chore(deps): bump the npm-version-updates group across 1 directory with 19 updates

[dependabot]

Bumps the npm-version-updates group with 17 updates in the / directory:

Package	From	To
@auth/core	0.40.0	0.41.3
@solidjs/router	0.15.4	1.0.0
@solidjs/start	1.3.2	2.0.0
@zitadel/solidstart-auth	1.1.2	1.1.3
@commitlint/config-conventional	20.5.3	21.2.0
@eslint/js	9.39.4	10.0.1
@playwright/test	1.60.0	1.62.1
@tailwindcss/vite	4.3.0	4.3.3
@types/node	22.19.19	26.2.0
eslint	9.39.4	10.8.1
globals	16.5.0	17.9.0
knip	5.88.1	6.32.1
prettier	3.8.3	3.9.6
prettier-plugin-tailwindcss	0.8.0	0.8.1
typescript	5.9.3	7.0.2
typescript-eslint	8.60.0	8.67.0
vite	8.0.16	8.2.1

Updates @auth/core from 0.40.0 to 0.41.3

Release notes

Sourced from @​auth/core's releases.

@​auth/core@​0.41.3

Bugfixes

• core: getToken() now returns null instead of throwing when the Authorization header contains a malformed Bearer value
• core: OAuth state, nonce, and PKCE check cookies are now bound to the provider that created them and are rejected when a different provider handles the callback
• core: email addresses are Unicode-normalized (NFKC) before validation in the default email normalizer, closing a homoglyph @ bypass

Other

• deps: resolve Dependabot alerts via cross-major dependency upgrades (#13449)
• deps: resolve Dependabot security advisories via pnpm overrides (#13441)
• deps: allow nodemailer 8 in peer dependency ranges (#13434)
• CI formatting and proxy deploy repairs (#13444)

@​auth/core@​0.41.2

Bugfixes

• providers: add issuer to GitHub provider for RFC 9207 compliance (#13410)

Other

• sync package versions with npm registry (#13414)

@​auth/core@​0.41.1

Bugfixes

• security issue from nodemailer (#13305)

Other

• update links for Credentials-based Authentication (#13258)

Commits

• 5af7357 chore(release): bump package version(s) [skip ci]
• 8a933f9 fix(core): document that getToken returns null for malformed authorization he...
• 5b1aa47 chore(ci): pin surrealdb test server to the v2 image for the 1.3 client (#13468)
• 1116034 Chore/nodemailer 8 peer deps (#13434)
• 7b35fc3 fix(docs): repair docs build broken by floating TypeScript resolution (#13450)
• b24abfa fix(proxy): override Vercel build command so it doesn't run turbo (#13448)
• a99514b chore(deps): resolve remaining Dependabot alerts via cross-major dependency u...
• d008b9b Merge commit from fork
• af42d8f chore: lint (#13446)
• e707770 Merge commit from fork
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by better-gustavo, a new releaser for @​auth/core since your current version.

Updates @solidjs/router from 0.15.4 to 1.0.0

Changelog

Sourced from @​solidjs/router's changelog.

1.0.0

Major Changes

• Declare the router stable as 1.0.0. This is a version realignment, not a breaking change: the code is functionally identical to the 0.16 line, which has held API-stable for years, and ^1.0.0 finally gets normal caret semantics instead of the pinned-minor treatment resolvers give 0.x releases. It also aligns major numbers across the ecosystem — router 1.x pairs with Solid 1.x (and SolidStart 2.0), while the in-progress Solid 2 router moves from 1.0.0-next.* to 2.0.0-next.* prereleases under the next tag.

Patch Changes

• 1211a89: Restore scroll with a single scroll once routing settles, dropping the ResizeObserver that re-asserted the offset while the document was still growing (<Router scrollRestoration>, added in 0.16.3). Settling after the navigation commits is what makes the offset reachable, and it is the strategy every peer router ships (SvelteKit, TanStack Router, React Router, Next); TanStack's equivalent MutationObserver sits commented out in their source. The chase carried real downside for a case none of them try to cover: with no bound, a target that is never reachable (a list that is genuinely shorter now) left the observer connected for the life of the page, re-clamping the viewport to the bottom on every subsequent resize, and scroll-induced layout changes can feed it back into itself. It was also untestable in jsdom, which has no ResizeObserver, so the branch had no coverage. Content committing after the navigation settles — an image without reserved space, a boundary below the fold — now keeps whatever offset the document can hold.

0.16.3

Patch Changes

• 31501fd: Add opt-in explicit scroll restoration for back/forward navigation: <Router scrollRestoration> (#577). The browser's native same-document heuristic loses the saved offset when the destination route forces a layout while the document is still short — any component that measures itself on mount is enough to trigger it. When enabled the router sets history.scrollRestoration = "manual", captures positions continuously keyed by the history entry depth it already tracks, persists them across reloads, and restores after the navigation settles — retrying as the document grows if the target offset isn't reachable yet, cancelled by the first user scroll. Off by default on 0.x; no behavior changes unless enabled.

0.16.2

Patch Changes

• 676db85: fix #451 - dispose per-route roots when the route tree unmounts; leaked roots stayed subscribed to route matches and crashed with TypeError: ... (evaluating 'match().path') on a later navigation (e.g. when a <Show> in the root component hid the outlet during login/logout flows)

• cae1d15: Fix a batch of long-standing bugs:

  • useSubmission().retry was always a no-op due to an operator-precedence bug (#504)
  • disposing an older owner no longer unregisters a newer action bound to the same URL, which caused forms to fall through to native submission after revalidation (#542)
  • useBeforeLeave listeners now observe defaultPrevented set by other listeners (#530)
  • <A> active state now ignores trailing slashes on href (#532)
  • useCurrentMatches returns a copy so user mutation can't corrupt router state (#516)
  • static path segments no longer percent-encode RFC 3986 pchar characters (+, @, :, $, &, ,, ;, =), so routes like /+foo or /@user match the browser's raw pathname (#559, #509)
  • consecutive synchronous setSearchParams calls now compose: the merge applies to the in-flight navigation target instead of the stale committed location (#547)

• e9acd69: fix #454 - default RouteDefinition's data generic to any so typed components and preload functions are assignable in annotated configs like const routes: RouteDefinition[], where no inference site for the generic exists

• 9d80d4e: Paths with empty interior segments (doubled slashes, e.g. //dash or /foo//bar) no longer match routes and now render the not-found state instead of silently matching their collapsed form (#567). A single trailing slash is still tolerated. Doubled leading slashes are also no longer normalized away by the browser integration and parse correctly instead of being treated as protocol-relative URLs.

• b308c21: fix #497 - revalidate now forces the cache miss synchronously instead of deferring it into the transition microtask, so a same-tick refetch() after an un-awaited revalidate() refetches fresh data

• e9acd69: fix #347 - accept VoidComponent pages as route components; component now takes a RouteSectionComponent union so components that don't declare children type-check, while components requiring props the router doesn't pass are still rejected

0.16.1

Patch Changes

• e847f96: Fix the published package contents so dist no longer includes mirrored src, test, or co-located spec files.

  Also move the data tests under test/ and align the test TypeScript config with that layout so test:types continues to pass cleanly.

0.16.0

Minor Changes

• 8f0a8c3: Re-export context
• 9e85fe2: Update moduleResolution

... (truncated)

Commits

• See full diff in compare view

Updates @solidjs/start from 1.3.2 to 2.0.0

Release notes

Sourced from @​solidjs/start's releases.

@​solidjs/start@​2.0.0

Highlights

SolidStart v2 is now stable. This release replaces Vinxi with direct use of Vite’s Environment API, providing Solid v1 applications with a simpler Vite 8 and Rolldown-powered foundation, improved compatibility with the Vite ecosystem, and direct integration with deployment plugins.

SolidStart v2 requires Node.js 24 or newer and Vite 8. Most SolidStart v1 applications can upgrade by moving their framework configuration from app.config.ts to vite.config.ts and following the migration guide.

• Read the full SolidStart v2 announcement
• Follow the migration guide
• View the complete changelog

@​solidjs/start@​2.0.0-rc.10

Minor Changes

• 3f2b7a7: The file filter logic used for CSS crawling in development can now be configured with the vite plugin option css.filter analog to serverFunctions.filter:

  solidStart({
    css: {
      filter: {
        // Exclude all node_modules except "my-dependency" with a flat node_modules layout
        exclude: "node_modules/!(my-dependency)/**/*",
      },
    },
  });

Patch Changes

• 6581877: Fixed shared chunk css not being server rendered in production (Vite 8 regression).
• 37d4488: Migrate the built-in Vite configuration from the deprecated rollupOptions alias to rolldownOptions.
• 3f2b7a7: Fixed css from files with url sensitive characters such as + not being server-rendered.

@​solidjs/start@​2.0.0-rc.9

Patch Changes

• 8eef552: Remove type-only import remnants from client server-function transforms so they do not retain server-only dependency chains.

@​solidjs/start@​2.0.0-rc.8

Patch Changes

• 3573985: Await asynchronous serverFunctions.onError handlers before serializing server function errors. Preserve the original error if the handler throws or rejects.

@​solidjs/start@​2.0.0-rc.7

Patch Changes

• 87d73e1: chore: bump seroval to v1.6.0

@​solidjs/start@​2.0.0-rc.6

... (truncated)

Changelog

Sourced from @​solidjs/start's changelog.

2.0.0

Highlights

SolidStart v2 is now stable. This release replaces Vinxi with direct use of Vite’s Environment API, providing Solid v1 applications with a simpler Vite 8 and Rolldown-powered foundation, improved compatibility with the Vite ecosystem, and direct integration with deployment plugins.

SolidStart v2 requires Node.js 24 or newer and Vite 8. Most SolidStart v1 applications can upgrade by moving their framework configuration from app.config.ts to vite.config.ts and following the migration guide.

• Read the full SolidStart v2 announcement
• Follow the migration guide
• View the complete changelog

2.0.0-rc.10

Minor Changes

• 3f2b7a7: The file filter logic used for CSS crawling in development can now be configured with the vite plugin option css.filter analog to serverFunctions.filter:

  solidStart({
    css: {
      filter: {
        // Exclude all node_modules except "my-dependency" with a flat node_modules layout
        exclude: "node_modules/!(my-dependency)/**/*",
      },
    },
  });

Patch Changes

• 6581877: Fixed shared chunk css not being server rendered in production (Vite 8 regression).
• 37d4488: Migrate the built-in Vite configuration from the deprecated rollupOptions alias to rolldownOptions.
• 3f2b7a7: Fixed css from files with url sensitive characters such as + not being server-rendered.

2.0.0-rc.9

Patch Changes

• 8eef552: Remove type-only import remnants from client server-function transforms so they do not retain server-only dependency chains.

2.0.0-rc.8

Patch Changes

• 3573985: Await asynchronous serverFunctions.onError handlers before serializing server function errors. Preserve the original error if the handler throws or rejects.

2.0.0-rc.7

... (truncated)

Commits

• e0edaa1 chore: release (#2280)
• f7023cf chore: release (rc) (#2277)
• 37d4488 chore: migrate from rollupOptions to rolldownOptions (#2278)
• 6581877 fix: detect shared chunks via moduleIds and imported css instead of isDynamic...
• 3f2b7a7 feat: implement css.filter plugin option (#2276)
• 4fbca7a chore: release (rc) (#2274)
• 8eef552 fix: remove type-only server import remnants (#2273)
• ffeb0be chore: release (rc) (#2270)
• 3573985 fix: await server function error handlers (#2269)
• 0a49519 chore: release (rc) (#2267)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​solidjs/start since your current version.

Updates @zitadel/solidstart-auth from 1.1.2 to 1.1.3

Release notes

Sourced from @​zitadel/solidstart-auth's releases.

v1.1.3

1.1.3 (2026-06-21)

Commits

• 44bd9cd chore(release): 1.1.3 [skip ci]
• 75cb775 chore(deps): bump the npm-security-updates group across 1 directory with 5 up...
• 4f420b9 chore(release): use semantic-release default branches
• 31aaafe ci: add concurrency group to release workflow
• a4fd8c2 chore(eslint): align preset and dep versions across the fleet (#7)
• 1999d98 chore(qodana): bump linter to jetbrains/qodana-js:2026.1
• 79ccaaa chore(typedoc): normalize config to canonical template
• See full diff in compare view

Updates solid-js from 1.9.13 to 1.9.14

Commits

• See full diff in compare view

Updates @commitlint/config-conventional from 20.5.3 to 21.2.0

Release notes

Sourced from @​commitlint/config-conventional's releases.

v21.2.0

21.2.0 (2026-06-30)

Features

• feat(resolve-extends): resolve pure-ESM presets (conventional-changelog v7/v9/v10) by @​escapedcat in conventional-changelog/commitlint#4859

Chore

• ci: install git in stock-Ubuntu baseline job by @​escapedcat in conventional-changelog/commitlint#4847

Full Changelog: conventional-changelog/commitlint@v21.1.0...v21.2.0

v21.1.0

21.1.0 (2026-06-23)

Bug Fixes

• fix: remove duplicate es-toolkit@1.47.1 keys from lockfile by @​escapedcat in conventional-changelog/commitlint#4833

Features

• feat(cli): add --default-config flag to lint without a config file by @​escapedcat in conventional-changelog/commitlint#4805
• feat(lint): allow for custom commit parser function by @​esatterwhite in conventional-changelog/commitlint#4829

Docs, chore, etc.

• test(cli): verify --cwd redirects config resolution #997 by @​escapedcat in conventional-changelog/commitlint#4796
• docs: add ai agent support (skill, guide, llms.txt) by @​escapedcat in conventional-changelog/commitlint#4804
• docs: add TDD commit flow and review expectations for contributors by @​escapedcat in conventional-changelog/commitlint#4836

New Contributors

• @​esatterwhite made their first contribution in conventional-changelog/commitlint#4829

Full Changelog: conventional-changelog/commitlint@v21.0.2...v21.1.0

v21.0.2

... (truncated)

Changelog

Sourced from @​commitlint/config-conventional's changelog.

21.2.0 (2026-06-30)

Features

• resolve-extends: resolve pure-ESM presets (conventional-changelog v7/v9/v10) (#4859) (fdb566f)

21.1.0 (2026-06-23)

Note: Version bump only for package @​commitlint/config-conventional

21.0.2 (2026-05-29)

Note: Version bump only for package @​commitlint/config-conventional

21.0.1 (2026-05-12)

Note: Version bump only for package @​commitlint/config-conventional

21.0.0 (2026-05-08)

• chore!: minimum node version v22 (#4679) (ac2b3f4), closes #4679

BREAKING CHANGES

• drop node v18 and v20 support

• Bump engines to >=v22 in all 39 package.json files
• Update @​types/node to ^22.0.0
• Update CI matrix to [22, 24]
• Update Ubuntu baseline job to ubuntu:26.04
• Update Dockerfile.ci, .mise.toml, .codesandbox/ci.json

... (truncated)

Commits

• 1b4e5bc v21.2.0
• fdb566f feat(resolve-extends): resolve pure-ESM presets (conventional-changelog v7/v9...
• 6f1c0af v21.1.0
• 8069048 v21.0.2
• db8d7d6 v21.0.1
• 1329a25 chore: migrate to pnpm (#4762)
• 6099ae5 chore: replace eslint with oxlint (#4756)
• f081a8e v21.0.0
• 44c3174 chore: update dependency yargs to v18 #4432 (#4686)
• ac2b3f4 chore!: minimum node version v22 (#4679)
• See full diff in compare view

Updates @eslint/js from 9.39.4 to 10.0.1

Release notes

Sourced from @​eslint/js's releases.

v10.0.1

Bug Fixes

• c87d5bd fix: update eslint (#20531) (renovate[bot])
• d841001 fix: update minimatch to 10.2.1 to address security vulnerabilities (#20519) (루밀LuMir)
• 04c2147 fix: update error message for unused suppressions (#20496) (fnx)
• 38b089c fix: update dependency @​eslint/config-array to ^0.23.1 (#20484) (renovate[bot])

Documentation

• 5b3dbce docs: add AI acknowledgement section to templates (#20431) (루밀LuMir)
• 6f23076 docs: toggle nav in no-JS mode (#20476) (Tanuj Kanti)
• b69cfb3 docs: Update README (GitHub Actions Bot)

Chores

• e5c281f chore: updates for v9.39.3 release (Jenkins)
• 8c3832a chore: update @​typescript-eslint/parser to ^8.56.0 (#20514) (Milos Djermanovic)
• 8330d23 test: add tests for config-api (#20493) (Milos Djermanovic)
• 37d6e91 chore: remove eslint v10 prereleases from eslint-config-eslint deps (#20494) (Milos Djermanovic)
• da7cd0e refactor: cleanup error message templates (#20479) (Francesco Trotta)
• 84fb885 chore: package.json update for @​eslint/js release (Jenkins)
• 1f66734 chore: add eslint to peerDependencies of @eslint/js (#20467) (Milos Djermanovic)

v10.0.0

Breaking Changes

• f9e54f4 feat!: estimate rule-tester failure location (#20420) (ST-DDT)
• a176319 feat!: replace chalk with styleText and add color to ResultsMeta (#20227) (루밀LuMir)
• c7046e6 feat!: enable JSX reference tracking (#20152) (Pixel998)
• fa31a60 feat!: add name to configs (#20015) (Kirk Waiblinger)
• 3383e7e fix!: remove deprecated SourceCode methods (#20137) (Pixel998)
• 501abd0 feat!: update dependency minimatch to v10 (#20246) (renovate[bot])
• ca4d3b4 fix!: stricter rule tester assertions for valid test cases (#20125) (唯然)
• 96512a6 fix!: Remove deprecated rule context methods (#20086) (Nicholas C. Zakas)
• c69fdac feat!: remove eslintrc support (#20037) (Francesco Trotta)
• 208b5cc feat!: Use ScopeManager#addGlobals() (#20132) (Milos Djermanovic)
• a2ee188 fix!: add uniqueItems: true in no-invalid-regexp option (#20155) (Tanuj Kanti)
• a89059d feat!: Program range span entire source text (#20133) (Pixel998)
• 39a6424 fix!: assert 'text' is a string across all RuleFixer methods (#20082) (Pixel998)
• f28fbf8 fix!: Deprecate "always" and "as-needed" options of the radix rule (#20223) (Milos Djermanovic)
• aa3fb2b fix!: tighten func-names schema (#20119) (Pixel998)
• f6c0ed0 feat!: report eslint-env comments as errors (#20128) (Francesco Trotta)
• 4bf739f fix!: remove deprecated LintMessage#nodeType and TestCaseError#type (#20096) (Pixel998)
• 523c076 feat!: drop support for jiti < 2.2.0 (#20016) (michael faith)
• 454a292 feat!: update eslint:recommended configuration (#20210) (Pixel998)
• 4f880ee feat!: remove v10_* and inactive unstable_* flags (#20225) (sethamus)
• f18115c feat!: no-shadow-restricted-names report globalThis by default (#20027) (sethamus)
• c6358c3 feat!: Require Node.js ^20.19.0 || ^22.13.0 || >=24 (#20160) (Milos Djermanovic)

Features

• bff9091 feat: handle Array.fromAsync in array-callback-return (#20457) (Francesco Trotta)
• 290c594 feat: add self to no-implied-eval rule (#20468) (sethamus)
• 43677de feat: fix handling of function and class expression names in no-shadow (#20432) (Milos Djermanovic)

... (truncated)

Commits

• 84fb885 chore: package.json update for @​eslint/js release
• 1f66734 chore: add eslint to peerDependencies of @eslint/js (#20467)
• f3fbc2f chore: set @eslint/js version to 10.0.0 to skip releasing it (#20466)
• b4b3127 chore: package.json update for @​eslint/js release
• 0b14059 chore: package.json update for @​eslint/js release
• fa31a60 feat!: add name to configs (#20015)
• 1e2cad5 chore: package.json update for @​eslint/js release
• 454a292 feat!: update eslint:recommended configuration (#20210)
• c6358c3 feat!: Require Node.js ^20.19.0 || ^22.13.0 || >=24 (#20160)
• See full diff in compare view

Updates @playwright/test from 1.60.0 to 1.62.1

Release notes

Sourced from @​playwright/test's releases.

v1.62.1

Bug Fixes

• #41989 [Regression]: tsconfig "extends" bare specifier isn't resolved via node_modules walk-up like tsc (fatal since 1.62)
• #41998 [Regression]: directory-form tsconfig project references ("path": "../pkg") fail to resolve (fatal since 1.62)
• #41985 Accessibility snapshot drops button name when text is nested inside spans with aria-hidden SVG
• #42000 [Regression]: page.evaluate() arg of a branded primitive type (string & { brand }) no longer type-checks since 1.62
• #42013 [BUG]Image-type actionable elements are not presented in the snapshot.

v1.62.0

🧱 New component testing model

Component testing moves to a stories and galleries model. A story wraps your component in one specific scenario — hard-coded props, mock data, providers — and a gallery page that you serve renders stories on demand. The new fixtures.mount() fixture navigates to the gallery, mounts a story by id, and returns a Locator scoped to the story's root element:

test('click should expand', async ({ mount }) => {
  const component = await mount('components/Expandable/Stateful');
  await component.getByRole('button').click();
  await expect(component.getByTestId('expanded')).toHaveValue('true');
});

Pass a story type as a template argument to type-check its props, and use update(props) / unmount() on the returned locator to re-render or tear down within a test.

🛑 Cancel operations with AbortSignal

Most operations and web-first assertions now accept a signal option that takes an AbortSignal, letting you cancel long-running actions, navigations, waits, and assertions:

const controller = new AbortController();
setTimeout(() => controller.abort(), 1000);
await page.getByRole('button', { name: 'Submit' }).click({ signal: controller.signal });
await expect(page.getByText('Done')).toBeVisible({ signal: controller.signal });

Providing a signal does not disable the default timeout; pass timeout: 0 to disable it.

🖼️ WebP screenshots

expect(page).toHaveScreenshot() and expect(locator).toHaveScreenshot() can now store snapshots in the WebP format — just give the snapshot a .webp name:

// Visual comparisons store the golden snapshot as lossless WebP.
await expect(page).toHaveScreenshot('homepage.webp');
// Standalone screenshots can trade quality for size with lossy WebP.
await page.screenshot({ path: 'homepage.webp', quality: 50 });
</tr></table>

... (truncated)

Commits

• 26a9e47 cherry-pick(#42043): docs: release notes for v1.62 Python, Java, and .NET (#4...
• 0a81d5d cherry-pick(#42040): docs(release-notes): mention the isolated headless clipb...
• 8376826 cherry-pick(#42034): fix(aria): keep icon-only clickable elements in ai snaps...
• 66c5cc9 chore: mark v1.62.1 (#42020)
• 9672bc3 cherry-pick(#42009): fix(types): support branded primitives in evaluate argum...
• 4325804 cherry-pick(#41988): fix(aria): preserve names from collapsed text contributors
• 9632f8e cherry-pick(#42005): fix(tsconfig): do not throw when "extends"/"references" ...
• e3950d9 chore: mark v1.62.0 (#41981)
• f07e0f7 cherry-pick(#41940): docs: release notes for v1.62 (#41967)
• 05a306c cherry-pick(#41964): Revert "feat(routeFromHar): add interceptAPIRequests opt...
• Additional commits viewable in compare view

Updates @tailwindcss/vite from 4.3.0 to 4.3.3

Release notes

Sourced from @​tailwindcss/vite's releases.

v4.3.3

Fixed

• Support --watch --poll[=ms] in @tailwindcss/cli when filesystem events are unreliable or unavailable (#20297)
• Canonicalization: match arbitrary hex colors against theme colors case-insensitively (e.g. bg-[#fff] and bg-[#FFF] → bg-white) (#20298)
• Prevent Preflight from overriding Firefox's native iframe:focus-visible outline styles (#20292)
• Ensure theme('colors.foo') in JS plugins resolves correctly when both --color-foo and --color-foo-bar exist (#20299)
• Ensure fractional opacity modifiers work with named shadow sizes like shadow-sm/12.5, text-shadow-sm/12.5, drop-shadow-sm/12.5, and inset-shadow-sm/12.5 (#20302)
• Parse selectors like [data-foo]div as two selectors instead of one (#20303)
• Ensure @tailwindcss/postcss rebuilds when a preprocessor like Sass changes the input CSS without changing the input file on disk (#20310)
• Ensure CSS nesting is handled even when Lightning CSS isn't run, such as in @tailwindcss/browser and Tailwind Play (#20124)
• Prevent achromatic theme colors from shifting hue when mixed in polar color spaces like oklch (#20314)
• Ensure --spacing(0) is optimized to 0px instead of 0 so it remains a <length> when used in calc(…) (#20319)
• Load @parcel/watcher only when needed in @tailwindcss/cli --watch mode, so one-off builds and --watch --poll work when @parcel/watcher can't be loaded (#20325)
• Use explicit platform fonts instead of system-ui and ui-sans-serif so CJK text respects the page's lang attribute on Windows (#20318)
• Prevent @tailwindcss/upgrade from rewriting ignored files when run from a subdirectory (#20329)
• Ensure earlier @source rules pointing to nested files are scanned when later @source rules point to files in parent folders (#20335)
• Prevent @tailwindcss/vite from triggering full page reloads when scanned files are processed by Vite but haven't been loaded as modules yet (#20336)

v4.3.2

Fixed

• Support bare spacing values for auto-rows-* and auto-cols-* utilities (e.g. auto-rows-12 and auto-cols-16) (#20229)
• Prevent @tailwindcss/cli in --watch mode from crashing on Windows when @source points to a directory that doesn't exist (#20242)
• Prevent @tailwindcss/vite from crashing in Deno v2.8.x when context.parentURL is not a valid URL (#20245)
• Ensure @tailwindcss/cli in --watch mode rebuilds when the input CSS file changes in an ignored directory (#20246)
• Allow @variant rules used in addBase(…) to use custom variants defined later (#20247)
• Prevent @tailwindcss/vite from crashing during HMR when scanned files or directories are deleted (#20259)
• Generate font-size instead of color declarations for text-[--spacing(…)] (#20260)
• Prevent @source patterns from scanning unrelated sibling files and folders (#20263)
• Extract class candidates adjacent to Template Toolkit delimiters like %]…[% in .tt, .tt2, and .tx files (#20269)
• Extract class candidates from conditional Maud syntax like p.text-black[condition] (#20269)
• Prevent @position-try rules from triggering unknown at-rule warnings when optimizing CSS (#20277)
• Support class suggestions for named opacity modifiers from --opacity theme values (#20287)
• Prevent type errors in @tailwindcss/postcss when used with newer PostCSS patch releases (#20289)

v4.3.1

Added

• Add --silent option to suppress output in @tailwindcss/cli (#20100)

Fixed

• Remove deprecation warnings by using Module#registerHooks instead of Module#register on Node 26+ (#20028)
• Canonicalization: don't crash when plugin utilities throw for unsupported values (#20052)
• Allow @apply to be used with CSS mixins (#19427)
• Ensure not-* correctly negates @container queries, including style(…) queries (#20059)
• Ensure drop-shadow-* color utilities work with custom shadow values containing calc(…) (#20080)
• Fix 'Sourcemap is likely to be incorrect' warnings when using @tailwindcss/vite (#20103)
• Ensure @tailwindcss/webpack can be installed in Rspack projects without requiring webpack as a peer dependency (#20027)

... (truncated)

Changelog

Sourced from @​tailwindcss/vite's changelog.

[4.3.3] - 2026-07-16

Fixed

• Support --watch --poll[=ms] in @tailwindcss/cli when filesystem events are unreliable or unavailable (#20297)
• Canonicalization: match arbitrary hex colors against theme colors case-insensitively (e.g. bg-[#fff] and bg-[#FFF] → bg-white) (#20298)
• Prevent Preflight from overriding Firefox's native iframe:focus-visible outline styles (#20292)
• Ensure theme('colors.foo') in JS plugins resolves correctly when both --color-foo and --color-foo-bar exist (#20299)
• Ensure fractional opacity modifiers work with named shadow sizes like shadow-sm/12.5, text-shadow-sm/12.5, drop-shadow-sm/12.5, and inset-shadow-sm/12.5 (#20302)
• Parse selectors like [data-foo]div as two selectors instead of one (#20303)
• Ensure @tailwindcss/postcss rebuilds when a preprocessor like Sass changes the input CSS without changing the input file on disk (#20310)
• Ensure CSS nesting is handled even when Lightning CSS isn't run, such as in @tailwindcss/brow...

  Description has been truncated

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.