[PR #3078] Bump the dev-minor-updates group across 1 directory with 13 updates #16230

New Issue

GiteaMirror · 2026-05-16T04:13:10-05:00

GiteaMirror commented

2026-05-16 04:13:10 -05:00

📋 Pull Request Information

Original PR: https://github.com/fosrl/pangolin/pull/3078
Author: @dependabot[bot]
Created: 5/15/2026
Status: 🔄 Open

Base: main ← Head: dependabot/npm_and_yarn/dev-minor-updates-48f670c3a3

📝 Commits (1)

1ed6467 Bump the dev-minor-updates group across 1 directory with 13 updates

📊 Changes

2 files changed (+425 additions, -415 deletions)

View changed files

📝 package-lock.json (+411 -401)
📝 package.json (+14 -14)

📄 Description

Bumps the dev-minor-updates group with 13 updates in the / directory:

Package	From	To
@dotenvx/dotenvx	`1.54.1`	`1.66.0`
@tailwindcss/postcss	`4.2.2`	`4.3.0`
@tanstack/react-query-devtools	`5.91.3`	`5.100.10`
@types/express-session	`1.18.2`	`1.19.0`
@types/node	`25.3.5`	`25.8.0`
@types/pg	`8.18.0`	`8.20.0`
esbuild	`0.27.4`	`0.28.0`
esbuild-node-externals	`1.20.1`	`1.22.0`
eslint	`10.0.3`	`10.3.0`
eslint-config-next	`16.1.7`	`16.2.6`
tailwindcss	`4.2.2`	`4.3.0`
tsx	`4.21.0`	`4.22.0`
typescript-eslint	`8.56.1`	`8.59.3`

Updates @dotenvx/dotenvx from 1.54.1 to 1.66.0

Release notes

Sourced from @dotenvx/dotenvx's releases.

v1.66.0

see CHANGELOG

v1.65.3

see CHANGELOG

v1.65.2

see CHANGELOG

v1.65.1

see CHANGELOG

v1.65.0

see CHANGELOG

v1.64.0

see CHANGELOG

v1.63.0

see CHANGELOG

v1.62.0

see CHANGELOG

v1.61.6

see CHANGELOG

v1.61.5

see CHANGELOG

v1.61.4

see CHANGELOG

v1.61.3

see CHANGELOG

v1.61.2

see CHANGELOG

v1.61.1

see CHANGELOG

v1.61.0

see CHANGELOG

v1.60.2

see CHANGELOG

v1.60.1

see CHANGELOG

... (truncated)

Changelog

Sourced from @dotenvx/dotenvx's changelog.

1.66.0 (2026-05-13)

Added

Add dotenvx doctor (#815)

1.65.3 (2026-05-13)

Changed

Improve spinner message blinking with simpler --no-spinner flag passed to ops (#814)

1.65.2 (2026-05-13)

Changed

Improve spinner message coordination between dotenvx and dotenvx-ops (#813)

1.65.1 (2026-05-13)

Changed

Prompts from ops should bubble up (#812)

1.65.0 (2026-05-05)

Added

Add support for replaceing duplicate keys with different values (#806)

1.64.0 (2026-04-27)

Added

Add optional dotenvx armor command.

armor up armor private key

armor down dearmor private key

armor push push armored key (from .env.keys)

armor pull pull armored key (into .env.keys)

Move private keys off device and under access control with Dotenvx Ops ⛨. Learn more

1.63.0 (2026-04-24)

Added

Add support for encrypted values passed to --env flag (#804)

Add support for --format=colon in order to support cloudflare's wrangler --var flag format (#804)

1.62.0 (2026-04-23)

... (truncated)

Commits

bbb7d9a 1.66.0
d36efc1 add dotenvx doctor command
9371b58 Merge pull request #815 from dotenvx/doctor
8b31be7 test coverage
2a8b1ee add doctor command to locate possible dotenv loaders that can be removed
0beec16 1.65.3
a653fca changelog
e30bc2f Merge pull request #814 from dotenvx/no-spinner
4fd21ba cleanup
140ade2 pass --no-spinner to ops
Additional commits viewable in compare view

Updates @tailwindcss/postcss from 4.2.2 to 4.3.0

Release notes

Sourced from @tailwindcss/postcss's releases.

v4.3.0

Added

Add @container-size utility (#18901)

Add scrollbar-{auto,thin,none} utilities for scrollbar-width, and scrollbar-thumb-* / scrollbar-track-* color utilities for scrollbar-color (#19981, #20019)

Add scrollbar-gutter-* utilities (#20018)

Add zoom-* utilities (#20020)

Add tab-* utilities (#20022)

Allow using @variant with stacked variants (e.g. @variant hover:focus { … }) (#19996)

Allow using @variant with compound variants (e.g. @variant hover, focus { … }) (#19996)

Support --default(…) in --value(…) and --modifier(…) for functional @utility definitions (#19989)

Fixed

Ensure @plugin resolves package JavaScript entries instead of browser CSS entries when using @tailwindcss/vite (#19949)

Fix relative @import and @plugin paths resolving from the wrong directory when using @tailwindcss/vite (#19965)

Ensure CSS files containing @variant are processed by @tailwindcss/vite (#19966)

Resolve imports relative to base when result.opts.from is not provided when using @tailwindcss/postcss (#19980)

Canonicalization: preserve significant _ whitespace in arbitrary values (#19986)

Canonicalization: add parentheses when removing whitespace from arbitrary values would hurt readability (e.g. w-[calc(100%---spacing(60))] → w-[calc(100%-(--spacing(60)))]) (#19986)

Canonicalization: preserve the original unit in arbitrary values instead of normalizing to base units (e.g. -mt-[20in] → mt-[-20in], not mt-[-1920px]) (#19988)

Canonicalization: migrate arbitrary :has() variants from [&:has(…)] to has-[…] (#19991)

Upgrade: don’t migrate inline style attributes (e.g. style="flex-grow: 1" → style="flex-grow: 1", not style="grow: 1") (#19918)

Allow multiple @utility definitions with the same name but different value types (#19777)

Export missing PluginWithConfig type from tailwindcss/plugin to fix errors when inferring plugin config types (#19707)

Ensure start and end legacy utilities without values do not generate CSS (#20003)

Ensure --value(…) is required in functional @utility definitions (#20005)

Canonicalization: preserve required whitespace around operators in negated arbitrary values (e.g. -left-[(var(--a)+var(--b))]) (#20011)

v4.2.4

Fixed

Ensure imports in @import and @plugin still resolve correctly when using Vite aliases in @tailwindcss/vite (#19947)

v4.2.3

Fixed

Canonicalization: improve canonicalizations for tracking-* utilities by preferring non-negative utilities (e.g. -tracking-tighter → tracking-wider) (#19827)

Fix crash due to invalid characters in candidate (exceeding valid unicode code point range) (#19829)

Ensure query params in imports are considered unique resources when using @tailwindcss/webpack (#19723)

Canonicalization: collapse arbitrary values into shorthand utilities (e.g. px-[1.2rem] py-[1.2rem] → p-[1.2rem]) (#19837)

Canonicalization: collapse border-{t,b}-* into border-y-*, border-{l,r}-* into border-x-*, and border-{t,r,b,l}-* into border-* (#19842)

Canonicalization: collapse scroll-m{t,b}-* into scroll-my-*, scroll-m{l,r}-* into scroll-mx-*, and scroll-m{t,r,b,l}-* into scroll-m-* (#19842)

Canonicalization: collapse scroll-p{t,b}-* into scroll-py-*, scroll-p{l,r}-* into scroll-px-*, and scroll-p{t,r,b,l}-* into scroll-p-* (#19842)

Canonicalization: collapse overflow-{x,y}-* into overflow-* (#19842)

Canonicalization: collapse overscroll-{x,y}-* into overscroll-* (#19842)

Read from --placeholder-color instead of --background-color for placeholder-* utilities (#19843)

Upgrade: ensure files are not emptied out when killing the upgrade process while it's running (#19846)

Upgrade: use config.content when migrating from Tailwind CSS v3 to Tailwind CSS v4 (#19846)

Upgrade: never migrate files that are ignored by git (#19846)

... (truncated)

Changelog

Sourced from @tailwindcss/postcss's changelog.

[4.3.0] - 2026-05-08

Added

Add @container-size utility (#18901)

Add scrollbar-{auto,thin,none} utilities for scrollbar-width, and scrollbar-thumb-* / scrollbar-track-* color utilities for scrollbar-color (#19981, #20019)

Add scrollbar-gutter-* utilities (#20018)

Add zoom-* utilities (#20020)

Add tab-* utilities (#20022)

Allow using @variant with stacked variants (e.g. @variant hover:focus { … }) (#19996)

Allow using @variant with compound variants (e.g. @variant hover, focus { … }) (#19996)

Support --default(…) in --value(…) and --modifier(…) for functional @utility definitions (#19989)

Fixed

Ensure @plugin resolves package JavaScript entries instead of browser CSS entries when using @tailwindcss/vite (#19949)

Fix relative @import and @plugin paths resolving from the wrong directory when using @tailwindcss/vite (#19965)

Ensure CSS files containing @variant are processed by @tailwindcss/vite (#19966)

Resolve imports relative to base when result.opts.from is not provided when using @tailwindcss/postcss (#19980)

Canonicalization: preserve significant _ whitespace in arbitrary values (#19986)

Canonicalization: add parentheses when removing whitespace from arbitrary values would hurt readability (e.g. w-[calc(100%---spacing(60))] → w-[calc(100%-(--spacing(60)))]) (#19986)

Canonicalization: preserve the original unit in arbitrary values instead of normalizing to base units (e.g. -mt-[20in] → mt-[-20in], not mt-[-1920px]) (#19988)

Canonicalization: migrate arbitrary :has() variants from [&:has(…)] to has-[…] (#19991)

Upgrade: don’t migrate inline style attributes (e.g. style="flex-grow: 1" → style="flex-grow: 1", not style="grow: 1") (#19918)

Allow multiple @utility definitions with the same name but different value types (#19777)

Export missing PluginWithConfig type from tailwindcss/plugin to fix errors when inferring plugin config types (#19707)

Ensure start and end legacy utilities without values do not generate CSS (#20003)

Ensure --value(…) is required in functional @utility definitions (#20005)

Canonicalization: preserve required whitespace around operators in negated arbitrary values (e.g. -left-[(var(--a)+var(--b))]) (#20011)

[4.2.4] - 2026-04-21

Fixed

Ensure imports in @import and @plugin still resolve correctly when using Vite aliases in @tailwindcss/vite (#19947)

[4.2.3] - 2026-04-20

Fixed

Canonicalization: improve canonicalization for tracking-* utilities by preferring non-negative utilities (e.g. -tracking-tighter → tracking-wider) (#19827)

Fix crash due to invalid characters in candidate (exceeding valid unicode code point range) (#19829)

Ensure query params in imports are considered unique resources when using @tailwindcss/webpack (#19723)

Canonicalization: collapse arbitrary values into shorthand utilities (e.g. px-[1.2rem] py-[1.2rem] → p-[1.2rem]) (#19837)

Canonicalization: collapse border-{t,b}-* into border-y-*, border-{l,r}-* into border-x-*, and border-{t,r,b,l}-* into border-* (#19842)

Canonicalization: collapse scroll-m{t,b}-* into scroll-my-*, scroll-m{l,r}-* into scroll-mx-*, and scroll-m{t,r,b,l}-* into scroll-m-* (#19842)

Canonicalization: collapse scroll-p{t,b}-* into scroll-py-*, scroll-p{l,r}-* into scroll-px-*, and scroll-p{t,r,b,l}-* into scroll-p-* (#19842)

Canonicalization: collapse overflow-{x,y}-* into overflow-* (#19842)

Canonicalization: collapse overscroll-{x,y}-* into overscroll-* (#19842)

Read from --placeholder-color instead of --background-color for placeholder-* utilities (#19843)

... (truncated)

Commits

588bd73 4.3.0 (#20023)
12eb5ae Cleanup noisy test output (#20015)
4255671 Improve snapshot tests (#20013)
52f94c7 Improve codebase quality (#19999)
d194d4c docs: fix various typos in comments and documentation (#19878)
bfb5732 Fall back to the plugin base when PostCSS has no from option (#19980)
3a890c3 Bump dependencies (#19957)
69ad7cc 4.2.4 (#19948)
685c19e Fix issue around resolving paths in @tailwindcss/vite (#19947)
2e3fa49 4.2.3 (#19944)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @tailwindcss/postcss since your current version.

Updates @tanstack/react-query-devtools from 5.91.3 to 5.100.10

Release notes

Sourced from @tanstack/react-query-devtools's releases.

@tanstack/react-query-devtools@5.100.9

Patch Changes

Updated dependencies [3d21cac]:

@tanstack/query-devtools@5.100.9

@tanstack/react-query@5.100.9

@tanstack/react-query-devtools@5.100.8

Patch Changes

Updated dependencies []:

@tanstack/query-devtools@5.100.8

@tanstack/react-query@5.100.8

@tanstack/react-query-devtools@5.100.7

Patch Changes

docs(devtools): align logo, panel, and 'buttonPosition' union descriptions across docs and JSDoc (#10617)

Updated dependencies []:

@tanstack/query-devtools@5.100.7

@tanstack/react-query@5.100.7

@tanstack/react-query-devtools@5.100.6

Patch Changes

Updated dependencies []:

@tanstack/query-devtools@5.100.6

@tanstack/react-query@5.100.6

Changelog

Sourced from @tanstack/react-query-devtools's changelog.

5.100.10

Patch Changes

Updated dependencies [4d130b9]:

@tanstack/query-devtools@5.100.10

@tanstack/react-query@5.100.10

5.100.9

Patch Changes

Updated dependencies [3d21cac]:

@tanstack/query-devtools@5.100.9

@tanstack/react-query@5.100.9

5.100.8

Patch Changes

Updated dependencies []:

@tanstack/query-devtools@5.100.8

@tanstack/react-query@5.100.8

5.100.7

Patch Changes

docs(devtools): align logo, panel, and 'buttonPosition' union descriptions across docs and JSDoc (#10617)

Updated dependencies []:

@tanstack/query-devtools@5.100.7

@tanstack/react-query@5.100.7

5.100.6

Patch Changes

Updated dependencies []:

@tanstack/query-devtools@5.100.6

@tanstack/react-query@5.100.6

5.100.5

Patch Changes

Updated dependencies []:

@tanstack/query-devtools@5.100.5

@tanstack/react-query@5.100.5

... (truncated)

Commits

See full diff in compare view

Updates @types/express-session from 1.18.2 to 1.19.0

Commits

See full diff in compare view

Updates @types/node from 25.3.5 to 25.8.0

Commits

See full diff in compare view

Updates @types/pg from 8.18.0 to 8.20.0

Commits

See full diff in compare view

Updates esbuild from 0.27.4 to 0.28.0

Release notes

Sourced from esbuild's releases.

v0.28.0
Add support for with { type: 'text' } imports (#4435)

The import text proposal has reached stage 3 in the TC39 process, which means that it's recommended for implementation. It has also already been implemented by Deno and Bun. So with this release, esbuild also adds support for it. This behaves exactly the same as esbuild's existing text loader. Here's an example:
import string from './example.txt' with { type: 'text' }
console.log(string)
Add integrity checks to fallback download path (#4343)

Installing esbuild via npm is somewhat complicated with several different edge cases (see esbuild's documentation for details). If the regular installation of esbuild's platform-specific package fails, esbuild's install script attempts to download the platform-specific package itself (first with the npm command, and then with a HTTP request to registry.npmjs.org as a last resort).

This last resort path previously didn't have any integrity checks. With this release, esbuild will now verify that the hash of the downloaded binary matches the expected hash for the current release. This means the hashes for all of esbuild's platform-specific binary packages will now be embedded in the top-level esbuild package. Hopefully this should work without any problems. But just in case, this change is being done as a breaking change release.

Update the Go compiler from 1.25.7 to 1.26.1

This upgrade should not affect anything. However, there have been some significant internal changes to the Go compiler, so esbuild could potentially behave differently in certain edge cases:

It now uses the new garbage collector that comes with Go 1.26.

The Go compiler is now more aggressive with allocating memory on the stack.

The executable format that the Go linker uses has undergone several changes.

The WebAssembly build now unconditionally makes use of the sign extension and non-trapping floating-point to integer conversion instructions.

You can read the Go 1.26 release notes for more information.
v0.27.7
Fix lowering of define semantics for TypeScript parameter properties (#4421)

The previous release incorrectly generated class fields for TypeScript parameter properties even when the configured target environment does not support class fields. With this release, the generated class fields will now be correctly lowered in this case:
// Original code
class Foo {
  constructor(public x = 1) {}
  y = 2
}
// Old output (with --loader=ts --target=es2021)

class Foo {

constructor(x = 1) {

this.x = x;

__publicField(this, "y", 2);

}

x;

}
// New output (with --loader=ts --target=es2021)

class Foo {

... (truncated)

Changelog

Sourced from esbuild's changelog.

0.28.0
Add support for with { type: 'text' } imports (#4435)

The import text proposal has reached stage 3 in the TC39 process, which means that it's recommended for implementation. It has also already been implemented by Deno and Bun. So with this release, esbuild also adds support for it. This behaves exactly the same as esbuild's existing text loader. Here's an example:
import string from './example.txt' with { type: 'text' }
console.log(string)
Add integrity checks to fallback download path (#4343)

Installing esbuild via npm is somewhat complicated with several different edge cases (see esbuild's documentation for details). If the regular installation of esbuild's platform-specific package fails, esbuild's install script attempts to download the platform-specific package itself (first with the npm command, and then with a HTTP request to registry.npmjs.org as a last resort).

This last resort path previously didn't have any integrity checks. With this release, esbuild will now verify that the hash of the downloaded binary matches the expected hash for the current release. This means the hashes for all of esbuild's platform-specific binary packages will now be embedded in the top-level esbuild package. Hopefully this should work without any problems. But just in case, this change is being done as a breaking change release.

Update the Go compiler from 1.25.7 to 1.26.1

This upgrade should not affect anything. However, there have been some significant internal changes to the Go compiler, so esbuild could potentially behave differently in certain edge cases:

It now uses the new garbage collector that comes with Go 1.26.

The Go compiler is now more aggressive with allocating memory on the stack.

The executable format that the Go linker uses has undergone several changes.

The WebAssembly build now unconditionally makes use of the sign extension and non-trapping floating-point to integer conversion instructions.

You can read the Go 1.26 release notes for more information.
0.27.7
Fix lowering of define semantics for TypeScript parameter properties (#4421)

The previous release incorrectly generated class fields for TypeScript parameter properties even when the configured target environment does not support class fields. With this release, the generated class fields will now be correctly lowered in this case:
// Original code
class Foo {
  constructor(public x = 1) {}
  y = 2
}
// Old output (with --loader=ts --target=es2021)

class Foo {

constructor(x = 1) {

this.x = x;

__publicField(this, "y", 2);

}

x;

}

... (truncated)

Commits

6a794df publish 0.28.0 to npm
64ee0ea fix #4435: support with { type: text } imports
ef65aee fix sort order in snapshots_packagejson.txt
1a26a8e try to fix test-old-ts, also shuffle CI tasks
556ce6c use '' instead of null to omit build hashes
8e675a8 ci: allow missing binary hashes for tests
7067763 Reapply "update go 1.25.7 => 1.26.1"
39473a9 fix #4343: integrity check for binary download
2025c9f publish 0.27.7 to npm
c6b586e fix typo in Makefile for @esbuild/win32-x64
Additional commits viewable in compare view

Updates esbuild-node-externals from 1.20.1 to 1.22.0

Release notes

Sourced from esbuild-node-externals's releases.

esbuild-node-externals: v1.22.0

1.22.0 (2026-04-08)

Features

replace find-up with empathic to have smaller installation (#86) (87229fc)

esbuild-node-externals: v1.21.0

1.21.0 (2026-04-03)

Features

add esbuild 0.28 to the allowed range (#84) (e66160f)

Commits

bbaed41 chore(main): release esbuild-node-externals 1.22.0 (#87)
87229fc feat: replace find-up with empathic to have smaller installation (#86)
1b60aa3 chore(main): release esbuild-node-externals 1.21.0 (#85)
e66160f feat: add esbuild 0.28 to the allowed range (#84)
See full diff in compare view

Updates eslint from 10.0.3 to 10.3.0

Release notes

Sourced from eslint's releases.

v10.3.0

Features

379571a feat: add suggestions for no-unused-private-class-members (#20773) (sethamus)

Bug Fixes

b6ae5cf fix: handle unavailable require cache (#20812) (Simon Podlipsky)

6fb3685 fix: rule suggestions cause continuation in class body (#20787) (Milos Djermanovic)

Documentation

32cc7ab docs: fix typos in docs and comments (#20809) (Tanuj Kanti)

7f47937 docs: Update README (GitHub Actions Bot)

Chores

d32235e ci: use pnpm in eslint-flat-config-utils type integration test (#20826) (Francesco Trotta)

3ffb14e chore: clean up typos in comments and JSDoc (#20821) (Pixel998)

22eb58a chore: add missing continue-on-error to ecosystem-tests.yml (#20818) (Josh Goldberg ✨)

88bf002 ci: bump pnpm/action-setup from 6.0.1 to 6.0.3 (#20815) (dependabot[bot])

97c8c33 chore: update ilshidur/action-discord action to v0.4.0 (#20811) (renovate[bot])

2f58136 chore: pin peter-evans/create-pull-request action to 5f6978f (#20810) (renovate[bot])

77add7f chore: add initial ecosystem plugin tests workflow (#19643) (Josh Goldberg ✨)

4023b55 test: Add unit tests for SuppressionsService.prune() (#20797) (kuldeep kumar)

54080da test: add unit tests for ForkContext (#20778) (kuldeep kumar)

f0e2bcc test: add unit tests for SuppressionsService.suppress() method (#20765) (kuldeep kumar)

a7f0b94 chore: update dependency prettier to v3.8.3 (#20782) (renovate[bot])

7bf93d9 chore: update TypeScript to v6 (#20677) (sethamus)

b42dd72 ci: bump pnpm/action-setup from 6.0.0 to 6.0.1 (#20781) (dependabot[bot])

2b252be test: add unit tests for IdGenerator (#20775) (kuldeep kumar)

v10.2.1

Bug Fixes

14be92b fix: model generator yield resumption paths in code path analysis (#20665) (sethamus)

84a19d2 fix: no-async-promise-executor false positives for shadowed Promise (#20740) (xbinaryx)

af764af fix: clarify language and processor validation errors (#20729) (Pixel998)

e251b89 fix: update eslint (#20715) (renovate[bot])

Documentation

ca92ca0 docs: reuse markdown-it instance for markdown filter (#20768) (Amaresh S M)

57d2ee2 docs: Enable Eleventy incremental mode for watch (#20767) (Amaresh S M)

c1621b9 docs: fix typos in code-path-analyzer.js (#20700) (Ayush Shukla)

1418d52 docs: Update README (GitHub Actions Bot)

39771e6 docs: Update README (GitHub Actions Bot)

71e0469 docs: fix incomplete JSDoc param description in no-shadow rule (#20728) (kuldeep kumar)

22119ce docs: clarify scope of for-direction rule with dead code examples (#20723) (Amaresh S M)

8f3fb77 docs: document meta.docs.dialects (#20718) (Pixel998)

Chores

7ddfea9 chore: update dependency prettier to v3.8.2 (#20770) (renovate[bot])

fac40e1 ci: bump pnpm/action-setup from 5.0.0 to 6.0.0 (#20763) (dependabot[bot])

7246f92 test: add tests for SuppressionsService.load() error handling (#20734) (kuldeep kumar)

4f34b1e chore: update pnpm/action-setup action to v5 (#20762) (renovate[bot])

... (truncated)

Commits

7889204 10.3.0
5b69b4f Build: changelog update for 10.3.0
d32235e ci: use pnpm in eslint-flat-config-utils type integration test (#20826)
b6ae5cf fix: handle unavailable require cache (#20812)
3ffb14e chore: clean up typos in comments and JSDoc (#20821)
6fb3685 fix: rule suggestions cause continuation in class body (#20787)
22eb58a chore: add missing continue-on-error to ecosystem-tests.yml (#20818)
88bf002 ci: bump pnpm/action-setup from 6.0.1 to 6.0.3 (#20815)
379571a feat: add suggestions for no-unused-private-class-members (#20773)
97c8c33 chore: update ilshidur/action-discord action to v0.4.0 (#20811)
Additional commits viewable in compare view

Updates eslint-config-next from 16.1.7 to 16.2.6

Release notes

Sourced from eslint-config-next's releases.

v16.2.6

[!NOTE] This release contains security fixes and backported bug fixes. It does not include all pending features/changes on canary.

Security Fixes

The following advisories have been addressed:

High:

GHSA-8h8q-6873-q5fj: Denial of Service with Server Components

GHSA-267c-6grr-h53f: Middleware / Proxy bypass in App Router applications via segment-prefetch routes

GHSA-26hh-7cqf-hhc6: Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up

GHSA-mg66-mrh9-m8jx: Denial of Service via connection exhaustion in applications using Cache Components

GHSA-492v-c6pp-mqqv: Middleware / Proxy bypass through dynamic route parameter injection

GHSA-c4j6-fc7j-m34r: Server-side request forgery in applications using WebSocket upgrades

GHSA-36qx-fr4f-26g5: Middleware / Proxy bypass in Pages Router applications using i18n

Moderate:

GHSA-ffhc-5mcf-pf4q: Cross-site scripting in App Router applications using CSP nonces

GHSA-gx5p-jg67-6x7h: Cross-site scripting in beforeInteractive scripts with untrusted input

GHSA-h64f-5h5j-jqjh: Denial of Service in the Image Optimization API

GHSA-wfc6-r584-vfw7: Cache poisoning in React Server Component responses

Low:

GHSA-vfv6-92ff-j949: Cache poisoning via collisions in React Server Component cache-busting

GHSA-3g8h-86w9-wvmq: Middleware / Proxy redirects can be cache-poisoned

Core Changes

fix: preserve HTTP access fallbacks during prerender recovery (#92231)

Fix fallback route params case in app-page handler (#91737)

Fix invalid HTML response for route-level RSC requests in deployment adapter (#91541)

Patch setHeader for direct route handlers (#93101)

Include deployment id in cacheHandlers keys (#93453)

Fix double-encoding of URL pathname parts in client param parsing (#93491)

v16.2.5

[!NOTE] This release contains security fixes and backported bug fixes. It does not include all pending features/changes on canary.

Security Fixes

The following advisories have been addressed:

High:

GHSA-8h8q-6873-q5fj: Denial of Service with Server Components

GHSA-267c-6grr-h53f: Middleware / Proxy bypass in App Router applications via segment-prefetch routes

GHSA-mg66-mrh9-m8jx: Denial of Service via connection exhaustion in applications using Cache Components

GHSA-492v-c6pp-mqqv: Middleware / Proxy bypass through dynamic route parameter injection

GHSA-c4j6-fc7j-m34r: Server-side request forgery in applications using WebSocket upgrades

... (truncated)

Commits

ee6e79b v16.2.6
766148f v16.2.5
2275bd8 v16.2.4
d5f649b v16.2.3
52faae3 v16.2.2
ed7d2ce v16.2.1
c5c94df v16.2.0
3683192 v16.2.0-canary.104
6689814 v16.2.0-canary.103
ad66dbc v16.2.0-canary.102
Additional commits viewable in compare view

Maintainer changes

This version was pushed to...

Description has been truncated

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/fosrl/pangolin/pull/3078 **Author:** [@dependabot[bot]](https://github.com/apps/dependabot) **Created:** 5/15/2026 **Status:** 🔄 Open **Base:** `main` ← **Head:** `dependabot/npm_and_yarn/dev-minor-updates-48f670c3a3` --- ### 📝 Commits (1) - [`1ed6467`](https://github.com/fosrl/pangolin/commit/1ed64674463bd0b1b7352a299e809fdbd58526e5) Bump the dev-minor-updates group across 1 directory with 13 updates ### 📊 Changes **2 files changed** (+425 additions, -415 deletions) <details> <summary>View changed files</summary> 📝 `package-lock.json` (+411 -401) 📝 `package.json` (+14 -14) </details> ### 📄 Description Bumps the dev-minor-updates group with 13 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@dotenvx/dotenvx](https://github.com/dotenvx/dotenvx) | `1.54.1` | `1.66.0` | | [@tailwindcss/postcss](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-postcss) | `4.2.2` | `4.3.0` | | [@tanstack/react-query-devtools](https://github.com/TanStack/query/tree/HEAD/packages/react-query-devtools) | `5.91.3` | `5.100.10` | | [@types/express-session](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/express-session) | `1.18.2` | `1.19.0` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `25.3.5` | `25.8.0` | | [@types/pg](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/pg) | `8.18.0` | `8.20.0` | | [esbuild](https://github.com/evanw/esbuild) | `0.27.4` | `0.28.0` | | [esbuild-node-externals](https://github.com/pradel/esbuild-node-externals) | `1.20.1` | `1.22.0` | | [eslint](https://github.com/eslint/eslint) | `10.0.3` | `10.3.0` | | [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next) | `16.1.7` | `16.2.6` | | [tailwindcss](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss) | `4.2.2` | `4.3.0` | | [tsx](https://github.com/privatenumber/tsx) | `4.21.0` | `4.22.0` | | [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.56.1` | `8.59.3` | Updates `@dotenvx/dotenvx` from 1.54.1 to 1.66.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/dotenvx/dotenvx/releases">@dotenvx/dotenvx's releases</a>.</em></p> <blockquote> <h2>v1.66.0</h2> <p>see <a href="https://github.com/dotenvx/dotenvx/blob/main/CHANGELOG.md">CHANGELOG</a></p> <h2>v1.65.3</h2> <p>see <a href="https://github.com/dotenvx/dotenvx/blob/main/CHANGELOG.md">CHANGELOG</a></p> <h2>v1.65.2</h2> <p>see <a href="https://github.com/dotenvx/dotenvx/blob/main/CHANGELOG.md">CHANGELOG</a></p> <h2>v1.65.1</h2> <p>see <a href="https://github.com/dotenvx/dotenvx/blob/main/CHANGELOG.md">CHANGELOG</a></p> <h2>v1.65.0</h2> <p>see <a href="https://github.com/dotenvx/dotenvx/blob/main/CHANGELOG.md">CHANGELOG</a></p> <h2>v1.64.0</h2> <p>see <a href="https://github.com/dotenvx/dotenvx/blob/main/CHANGELOG.md">CHANGELOG</a></p> <h2>v1.63.0</h2> <p>see <a href="https://github.com/dotenvx/dotenvx/blob/main/CHANGELOG.md">CHANGELOG</a></p> <h2>v1.62.0</h2> <p>see <a href="https://github.com/dotenvx/dotenvx/blob/main/CHANGELOG.md">CHANGELOG</a></p> <h2>v1.61.6</h2> <p>see <a href="https://github.com/dotenvx/dotenvx/blob/main/CHANGELOG.md">CHANGELOG</a></p> <h2>v1.61.5</h2> <p>see <a href="https://github.com/dotenvx/dotenvx/blob/main/CHANGELOG.md">CHANGELOG</a></p> <h2>v1.61.4</h2> <p>see <a href="https://github.com/dotenvx/dotenvx/blob/main/CHANGELOG.md">CHANGELOG</a></p> <h2>v1.61.3</h2> <p>see <a href="https://github.com/dotenvx/dotenvx/blob/main/CHANGELOG.md">CHANGELOG</a></p> <h2>v1.61.2</h2> <p>see <a href="https://github.com/dotenvx/dotenvx/blob/main/CHANGELOG.md">CHANGELOG</a></p> <h2>v1.61.1</h2> <p>see <a href="https://github.com/dotenvx/dotenvx/blob/main/CHANGELOG.md">CHANGELOG</a></p> <h2>v1.61.0</h2> <p>see <a href="https://github.com/dotenvx/dotenvx/blob/main/CHANGELOG.md">CHANGELOG</a></p> <h2>v1.60.2</h2> <p>see <a href="https://github.com/dotenvx/dotenvx/blob/main/CHANGELOG.md">CHANGELOG</a></p> <h2>v1.60.1</h2> <p>see <a href="https://github.com/dotenvx/dotenvx/blob/main/CHANGELOG.md">CHANGELOG</a></p>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/dotenvx/dotenvx/blob/main/CHANGELOG.md">@dotenvx/dotenvx's changelog</a>.</em></p> <blockquote> <h2><a href="https://github.com/dotenvx/dotenvx/compare/v1.65.3...v1.66.0">1.66.0</a> (2026-05-13)</h2> <h3>Added</h3> <ul> <li>Add <code>dotenvx doctor</code> (<a href="https://redirect.github.com/dotenvx/dotenvx/pull/815">#815</a>)</li> </ul> <h2><a href="https://github.com/dotenvx/dotenvx/compare/v1.65.2...v1.65.3">1.65.3</a> (2026-05-13)</h2> <h3>Changed</h3> <ul> <li>Improve spinner message blinking with simpler <code>--no-spinner</code> flag passed to ops (<a href="https://redirect.github.com/dotenvx/dotenvx/pull/814">#814</a>)</li> </ul> <h2><a href="https://github.com/dotenvx/dotenvx/compare/v1.65.1...v1.65.2">1.65.2</a> (2026-05-13)</h2> <h3>Changed</h3> <ul> <li>Improve spinner message coordination between <code>dotenvx</code> and <code>dotenvx-ops</code> (<a href="https://redirect.github.com/dotenvx/dotenvx/pull/813">#813</a>)</li> </ul> <h2><a href="https://github.com/dotenvx/dotenvx/compare/v1.65.0...v1.65.1">1.65.1</a> (2026-05-13)</h2> <h3>Changed</h3> <ul> <li>Prompts from <code>ops</code> should bubble up (<a href="https://redirect.github.com/dotenvx/dotenvx/pull/812">#812</a>)</li> </ul> <h2><a href="https://github.com/dotenvx/dotenvx/compare/v1.64.0...v1.65.0">1.65.0</a> (2026-05-05)</h2> <h3>Added</h3> <ul> <li>Add support for <code>replace</code>ing duplicate keys with different values (<a href="https://redirect.github.com/dotenvx/dotenvx/pull/806">#806</a>)</li> </ul> <h2><a href="https://github.com/dotenvx/dotenvx/compare/v1.63.0...v1.64.0">1.64.0</a> (2026-04-27)</h2> <h3>Added</h3> <ul> <li>Add optional <code>dotenvx armor</code> command. <ul> <li><code>armor up</code> armor private key</li> <li><code>armor down</code> dearmor private key</li> <li><code>armor push</code> push armored key (from .env.keys)</li> <li><code>armor pull</code> pull armored key (into .env.keys)</li> </ul> </li> </ul> <p>Move private keys off device and under access control with Dotenvx Ops ⛨. <a href="https://dotenvx.com/ops">Learn more</a></p> <h2><a href="https://github.com/dotenvx/dotenvx/compare/v1.62.0...v1.63.0">1.63.0</a> (2026-04-24)</h2> <h3>Added</h3> <ul> <li>Add support for encrypted values passed to <code>--env</code> flag (<a href="https://redirect.github.com/dotenvx/dotenvx/pull/804">#804</a>)</li> <li>Add support for <code>--format=colon</code> in order to support cloudflare's wrangler <code>--var</code> flag format (<a href="https://redirect.github.com/dotenvx/dotenvx/pull/804">#804</a>)</li> </ul> <h2><a href="https://github.com/dotenvx/dotenvx/compare/v1.61.6...v1.62.0">1.62.0</a> (2026-04-23)</h2>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/dotenvx/dotenvx/commit/bbb7d9a12ca0e4cfd9148aac500434b503f5203c"><code>bbb7d9a</code></a> 1.66.0</li> <li><a href="https://github.com/dotenvx/dotenvx/commit/d36efc177615190db0e236af314f94bb686256c1"><code>d36efc1</code></a> add dotenvx doctor command</li> <li><a href="https://github.com/dotenvx/dotenvx/commit/9371b58f2be817bf797dffad5bf5a0620001acc5"><code>9371b58</code></a> Merge pull request <a href="https://redirect.github.com/dotenvx/dotenvx/issues/815">#815</a> from dotenvx/doctor</li> <li><a href="https://github.com/dotenvx/dotenvx/commit/8b31be7aa28e6da67c1cacd3d279412808de191c"><code>8b31be7</code></a> test coverage</li> <li><a href="https://github.com/dotenvx/dotenvx/commit/2a8b1ee59b1ba64bea1a9d23c6f62321629f8ed5"><code>2a8b1ee</code></a> add <code>doctor</code> command to locate possible dotenv loaders that can be removed</li> <li><a href="https://github.com/dotenvx/dotenvx/commit/0beec169c22f4805d7d4bd098017a475528a6da8"><code>0beec16</code></a> 1.65.3</li> <li><a href="https://github.com/dotenvx/dotenvx/commit/a653fca3d49a8b5acf089dc971838e478ad9203e"><code>a653fca</code></a> changelog</li> <li><a href="https://github.com/dotenvx/dotenvx/commit/e30bc2f3ec9847c330cc8bae904b8689a9ffd8f9"><code>e30bc2f</code></a> Merge pull request <a href="https://redirect.github.com/dotenvx/dotenvx/issues/814">#814</a> from dotenvx/no-spinner</li> <li><a href="https://github.com/dotenvx/dotenvx/commit/4fd21bafb99cabd518e8358bbdf52717cd6f1340"><code>4fd21ba</code></a> cleanup</li> <li><a href="https://github.com/dotenvx/dotenvx/commit/140ade26b52e10391bb848cfe9947fcc7afc7c02"><code>140ade2</code></a> pass <code>--no-spinner</code> to ops</li> <li>Additional commits viewable in <a href="https://github.com/dotenvx/dotenvx/compare/v1.54.1...v1.66.0">compare view</a></li> </ul> </details> <br /> Updates `@tailwindcss/postcss` from 4.2.2 to 4.3.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/tailwindlabs/tailwindcss/releases">@tailwindcss/postcss's releases</a>.</em></p> <blockquote> <h2>v4.3.0</h2> <h3>Added</h3> <ul> <li>Add <code>@container-size</code> utility (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/18901">#18901</a>)</li> <li>Add <code>scrollbar-{auto,thin,none}</code> utilities for <code>scrollbar-width</code>, and <code>scrollbar-thumb-*</code> / <code>scrollbar-track-*</code> color utilities for <code>scrollbar-color</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19981">#19981</a>, <a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20019">#20019</a>)</li> <li>Add <code>scrollbar-gutter-*</code> utilities (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20018">#20018</a>)</li> <li>Add <code>zoom-*</code> utilities (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20020">#20020</a>)</li> <li>Add <code>tab-*</code> utilities (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20022">#20022</a>)</li> <li>Allow using <code>@variant</code> with stacked variants (e.g. <code>@variant hover:focus { … }</code>) (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19996">#19996</a>)</li> <li>Allow using <code>@variant</code> with compound variants (e.g. <code>@variant hover, focus { … }</code>) (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19996">#19996</a>)</li> <li>Support <code>--default(…)</code> in <code>--value(…)</code> and <code>--modifier(…)</code> for functional <code>@utility</code> definitions (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19989">#19989</a>)</li> </ul> <h3>Fixed</h3> <ul> <li>Ensure <code>@plugin</code> resolves package JavaScript entries instead of browser CSS entries when using <code>@tailwindcss/vite</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19949">#19949</a>)</li> <li>Fix relative <code>@import</code> and <code>@plugin</code> paths resolving from the wrong directory when using <code>@tailwindcss/vite</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19965">#19965</a>)</li> <li>Ensure CSS files containing <code>@variant</code> are processed by <code>@tailwindcss/vite</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19966">#19966</a>)</li> <li>Resolve imports relative to <code>base</code> when <code>result.opts.from</code> is not provided when using <code>@tailwindcss/postcss</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19980">#19980</a>)</li> <li>Canonicalization: preserve significant <code>_</code> whitespace in arbitrary values (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19986">#19986</a>)</li> <li>Canonicalization: add parentheses when removing whitespace from arbitrary values would hurt readability (e.g. <code>w-[calc(100%---spacing(60))]</code> → <code>w-[calc(100%-(--spacing(60)))]</code>) (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19986">#19986</a>)</li> <li>Canonicalization: preserve the original unit in arbitrary values instead of normalizing to base units (e.g. <code>-mt-[20in]</code> → <code>mt-[-20in]</code>, not <code>mt-[-1920px]</code>) (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19988">#19988</a>)</li> <li>Canonicalization: migrate arbitrary <code>:has()</code> variants from <code>[&:has(…)]</code> to <code>has-[…]</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19991">#19991</a>)</li> <li>Upgrade: don’t migrate inline <code>style</code> attributes (e.g. <code>style="flex-grow: 1"</code> → <code>style="flex-grow: 1"</code>, not <code>style="grow: 1"</code>) (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19918">#19918</a>)</li> <li>Allow multiple <code>@utility</code> definitions with the same name but different value types (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19777">#19777</a>)</li> <li>Export missing <code>PluginWithConfig</code> type from <code>tailwindcss/plugin</code> to fix errors when inferring plugin config types (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19707">#19707</a>)</li> <li>Ensure <code>start</code> and <code>end</code> legacy utilities without values do not generate CSS (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20003">#20003</a>)</li> <li>Ensure <code>--value(…)</code> is required in functional <code>@utility</code> definitions (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20005">#20005</a>)</li> <li>Canonicalization: preserve required whitespace around operators in negated arbitrary values (e.g. <code>-left-[(var(--a)+var(--b))]</code>) (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20011">#20011</a>)</li> </ul> <h2>v4.2.4</h2> <h3>Fixed</h3> <ul> <li>Ensure imports in <code>@import</code> and <code>@plugin</code> still resolve correctly when using Vite aliases in <code>@tailwindcss/vite</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19947">#19947</a>)</li> </ul> <h2>v4.2.3</h2> <h3>Fixed</h3> <ul> <li>Canonicalization: improve canonicalizations for <code>tracking-*</code> utilities by preferring non-negative utilities (e.g. <code>-tracking-tighter</code> → <code>tracking-wider</code>) (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19827">#19827</a>)</li> <li>Fix crash due to invalid characters in candidate (exceeding valid unicode code point range) (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19829">#19829</a>)</li> <li>Ensure query params in imports are considered unique resources when using <code>@tailwindcss/webpack</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19723">#19723</a>)</li> <li>Canonicalization: collapse arbitrary values into shorthand utilities (e.g. <code>px-[1.2rem] py-[1.2rem]</code> → <code>p-[1.2rem]</code>) (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19837">#19837</a>)</li> <li>Canonicalization: collapse <code>border-{t,b}-*</code> into <code>border-y-*</code>, <code>border-{l,r}-*</code> into <code>border-x-*</code>, and <code>border-{t,r,b,l}-*</code> into <code>border-*</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19842">#19842</a>)</li> <li>Canonicalization: collapse <code>scroll-m{t,b}-*</code> into <code>scroll-my-*</code>, <code>scroll-m{l,r}-*</code> into <code>scroll-mx-*</code>, and <code>scroll-m{t,r,b,l}-*</code> into <code>scroll-m-*</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19842">#19842</a>)</li> <li>Canonicalization: collapse <code>scroll-p{t,b}-*</code> into <code>scroll-py-*</code>, <code>scroll-p{l,r}-*</code> into <code>scroll-px-*</code>, and <code>scroll-p{t,r,b,l}-*</code> into <code>scroll-p-*</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19842">#19842</a>)</li> <li>Canonicalization: collapse <code>overflow-{x,y}-*</code> into <code>overflow-*</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19842">#19842</a>)</li> <li>Canonicalization: collapse <code>overscroll-{x,y}-*</code> into <code>overscroll-*</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19842">#19842</a>)</li> <li>Read from <code>--placeholder-color</code> instead of <code>--background-color</code> for <code>placeholder-*</code> utilities (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19843">#19843</a>)</li> <li>Upgrade: ensure files are not emptied out when killing the upgrade process while it's running (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19846">#19846</a>)</li> <li>Upgrade: use <code>config.content</code> when migrating from Tailwind CSS v3 to Tailwind CSS v4 (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19846">#19846</a>)</li> <li>Upgrade: never migrate files that are ignored by git (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19846">#19846</a>)</li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md">@tailwindcss/postcss's changelog</a>.</em></p> <blockquote> <h2>[4.3.0] - 2026-05-08</h2> <h3>Added</h3> <ul> <li>Add <code>@container-size</code> utility (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/18901">#18901</a>)</li> <li>Add <code>scrollbar-{auto,thin,none}</code> utilities for <code>scrollbar-width</code>, and <code>scrollbar-thumb-*</code> / <code>scrollbar-track-*</code> color utilities for <code>scrollbar-color</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19981">#19981</a>, <a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20019">#20019</a>)</li> <li>Add <code>scrollbar-gutter-*</code> utilities (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20018">#20018</a>)</li> <li>Add <code>zoom-*</code> utilities (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20020">#20020</a>)</li> <li>Add <code>tab-*</code> utilities (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20022">#20022</a>)</li> <li>Allow using <code>@variant</code> with stacked variants (e.g. <code>@variant hover:focus { … }</code>) (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19996">#19996</a>)</li> <li>Allow using <code>@variant</code> with compound variants (e.g. <code>@variant hover, focus { … }</code>) (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19996">#19996</a>)</li> <li>Support <code>--default(…)</code> in <code>--value(…)</code> and <code>--modifier(…)</code> for functional <code>@utility</code> definitions (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19989">#19989</a>)</li> </ul> <h3>Fixed</h3> <ul> <li>Ensure <code>@plugin</code> resolves package JavaScript entries instead of browser CSS entries when using <code>@tailwindcss/vite</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19949">#19949</a>)</li> <li>Fix relative <code>@import</code> and <code>@plugin</code> paths resolving from the wrong directory when using <code>@tailwindcss/vite</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19965">#19965</a>)</li> <li>Ensure CSS files containing <code>@variant</code> are processed by <code>@tailwindcss/vite</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19966">#19966</a>)</li> <li>Resolve imports relative to <code>base</code> when <code>result.opts.from</code> is not provided when using <code>@tailwindcss/postcss</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19980">#19980</a>)</li> <li>Canonicalization: preserve significant <code>_</code> whitespace in arbitrary values (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19986">#19986</a>)</li> <li>Canonicalization: add parentheses when removing whitespace from arbitrary values would hurt readability (e.g. <code>w-[calc(100%---spacing(60))]</code> → <code>w-[calc(100%-(--spacing(60)))]</code>) (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19986">#19986</a>)</li> <li>Canonicalization: preserve the original unit in arbitrary values instead of normalizing to base units (e.g. <code>-mt-[20in]</code> → <code>mt-[-20in]</code>, not <code>mt-[-1920px]</code>) (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19988">#19988</a>)</li> <li>Canonicalization: migrate arbitrary <code>:has()</code> variants from <code>[&:has(…)]</code> to <code>has-[…]</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19991">#19991</a>)</li> <li>Upgrade: don’t migrate inline <code>style</code> attributes (e.g. <code>style="flex-grow: 1"</code> → <code>style="flex-grow: 1"</code>, not <code>style="grow: 1"</code>) (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19918">#19918</a>)</li> <li>Allow multiple <code>@utility</code> definitions with the same name but different value types (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19777">#19777</a>)</li> <li>Export missing <code>PluginWithConfig</code> type from <code>tailwindcss/plugin</code> to fix errors when inferring plugin config types (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19707">#19707</a>)</li> <li>Ensure <code>start</code> and <code>end</code> legacy utilities without values do not generate CSS (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20003">#20003</a>)</li> <li>Ensure <code>--value(…)</code> is required in functional <code>@utility</code> definitions (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20005">#20005</a>)</li> <li>Canonicalization: preserve required whitespace around operators in negated arbitrary values (e.g. <code>-left-[(var(--a)+var(--b))]</code>) (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20011">#20011</a>)</li> </ul> <h2>[4.2.4] - 2026-04-21</h2> <h3>Fixed</h3> <ul> <li>Ensure imports in <code>@import</code> and <code>@plugin</code> still resolve correctly when using Vite aliases in <code>@tailwindcss/vite</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19947">#19947</a>)</li> </ul> <h2>[4.2.3] - 2026-04-20</h2> <h3>Fixed</h3> <ul> <li>Canonicalization: improve canonicalization for <code>tracking-*</code> utilities by preferring non-negative utilities (e.g. <code>-tracking-tighter</code> → <code>tracking-wider</code>) (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19827">#19827</a>)</li> <li>Fix crash due to invalid characters in candidate (exceeding valid unicode code point range) (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19829">#19829</a>)</li> <li>Ensure query params in imports are considered unique resources when using <code>@tailwindcss/webpack</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19723">#19723</a>)</li> <li>Canonicalization: collapse arbitrary values into shorthand utilities (e.g. <code>px-[1.2rem] py-[1.2rem]</code> → <code>p-[1.2rem]</code>) (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19837">#19837</a>)</li> <li>Canonicalization: collapse <code>border-{t,b}-*</code> into <code>border-y-*</code>, <code>border-{l,r}-*</code> into <code>border-x-*</code>, and <code>border-{t,r,b,l}-*</code> into <code>border-*</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19842">#19842</a>)</li> <li>Canonicalization: collapse <code>scroll-m{t,b}-*</code> into <code>scroll-my-*</code>, <code>scroll-m{l,r}-*</code> into <code>scroll-mx-*</code>, and <code>scroll-m{t,r,b,l}-*</code> into <code>scroll-m-*</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19842">#19842</a>)</li> <li>Canonicalization: collapse <code>scroll-p{t,b}-*</code> into <code>scroll-py-*</code>, <code>scroll-p{l,r}-*</code> into <code>scroll-px-*</code>, and <code>scroll-p{t,r,b,l}-*</code> into <code>scroll-p-*</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19842">#19842</a>)</li> <li>Canonicalization: collapse <code>overflow-{x,y}-*</code> into <code>overflow-*</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19842">#19842</a>)</li> <li>Canonicalization: collapse <code>overscroll-{x,y}-*</code> into <code>overscroll-*</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19842">#19842</a>)</li> <li>Read from <code>--placeholder-color</code> instead of <code>--background-color</code> for <code>placeholder-*</code> utilities (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19843">#19843</a>)</li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/tailwindlabs/tailwindcss/commit/588bd7371f4cae96426e1387819b7fd1d99765f9"><code>588bd73</code></a> 4.3.0 (<a href="https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-postcss/issues/20023">#20023</a>)</li> <li><a href="https://github.com/tailwindlabs/tailwindcss/commit/12eb5ae7b6026ff64c04f889b2221418d772da72"><code>12eb5ae</code></a> Cleanup noisy test output (<a href="https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-postcss/issues/20015">#20015</a>)</li> <li><a href="https://github.com/tailwindlabs/tailwindcss/commit/4255671c5f792c42808ecd6b2dec27c16e3c559e"><code>4255671</code></a> Improve snapshot tests (<a href="https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-postcss/issues/20013">#20013</a>)</li> <li><a href="https://github.com/tailwindlabs/tailwindcss/commit/52f94c74bb491e9c3641ce322a0ef90fb3c45de6"><code>52f94c7</code></a> Improve codebase quality (<a href="https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-postcss/issues/19999">#19999</a>)</li> <li><a href="https://github.com/tailwindlabs/tailwindcss/commit/d194d4c3e656313421f1cfa1954db8f58eec0fcd"><code>d194d4c</code></a> docs: fix various typos in comments and documentation (<a href="https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-postcss/issues/19878">#19878</a>)</li> <li><a href="https://github.com/tailwindlabs/tailwindcss/commit/bfb5732b0b948d89c6803cb537bca168ec8e0a46"><code>bfb5732</code></a> Fall back to the plugin <code>base</code> when PostCSS has no <code>from</code> option (<a href="https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-postcss/issues/19980">#19980</a>)</li> <li><a href="https://github.com/tailwindlabs/tailwindcss/commit/3a890c35727fe0630c59b72dbec799d02e3c4800"><code>3a890c3</code></a> Bump dependencies (<a href="https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-postcss/issues/19957">#19957</a>)</li> <li><a href="https://github.com/tailwindlabs/tailwindcss/commit/69ad7cc5ec091125842aba783c5bfce536e9c234"><code>69ad7cc</code></a> 4.2.4 (<a href="https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-postcss/issues/19948">#19948</a>)</li> <li><a href="https://github.com/tailwindlabs/tailwindcss/commit/685c19e266a6b75842747acab6fe7076e82df62d"><code>685c19e</code></a> Fix issue around resolving paths in <code>@tailwindcss/vite</code> (<a href="https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-postcss/issues/19947">#19947</a>)</li> <li><a href="https://github.com/tailwindlabs/tailwindcss/commit/2e3fa490a535a8341fd2853d75098f0d4dbcc825"><code>2e3fa49</code></a> 4.2.3 (<a href="https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-postcss/issues/19944">#19944</a>)</li> <li>Additional commits viewable in <a href="https://github.com/tailwindlabs/tailwindcss/commits/v4.3.0/packages/@tailwindcss-postcss">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for <code>@tailwindcss/postcss</code> since your current version.</p> </details> <br /> Updates `@tanstack/react-query-devtools` from 5.91.3 to 5.100.10 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/TanStack/query/releases">@tanstack/react-query-devtools's releases</a>.</em></p> <blockquote> <h2><code>@tanstack/react-query-devtools</code><a href="https://github.com/5"><code>@5</code></a>.100.9</h2> <h3>Patch Changes</h3> <ul> <li>Updated dependencies [<a href="https://github.com/TanStack/query/commit/3d21cacdec3028b700c4c2e3e0ff8dbe7a235e8c"><code>3d21cac</code></a>]: <ul> <li><code>@tanstack/query-devtools</code><a href="https://github.com/5"><code>@5</code></a>.100.9</li> <li><code>@tanstack/react-query</code><a href="https://github.com/5"><code>@5</code></a>.100.9</li> </ul> </li> </ul> <h2><code>@tanstack/react-query-devtools</code><a href="https://github.com/5"><code>@5</code></a>.100.8</h2> <h3>Patch Changes</h3> <ul> <li>Updated dependencies []: <ul> <li><code>@tanstack/query-devtools</code><a href="https://github.com/5"><code>@5</code></a>.100.8</li> <li><code>@tanstack/react-query</code><a href="https://github.com/5"><code>@5</code></a>.100.8</li> </ul> </li> </ul> <h2><code>@tanstack/react-query-devtools</code><a href="https://github.com/5"><code>@5</code></a>.100.7</h2> <h3>Patch Changes</h3> <ul> <li> <p>docs(devtools): align logo, panel, and 'buttonPosition' union descriptions across docs and JSDoc (<a href="https://redirect.github.com/TanStack/query/pull/10617">#10617</a>)</p> </li> <li> <p>Updated dependencies []:</p> <ul> <li><code>@tanstack/query-devtools</code><a href="https://github.com/5"><code>@5</code></a>.100.7</li> <li><code>@tanstack/react-query</code><a href="https://github.com/5"><code>@5</code></a>.100.7</li> </ul> </li> </ul> <h2><code>@tanstack/react-query-devtools</code><a href="https://github.com/5"><code>@5</code></a>.100.6</h2> <h3>Patch Changes</h3> <ul> <li>Updated dependencies []: <ul> <li><code>@tanstack/query-devtools</code><a href="https://github.com/5"><code>@5</code></a>.100.6</li> <li><code>@tanstack/react-query</code><a href="https://github.com/5"><code>@5</code></a>.100.6</li> </ul> </li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/TanStack/query/blob/main/packages/react-query-devtools/CHANGELOG.md">@tanstack/react-query-devtools's changelog</a>.</em></p> <blockquote> <h2>5.100.10</h2> <h3>Patch Changes</h3> <ul> <li>Updated dependencies [<a href="https://github.com/TanStack/query/commit/4d130b992d2ac396d75f921bfc530dd3a9d50577"><code>4d130b9</code></a>]: <ul> <li><code>@tanstack/query-devtools</code><a href="https://github.com/5"><code>@5</code></a>.100.10</li> <li><code>@tanstack/react-query</code><a href="https://github.com/5"><code>@5</code></a>.100.10</li> </ul> </li> </ul> <h2>5.100.9</h2> <h3>Patch Changes</h3> <ul> <li>Updated dependencies [<a href="https://github.com/TanStack/query/commit/3d21cacdec3028b700c4c2e3e0ff8dbe7a235e8c"><code>3d21cac</code></a>]: <ul> <li><code>@tanstack/query-devtools</code><a href="https://github.com/5"><code>@5</code></a>.100.9</li> <li><code>@tanstack/react-query</code><a href="https://github.com/5"><code>@5</code></a>.100.9</li> </ul> </li> </ul> <h2>5.100.8</h2> <h3>Patch Changes</h3> <ul> <li>Updated dependencies []: <ul> <li><code>@tanstack/query-devtools</code><a href="https://github.com/5"><code>@5</code></a>.100.8</li> <li><code>@tanstack/react-query</code><a href="https://github.com/5"><code>@5</code></a>.100.8</li> </ul> </li> </ul> <h2>5.100.7</h2> <h3>Patch Changes</h3> <ul> <li> <p>docs(devtools): align logo, panel, and 'buttonPosition' union descriptions across docs and JSDoc (<a href="https://redirect.github.com/TanStack/query/pull/10617">#10617</a>)</p> </li> <li> <p>Updated dependencies []:</p> <ul> <li><code>@tanstack/query-devtools</code><a href="https://github.com/5"><code>@5</code></a>.100.7</li> <li><code>@tanstack/react-query</code><a href="https://github.com/5"><code>@5</code></a>.100.7</li> </ul> </li> </ul> <h2>5.100.6</h2> <h3>Patch Changes</h3> <ul> <li>Updated dependencies []: <ul> <li><code>@tanstack/query-devtools</code><a href="https://github.com/5"><code>@5</code></a>.100.6</li> <li><code>@tanstack/react-query</code><a href="https://github.com/5"><code>@5</code></a>.100.6</li> </ul> </li> </ul> <h2>5.100.5</h2> <h3>Patch Changes</h3> <ul> <li>Updated dependencies []: <ul> <li><code>@tanstack/query-devtools</code><a href="https://github.com/5"><code>@5</code></a>.100.5</li> <li><code>@tanstack/react-query</code><a href="https://github.com/5"><code>@5</code></a>.100.5</li> </ul> </li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/TanStack/query/commits/HEAD/packages/react-query-devtools">compare view</a></li> </ul> </details> <br /> Updates `@types/express-session` from 1.18.2 to 1.19.0 <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/express-session">compare view</a></li> </ul> </details> <br /> Updates `@types/node` from 25.3.5 to 25.8.0 <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node">compare view</a></li> </ul> </details> <br /> Updates `@types/pg` from 8.18.0 to 8.20.0 <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/pg">compare view</a></li> </ul> </details> <br /> Updates `esbuild` from 0.27.4 to 0.28.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/evanw/esbuild/releases">esbuild's releases</a>.</em></p> <blockquote> <h2>v0.28.0</h2> <ul> <li> <p>Add support for <code>with { type: 'text' }</code> imports (<a href="https://redirect.github.com/evanw/esbuild/issues/4435">#4435</a>)</p> <p>The <a href="https://github.com/tc39/proposal-import-text">import text</a> proposal has reached stage 3 in the TC39 process, which means that it's recommended for implementation. It has also already been implemented by <a href="https://docs.deno.com/examples/importing_text/">Deno</a> and <a href="https://bun.com/docs/guides/runtime/import-html">Bun</a>. So with this release, esbuild also adds support for it. This behaves exactly the same as esbuild's existing <a href="https://esbuild.github.io/content-types/#text"><code>text</code> loader</a>. Here's an example:</p> <pre lang="js"><code>import string from './example.txt' with { type: 'text' } console.log(string) </code></pre> </li> <li> <p>Add integrity checks to fallback download path (<a href="https://redirect.github.com/evanw/esbuild/issues/4343">#4343</a>)</p> <p>Installing esbuild via npm is somewhat complicated with several different edge cases (see <a href="https://esbuild.github.io/getting-started/#additional-npm-flags">esbuild's documentation</a> for details). If the regular installation of esbuild's platform-specific package fails, esbuild's install script attempts to download the platform-specific package itself (first with the <code>npm</code> command, and then with a HTTP request to <code>registry.npmjs.org</code> as a last resort).</p> <p>This last resort path previously didn't have any integrity checks. With this release, esbuild will now verify that the hash of the downloaded binary matches the expected hash for the current release. This means the hashes for all of esbuild's platform-specific binary packages will now be embedded in the top-level <code>esbuild</code> package. Hopefully this should work without any problems. But just in case, this change is being done as a breaking change release.</p> </li> <li> <p>Update the Go compiler from 1.25.7 to 1.26.1</p> <p>This upgrade should not affect anything. However, there have been some significant internal changes to the Go compiler, so esbuild could potentially behave differently in certain edge cases:</p> <ul> <li>It now uses the <a href="https://go.dev/doc/go1.26#new-garbage-collector">new garbage collector</a> that comes with Go 1.26.</li> <li>The Go compiler is now more aggressive with allocating memory on the stack.</li> <li>The executable format that the Go linker uses has undergone several changes.</li> <li>The WebAssembly build now unconditionally makes use of the sign extension and non-trapping floating-point to integer conversion instructions.</li> </ul> <p>You can read the <a href="https://go.dev/doc/go1.26">Go 1.26 release notes</a> for more information.</p> </li> </ul> <h2>v0.27.7</h2> <ul> <li> <p>Fix lowering of define semantics for TypeScript parameter properties (<a href="https://redirect.github.com/evanw/esbuild/issues/4421">#4421</a>)</p> <p>The previous release incorrectly generated class fields for TypeScript parameter properties even when the configured target environment does not support class fields. With this release, the generated class fields will now be correctly lowered in this case:</p> <pre lang="ts"><code>// Original code class Foo { constructor(public x = 1) {} y = 2 } <p>// Old output (with --loader=ts --target=es2021)<br /> class Foo {<br /> constructor(x = 1) {<br /> this.x = x;<br /> __publicField(this, "y", 2);<br /> }<br /> x;<br /> }</p> <p>// New output (with --loader=ts --target=es2021)<br /> class Foo {<br /> </code></pre></p> </li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/evanw/esbuild/blob/main/CHANGELOG.md">esbuild's changelog</a>.</em></p> <blockquote> <h2>0.28.0</h2> <ul> <li> <p>Add support for <code>with { type: 'text' }</code> imports (<a href="https://redirect.github.com/evanw/esbuild/issues/4435">#4435</a>)</p> <p>The <a href="https://github.com/tc39/proposal-import-text">import text</a> proposal has reached stage 3 in the TC39 process, which means that it's recommended for implementation. It has also already been implemented by <a href="https://docs.deno.com/examples/importing_text/">Deno</a> and <a href="https://bun.com/docs/guides/runtime/import-html">Bun</a>. So with this release, esbuild also adds support for it. This behaves exactly the same as esbuild's existing <a href="https://esbuild.github.io/content-types/#text"><code>text</code> loader</a>. Here's an example:</p> <pre lang="js"><code>import string from './example.txt' with { type: 'text' } console.log(string) </code></pre> </li> <li> <p>Add integrity checks to fallback download path (<a href="https://redirect.github.com/evanw/esbuild/issues/4343">#4343</a>)</p> <p>Installing esbuild via npm is somewhat complicated with several different edge cases (see <a href="https://esbuild.github.io/getting-started/#additional-npm-flags">esbuild's documentation</a> for details). If the regular installation of esbuild's platform-specific package fails, esbuild's install script attempts to download the platform-specific package itself (first with the <code>npm</code> command, and then with a HTTP request to <code>registry.npmjs.org</code> as a last resort).</p> <p>This last resort path previously didn't have any integrity checks. With this release, esbuild will now verify that the hash of the downloaded binary matches the expected hash for the current release. This means the hashes for all of esbuild's platform-specific binary packages will now be embedded in the top-level <code>esbuild</code> package. Hopefully this should work without any problems. But just in case, this change is being done as a breaking change release.</p> </li> <li> <p>Update the Go compiler from 1.25.7 to 1.26.1</p> <p>This upgrade should not affect anything. However, there have been some significant internal changes to the Go compiler, so esbuild could potentially behave differently in certain edge cases:</p> <ul> <li>It now uses the <a href="https://go.dev/doc/go1.26#new-garbage-collector">new garbage collector</a> that comes with Go 1.26.</li> <li>The Go compiler is now more aggressive with allocating memory on the stack.</li> <li>The executable format that the Go linker uses has undergone several changes.</li> <li>The WebAssembly build now unconditionally makes use of the sign extension and non-trapping floating-point to integer conversion instructions.</li> </ul> <p>You can read the <a href="https://go.dev/doc/go1.26">Go 1.26 release notes</a> for more information.</p> </li> </ul> <h2>0.27.7</h2> <ul> <li> <p>Fix lowering of define semantics for TypeScript parameter properties (<a href="https://redirect.github.com/evanw/esbuild/issues/4421">#4421</a>)</p> <p>The previous release incorrectly generated class fields for TypeScript parameter properties even when the configured target environment does not support class fields. With this release, the generated class fields will now be correctly lowered in this case:</p> <pre lang="ts"><code>// Original code class Foo { constructor(public x = 1) {} y = 2 } <p>// Old output (with --loader=ts --target=es2021)<br /> class Foo {<br /> constructor(x = 1) {<br /> this.x = x;<br /> __publicField(this, "y", 2);<br /> }<br /> x;<br /> }</p> <p></code></pre></p> </li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/evanw/esbuild/commit/6a794dff68e6a43539f6da671e3080efdf11ca70"><code>6a794df</code></a> publish 0.28.0 to npm</li> <li><a href="https://github.com/evanw/esbuild/commit/64ee0ea63b2ff303caafc9610c388dc72c882c23"><code>64ee0ea</code></a> fix <a href="https://redirect.github.com/evanw/esbuild/issues/4435">#4435</a>: support <code>with { type: text }</code> imports</li> <li><a href="https://github.com/evanw/esbuild/commit/ef65aeeaacdb71eade186f888975b1de89574314"><code>ef65aee</code></a> fix sort order in <code>snapshots_packagejson.txt</code></li> <li><a href="https://github.com/evanw/esbuild/commit/1a26a8ecbc39aaf1379c524a0274a08fbcbed655"><code>1a26a8e</code></a> try to fix <code>test-old-ts</code>, also shuffle CI tasks</li> <li><a href="https://github.com/evanw/esbuild/commit/556ce6c1fc00d7c0917fbfada01ed8e5251bc510"><code>556ce6c</code></a> use <code>''</code> instead of <code>null</code> to omit build hashes</li> <li><a href="https://github.com/evanw/esbuild/commit/8e675a81a473ea69a46a69792f1386bb110dd877"><code>8e675a8</code></a> ci: allow missing binary hashes for tests</li> <li><a href="https://github.com/evanw/esbuild/commit/7067763b904fe8a522fa840a4a48c5fbd4c395e0"><code>7067763</code></a> Reapply "update go 1.25.7 => 1.26.1"</li> <li><a href="https://github.com/evanw/esbuild/commit/39473a952ab3b450d0578b698a8b8d2a02332e0d"><code>39473a9</code></a> fix <a href="https://redirect.github.com/evanw/esbuild/issues/4343">#4343</a>: integrity check for binary download</li> <li><a href="https://github.com/evanw/esbuild/commit/2025c9ff6ab15ba6b0f9d074fd732250cc46e4a3"><code>2025c9f</code></a> publish 0.27.7 to npm</li> <li><a href="https://github.com/evanw/esbuild/commit/c6b586e4904f47e8d5f783a2813660c13e2672e7"><code>c6b586e</code></a> fix typo in <code>Makefile</code> for <code>@esbuild/win32-x64</code></li> <li>Additional commits viewable in <a href="https://github.com/evanw/esbuild/compare/v0.27.4...v0.28.0">compare view</a></li> </ul> </details> <br /> Updates `esbuild-node-externals` from 1.20.1 to 1.22.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/pradel/esbuild-node-externals/releases">esbuild-node-externals's releases</a>.</em></p> <blockquote> <h2>esbuild-node-externals: v1.22.0</h2> <h2><a href="https://github.com/pradel/esbuild-node-externals/compare/esbuild-node-externals-v1.21.0...esbuild-node-externals-v1.22.0">1.22.0</a> (2026-04-08)</h2> <h3>Features</h3> <ul> <li>replace find-up with empathic to have smaller installation (<a href="https://redirect.github.com/pradel/esbuild-node-externals/issues/86">#86</a>) (<a href="https://github.com/pradel/esbuild-node-externals/commit/87229fc8268ebaed346172ba4534777d133e6f14">87229fc</a>)</li> </ul> <h2>esbuild-node-externals: v1.21.0</h2> <h2><a href="https://github.com/pradel/esbuild-node-externals/compare/esbuild-node-externals-v1.20.1...esbuild-node-externals-v1.21.0">1.21.0</a> (2026-04-03)</h2> <h3>Features</h3> <ul> <li>add esbuild 0.28 to the allowed range (<a href="https://redirect.github.com/pradel/esbuild-node-externals/issues/84">#84</a>) (<a href="https://github.com/pradel/esbuild-node-externals/commit/e66160f843ffe526f0e4dde4dd4e9f6896d0399b">e66160f</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/pradel/esbuild-node-externals/commit/bbaed41660111d1851907aea47534b87aa66e1ff"><code>bbaed41</code></a> chore(main): release esbuild-node-externals 1.22.0 (<a href="https://redirect.github.com/pradel/esbuild-node-externals/issues/87">#87</a>)</li> <li><a href="https://github.com/pradel/esbuild-node-externals/commit/87229fc8268ebaed346172ba4534777d133e6f14"><code>87229fc</code></a> feat: replace find-up with empathic to have smaller installation (<a href="https://redirect.github.com/pradel/esbuild-node-externals/issues/86">#86</a>)</li> <li><a href="https://github.com/pradel/esbuild-node-externals/commit/1b60aa3b4ec5dc7be3e3bee692ca5d5306a47a88"><code>1b60aa3</code></a> chore(main): release esbuild-node-externals 1.21.0 (<a href="https://redirect.github.com/pradel/esbuild-node-externals/issues/85">#85</a>)</li> <li><a href="https://github.com/pradel/esbuild-node-externals/commit/e66160f843ffe526f0e4dde4dd4e9f6896d0399b"><code>e66160f</code></a> feat: add esbuild 0.28 to the allowed range (<a href="https://redirect.github.com/pradel/esbuild-node-externals/issues/84">#84</a>)</li> <li>See full diff in <a href="https://github.com/pradel/esbuild-node-externals/compare/esbuild-node-externals-v1.20.1...esbuild-node-externals-v1.22.0">compare view</a></li> </ul> </details> <br /> Updates `eslint` from 10.0.3 to 10.3.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/eslint/eslint/releases">eslint's releases</a>.</em></p> <blockquote> <h2>v10.3.0</h2> <h2>Features</h2> <ul> <li><a href="https://github.com/eslint/eslint/commit/379571a975f2b24d88037b9de2e72ec61d004130"><code>379571a</code></a> feat: add suggestions for no-unused-private-class-members (<a href="https://redirect.github.com/eslint/eslint/issues/20773">#20773</a>) (sethamus)</li> </ul> <h2>Bug Fixes</h2> <ul> <li><a href="https://github.com/eslint/eslint/commit/b6ae5cf07b9b51802367539cb24b245b61eaa37c"><code>b6ae5cf</code></a> fix: handle unavailable require cache (<a href="https://redirect.github.com/eslint/eslint/issues/20812">#20812</a>) (Simon Podlipsky)</li> <li><a href="https://github.com/eslint/eslint/commit/6fb3685bcbe9a6f72fd7dfb9129686b6fb96b0bd"><code>6fb3685</code></a> fix: rule suggestions cause continuation in class body (<a href="https://redirect.github.com/eslint/eslint/issues/20787">#20787</a>) (Milos Djermanovic)</li> </ul> <h2>Documentation</h2> <ul> <li><a href="https://github.com/eslint/eslint/commit/32cc7ab4ec653ce89da92deb5c40a9f4fc707fe5"><code>32cc7ab</code></a> docs: fix typos in docs and comments (<a href="https://redirect.github.com/eslint/eslint/issues/20809">#20809</a>) (Tanuj Kanti)</li> <li><a href="https://github.com/eslint/eslint/commit/7f479376a2fa463d823ab762db6bb37ce8d2ee8f"><code>7f47937</code></a> docs: Update README (GitHub Actions Bot)</li> </ul> <h2>Chores</h2> <ul> <li><a href="https://github.com/eslint/eslint/commit/d32235ec19ceea211fa86452afa383ca05f5c2f9"><code>d32235e</code></a> ci: use pnpm in <code>eslint-flat-config-utils</code> type integration test (<a href="https://redirect.github.com/eslint/eslint/issues/20826">#20826</a>) (Francesco Trotta)</li> <li><a href="https://github.com/eslint/eslint/commit/3ffb14ea517de750ed1181579ef844af342e4096"><code>3ffb14e</code></a> chore: clean up typos in comments and JSDoc (<a href="https://redirect.github.com/eslint/eslint/issues/20821">#20821</a>) (Pixel998)</li> <li><a href="https://github.com/eslint/eslint/commit/22eb58a21cbde2fbd53a1fae99453d408672de50"><code>22eb58a</code></a> chore: add missing continue-on-error to ecosystem-tests.yml (<a href="https://redirect.github.com/eslint/eslint/issues/20818">#20818</a>) (Josh Goldberg ✨)</li> <li><a href="https://github.com/eslint/eslint/commit/88bf0024cb36caebf2880516d9a1f81aa75dafe2"><code>88bf002</code></a> ci: bump pnpm/action-setup from 6.0.1 to 6.0.3 (<a href="https://redirect.github.com/eslint/eslint/issues/20815">#20815</a>) (dependabot[bot])</li> <li><a href="https://github.com/eslint/eslint/commit/97c8c330beae9557ad24e19f94eebc8d08d1a722"><code>97c8c33</code></a> chore: update ilshidur/action-discord action to v0.4.0 (<a href="https://redirect.github.com/eslint/eslint/issues/20811">#20811</a>) (renovate[bot])</li> <li><a href="https://github.com/eslint/eslint/commit/2f58136dd47364a4cae7054a64f7bf1e79693813"><code>2f58136</code></a> chore: pin peter-evans/create-pull-request action to 5f6978f (<a href="https://redirect.github.com/eslint/eslint/issues/20810">#20810</a>) (renovate[bot])</li> <li><a href="https://github.com/eslint/eslint/commit/77add7f1bc91ed17bba3be3289928a9146c5f5a1"><code>77add7f</code></a> chore: add initial ecosystem plugin tests workflow (<a href="https://redirect.github.com/eslint/eslint/issues/19643">#19643</a>) (Josh Goldberg ✨)</li> <li><a href="https://github.com/eslint/eslint/commit/4023b55490fae55e464fe35530ef038cdf5d79a5"><code>4023b55</code></a> test: Add unit tests for SuppressionsService.prune() (<a href="https://redirect.github.com/eslint/eslint/issues/20797">#20797</a>) (kuldeep kumar)</li> <li><a href="https://github.com/eslint/eslint/commit/54080dad4f77bb39a1a843933d4ff3a2b7c175e2"><code>54080da</code></a> test: add unit tests for ForkContext (<a href="https://redirect.github.com/eslint/eslint/issues/20778">#20778</a>) (kuldeep kumar)</li> <li><a href="https://github.com/eslint/eslint/commit/f0e2bcc4bf19253aaebfbd7df87824b0ca4a151f"><code>f0e2bcc</code></a> test: add unit tests for SuppressionsService.suppress() method (<a href="https://redirect.github.com/eslint/eslint/issues/20765">#20765</a>) (kuldeep kumar)</li> <li><a href="https://github.com/eslint/eslint/commit/a7f0b94743a99bcdf8d07cff15ffbfa6a6c5f927"><code>a7f0b94</code></a> chore: update dependency prettier to v3.8.3 (<a href="https://redirect.github.com/eslint/eslint/issues/20782">#20782</a>) (renovate[bot])</li> <li><a href="https://github.com/eslint/eslint/commit/7bf93d9e79f6dbf77242cbb9a9b8be834730fccd"><code>7bf93d9</code></a> chore: update TypeScript to v6 (<a href="https://redirect.github.com/eslint/eslint/issues/20677">#20677</a>) (sethamus)</li> <li><a href="https://github.com/eslint/eslint/commit/b42dd72e76e7f90e7f0be9458288d93353052adc"><code>b42dd72</code></a> ci: bump pnpm/action-setup from 6.0.0 to 6.0.1 (<a href="https://redirect.github.com/eslint/eslint/issues/20781">#20781</a>) (dependabot[bot])</li> <li><a href="https://github.com/eslint/eslint/commit/2b252be80f362cca7be3326a6dbe958680fdfe9a"><code>2b252be</code></a> test: add unit tests for IdGenerator (<a href="https://redirect.github.com/eslint/eslint/issues/20775">#20775</a>) (kuldeep kumar)</li> </ul> <h2>v10.2.1</h2> <h2>Bug Fixes</h2> <ul> <li><a href="https://github.com/eslint/eslint/commit/14be92b6d1fa0923b8923830f2208e5e2705b002"><code>14be92b</code></a> fix: model generator yield resumption paths in code path analysis (<a href="https://redirect.github.com/eslint/eslint/issues/20665">#20665</a>) (sethamus)</li> <li><a href="https://github.com/eslint/eslint/commit/84a19d2c32255db6b9cfc08644a607aae6d5cb62"><code>84a19d2</code></a> fix: no-async-promise-executor false positives for shadowed Promise (<a href="https://redirect.github.com/eslint/eslint/issues/20740">#20740</a>) (xbinaryx)</li> <li><a href="https://github.com/eslint/eslint/commit/af764af0ec38225755fbf8a6f207f0c77b595a8d"><code>af764af</code></a> fix: clarify language and processor validation errors (<a href="https://redirect.github.com/eslint/eslint/issues/20729">#20729</a>) (Pixel998)</li> <li><a href="https://github.com/eslint/eslint/commit/e251b89a38280973e468a4a9386c138f4f55d10d"><code>e251b89</code></a> fix: update eslint (<a href="https://redirect.github.com/eslint/eslint/issues/20715">#20715</a>) (renovate[bot])</li> </ul> <h2>Documentation</h2> <ul> <li><a href="https://github.com/eslint/eslint/commit/ca92ca0fb4599e8de1e2fb914e695fe7397cbe63"><code>ca92ca0</code></a> docs: reuse markdown-it instance for markdown filter (<a href="https://redirect.github.com/eslint/eslint/issues/20768">#20768</a>) (Amaresh S M)</li> <li><a href="https://github.com/eslint/eslint/commit/57d2ee213305cee0cb55ef08e0480b57396269a9"><code>57d2ee2</code></a> docs: Enable Eleventy incremental mode for watch (<a href="https://redirect.github.com/eslint/eslint/issues/20767">#20767</a>) (Amaresh S M)</li> <li><a href="https://github.com/eslint/eslint/commit/c1621b915742276e5f4b25efe790ca62296330dc"><code>c1621b9</code></a> docs: fix typos in code-path-analyzer.js (<a href="https://redirect.github.com/eslint/eslint/issues/20700">#20700</a>) (Ayush Shukla)</li> <li><a href="https://github.com/eslint/eslint/commit/1418d522d10bde1960f4942afb548bc7160ec49e"><code>1418d52</code></a> docs: Update README (GitHub Actions Bot)</li> <li><a href="https://github.com/eslint/eslint/commit/39771e6e600f0b0617fdeafff6dd07e4211ffde6"><code>39771e6</code></a> docs: Update README (GitHub Actions Bot)</li> <li><a href="https://github.com/eslint/eslint/commit/71e04693def2df57268f08f3072a2749df6bf438"><code>71e0469</code></a> docs: fix incomplete JSDoc param description in no-shadow rule (<a href="https://redirect.github.com/eslint/eslint/issues/20728">#20728</a>) (kuldeep kumar)</li> <li><a href="https://github.com/eslint/eslint/commit/22119ceb93e28f62262fc1d98ff1b1442d6e2dbf"><code>22119ce</code></a> docs: clarify scope of for-direction rule with dead code examples (<a href="https://redirect.github.com/eslint/eslint/issues/20723">#20723</a>) (Amaresh S M)</li> <li><a href="https://github.com/eslint/eslint/commit/8f3fb77f122a5641d1833cad5d93f3f54fa3be0b"><code>8f3fb77</code></a> docs: document <code>meta.docs.dialects</code> (<a href="https://redirect.github.com/eslint/eslint/issues/20718">#20718</a>) (Pixel998)</li> </ul> <h2>Chores</h2> <ul> <li><a href="https://github.com/eslint/eslint/commit/7ddfea9c4f62add1588c5c0b0da568c299246383"><code>7ddfea9</code></a> chore: update dependency prettier to v3.8.2 (<a href="https://redirect.github.com/eslint/eslint/issues/20770">#20770</a>) (renovate[bot])</li> <li><a href="https://github.com/eslint/eslint/commit/fac40e1de2ba7646cc7cd2d3f93fbdd1f8819001"><code>fac40e1</code></a> ci: bump pnpm/action-setup from 5.0.0 to 6.0.0 (<a href="https://redirect.github.com/eslint/eslint/issues/20763">#20763</a>) (dependabot[bot])</li> <li><a href="https://github.com/eslint/eslint/commit/7246f923332522d8b3d46b6ee646fce88535f3fb"><code>7246f92</code></a> test: add tests for SuppressionsService.load() error handling (<a href="https://redirect.github.com/eslint/eslint/issues/20734">#20734</a>) (kuldeep kumar)</li> <li><a href="https://github.com/eslint/eslint/commit/4f34b1e592b0f63d766d9903998e8e36eb49d3aa"><code>4f34b1e</code></a> chore: update pnpm/action-setup action to v5 (<a href="https://redirect.github.com/eslint/eslint/issues/20762">#20762</a>) (renovate[bot])</li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/eslint/eslint/commit/78892043a36da4aa7640b59c99344b00c181048a"><code>7889204</code></a> 10.3.0</li> <li><a href="https://github.com/eslint/eslint/commit/5b69b4fce4dc407c8e960eba638b5a3409c4f1fd"><code>5b69b4f</code></a> Build: changelog update for 10.3.0</li> <li><a href="https://github.com/eslint/eslint/commit/d32235ec19ceea211fa86452afa383ca05f5c2f9"><code>d32235e</code></a> ci: use pnpm in <code>eslint-flat-config-utils</code> type integration test (<a href="https://redirect.github.com/eslint/eslint/issues/20826">#20826</a>)</li> <li><a href="https://github.com/eslint/eslint/commit/b6ae5cf07b9b51802367539cb24b245b61eaa37c"><code>b6ae5cf</code></a> fix: handle unavailable require cache (<a href="https://redirect.github.com/eslint/eslint/issues/20812">#20812</a>)</li> <li><a href="https://github.com/eslint/eslint/commit/3ffb14ea517de750ed1181579ef844af342e4096"><code>3ffb14e</code></a> chore: clean up typos in comments and JSDoc (<a href="https://redirect.github.com/eslint/eslint/issues/20821">#20821</a>)</li> <li><a href="https://github.com/eslint/eslint/commit/6fb3685bcbe9a6f72fd7dfb9129686b6fb96b0bd"><code>6fb3685</code></a> fix: rule suggestions cause continuation in class body (<a href="https://redirect.github.com/eslint/eslint/issues/20787">#20787</a>)</li> <li><a href="https://github.com/eslint/eslint/commit/22eb58a21cbde2fbd53a1fae99453d408672de50"><code>22eb58a</code></a> chore: add missing continue-on-error to ecosystem-tests.yml (<a href="https://redirect.github.com/eslint/eslint/issues/20818">#20818</a>)</li> <li><a href="https://github.com/eslint/eslint/commit/88bf0024cb36caebf2880516d9a1f81aa75dafe2"><code>88bf002</code></a> ci: bump pnpm/action-setup from 6.0.1 to 6.0.3 (<a href="https://redirect.github.com/eslint/eslint/issues/20815">#20815</a>)</li> <li><a href="https://github.com/eslint/eslint/commit/379571a975f2b24d88037b9de2e72ec61d004130"><code>379571a</code></a> feat: add suggestions for no-unused-private-class-members (<a href="https://redirect.github.com/eslint/eslint/issues/20773">#20773</a>)</li> <li><a href="https://github.com/eslint/eslint/commit/97c8c330beae9557ad24e19f94eebc8d08d1a722"><code>97c8c33</code></a> chore: update ilshidur/action-discord action to v0.4.0 (<a href="https://redirect.github.com/eslint/eslint/issues/20811">#20811</a>)</li> <li>Additional commits viewable in <a href="https://github.com/eslint/eslint/compare/v10.0.3...v10.3.0">compare view</a></li> </ul> </details> <br /> Updates `eslint-config-next` from 16.1.7 to 16.2.6 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vercel/next.js/releases">eslint-config-next's releases</a>.</em></p> <blockquote> <h2>v16.2.6</h2> <blockquote> <p>[!NOTE] This release contains security fixes and backported bug fixes. It does <strong>not</strong> include all pending features/changes on canary.</p> </blockquote> <h3>Security Fixes</h3> <p>The following advisories have been addressed:</p> <p><strong>High:</strong></p> <ul> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-8h8q-6873-q5fj">GHSA-8h8q-6873-q5fj: Denial of Service with Server Components</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-267c-6grr-h53f">GHSA-267c-6grr-h53f: Middleware / Proxy bypass in App Router applications via segment-prefetch routes</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-26hh-7cqf-hhc6">GHSA-26hh-7cqf-hhc6: Middleware / Proxy bypass in App Router applications via segment-prefetch routes - <strong>Incomplete Fix Follow-Up</strong></a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-mg66-mrh9-m8jx">GHSA-mg66-mrh9-m8jx: Denial of Service via connection exhaustion in applications using Cache Components</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-492v-c6pp-mqqv">GHSA-492v-c6pp-mqqv: Middleware / Proxy bypass through dynamic route parameter injection</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-c4j6-fc7j-m34r">GHSA-c4j6-fc7j-m34r: Server-side request forgery in applications using WebSocket upgrades</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-36qx-fr4f-26g5">GHSA-36qx-fr4f-26g5: Middleware / Proxy bypass in Pages Router applications using i18n</a></li> </ul> <p><strong>Moderate:</strong></p> <ul> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-ffhc-5mcf-pf4q">GHSA-ffhc-5mcf-pf4q: Cross-site scripting in App Router applications using CSP nonces</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-gx5p-jg67-6x7h">GHSA-gx5p-jg67-6x7h: Cross-site scripting in beforeInteractive scripts with untrusted input</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-h64f-5h5j-jqjh">GHSA-h64f-5h5j-jqjh: Denial of Service in the Image Optimization API</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-wfc6-r584-vfw7">GHSA-wfc6-r584-vfw7: Cache poisoning in React Server Component responses</a></li> </ul> <p><strong>Low:</strong></p> <ul> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-vfv6-92ff-j949">GHSA-vfv6-92ff-j949: Cache poisoning via collisions in React Server Component cache-busting</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-3g8h-86w9-wvmq">GHSA-3g8h-86w9-wvmq: Middleware / Proxy redirects can be cache-poisoned</a></li> </ul> <h3>Core Changes</h3> <ul> <li>fix: preserve HTTP access fallbacks during prerender recovery (<a href="https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next/issues/92231">#92231</a>)</li> <li>Fix fallback route params case in app-page handler (<a href="https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next/issues/91737">#91737</a>)</li> <li>Fix invalid HTML response for route-level RSC requests in deployment adapter (<a href="https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next/issues/91541">#91541</a>)</li> <li>Patch setHeader for direct route handlers (<a href="https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next/issues/93101">#93101</a>)</li> <li>Include deployment id in <code>cacheHandlers</code> keys (<a href="https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next/issues/93453">#93453</a>)</li> <li>Fix double-encoding of URL pathname parts in client param parsing (<a href="https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next/issues/93491">#93491</a>)</li> </ul> <h2>v16.2.5</h2> <blockquote> <p>[!NOTE] This release contains security fixes and backported bug fixes. It does <strong>not</strong> include all pending features/changes on canary.</p> </blockquote> <h3>Security Fixes</h3> <p>The following advisories have been addressed:</p> <p><strong>High:</strong></p> <ul> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-8h8q-6873-q5fj">GHSA-8h8q-6873-q5fj: Denial of Service with Server Components</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-267c-6grr-h53f">GHSA-267c-6grr-h53f: Middleware / Proxy bypass in App Router applications via segment-prefetch routes</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-mg66-mrh9-m8jx">GHSA-mg66-mrh9-m8jx: Denial of Service via connection exhaustion in applications using Cache Components</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-492v-c6pp-mqqv">GHSA-492v-c6pp-mqqv: Middleware / Proxy bypass through dynamic route parameter injection</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-c4j6-fc7j-m34r">GHSA-c4j6-fc7j-m34r: Server-side request forgery in applications using WebSocket upgrades</a></li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vercel/next.js/commit/ee6e79b1792a4d401ddf2480f40a83549fe8e722"><code>ee6e79b</code></a> v16.2.6</li> <li><a href="https://github.com/vercel/next.js/commit/766148f9cd48c0e218acafcd0f15defc14871bf4"><code>766148f</code></a> v16.2.5</li> <li><a href="https://github.com/vercel/next.js/commit/2275bd8598c88e8652d1271e74bcf972f72f4f38"><code>2275bd8</code></a> v16.2.4</li> <li><a href="https://github.com/vercel/next.js/commit/d5f649b2f4affdad1009cb178c1e3b37f4f1ad3f"><code>d5f649b</code></a> v16.2.3</li> <li><a href="https://github.com/vercel/next.js/commit/52faae3d94641584e13691238df5be158d0f00fb"><code>52faae3</code></a> v16.2.2</li> <li><a href="https://github.com/vercel/next.js/commit/ed7d2cef246dcb3e2955c018fd8b2027e0ff8eed"><code>ed7d2ce</code></a> v16.2.1</li> <li><a href="https://github.com/vercel/next.js/commit/c5c94dffbf084e66b172a9c6ff23d80c24973764"><code>c5c94df</code></a> v16.2.0</li> <li><a href="https://github.com/vercel/next.js/commit/3683192a6bea9011222e9b236f8000b5266f3fe6"><code>3683192</code></a> v16.2.0-canary.104</li> <li><a href="https://github.com/vercel/next.js/commit/668981482a3f9de97c4c1371e940e0f84972c080"><code>6689814</code></a> v16.2.0-canary.103</li> <li><a href="https://github.com/vercel/next.js/commit/ad66dbc89b356867c308110dc5365a696c763991"><code>ad66dbc</code></a> v16.2.0-canary.102</li> <li>Additional commits viewable in <a href="https://github.com/vercel/next.js/commits/v16.2.6/packages/eslint-config-next">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to... _Description has been truncated_ --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

GiteaMirror added the pull-request label 2026-05-16 04:13:10 -05:00

Sign in to join this conversation.

Branches Tags

main

dev

crowdin_dev

dependabot/npm_and_yarn/npm-dependencies-8b2d4a9f3a

dependabot/go_modules/install/go-install-dependencies-3804ca7238

dependabot/docker/docker-dependencies-4faa477378

dependabot/github_actions/github-actions-dependencies-6d79802a48

api-improvements

feat/remember-last-idp-on-smart-login-form

refactor/batch-status-requests

dependabot/npm_and_yarn/multi-5f1280885e

fix/non-semver-version-error

private-resource-page

resource-launcher

backhaul

exit-node-reconnect

feat/command-palette

ssh

delete-account

msg-delivery

org-only-idp

cicd

patch

site-targets-auto-login

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/pangolin#16230

[PR #3078] Bump the dev-minor-updates group across 1 directory with 13 updates #16230

📋 Pull Request Information

📝 Commits (1)

📊 Changes

📄 Description

v1.66.0

v1.65.3

v1.65.2

v1.65.1

v1.65.0

v1.64.0

v1.63.0

v1.62.0

v1.61.6

v1.61.5

v1.61.4

v1.61.3

v1.61.2

v1.61.1

v1.61.0

v1.60.2

v1.60.1

1.66.0 (2026-05-13)

Added

1.65.3 (2026-05-13)

Changed

1.65.2 (2026-05-13)

Changed

1.65.1 (2026-05-13)

Changed

1.65.0 (2026-05-05)

Added

1.64.0 (2026-04-27)

Added

1.63.0 (2026-04-24)

Added

1.62.0 (2026-04-23)

v4.3.0

Added

Fixed

v4.2.4

Fixed

v4.2.3

Fixed

[4.3.0] - 2026-05-08

Added

Fixed

[4.2.4] - 2026-04-21

Fixed

[4.2.3] - 2026-04-20

Fixed

@​tanstack/react-query-devtools@​5.100.9

Patch Changes

@​tanstack/react-query-devtools@​5.100.8

Patch Changes

@​tanstack/react-query-devtools@​5.100.7

Patch Changes

@​tanstack/react-query-devtools@​5.100.6

Patch Changes

5.100.10

Patch Changes

5.100.9

Patch Changes

5.100.8

Patch Changes

5.100.7

Patch Changes

5.100.6

Patch Changes

5.100.5

Patch Changes

v0.28.0

v0.27.7

0.28.0

0.27.7

esbuild-node-externals: v1.22.0

1.22.0 (2026-04-08)

Features

esbuild-node-externals: v1.21.0

1.21.0 (2026-04-03)

`@tanstack/react-query-devtools@5`.100.9

`@tanstack/react-query-devtools@5`.100.8

`@tanstack/react-query-devtools@5`.100.7

`@tanstack/react-query-devtools@5`.100.6