd9)

Expose per-retry/repeat attempt result - by @hi-ogawa, Codex (GPT-6) and Claude Opus 5.5 (1M context) in vitest-dev/vitest#11232 (21be4)

Support fake timers for node:timers and node:timers/promise - by @hi-ogawa, OpenCode and Codex (GPT-6) in vitest-dev/vitest#10899 (fbe97)

Allow coverage providers to store data in fs module cache - by @AriPerkkio in vitest-dev/vitest#11747 (54a2b)

Interactively review failed snapshots - by @macarie and @hi-ogawa in vitest-dev/vitest#11325 (54e5b)

browser:

Mock modules through an import map - by @sheremet-va in vitest-dev/vitest#11534 (707f8)

Drop experimental label from trace view - by @hi-ogawa and Claude Opus 5.5 (1M context) in vitest-dev/vitest#11518 (44c3c)

Introduce experimental pointer API - by @macarie in vitest-dev/vitest#10780 (5dc09)

Capture aria snapshot in trace view - by @hi-ogawa and Claude Opus 5.5 (1M context) in vitest-dev/vitest#11492 (0cc39)

Show trace steps timeline on terminal on test failure - by @hi-ogawa and Claude Opus 5.5 (1M context) in vitest-dev/vitest#11594 (973dc)

Add failure-only trace view mode - by @hi-ogawa and Claude Opus 5.5 (1M context) in vitest-dev/vitest#11612 (d5d7d)

Enable failure-only trace view by default - by @hi-ogawa and Claude Opus 5.5 (1M context) in vitest-dev/vitest#11766 (f37b6)

coverage:

V8 to support ignoreNode option - by @erickserra and @AriPerkkio in vitest-dev/vitest#11688 (e02db)

experimental:

Add trace timeline for node - by @hi-ogawa and Claude Opus 5.5 (1M context) in vitest-dev/vitest#11753 (4e985)

Add message option to vi.waitFor and vi.waitUntil - by @hi-ogawa and Claude Opus 5.5 (1M context) in vitest-dev/vitest#11754 (fd145)

🐞 Bug Fixes

Rerun setup files after --changed filtering - by @sheremet-va in vitest-dev/vitest#11621 (3a39c)

Return the mock to concurrent imports - by @sheremet-va in vitest-dev/vitest#11623 (1453b)

Don't fail on console log pending at teardown - by @sheremet-va in vitest-dev/vitest#11619 (a60b8)

Reference chai types in every d.ts chunk - by @sheremet-va in vitest-dev/vitest#11618 (fb150)

Detect mock factory cycles that form later - by @sheremet-va in vitest-dev/vitest#11642 (e9554)

Skip fs module cache for typed import.meta.glob - by @sheremet-va in vitest-dev/vitest#11666 (79501)

Run tests that import a deleted file - by @sheremet-va in vitest-dev/vitest#11669 (80aa1)

Keep syntax highlighting in code frames - by @sheremet-va in vitest-dev/vitest#11705 (d39f5)

Respect CLI filters when prewarming browsers - by @sheremet-va and Benjamin Tang in vitest-dev/vitest#11706 (10947)

Read cached source as utf-8 - by @juan-fernandez in vitest-dev/vitest#11682 and vitest-dev/vitest#11709 (867a5)

Inherit watch from the root config in projects - by @nstepien and Claude Opus 5.5 (1M context) in vitest-dev/vitest#11724 (77c12)

Prefix expect.poll message to all errors - by @hi-ogawa and Claude Opus 5.5 (1M context) in vitest-dev/vitest#11756 (cab58)

Support api.port 0 - by @hi-ogawa and Claude Opus 5.5 (1M context) in vitest-dev/vitest#11641 (3667c)

Show attempts in test error logs of retried tests - by @hi-ogawa and Claude Opus 5.5 (1M context) in vitest-dev/vitest#11696 (77a94)

Preserve rootDir in project paths - by @btea in vitest-dev/vitest#11816 (bf96d)

browser:

Change default port to 23315 - by @hi-ogawa and Claude Opus 5.5 (1M context) in vitest-dev/vitest#11640 (a2ec4)

Advance fake timers in actions and expect.element - by @julienw, @hi-ogawa and Claude Opus 5.5 (1M context) in vitest-dev/vitest#11242 (68190)

Drop trace view warning without html reporter - by @hi-ogawa and Claude Opus 5.5 (1M context) in vitest-dev/vitest#11665 (e6407)

Detect shared chunks via the optimizer - by @sheremet-va in vitest-dev/vitest#11661 (e2e9c)

Clear screenshot stability timeout - by @sheremet-va in vitest-dev/vitest#11659 (fbe37)

Measure prepare duration with one clock - by @sheremet-va in vitest-dev/vitest#11667 (a3ed4)

Keep failure screenshot per attempt - by @hi-ogawa and Claude Opus 5.5 (1M context) in vitest-dev/vitest#11694 (a5022)

Print trace timeline of each attempt - by @hi-ogawa and Claude Opus 5.5 (1M context) in vitest-dev/vitest#11695 (27229)

... (truncated)

Commits

7a38449 chore: release v5.1.0 (#11838)
5901fb4 fix(coverage): v8 to ignore Vite's generated CJS namespace import helper (#11...
e02db08 feat(coverage): v8 to support ignoreNode option (#11688)
e1b0d33 chore: release v5.1.0-beta.1 (#11647)
de5af29 fix(coverage): v8 autoAttachSubprocess to use .tmp directory (#11632)
See full diff in compare view

Updates eslint-config-next from 16.4.3 to 16.4.5

Release notes

Sourced from eslint-config-next's releases.

v16.4.5

This release contains security fixes for the following advisories:

Moderate

Cross-tenant sensitive information disclosure in Next.js 'use cache' when called through unstable_cache

Cache leak across root param values in nested 'use cache' functions (follow-up)

Cache poisoning of shared fallback shells in Cache Components via request-supplied placeholder route params

Cross-user cache disclosure and poisoning in Next.js use cache with binary arguments

Cross-client response injection and disclosure in self-hosted Next.js applications forwarding fetched responses

SVG rejection bypass in Next.js image optimization

HttpOnly cookie exposure through internal response header on Next.js Edge runtime routes

v16.4.4

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary. The announced security released for November will be published tomorrow.

Core Changes

[lts-active] test: disable the reads fallback params after a client navigation deployment test (#100668)

[lts-active] Reload on missed Turbopack startup CSS updates (#100619)

[lts-active] Revert "Optimize strict module factory chunks (#98421)" (#100866)

[lts-active] Emit the Turbopack shared-runtime bootstrap in the PPR resume so it gets the CSP nonce (#100907)

[lts-active] [ci] Pin deploy test deployments to Node.js 22.x (#100886)

[lts-active] fix(analyze): use route summaries as the analyzer route index (#100974)

[lts-active] Use fast-jwt instead of jsonwebtoken (#100885)

Credits

Huge thanks to @icyJoseph, @mischnic, @wbinnssmith, @lukesandberg, and @eps1lon for helping!

Commits

4e5335a v16.4.5
b175f52 v16.4.4
See full diff in compare view

Updates tailwindcss from 4.3.3 to 4.3.4

Release notes

Sourced from tailwindcss's releases.

v4.3.4

Added

Add @tailwindcss/turbopack, a Turbopack loader for using Tailwind CSS with Next.js (#20367)

Fixed

Ensure watch mode detects changes to symlinked @source files whose real paths aren't otherwise scanned (#20356)

Ensure variants using @scope wrap generated utilities instead of nesting inside them (#20369)

Ensure nested @scope rules preserve their scoping semantics when flattened (#20369)

Preserve declarations directly inside @scope by wrapping them in :where(:scope) (#20369)

Ensure generated utilities include a space in empty var() fallbacks (e.g. var(--tw-blur,) → var(--tw-blur, )) (#20373)

Canonicalization: convert arbitrary breakpoint and container query variants to named equivalents (e.g. max-[64rem]:flex → max-lg:flex) (#20380)

Prevent @tailwindcss/vite from crashing on every edit under Vite's experimental bundledDev mode (#20379)

Ensure @tailwindcss/oxide falls back to WASM on platforms without native bindings (#20383)

Extract class candidates from Ruby %w and %W literals using angle brackets or custom delimiters (e.g. %w<flex>, %w|flex|), including in Slim and Haml templates (#20387)

Preserve whitespace in --default(…) values in functional @utility definitions (e.g. --default(box alphabetic) no longer becomes boxalphabetic) (#20392)

Ensure automatic source detection respects negation-based .gitignore files (e.g. /* followed by !/… patterns) (#20397)

Ensure root theme('…') namespace lookups in JavaScript plugins and config files return the full namespace object instead of the value of its DEFAULT key (#20399)

Skip ignored directories when generating watch globs instead of walking their contents on every rebuild (#20408)

Drop invalid UTF-8 candidates during class detection (#20389)

Prevent @tailwindcss/vite from forcing full-page reloads for scanned files that Vite does not handle as modules (e.g. .php files) (#20414)

Canonicalization: don't merge utilities that reference different theme variables set to CSS-wide keywords like unset (#20417)

Don't generate utilities when a modifier is used that would otherwise be silently ignored (e.g. rounded-sm/[5], shadow-sm/foo, stroke-2/50) (#20419)

Preserve and, or, and not inside selectors in supports-[…] variants (e.g. supports-[selector(a:not(.foo))]:flex) (#20420)

Don't warn about Angular's ::ng-deep and :host-context() when optimizing CSS (#20434)

Don't generate CSS for candidates containing an empty additional modifier (e.g. bg-red-500/50/ and group-hover/foo//bar:flex) (#20466)

Ensure min-*, max-*, and container query variants with decimal values are sorted numerically (e.g. min-[40.25rem] before min-[40.5rem]) (#20512)

Ensure CSS comments ending with \*/ are closed correctly instead of swallowing the CSS that follows (e.g. /* C:\temp\*/) (#20508)

Improve style invalidation performance of group-* and peer-* variants (#20513)

Ensure cached compilers release their loadModule and loadStylesheet callbacks after compilation (#20531)

Canonicalization: preserve & when moving a pseudo-element into * or ** (e.g. [&_::before]:flex → **:[&::before]:flex) (#20550)

Ensure the Set.prototype.intersection polyfill in canonicalizeCandidates(…) returns the intersection instead of the first set on Node.js < 22 (#20562)

Canonicalization: ensure inline theme(…) alphas with more than 2 decimals migrate to a percentage modifier with the same opacity (e.g. theme(colors.red.500/.12345) → text-red-500/[12.345%], not text-red-500/[12.345]) (#20563)

Canonicalization: preserve inline theme(…) alphas as an arbitrary percentage when a custom --opacity-* theme value would change the opacity (e.g. theme(colors.red.500/50%) → text-red-500/[50%] with --opacity-50: 10%) (#20563)

Ensure the @property fallback isn't applied in Safari versions that no longer support margin-trim: inline (#20569)

Treat viewport units like dvmin and svi and font-relative units like cap and rex as lengths in arbitrary values (e.g. text-[10dvmin] generates font-size instead of color) (#20516)

Write plugin logs to stderr in tailwindcss canonicalize so they don't end up in the results on stdout (#20561)

Extract class shorthands on later lines when Pug text, comments, or quoted attribute values contain unbalanced brackets, or a quote that doesn't start a string (e.g. input(pattern=/"/.source)) (#20547, #20572)

Underline the correct occurrence of an unsupported data type in --value(…) warnings (#20554)

Canonicalization: prefer an existing candidate when collapsing utilities over another utility with the same default theme value (e.g. text-foreground text-primary → text-primary, not text-card-checked-border) (#20540)

Canonicalization: don't collapse utilities into a utility that uses another theme variable with the same default value (e.g. mt-card mb-card → my-card, not my-4) (#20574)

Ensure @tailwindcss/postcss rewrites relative url(…)s of stylesheets that are inlined before it runs (e.g. @imports in Vite) in optimized builds (#20576)

Drop nested rules that put a combinator after a pseudo-element when using pseudo-element variants (e.g. selection:* on a utility with a nested & > * rule) (#20575)

Don't generate CSS for arbitrary values with unbalanced parentheses or brackets (e.g. w-[calc(1px] or [--x:a[b]) (#20577)

Canonicalization: prevent collapse: true from taking exponentially longer when classes are linked through a utility that sets many properties (e.g. sr-only) (#20558)

Ensure & is substituted inside :-moz-any(…) and :-webkit-any(…) in custom variants (e.g. @custom-variant firefox (:-moz-any(&));) (#20486)

Ensure the standalone macOS binaries have a valid code signature, so macOS 27 no longer kills them at launch (#20578)

Ensure @tailwindcss/turbopack and @tailwindcss/webpack rebuild when the input CSS changes (e.g. next dev with Turbopack no longer serves the CSS of the previous edit) (#20582)

Canonicalization: don't drop a utility that sets a --tw-* variable when an unrelated property has the same value (e.g. link mt-4 no longer becomes mt-4 when link sets margin-top: 16px and --tw-translate-x: 16px) (#20593)

... (truncated)

Changelog

Sourced from tailwindcss's changelog.Description has been truncated

Bumps the minor-and-patch group with 6 updates: | Package | From | To | | --- | --- | --- | | [next](https://github.com/vercel/next.js) | `16.4.3` | `16.4.5` | | [@tailwindcss/postcss](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-postcss) | `4.3.3` | `4.3.4` | | [@vitest/coverage-v8](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8) | `5.0.5` | `5.1.0` | | [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next) | `16.4.3` | `16.4.5` | | [tailwindcss](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss) | `4.3.3` | `4.3.4` | | [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `5.0.5` | `5.1.0` | Updates `next` from 16.4.3 to 16.4.5 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v16.4.3...v16.4.5) Updates `@tailwindcss/postcss` from 4.3.3 to 4.3.4 - [Release notes](https://github.com/tailwindlabs/tailwindcss/releases) - [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md) - [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.3.4/packages/@tailwindcss-postcss) Updates `@vitest/coverage-v8` from 5.0.5 to 5.1.0 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v5.1.0/packages/coverage-v8) Updates `eslint-config-next` from 16.4.3 to 16.4.5 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](https://github.com/vercel/next.js/commits/v16.4.5/packages/eslint-config-next) Updates `tailwindcss` from 4.3.3 to 4.3.4 - [Release notes](https://github.com/tailwindlabs/tailwindcss/releases) - [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md) - [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.3.4/packages/tailwindcss) Updates `vitest` from 5.0.5 to 5.1.0 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v5.1.0/packages/vitest) --- updated-dependencies: - dependency-name: next dependency-version: 16.4.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: "@tailwindcss/postcss" dependency-version: 4.3.4 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: "@vitest/coverage-v8" dependency-version: 5.1.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: eslint-config-next dependency-version: 16.4.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: tailwindcss dependency-version: 4.3.4 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: vitest dependency-version: 5.1.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-and-patch ... Signed-off-by: dependabot[bot] <support@github.com>

coderabbitai · 2026-11-06T20:05:50Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

Source mode: Auto
Repository: GeiserX/Pumperly
Branch: main
File: .coderabbit.yaml
Commit: 4b3899a
Layers: Repository YAML
Review profile: CHILL
Plan: Advanced
Run ID: 92188abc-0aec-474f-9707-cdadea760b94

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

Trigger review

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 6, 2026

GeiserX merged commit 3edb66f into main Nov 6, 2026
11 checks passed

GeiserX deleted the dependabot/npm_and_yarn/minor-and-patch-d8b7b41a55 branch November 6, 2026 23:48

Navigation Menu

Repository navigation

build(deps): bump the minor-and-patch group with 6 updates - #207

build(deps): bump the minor-and-patch group with 6 updates#207
GeiserX merged 1 commit into
mainfrom
dependabot/npm_and_yarn/minor-and-patch-d8b7b41a55

dependabot Bot commented on behalf of github Nov 6, 2026

Uh oh!

coderabbitai Bot commented Nov 6, 2026

Review skipped

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Nov 6, 2026

v16.4.5

Moderate

v16.4.4

Core Changes

Credits

v4.3.4

Added

Fixed

[4.3.4] - 2026-11-02

Added

Fixed

v5.1.0

🚀 Features

🐞 Bug Fixes

v16.4.5

Moderate

v16.4.4

Core Changes

Credits

v4.3.4

Added

Fixed

Uh oh!

coderabbitai Bot commented Nov 6, 2026

Review skipped

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant