[PR #3078] [CLOSED] Bump the dev-minor-updates group across 1 directory with 13 updates #22515

New Issue

GiteaMirror · 2026-06-02T05:23:30-05:00

GiteaMirror commented

2026-06-02 05:23:30 -05:00

📋 Pull Request Information

Original PR: https://github.com/fosrl/pangolin/pull/3078
Author: @dependabot[bot]
Created: 5/15/2026
Status: ❌ Closed

Base: main ← Head: dependabot/npm_and_yarn/dev-minor-updates-48f670c3a3

📝 Commits (1)

15d58ce Bump the dev-minor-updates group across 1 directory with 13 updates

📊 Changes

2 files changed (+425 additions, -415 deletions)

View changed files

📝 package-lock.json (+411 -401)
📝 package.json (+14 -14)

📄 Description

Bumps the dev-minor-updates group with 13 updates in the / directory:

Package	From	To
@dotenvx/dotenvx	`1.54.1`	`1.66.0`
@tailwindcss/postcss	`4.2.2`	`4.3.0`
@tanstack/react-query-devtools	`5.91.3`	`5.100.10`
@types/express-session	`1.18.2`	`1.19.0`
@types/node	`25.3.5`	`25.8.0`
@types/pg	`8.18.0`	`8.20.0`
esbuild	`0.27.4`	`0.28.0`
esbuild-node-externals	`1.20.1`	`1.22.0`
eslint	`10.0.3`	`10.4.0`
eslint-config-next	`16.1.7`	`16.2.6`
tailwindcss	`4.2.2`	`4.3.0`
tsx	`4.21.0`	`4.22.1`
typescript-eslint	`8.56.1`	`8.59.3`

Updates @dotenvx/dotenvx from 1.54.1 to 1.66.0

Release notes

Sourced from @dotenvx/dotenvx's releases.

v1.66.0

see CHANGELOG

v1.65.3

see CHANGELOG

v1.65.2

see CHANGELOG

v1.65.1

see CHANGELOG

v1.65.0

see CHANGELOG

v1.64.0

see CHANGELOG

v1.63.0

see CHANGELOG

v1.62.0

see CHANGELOG

v1.61.6

see CHANGELOG

v1.61.5

see CHANGELOG

v1.61.4

see CHANGELOG

v1.61.3

see CHANGELOG

v1.61.2

see CHANGELOG

v1.61.1

see CHANGELOG

v1.61.0

see CHANGELOG

v1.60.2

see CHANGELOG

v1.60.1

see CHANGELOG

... (truncated)

Changelog

Sourced from @dotenvx/dotenvx's changelog.

1.66.0 (2026-05-13)

Added

Add dotenvx doctor (#815)

1.65.3 (2026-05-13)

Changed

Improve spinner message blinking with simpler --no-spinner flag passed to ops (#814)

1.65.2 (2026-05-13)

Changed

Improve spinner message coordination between dotenvx and dotenvx-ops (#813)

1.65.1 (2026-05-13)

Changed

Prompts from ops should bubble up (#812)

1.65.0 (2026-05-05)

Added

Add support for replaceing duplicate keys with different values (#806)

1.64.0 (2026-04-27)

Added

Add optional dotenvx armor command.

armor up armor private key

armor down dearmor private key

armor push push armored key (from .env.keys)

armor pull pull armored key (into .env.keys)

Move private keys off device and under access control with Dotenvx Ops ⛨. Learn more

1.63.0 (2026-04-24)

Added

Add support for encrypted values passed to --env flag (#804)

Add support for --format=colon in order to support cloudflare's wrangler --var flag format (#804)

1.62.0 (2026-04-23)

... (truncated)

Commits

bbb7d9a 1.66.0
d36efc1 add dotenvx doctor command
9371b58 Merge pull request #815 from dotenvx/doctor
8b31be7 test coverage
2a8b1ee add doctor command to locate possible dotenv loaders that can be removed
0beec16 1.65.3
a653fca changelog
e30bc2f Merge pull request #814 from dotenvx/no-spinner
4fd21ba cleanup
140ade2 pass --no-spinner to ops
Additional commits viewable in compare view

Updates @tailwindcss/postcss from 4.2.2 to 4.3.0

Release notes

Sourced from @tailwindcss/postcss's releases.

v4.3.0

Added

Add @container-size utility (#18901)

Add scrollbar-{auto,thin,none} utilities for scrollbar-width, and scrollbar-thumb-* / scrollbar-track-* color utilities for scrollbar-color (#19981, #20019)

Add scrollbar-gutter-* utilities (#20018)

Add zoom-* utilities (#20020)

Add tab-* utilities (#20022)

Allow using @variant with stacked variants (e.g. @variant hover:focus { … }) (#19996)

Allow using @variant with compound variants (e.g. @variant hover, focus { … }) (#19996)

Support --default(…) in --value(…) and --modifier(…) for functional @utility definitions (#19989)

Fixed

Ensure @plugin resolves package JavaScript entries instead of browser CSS entries when using @tailwindcss/vite (#19949)

Fix relative @import and @plugin paths resolving from the wrong directory when using @tailwindcss/vite (#19965)

Ensure CSS files containing @variant are processed by @tailwindcss/vite (#19966)

Resolve imports relative to base when result.opts.from is not provided when using @tailwindcss/postcss (#19980)

Canonicalization: preserve significant _ whitespace in arbitrary values (#19986)

Canonicalization: add parentheses when removing whitespace from arbitrary values would hurt readability (e.g. w-[calc(100%---spacing(60))] → w-[calc(100%-(--spacing(60)))]) (#19986)

Canonicalization: preserve the original unit in arbitrary values instead of normalizing to base units (e.g. -mt-[20in] → mt-[-20in], not mt-[-1920px]) (#19988)

Canonicalization: migrate arbitrary :has() variants from [&:has(…)] to has-[…] (#19991)

Upgrade: don’t migrate inline style attributes (e.g. style="flex-grow: 1" → style="flex-grow: 1", not style="grow: 1") (#19918)

Allow multiple @utility definitions with the same name but different value types (#19777)

Export missing PluginWithConfig type from tailwindcss/plugin to fix errors when inferring plugin config types (#19707)

Ensure start and end legacy utilities without values do not generate CSS (#20003)

Ensure --value(…) is required in functional @utility definitions (#20005)

Canonicalization: preserve required whitespace around operators in negated arbitrary values (e.g. -left-[(var(--a)+var(--b))]) (#20011)

v4.2.4

Fixed

Ensure imports in @import and @plugin still resolve correctly when using Vite aliases in @tailwindcss/vite (#19947)

v4.2.3

Fixed

Canonicalization: improve canonicalizations for tracking-* utilities by preferring non-negative utilities (e.g. -tracking-tighter → tracking-wider) (#19827)

Fix crash due to invalid characters in candidate (exceeding valid unicode code point range) (#19829)

Ensure query params in imports are considered unique resources when using @tailwindcss/webpack (#19723)

Canonicalization: collapse arbitrary values into shorthand utilities (e.g. px-[1.2rem] py-[1.2rem] → p-[1.2rem]) (#19837)

Canonicalization: collapse border-{t,b}-* into border-y-*, border-{l,r}-* into border-x-*, and border-{t,r,b,l}-* into border-* (#19842)

Canonicalization: collapse scroll-m{t,b}-* into scroll-my-*, scroll-m{l,r}-* into scroll-mx-*, and scroll-m{t,r,b,l}-* into scroll-m-* (#19842)

Canonicalization: collapse scroll-p{t,b}-* into scroll-py-*, scroll-p{l,r}-* into scroll-px-*, and scroll-p{t,r,b,l}-* into scroll-p-* (#19842)

Canonicalization: collapse overflow-{x,y}-* into overflow-* (#19842)

Canonicalization: collapse overscroll-{x,y}-* into overscroll-* (#19842)

Read from --placeholder-color instead of --background-color for placeholder-* utilities (#19843)

Upgrade: ensure files are not emptied out when killing the upgrade process while it's running (#19846)

Upgrade: use config.content when migrating from Tailwind CSS v3 to Tailwind CSS v4 (#19846)

Upgrade: never migrate files that are ignored by git (#19846)

... (truncated)

Changelog

Sourced from @tailwindcss/postcss's changelog.

[4.3.0] - 2026-05-08

Added

Add @container-size utility (#18901)

Add scrollbar-{auto,thin,none} utilities for scrollbar-width, and scrollbar-thumb-* / scrollbar-track-* color utilities for scrollbar-color (#19981, #20019)

Add scrollbar-gutter-* utilities (#20018)

Add zoom-* utilities (#20020)

Add tab-* utilities (#20022)

Allow using @variant with stacked variants (e.g. @variant hover:focus { … }) (#19996)

Allow using @variant with compound variants (e.g. @variant hover, focus { … }) (#19996)

Support --default(…) in --value(…) and --modifier(…) for functional @utility definitions (#19989)

Fixed

Ensure @plugin resolves package JavaScript entries instead of browser CSS entries when using @tailwindcss/vite (#19949)

Fix relative @import and @plugin paths resolving from the wrong directory when using @tailwindcss/vite (#19965)

Ensure CSS files containing @variant are processed by @tailwindcss/vite (#19966)

Resolve imports relative to base when result.opts.from is not provided when using @tailwindcss/postcss (#19980)

Canonicalization: preserve significant _ whitespace in arbitrary values (#19986)

Canonicalization: add parentheses when removing whitespace from arbitrary values would hurt readability (e.g. w-[calc(100%---spacing(60))] → w-[calc(100%-(--spacing(60)))]) (#19986)

Canonicalization: preserve the original unit in arbitrary values instead of normalizing to base units (e.g. -mt-[20in] → mt-[-20in], not mt-[-1920px]) (#19988)

Canonicalization: migrate arbitrary :has() variants from [&:has(…)] to has-[…] (#19991)

Upgrade: don’t migrate inline style attributes (e.g. style="flex-grow: 1" → style="flex-grow: 1", not style="grow: 1") (#19918)

Allow multiple @utility definitions with the same name but different value types (#19777)

Export missing PluginWithConfig type from tailwindcss/plugin to fix errors when inferring plugin config types (#19707)

Ensure start and end legacy utilities without values do not generate CSS (#20003)

Ensure --value(…) is required in functional @utility definitions (#20005)

Canonicalization: preserve required whitespace around operators in negated arbitrary values (e.g. -left-[(var(--a)+var(--b))]) (#20011)

[4.2.4] - 2026-04-21

Fixed

Ensure imports in @import and @plugin still resolve correctly when using Vite aliases in @tailwindcss/vite (#19947)

[4.2.3] - 2026-04-20

Fixed

Canonicalization: improve canonicalization for tracking-* utilities by preferring non-negative utilities (e.g. -tracking-tighter → tracking-wider) (#19827)

Fix crash due to invalid characters in candidate (exceeding valid unicode code point range) (#19829)

Ensure query params in imports are considered unique resources when using @tailwindcss/webpack (#19723)

Canonicalization: collapse arbitrary values into shorthand utilities (e.g. px-[1.2rem] py-[1.2rem] → p-[1.2rem]) (#19837)

Canonicalization: collapse border-{t,b}-* into border-y-*, border-{l,r}-* into border-x-*, and border-{t,r,b,l}-* into border-* (#19842)

Canonicalization: collapse scroll-m{t,b}-* into scroll-my-*, scroll-m{l,r}-* into scroll-mx-*, and scroll-m{t,r,b,l}-* into scroll-m-* (#19842)

Canonicalization: collapse scroll-p{t,b}-* into scroll-py-*, scroll-p{l,r}-* into scroll-px-*, and scroll-p{t,r,b,l}-* into scroll-p-* (#19842)

Canonicalization: collapse overflow-{x,y}-* into overflow-* (#19842)

Canonicalization: collapse overscroll-{x,y}-* into overscroll-* (#19842)

Read from --placeholder-color instead of --background-color for placeholder-* utilities (#19843)

... (truncated)

Commits

588bd73 4.3.0 (#20023)
12eb5ae Cleanup noisy test output (#20015)
4255671 Improve snapshot tests (#20013)
52f94c7 Improve codebase quality (#19999)
d194d4c docs: fix various typos in comments and documentation (#19878)
bfb5732 Fall back to the plugin base when PostCSS has no from option (#19980)
3a890c3 Bump dependencies (#19957)
69ad7cc 4.2.4 (#19948)
685c19e Fix issue around resolving paths in @tailwindcss/vite (#19947)
2e3fa49 4.2.3 (#19944)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @tailwindcss/postcss since your current version.

Updates @tanstack/react-query-devtools from 5.91.3 to 5.100.10

Release notes

Sourced from @tanstack/react-query-devtools's releases.

@tanstack/react-query-devtools@5.100.9

Patch Changes

Updated dependencies [3d21cac]:

@tanstack/query-devtools@5.100.9

@tanstack/react-query@5.100.9

@tanstack/react-query-devtools@5.100.8

Patch Changes

Updated dependencies []:

@tanstack/query-devtools@5.100.8

@tanstack/react-query@5.100.8

@tanstack/react-query-devtools@5.100.7

Patch Changes

docs(devtools): align logo, panel, and 'buttonPosition' union descriptions across docs and JSDoc (#10617)

Updated dependencies []:

@tanstack/query-devtools@5.100.7

@tanstack/react-query@5.100.7

@tanstack/react-query-devtools@5.100.6

Patch Changes

Updated dependencies []:

@tanstack/query-devtools@5.100.6

@tanstack/react-query@5.100.6

Changelog

Sourced from @tanstack/react-query-devtools's changelog.

5.100.10

Patch Changes

Updated dependencies [4d130b9]:

@tanstack/query-devtools@5.100.10

@tanstack/react-query@5.100.10

5.100.9

Patch Changes

Updated dependencies [3d21cac]:

@tanstack/query-devtools@5.100.9

@tanstack/react-query@5.100.9

5.100.8

Patch Changes

Updated dependencies []:

@tanstack/query-devtools@5.100.8

@tanstack/react-query@5.100.8

5.100.7

Patch Changes

docs(devtools): align logo, panel, and 'buttonPosition' union descriptions across docs and JSDoc (#10617)

Updated dependencies []:

@tanstack/query-devtools@5.100.7

@tanstack/react-query@5.100.7

5.100.6

Patch Changes

Updated dependencies []:

@tanstack/query-devtools@5.100.6

@tanstack/react-query@5.100.6

5.100.5

Patch Changes

Updated dependencies []:

@tanstack/query-devtools@5.100.5

@tanstack/react-query@5.100.5

... (truncated)

Commits

See full diff in compare view

Updates @types/express-session from 1.18.2 to 1.19.0

Commits

See full diff in compare view

Updates @types/node from 25.3.5 to 25.8.0

Commits

See full diff in compare view

Updates @types/pg from 8.18.0 to 8.20.0

Commits

See full diff in compare view

Updates esbuild from 0.27.4 to 0.28.0

Release notes

Sourced from esbuild's releases.

v0.28.0
Add support for with { type: 'text' } imports (#4435)

The import text proposal has reached stage 3 in the TC39 process, which means that it's recommended for implementation. It has also already been implemented by Deno and Bun. So with this release, esbuild also adds support for it. This behaves exactly the same as esbuild's existing text loader. Here's an example:
import string from './example.txt' with { type: 'text' }
console.log(string)
Add integrity checks to fallback download path (#4343)

Installing esbuild via npm is somewhat complicated with several different edge cases (see esbuild's documentation for details). If the regular installation of esbuild's platform-specific package fails, esbuild's install script attempts to download the platform-specific package itself (first with the npm command, and then with a HTTP request to registry.npmjs.org as a last resort).

This last resort path previously didn't have any integrity checks. With this release, esbuild will now verify that the hash of the downloaded binary matches the expected hash for the current release. This means the hashes for all of esbuild's platform-specific binary packages will now be embedded in the top-level esbuild package. Hopefully this should work without any problems. But just in case, this change is being done as a breaking change release.

Update the Go compiler from 1.25.7 to 1.26.1

This upgrade should not affect anything. However, there have been some significant internal changes to the Go compiler, so esbuild could potentially behave differently in certain edge cases:

It now uses the new garbage collector that comes with Go 1.26.

The Go compiler is now more aggressive with allocating memory on the stack.

The executable format that the Go linker uses has undergone several changes.

The WebAssembly build now unconditionally makes use of the sign extension and non-trapping floating-point to integer conversion instructions.

You can read the Go 1.26 release notes for more information.
v0.27.7
Fix lowering of define semantics for TypeScript parameter properties (#4421)

The previous release incorrectly generated class fields for TypeScript parameter properties even when the configured target environment does not support class fields. With this release, the generated class fields will now be correctly lowered in this case:
// Original code
class Foo {
  constructor(public x = 1) {}
  y = 2
}
// Old output (with --loader=ts --target=es2021)

class Foo {

constructor(x = 1) {

this.x = x;

__publicField(this, "y", 2);

}

x;

}
// New output (with --loader=ts --target=es2021)

class Foo {

... (truncated)

Changelog

Sourced from esbuild's changelog.

0.28.0
Add support for with { type: 'text' } imports (#4435)

The import text proposal has reached stage 3 in the TC39 process, which means that it's recommended for implementation. It has also already been implemented by Deno and Bun. So with this release, esbuild also adds support for it. This behaves exactly the same as esbuild's existing text loader. Here's an example:
import string from './example.txt' with { type: 'text' }
console.log(string)
Add integrity checks to fallback download path (#4343)

Installing esbuild via npm is somewhat complicated with several different edge cases (see esbuild's documentation for details). If the regular installation of esbuild's platform-specific package fails, esbuild's install script attempts to download the platform-specific package itself (first with the npm command, and then with a HTTP request to registry.npmjs.org as a last resort).

This last resort path previously didn't have any integrity checks. With this release, esbuild will now verify that the hash of the downloaded binary matches the expected hash for the current release. This means the hashes for all of esbuild's platform-specific binary packages will now be embedded in the top-level esbuild package. Hopefully this should work without any problems. But just in case, this change is being done as a breaking change release.

Update the Go compiler from 1.25.7 to 1.26.1

This upgrade should not affect anything. However, there have been some significant internal changes to the Go compiler, so esbuild could potentially behave differently in certain edge cases:

It now uses the new garbage collector that comes with Go 1.26.

The Go compiler is now more aggressive with allocating memory on the stack.

The executable format that the Go linker uses has undergone several changes.

The WebAssembly build now unconditionally makes use of the sign extension and non-trapping floating-point to integer conversion instructions.

You can read the Go 1.26 release notes for more information.
0.27.7
Fix lowering of define semantics for TypeScript parameter properties (#4421)

The previous release incorrectly generated class fields for TypeScript parameter properties even when the configured target environment does not support class fields. With this release, the generated class fields will now be correctly lowered in this case:
// Original code
class Foo {
  constructor(public x = 1) {}
  y = 2
}
// Old output (with --loader=ts --target=es2021)

class Foo {

constructor(x = 1) {

this.x = x;

__publicField(this, "y", 2);

}

x;

}

... (truncated)

Commits

6a794df publish 0.28.0 to npm
64ee0ea fix #4435: support with { type: text } imports
ef65aee fix sort order in snapshots_packagejson.txt
1a26a8e try to fix test-old-ts, also shuffle CI tasks
556ce6c use '' instead of null to omit build hashes
8e675a8 ci: allow missing binary hashes for tests
7067763 Reapply "update go 1.25.7 => 1.26.1"
39473a9 fix #4343: integrity check for binary download
2025c9f publish 0.27.7 to npm
c6b586e fix typo in Makefile for @esbuild/win32-x64
Additional commits viewable in compare view

Updates esbuild-node-externals from 1.20.1 to 1.22.0

Release notes

Sourced from esbuild-node-externals's releases.

esbuild-node-externals: v1.22.0

1.22.0 (2026-04-08)

Features

replace find-up with empathic to have smaller installation (#86) (87229fc)

esbuild-node-externals: v1.21.0

1.21.0 (2026-04-03)

Features

add esbuild 0.28 to the allowed range (#84) (e66160f)

Commits

bbaed41 chore(main): release esbuild-node-externals 1.22.0 (#87)
87229fc feat: replace find-up with empathic to have smaller installation (#86)
1b60aa3 chore(main): release esbuild-node-externals 1.21.0 (#85)
e66160f feat: add esbuild 0.28 to the allowed range (#84)
See full diff in compare view

Updates eslint from 10.0.3 to 10.4.0

Release notes

Sourced from eslint's releases.

v10.4.0

Features

1a45ec5 feat: check sequence expressions in for-direction (#20701) (kuldeep kumar)

450040b feat: add includeIgnoreFile() to eslint/config (#20735) (Kirk Waiblinger)

Bug Fixes

544c0c3 fix: escape code path DOT labels in debug output (#20866) (Pixel998)

6799431 fix: update dependency @eslint/config-helpers to ^0.6.0 (#20850) (renovate[bot])

f078fef fix: handle non-array deprecated rule replacements (#20825) (xbinaryx)

Documentation

7e52a71 docs: add mention of @eslint-react/eslint-plugin (#20869) (Pavel)

db3468b docs: tweak wording around ambiguous CJS-vs-ESM config (#20865) (Kirk Waiblinger)

9084664 docs: Update README (GitHub Actions Bot)

9cc7387 docs: Update README (GitHub Actions Bot)

3d7b548 docs: Update README (GitHub Actions Bot)

191ec3c docs: Update README (GitHub Actions Bot)

Chores

6616856 chore: upgrade knip to v6 (#20875) (Pixel998)

d13b084 ci: ensure auto-created PRs run CI (#20860) (lumir)

e71c7af ci: bump pnpm/action-setup from 6.0.5 to 6.0.7 (#20862) (dependabot[bot])

d84393d test: add unit tests for SuppressionsService.applySuppressions() (#20863) (kuldeep kumar)

24db8cb test: add tests for SuppressionsService.save() (#20802) (kuldeep kumar)

2ef0549 chore: update ecosystem plugins (#20857) (github-actions[bot])

a429791 ci: remove eslint-webpack-plugin types integration test (#20668) (Milos Djermanovic)

9e37386 chore: replace recast with range approach in code-sample-minimizer (#20682) (Copilot)

0dd1f9f test: disable warning for vm.constants.USE_MAIN_CONTEXT_DEFAULT_LOADER (#20845) (Francesco Trotta)

9da3c7b refactor: remove deprecated meta.language and migrate meta.dialects (#20716) (Pixel998)

2099ed1 refactor: add meta.defaultOptions to more rules, enable linting (#20800) (xbinaryx)

f1dfbc9 chore: update ecosystem plugins (#20836) (github-actions[bot])

c759413 ci: bump pnpm/action-setup from 6.0.3 to 6.0.5 (#20843) (dependabot[bot])

5b817d6 test: add unit tests for lib/shared/ast-utils (#20838) (kuldeep kumar)

1c13ae3 test: add unit tests for lib/shared/severity (#20835) (kuldeep kumar)

v10.3.0

Features

379571a feat: add suggestions for no-unused-private-class-members (#20773) (sethamus)

Bug Fixes

b6ae5cf fix: handle unavailable require cache (#20812) (Simon Podlipsky)

6fb3685 fix: rule suggestions cause continuation in class body (#20787) (Milos Djermanovic)

Documentation

32cc7ab docs: fix typos in docs and comments (#20809) (Tanuj Kanti)

7f47937 docs: Update README (GitHub Actions Bot)

Chores

d32235e ci: use pnpm in eslint-flat-config-utils type integration test (#20826) (Francesco Trotta)

3ffb14e chore: clean up typos in comments and JSDoc (#20821) (Pixel998)

... (truncated)

Commits

452c401 10.4.0
b6417e8 Build: changelog update for 10.4.0
6616856 chore: upgrade knip to v6 (#20875)
d13b084 ci: ensure auto-created PRs run CI (#20860)
7e52a71 docs: add mention of @eslint-react/eslint-plugin (#20869)
e71c7af ci: bump pnpm/action-setup from 6.0.5 to 6.0.7 (#20862)
544c0c3 fix: escape code path DOT labels in debug output (#20866)
db3468b docs: tweak wording around ambiguous CJS-vs-ESM config (#20865)
d84393d test: add unit tests for SuppressionsService.applySuppressions() (#20863)
9084664 docs: Update README
Additional commits viewable in compare view

Updates eslint-config-next from 16.1.7 to 16.2.6

Release notes

Sourced from eslint-config-next's releases.

v16.2.6

[!NOTE] This release contains security fixes and backported bug fixes. It does not include all pending features/changes on canary.

Security Fixes

The following advisories have been addressed:

High:

GHSA-8h8q-6873-q5fj: Denial of Service with Server Components

GHSA-267c-6grr-h53f: Middleware / Proxy bypass in App Router applications via segment-prefetch routes

GHSA-26hh-7cqf-hhc6: Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up

GHSA-mg66-mrh9-m8jx: Denial of Service via connection exhaustion in applications using Cache Components

GHSA-492v-c6pp-mqqv: Middleware / Proxy bypass through dynamic route parameter injection

GHSA-c4j6-fc7j-m34r: Server-side request forgery in applications using WebSocket upgrades

GHSA-36qx-fr4f-26g5: Middleware / Proxy bypass in Pages Router applications using i18n

Moderate:

GHSA-ffhc-5mcf-pf4q: Cross-site scripting in App Router applications using CSP nonces

GHSA-gx5p-jg67-6x7h: Cross-site scripting in beforeInteractive scripts with untrusted input

GHSA-h64f-5h5j-jqjh: Denial of Service in the Image Optimization API

GHSA-wfc6-r584-vfw7: Cache poisoning in React Server Component responses

Low:

GHSA-vfv6-92ff-j949: Cache poisoning via collisions in React Server Component cache-busting

GHSA-3g8h-86w9-wvmq: Middleware / Proxy redirects can be cache-poisoned

Core Changes

fix: preserve HTTP access fallbacks during prerender recovery (#92231)

Fix fallback route params case in app-page handler (#91737)

Fix invalid HTML response for route-level RSC requests in deployment adapter (#91541)

Patch setHeader for direct route handlers (#93101)

Include deployment id in cacheHandlers keys (#93453)

Fix double-encoding of URL pathname parts in client param parsing (#93491)

v16.2.5

[!NOTE] This release contains security fixes and backported bug fixes. It does not include all pending features/changes on canary.

Security Fixes

The following advisories have been addressed:

High:

GHSA-8h8q-6873-q5fj: Denial of Service with Server Components

GHSA-267c-6grr-h53f: Middleware / Proxy bypass in App Router applications via segment-prefetch routes

GHSA-mg66-mrh9-m8jx: Denial of Service via connection exhaustion in applications using Cache Components

GHSA-492v-c6pp-mqqv: Middleware / Proxy bypass through dynamic route parameter injection

GHSA-c4j6-fc7j-m34r: Server-side request forgery in applications using WebSocket upgrades

... (truncated)

Commits

ee6e79b v16.2.6
766148f v16.2.5
2275bd8 v16.2.4
d5f649b v16.2.3
52faae3 v16.2.2
ed7d2ce v16.2.1
c5c94df v16.2.0
3683192 v16.2.0-canary.104
6689814 v16.2.0-canary.103
ad66dbc v16.2.0-canary.102
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for eslint-config-next since your current version.

Updates tailwindcss from 4.2.2 to 4.3.0

Release notes

Sourced from tailwindcss's releases.

v4.3.0

Added

Add @container-size utility (#18901)

Add scrollbar-{auto,thin,none} utilities for scrollbar-width, and scrollbar-thumb-* / scrollbar-track-* color utiliti...
Description has been truncated

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/fosrl/pangolin/pull/3078 **Author:** [@dependabot[bot]](https://github.com/apps/dependabot) **Created:** 5/15/2026 **Status:** ❌ Closed **Base:** `main` ← **Head:** `dependabot/npm_and_yarn/dev-minor-updates-48f670c3a3` --- ### 📝 Commits (1) - [`15d58ce`](https://github.com/fosrl/pangolin/commit/15d58ce845bc407587a663faed9f3240003b04c4) Bump the dev-minor-updates group across 1 directory with 13 updates ### 📊 Changes **2 files changed** (+425 additions, -415 deletions) <details> <summary>View changed files</summary> 📝 `package-lock.json` (+411 -401) 📝 `package.json` (+14 -14) </details> ### 📄 Description Bumps the dev-minor-updates group with 13 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@dotenvx/dotenvx](https://github.com/dotenvx/dotenvx) | `1.54.1` | `1.66.0` | | [@tailwindcss/postcss](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-postcss) | `4.2.2` | `4.3.0` | | [@tanstack/react-query-devtools](https://github.com/TanStack/query/tree/HEAD/packages/react-query-devtools) | `5.91.3` | `5.100.10` | | [@types/express-session](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/express-session) | `1.18.2` | `1.19.0` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `25.3.5` | `25.8.0` | | [@types/pg](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/pg) | `8.18.0` | `8.20.0` | | [esbuild](https://github.com/evanw/esbuild) | `0.27.4` | `0.28.0` | | [esbuild-node-externals](https://github.com/pradel/esbuild-node-externals) | `1.20.1` | `1.22.0` | | [eslint](https://github.com/eslint/eslint) | `10.0.3` | `10.4.0` | | [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next) | `16.1.7` | `16.2.6` | | [tailwindcss](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss) | `4.2.2` | `4.3.0` | | [tsx](https://github.com/privatenumber/tsx) | `4.21.0` | `4.22.1` | | [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.56.1` | `8.59.3` | Updates `@dotenvx/dotenvx` from 1.54.1 to 1.66.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/dotenvx/dotenvx/releases">@dotenvx/dotenvx's releases</a>.</em></p> <blockquote> <h2>v1.66.0</h2> <p>see <a href="https://github.com/dotenvx/dotenvx/blob/main/CHANGELOG.md">CHANGELOG</a></p> <h2>v1.65.3</h2> <p>see <a href="https://github.com/dotenvx/dotenvx/blob/main/CHANGELOG.md">CHANGELOG</a></p> <h2>v1.65.2</h2> <p>see <a href="https://github.com/dotenvx/dotenvx/blob/main/CHANGELOG.md">CHANGELOG</a></p> <h2>v1.65.1</h2> <p>see <a href="https://github.com/dotenvx/dotenvx/blob/main/CHANGELOG.md">CHANGELOG</a></p> <h2>v1.65.0</h2> <p>see <a href="https://github.com/dotenvx/dotenvx/blob/main/CHANGELOG.md">CHANGELOG</a></p> <h2>v1.64.0</h2> <p>see <a href="https://github.com/dotenvx/dotenvx/blob/main/CHANGELOG.md">CHANGELOG</a></p> <h2>v1.63.0</h2> <p>see <a href="https://github.com/dotenvx/dotenvx/blob/main/CHANGELOG.md">CHANGELOG</a></p> <h2>v1.62.0</h2> <p>see <a href="https://github.com/dotenvx/dotenvx/blob/main/CHANGELOG.md">CHANGELOG</a></p> <h2>v1.61.6</h2> <p>see <a href="https://github.com/dotenvx/dotenvx/blob/main/CHANGELOG.md">CHANGELOG</a></p> <h2>v1.61.5</h2> <p>see <a href="https://github.com/dotenvx/dotenvx/blob/main/CHANGELOG.md">CHANGELOG</a></p> <h2>v1.61.4</h2> <p>see <a href="https://github.com/dotenvx/dotenvx/blob/main/CHANGELOG.md">CHANGELOG</a></p> <h2>v1.61.3</h2> <p>see <a href="https://github.com/dotenvx/dotenvx/blob/main/CHANGELOG.md">CHANGELOG</a></p> <h2>v1.61.2</h2> <p>see <a href="https://github.com/dotenvx/dotenvx/blob/main/CHANGELOG.md">CHANGELOG</a></p> <h2>v1.61.1</h2> <p>see <a href="https://github.com/dotenvx/dotenvx/blob/main/CHANGELOG.md">CHANGELOG</a></p> <h2>v1.61.0</h2> <p>see <a href="https://github.com/dotenvx/dotenvx/blob/main/CHANGELOG.md">CHANGELOG</a></p> <h2>v1.60.2</h2> <p>see <a href="https://github.com/dotenvx/dotenvx/blob/main/CHANGELOG.md">CHANGELOG</a></p> <h2>v1.60.1</h2> <p>see <a href="https://github.com/dotenvx/dotenvx/blob/main/CHANGELOG.md">CHANGELOG</a></p>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/dotenvx/dotenvx/blob/main/CHANGELOG.md">@dotenvx/dotenvx's changelog</a>.</em></p> <blockquote> <h2><a href="https://github.com/dotenvx/dotenvx/compare/v1.65.3...v1.66.0">1.66.0</a> (2026-05-13)</h2> <h3>Added</h3> <ul> <li>Add <code>dotenvx doctor</code> (<a href="https://redirect.github.com/dotenvx/dotenvx/pull/815">#815</a>)</li> </ul> <h2><a href="https://github.com/dotenvx/dotenvx/compare/v1.65.2...v1.65.3">1.65.3</a> (2026-05-13)</h2> <h3>Changed</h3> <ul> <li>Improve spinner message blinking with simpler <code>--no-spinner</code> flag passed to ops (<a href="https://redirect.github.com/dotenvx/dotenvx/pull/814">#814</a>)</li> </ul> <h2><a href="https://github.com/dotenvx/dotenvx/compare/v1.65.1...v1.65.2">1.65.2</a> (2026-05-13)</h2> <h3>Changed</h3> <ul> <li>Improve spinner message coordination between <code>dotenvx</code> and <code>dotenvx-ops</code> (<a href="https://redirect.github.com/dotenvx/dotenvx/pull/813">#813</a>)</li> </ul> <h2><a href="https://github.com/dotenvx/dotenvx/compare/v1.65.0...v1.65.1">1.65.1</a> (2026-05-13)</h2> <h3>Changed</h3> <ul> <li>Prompts from <code>ops</code> should bubble up (<a href="https://redirect.github.com/dotenvx/dotenvx/pull/812">#812</a>)</li> </ul> <h2><a href="https://github.com/dotenvx/dotenvx/compare/v1.64.0...v1.65.0">1.65.0</a> (2026-05-05)</h2> <h3>Added</h3> <ul> <li>Add support for <code>replace</code>ing duplicate keys with different values (<a href="https://redirect.github.com/dotenvx/dotenvx/pull/806">#806</a>)</li> </ul> <h2><a href="https://github.com/dotenvx/dotenvx/compare/v1.63.0...v1.64.0">1.64.0</a> (2026-04-27)</h2> <h3>Added</h3> <ul> <li>Add optional <code>dotenvx armor</code> command. <ul> <li><code>armor up</code> armor private key</li> <li><code>armor down</code> dearmor private key</li> <li><code>armor push</code> push armored key (from .env.keys)</li> <li><code>armor pull</code> pull armored key (into .env.keys)</li> </ul> </li> </ul> <p>Move private keys off device and under access control with Dotenvx Ops ⛨. <a href="https://dotenvx.com/ops">Learn more</a></p> <h2><a href="https://github.com/dotenvx/dotenvx/compare/v1.62.0...v1.63.0">1.63.0</a> (2026-04-24)</h2> <h3>Added</h3> <ul> <li>Add support for encrypted values passed to <code>--env</code> flag (<a href="https://redirect.github.com/dotenvx/dotenvx/pull/804">#804</a>)</li> <li>Add support for <code>--format=colon</code> in order to support cloudflare's wrangler <code>--var</code> flag format (<a href="https://redirect.github.com/dotenvx/dotenvx/pull/804">#804</a>)</li> </ul> <h2><a href="https://github.com/dotenvx/dotenvx/compare/v1.61.6...v1.62.0">1.62.0</a> (2026-04-23)</h2>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/dotenvx/dotenvx/commit/bbb7d9a12ca0e4cfd9148aac500434b503f5203c"><code>bbb7d9a</code></a> 1.66.0</li> <li><a href="https://github.com/dotenvx/dotenvx/commit/d36efc177615190db0e236af314f94bb686256c1"><code>d36efc1</code></a> add dotenvx doctor command</li> <li><a href="https://github.com/dotenvx/dotenvx/commit/9371b58f2be817bf797dffad5bf5a0620001acc5"><code>9371b58</code></a> Merge pull request <a href="https://redirect.github.com/dotenvx/dotenvx/issues/815">#815</a> from dotenvx/doctor</li> <li><a href="https://github.com/dotenvx/dotenvx/commit/8b31be7aa28e6da67c1cacd3d279412808de191c"><code>8b31be7</code></a> test coverage</li> <li><a href="https://github.com/dotenvx/dotenvx/commit/2a8b1ee59b1ba64bea1a9d23c6f62321629f8ed5"><code>2a8b1ee</code></a> add <code>doctor</code> command to locate possible dotenv loaders that can be removed</li> <li><a href="https://github.com/dotenvx/dotenvx/commit/0beec169c22f4805d7d4bd098017a475528a6da8"><code>0beec16</code></a> 1.65.3</li> <li><a href="https://github.com/dotenvx/dotenvx/commit/a653fca3d49a8b5acf089dc971838e478ad9203e"><code>a653fca</code></a> changelog</li> <li><a href="https://github.com/dotenvx/dotenvx/commit/e30bc2f3ec9847c330cc8bae904b8689a9ffd8f9"><code>e30bc2f</code></a> Merge pull request <a href="https://redirect.github.com/dotenvx/dotenvx/issues/814">#814</a> from dotenvx/no-spinner</li> <li><a href="https://github.com/dotenvx/dotenvx/commit/4fd21bafb99cabd518e8358bbdf52717cd6f1340"><code>4fd21ba</code></a> cleanup</li> <li><a href="https://github.com/dotenvx/dotenvx/commit/140ade26b52e10391bb848cfe9947fcc7afc7c02"><code>140ade2</code></a> pass <code>--no-spinner</code> to ops</li> <li>Additional commits viewable in <a href="https://github.com/dotenvx/dotenvx/compare/v1.54.1...v1.66.0">compare view</a></li> </ul> </details> <br /> Updates `@tailwindcss/postcss` from 4.2.2 to 4.3.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/tailwindlabs/tailwindcss/releases">@tailwindcss/postcss's releases</a>.</em></p> <blockquote> <h2>v4.3.0</h2> <h3>Added</h3> <ul> <li>Add <code>@container-size</code> utility (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/18901">#18901</a>)</li> <li>Add <code>scrollbar-{auto,thin,none}</code> utilities for <code>scrollbar-width</code>, and <code>scrollbar-thumb-*</code> / <code>scrollbar-track-*</code> color utilities for <code>scrollbar-color</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19981">#19981</a>, <a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20019">#20019</a>)</li> <li>Add <code>scrollbar-gutter-*</code> utilities (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20018">#20018</a>)</li> <li>Add <code>zoom-*</code> utilities (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20020">#20020</a>)</li> <li>Add <code>tab-*</code> utilities (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20022">#20022</a>)</li> <li>Allow using <code>@variant</code> with stacked variants (e.g. <code>@variant hover:focus { … }</code>) (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19996">#19996</a>)</li> <li>Allow using <code>@variant</code> with compound variants (e.g. <code>@variant hover, focus { … }</code>) (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19996">#19996</a>)</li> <li>Support <code>--default(…)</code> in <code>--value(…)</code> and <code>--modifier(…)</code> for functional <code>@utility</code> definitions (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19989">#19989</a>)</li> </ul> <h3>Fixed</h3> <ul> <li>Ensure <code>@plugin</code> resolves package JavaScript entries instead of browser CSS entries when using <code>@tailwindcss/vite</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19949">#19949</a>)</li> <li>Fix relative <code>@import</code> and <code>@plugin</code> paths resolving from the wrong directory when using <code>@tailwindcss/vite</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19965">#19965</a>)</li> <li>Ensure CSS files containing <code>@variant</code> are processed by <code>@tailwindcss/vite</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19966">#19966</a>)</li> <li>Resolve imports relative to <code>base</code> when <code>result.opts.from</code> is not provided when using <code>@tailwindcss/postcss</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19980">#19980</a>)</li> <li>Canonicalization: preserve significant <code>_</code> whitespace in arbitrary values (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19986">#19986</a>)</li> <li>Canonicalization: add parentheses when removing whitespace from arbitrary values would hurt readability (e.g. <code>w-[calc(100%---spacing(60))]</code> → <code>w-[calc(100%-(--spacing(60)))]</code>) (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19986">#19986</a>)</li> <li>Canonicalization: preserve the original unit in arbitrary values instead of normalizing to base units (e.g. <code>-mt-[20in]</code> → <code>mt-[-20in]</code>, not <code>mt-[-1920px]</code>) (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19988">#19988</a>)</li> <li>Canonicalization: migrate arbitrary <code>:has()</code> variants from <code>[&:has(…)]</code> to <code>has-[…]</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19991">#19991</a>)</li> <li>Upgrade: don’t migrate inline <code>style</code> attributes (e.g. <code>style="flex-grow: 1"</code> → <code>style="flex-grow: 1"</code>, not <code>style="grow: 1"</code>) (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19918">#19918</a>)</li> <li>Allow multiple <code>@utility</code> definitions with the same name but different value types (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19777">#19777</a>)</li> <li>Export missing <code>PluginWithConfig</code> type from <code>tailwindcss/plugin</code> to fix errors when inferring plugin config types (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19707">#19707</a>)</li> <li>Ensure <code>start</code> and <code>end</code> legacy utilities without values do not generate CSS (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20003">#20003</a>)</li> <li>Ensure <code>--value(…)</code> is required in functional <code>@utility</code> definitions (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20005">#20005</a>)</li> <li>Canonicalization: preserve required whitespace around operators in negated arbitrary values (e.g. <code>-left-[(var(--a)+var(--b))]</code>) (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20011">#20011</a>)</li> </ul> <h2>v4.2.4</h2> <h3>Fixed</h3> <ul> <li>Ensure imports in <code>@import</code> and <code>@plugin</code> still resolve correctly when using Vite aliases in <code>@tailwindcss/vite</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19947">#19947</a>)</li> </ul> <h2>v4.2.3</h2> <h3>Fixed</h3> <ul> <li>Canonicalization: improve canonicalizations for <code>tracking-*</code> utilities by preferring non-negative utilities (e.g. <code>-tracking-tighter</code> → <code>tracking-wider</code>) (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19827">#19827</a>)</li> <li>Fix crash due to invalid characters in candidate (exceeding valid unicode code point range) (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19829">#19829</a>)</li> <li>Ensure query params in imports are considered unique resources when using <code>@tailwindcss/webpack</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19723">#19723</a>)</li> <li>Canonicalization: collapse arbitrary values into shorthand utilities (e.g. <code>px-[1.2rem] py-[1.2rem]</code> → <code>p-[1.2rem]</code>) (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19837">#19837</a>)</li> <li>Canonicalization: collapse <code>border-{t,b}-*</code> into <code>border-y-*</code>, <code>border-{l,r}-*</code> into <code>border-x-*</code>, and <code>border-{t,r,b,l}-*</code> into <code>border-*</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19842">#19842</a>)</li> <li>Canonicalization: collapse <code>scroll-m{t,b}-*</code> into <code>scroll-my-*</code>, <code>scroll-m{l,r}-*</code> into <code>scroll-mx-*</code>, and <code>scroll-m{t,r,b,l}-*</code> into <code>scroll-m-*</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19842">#19842</a>)</li> <li>Canonicalization: collapse <code>scroll-p{t,b}-*</code> into <code>scroll-py-*</code>, <code>scroll-p{l,r}-*</code> into <code>scroll-px-*</code>, and <code>scroll-p{t,r,b,l}-*</code> into <code>scroll-p-*</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19842">#19842</a>)</li> <li>Canonicalization: collapse <code>overflow-{x,y}-*</code> into <code>overflow-*</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19842">#19842</a>)</li> <li>Canonicalization: collapse <code>overscroll-{x,y}-*</code> into <code>overscroll-*</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19842">#19842</a>)</li> <li>Read from <code>--placeholder-color</code> instead of <code>--background-color</code> for <code>placeholder-*</code> utilities (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19843">#19843</a>)</li> <li>Upgrade: ensure files are not emptied out when killing the upgrade process while it's running (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19846">#19846</a>)</li> <li>Upgrade: use <code>config.content</code> when migrating from Tailwind CSS v3 to Tailwind CSS v4 (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19846">#19846</a>)</li> <li>Upgrade: never migrate files that are ignored by git (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19846">#19846</a>)</li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md">@tailwindcss/postcss's changelog</a>.</em></p> <blockquote> <h2>[4.3.0] - 2026-05-08</h2> <h3>Added</h3> <ul> <li>Add <code>@container-size</code> utility (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/18901">#18901</a>)</li> <li>Add <code>scrollbar-{auto,thin,none}</code> utilities for <code>scrollbar-width</code>, and <code>scrollbar-thumb-*</code> / <code>scrollbar-track-*</code> color utilities for <code>scrollbar-color</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19981">#19981</a>, <a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20019">#20019</a>)</li> <li>Add <code>scrollbar-gutter-*</code> utilities (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20018">#20018</a>)</li> <li>Add <code>zoom-*</code> utilities (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20020">#20020</a>)</li> <li>Add <code>tab-*</code> utilities (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20022">#20022</a>)</li> <li>Allow using <code>@variant</code> with stacked variants (e.g. <code>@variant hover:focus { … }</code>) (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19996">#19996</a>)</li> <li>Allow using <code>@variant</code> with compound variants (e.g. <code>@variant hover, focus { … }</code>) (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19996">#19996</a>)</li> <li>Support <code>--default(…)</code> in <code>--value(…)</code> and <code>--modifier(…)</code> for functional <code>@utility</code> definitions (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19989">#19989</a>)</li> </ul> <h3>Fixed</h3> <ul> <li>Ensure <code>@plugin</code> resolves package JavaScript entries instead of browser CSS entries when using <code>@tailwindcss/vite</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19949">#19949</a>)</li> <li>Fix relative <code>@import</code> and <code>@plugin</code> paths resolving from the wrong directory when using <code>@tailwindcss/vite</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19965">#19965</a>)</li> <li>Ensure CSS files containing <code>@variant</code> are processed by <code>@tailwindcss/vite</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19966">#19966</a>)</li> <li>Resolve imports relative to <code>base</code> when <code>result.opts.from</code> is not provided when using <code>@tailwindcss/postcss</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19980">#19980</a>)</li> <li>Canonicalization: preserve significant <code>_</code> whitespace in arbitrary values (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19986">#19986</a>)</li> <li>Canonicalization: add parentheses when removing whitespace from arbitrary values would hurt readability (e.g. <code>w-[calc(100%---spacing(60))]</code> → <code>w-[calc(100%-(--spacing(60)))]</code>) (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19986">#19986</a>)</li> <li>Canonicalization: preserve the original unit in arbitrary values instead of normalizing to base units (e.g. <code>-mt-[20in]</code> → <code>mt-[-20in]</code>, not <code>mt-[-1920px]</code>) (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19988">#19988</a>)</li> <li>Canonicalization: migrate arbitrary <code>:has()</code> variants from <code>[&:has(…)]</code> to <code>has-[…]</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19991">#19991</a>)</li> <li>Upgrade: don’t migrate inline <code>style</code> attributes (e.g. <code>style="flex-grow: 1"</code> → <code>style="flex-grow: 1"</code>, not <code>style="grow: 1"</code>) (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19918">#19918</a>)</li> <li>Allow multiple <code>@utility</code> definitions with the same name but different value types (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19777">#19777</a>)</li> <li>Export missing <code>PluginWithConfig</code> type from <code>tailwindcss/plugin</code> to fix errors when inferring plugin config types (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19707">#19707</a>)</li> <li>Ensure <code>start</code> and <code>end</code> legacy utilities without values do not generate CSS (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20003">#20003</a>)</li> <li>Ensure <code>--value(…)</code> is required in functional <code>@utility</code> definitions (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20005">#20005</a>)</li> <li>Canonicalization: preserve required whitespace around operators in negated arbitrary values (e.g. <code>-left-[(var(--a)+var(--b))]</code>) (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20011">#20011</a>)</li> </ul> <h2>[4.2.4] - 2026-04-21</h2> <h3>Fixed</h3> <ul> <li>Ensure imports in <code>@import</code> and <code>@plugin</code> still resolve correctly when using Vite aliases in <code>@tailwindcss/vite</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19947">#19947</a>)</li> </ul> <h2>[4.2.3] - 2026-04-20</h2> <h3>Fixed</h3> <ul> <li>Canonicalization: improve canonicalization for <code>tracking-*</code> utilities by preferring non-negative utilities (e.g. <code>-tracking-tighter</code> → <code>tracking-wider</code>) (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19827">#19827</a>)</li> <li>Fix crash due to invalid characters in candidate (exceeding valid unicode code point range) (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19829">#19829</a>)</li> <li>Ensure query params in imports are considered unique resources when using <code>@tailwindcss/webpack</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19723">#19723</a>)</li> <li>Canonicalization: collapse arbitrary values into shorthand utilities (e.g. <code>px-[1.2rem] py-[1.2rem]</code> → <code>p-[1.2rem]</code>) (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19837">#19837</a>)</li> <li>Canonicalization: collapse <code>border-{t,b}-*</code> into <code>border-y-*</code>, <code>border-{l,r}-*</code> into <code>border-x-*</code>, and <code>border-{t,r,b,l}-*</code> into <code>border-*</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19842">#19842</a>)</li> <li>Canonicalization: collapse <code>scroll-m{t,b}-*</code> into <code>scroll-my-*</code>, <code>scroll-m{l,r}-*</code> into <code>scroll-mx-*</code>, and <code>scroll-m{t,r,b,l}-*</code> into <code>scroll-m-*</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19842">#19842</a>)</li> <li>Canonicalization: collapse <code>scroll-p{t,b}-*</code> into <code>scroll-py-*</code>, <code>scroll-p{l,r}-*</code> into <code>scroll-px-*</code>, and <code>scroll-p{t,r,b,l}-*</code> into <code>scroll-p-*</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19842">#19842</a>)</li> <li>Canonicalization: collapse <code>overflow-{x,y}-*</code> into <code>overflow-*</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19842">#19842</a>)</li> <li>Canonicalization: collapse <code>overscroll-{x,y}-*</code> into <code>overscroll-*</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19842">#19842</a>)</li> <li>Read from <code>--placeholder-color</code> instead of <code>--background-color</code> for <code>placeholder-*</code> utilities (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19843">#19843</a>)</li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/tailwindlabs/tailwindcss/commit/588bd7371f4cae96426e1387819b7fd1d99765f9"><code>588bd73</code></a> 4.3.0 (<a href="https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-postcss/issues/20023">#20023</a>)</li> <li><a href="https://github.com/tailwindlabs/tailwindcss/commit/12eb5ae7b6026ff64c04f889b2221418d772da72"><code>12eb5ae</code></a> Cleanup noisy test output (<a href="https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-postcss/issues/20015">#20015</a>)</li> <li><a href="https://github.com/tailwindlabs/tailwindcss/commit/4255671c5f792c42808ecd6b2dec27c16e3c559e"><code>4255671</code></a> Improve snapshot tests (<a href="https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-postcss/issues/20013">#20013</a>)</li> <li><a href="https://github.com/tailwindlabs/tailwindcss/commit/52f94c74bb491e9c3641ce322a0ef90fb3c45de6"><code>52f94c7</code></a> Improve codebase quality (<a href="https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-postcss/issues/19999">#19999</a>)</li> <li><a href="https://github.com/tailwindlabs/tailwindcss/commit/d194d4c3e656313421f1cfa1954db8f58eec0fcd"><code>d194d4c</code></a> docs: fix various typos in comments and documentation (<a href="https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-postcss/issues/19878">#19878</a>)</li> <li><a href="https://github.com/tailwindlabs/tailwindcss/commit/bfb5732b0b948d89c6803cb537bca168ec8e0a46"><code>bfb5732</code></a> Fall back to the plugin <code>base</code> when PostCSS has no <code>from</code> option (<a href="https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-postcss/issues/19980">#19980</a>)</li> <li><a href="https://github.com/tailwindlabs/tailwindcss/commit/3a890c35727fe0630c59b72dbec799d02e3c4800"><code>3a890c3</code></a> Bump dependencies (<a href="https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-postcss/issues/19957">#19957</a>)</li> <li><a href="https://github.com/tailwindlabs/tailwindcss/commit/69ad7cc5ec091125842aba783c5bfce536e9c234"><code>69ad7cc</code></a> 4.2.4 (<a href="https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-postcss/issues/19948">#19948</a>)</li> <li><a href="https://github.com/tailwindlabs/tailwindcss/commit/685c19e266a6b75842747acab6fe7076e82df62d"><code>685c19e</code></a> Fix issue around resolving paths in <code>@tailwindcss/vite</code> (<a href="https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-postcss/issues/19947">#19947</a>)</li> <li><a href="https://github.com/tailwindlabs/tailwindcss/commit/2e3fa490a535a8341fd2853d75098f0d4dbcc825"><code>2e3fa49</code></a> 4.2.3 (<a href="https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-postcss/issues/19944">#19944</a>)</li> <li>Additional commits viewable in <a href="https://github.com/tailwindlabs/tailwindcss/commits/v4.3.0/packages/@tailwindcss-postcss">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for <code>@tailwindcss/postcss</code> since your current version.</p> </details> <br /> Updates `@tanstack/react-query-devtools` from 5.91.3 to 5.100.10 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/TanStack/query/releases">@tanstack/react-query-devtools's releases</a>.</em></p> <blockquote> <h2><code>@tanstack/react-query-devtools</code><a href="https://github.com/5"><code>@5</code></a>.100.9</h2> <h3>Patch Changes</h3> <ul> <li>Updated dependencies [<a href="https://github.com/TanStack/query/commit/3d21cacdec3028b700c4c2e3e0ff8dbe7a235e8c"><code>3d21cac</code></a>]: <ul> <li><code>@tanstack/query-devtools</code><a href="https://github.com/5"><code>@5</code></a>.100.9</li> <li><code>@tanstack/react-query</code><a href="https://github.com/5"><code>@5</code></a>.100.9</li> </ul> </li> </ul> <h2><code>@tanstack/react-query-devtools</code><a href="https://github.com/5"><code>@5</code></a>.100.8</h2> <h3>Patch Changes</h3> <ul> <li>Updated dependencies []: <ul> <li><code>@tanstack/query-devtools</code><a href="https://github.com/5"><code>@5</code></a>.100.8</li> <li><code>@tanstack/react-query</code><a href="https://github.com/5"><code>@5</code></a>.100.8</li> </ul> </li> </ul> <h2><code>@tanstack/react-query-devtools</code><a href="https://github.com/5"><code>@5</code></a>.100.7</h2> <h3>Patch Changes</h3> <ul> <li> <p>docs(devtools): align logo, panel, and 'buttonPosition' union descriptions across docs and JSDoc (<a href="https://redirect.github.com/TanStack/query/pull/10617">#10617</a>)</p> </li> <li> <p>Updated dependencies []:</p> <ul> <li><code>@tanstack/query-devtools</code><a href="https://github.com/5"><code>@5</code></a>.100.7</li> <li><code>@tanstack/react-query</code><a href="https://github.com/5"><code>@5</code></a>.100.7</li> </ul> </li> </ul> <h2><code>@tanstack/react-query-devtools</code><a href="https://github.com/5"><code>@5</code></a>.100.6</h2> <h3>Patch Changes</h3> <ul> <li>Updated dependencies []: <ul> <li><code>@tanstack/query-devtools</code><a href="https://github.com/5"><code>@5</code></a>.100.6</li> <li><code>@tanstack/react-query</code><a href="https://github.com/5"><code>@5</code></a>.100.6</li> </ul> </li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/TanStack/query/blob/main/packages/react-query-devtools/CHANGELOG.md">@tanstack/react-query-devtools's changelog</a>.</em></p> <blockquote> <h2>5.100.10</h2> <h3>Patch Changes</h3> <ul> <li>Updated dependencies [<a href="https://github.com/TanStack/query/commit/4d130b992d2ac396d75f921bfc530dd3a9d50577"><code>4d130b9</code></a>]: <ul> <li><code>@tanstack/query-devtools</code><a href="https://github.com/5"><code>@5</code></a>.100.10</li> <li><code>@tanstack/react-query</code><a href="https://github.com/5"><code>@5</code></a>.100.10</li> </ul> </li> </ul> <h2>5.100.9</h2> <h3>Patch Changes</h3> <ul> <li>Updated dependencies [<a href="https://github.com/TanStack/query/commit/3d21cacdec3028b700c4c2e3e0ff8dbe7a235e8c"><code>3d21cac</code></a>]: <ul> <li><code>@tanstack/query-devtools</code><a href="https://github.com/5"><code>@5</code></a>.100.9</li> <li><code>@tanstack/react-query</code><a href="https://github.com/5"><code>@5</code></a>.100.9</li> </ul> </li> </ul> <h2>5.100.8</h2> <h3>Patch Changes</h3> <ul> <li>Updated dependencies []: <ul> <li><code>@tanstack/query-devtools</code><a href="https://github.com/5"><code>@5</code></a>.100.8</li> <li><code>@tanstack/react-query</code><a href="https://github.com/5"><code>@5</code></a>.100.8</li> </ul> </li> </ul> <h2>5.100.7</h2> <h3>Patch Changes</h3> <ul> <li> <p>docs(devtools): align logo, panel, and 'buttonPosition' union descriptions across docs and JSDoc (<a href="https://redirect.github.com/TanStack/query/pull/10617">#10617</a>)</p> </li> <li> <p>Updated dependencies []:</p> <ul> <li><code>@tanstack/query-devtools</code><a href="https://github.com/5"><code>@5</code></a>.100.7</li> <li><code>@tanstack/react-query</code><a href="https://github.com/5"><code>@5</code></a>.100.7</li> </ul> </li> </ul> <h2>5.100.6</h2> <h3>Patch Changes</h3> <ul> <li>Updated dependencies []: <ul> <li><code>@tanstack/query-devtools</code><a href="https://github.com/5"><code>@5</code></a>.100.6</li> <li><code>@tanstack/react-query</code><a href="https://github.com/5"><code>@5</code></a>.100.6</li> </ul> </li> </ul> <h2>5.100.5</h2> <h3>Patch Changes</h3> <ul> <li>Updated dependencies []: <ul> <li><code>@tanstack/query-devtools</code><a href="https://github.com/5"><code>@5</code></a>.100.5</li> <li><code>@tanstack/react-query</code><a href="https://github.com/5"><code>@5</code></a>.100.5</li> </ul> </li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/TanStack/query/commits/HEAD/packages/react-query-devtools">compare view</a></li> </ul> </details> <br /> Updates `@types/express-session` from 1.18.2 to 1.19.0 <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/express-session">compare view</a></li> </ul> </details> <br /> Updates `@types/node` from 25.3.5 to 25.8.0 <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node">compare view</a></li> </ul> </details> <br /> Updates `@types/pg` from 8.18.0 to 8.20.0 <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/pg">compare view</a></li> </ul> </details> <br /> Updates `esbuild` from 0.27.4 to 0.28.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/evanw/esbuild/releases">esbuild's releases</a>.</em></p> <blockquote> <h2>v0.28.0</h2> <ul> <li> <p>Add support for <code>with { type: 'text' }</code> imports (<a href="https://redirect.github.com/evanw/esbuild/issues/4435">#4435</a>)</p> <p>The <a href="https://github.com/tc39/proposal-import-text">import text</a> proposal has reached stage 3 in the TC39 process, which means that it's recommended for implementation. It has also already been implemented by <a href="https://docs.deno.com/examples/importing_text/">Deno</a> and <a href="https://bun.com/docs/guides/runtime/import-html">Bun</a>. So with this release, esbuild also adds support for it. This behaves exactly the same as esbuild's existing <a href="https://esbuild.github.io/content-types/#text"><code>text</code> loader</a>. Here's an example:</p> <pre lang="js"><code>import string from './example.txt' with { type: 'text' } console.log(string) </code></pre> </li> <li> <p>Add integrity checks to fallback download path (<a href="https://redirect.github.com/evanw/esbuild/issues/4343">#4343</a>)</p> <p>Installing esbuild via npm is somewhat complicated with several different edge cases (see <a href="https://esbuild.github.io/getting-started/#additional-npm-flags">esbuild's documentation</a> for details). If the regular installation of esbuild's platform-specific package fails, esbuild's install script attempts to download the platform-specific package itself (first with the <code>npm</code> command, and then with a HTTP request to <code>registry.npmjs.org</code> as a last resort).</p> <p>This last resort path previously didn't have any integrity checks. With this release, esbuild will now verify that the hash of the downloaded binary matches the expected hash for the current release. This means the hashes for all of esbuild's platform-specific binary packages will now be embedded in the top-level <code>esbuild</code> package. Hopefully this should work without any problems. But just in case, this change is being done as a breaking change release.</p> </li> <li> <p>Update the Go compiler from 1.25.7 to 1.26.1</p> <p>This upgrade should not affect anything. However, there have been some significant internal changes to the Go compiler, so esbuild could potentially behave differently in certain edge cases:</p> <ul> <li>It now uses the <a href="https://go.dev/doc/go1.26#new-garbage-collector">new garbage collector</a> that comes with Go 1.26.</li> <li>The Go compiler is now more aggressive with allocating memory on the stack.</li> <li>The executable format that the Go linker uses has undergone several changes.</li> <li>The WebAssembly build now unconditionally makes use of the sign extension and non-trapping floating-point to integer conversion instructions.</li> </ul> <p>You can read the <a href="https://go.dev/doc/go1.26">Go 1.26 release notes</a> for more information.</p> </li> </ul> <h2>v0.27.7</h2> <ul> <li> <p>Fix lowering of define semantics for TypeScript parameter properties (<a href="https://redirect.github.com/evanw/esbuild/issues/4421">#4421</a>)</p> <p>The previous release incorrectly generated class fields for TypeScript parameter properties even when the configured target environment does not support class fields. With this release, the generated class fields will now be correctly lowered in this case:</p> <pre lang="ts"><code>// Original code class Foo { constructor(public x = 1) {} y = 2 } <p>// Old output (with --loader=ts --target=es2021)<br /> class Foo {<br /> constructor(x = 1) {<br /> this.x = x;<br /> __publicField(this, "y", 2);<br /> }<br /> x;<br /> }</p> <p>// New output (with --loader=ts --target=es2021)<br /> class Foo {<br /> </code></pre></p> </li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/evanw/esbuild/blob/main/CHANGELOG.md">esbuild's changelog</a>.</em></p> <blockquote> <h2>0.28.0</h2> <ul> <li> <p>Add support for <code>with { type: 'text' }</code> imports (<a href="https://redirect.github.com/evanw/esbuild/issues/4435">#4435</a>)</p> <p>The <a href="https://github.com/tc39/proposal-import-text">import text</a> proposal has reached stage 3 in the TC39 process, which means that it's recommended for implementation. It has also already been implemented by <a href="https://docs.deno.com/examples/importing_text/">Deno</a> and <a href="https://bun.com/docs/guides/runtime/import-html">Bun</a>. So with this release, esbuild also adds support for it. This behaves exactly the same as esbuild's existing <a href="https://esbuild.github.io/content-types/#text"><code>text</code> loader</a>. Here's an example:</p> <pre lang="js"><code>import string from './example.txt' with { type: 'text' } console.log(string) </code></pre> </li> <li> <p>Add integrity checks to fallback download path (<a href="https://redirect.github.com/evanw/esbuild/issues/4343">#4343</a>)</p> <p>Installing esbuild via npm is somewhat complicated with several different edge cases (see <a href="https://esbuild.github.io/getting-started/#additional-npm-flags">esbuild's documentation</a> for details). If the regular installation of esbuild's platform-specific package fails, esbuild's install script attempts to download the platform-specific package itself (first with the <code>npm</code> command, and then with a HTTP request to <code>registry.npmjs.org</code> as a last resort).</p> <p>This last resort path previously didn't have any integrity checks. With this release, esbuild will now verify that the hash of the downloaded binary matches the expected hash for the current release. This means the hashes for all of esbuild's platform-specific binary packages will now be embedded in the top-level <code>esbuild</code> package. Hopefully this should work without any problems. But just in case, this change is being done as a breaking change release.</p> </li> <li> <p>Update the Go compiler from 1.25.7 to 1.26.1</p> <p>This upgrade should not affect anything. However, there have been some significant internal changes to the Go compiler, so esbuild could potentially behave differently in certain edge cases:</p> <ul> <li>It now uses the <a href="https://go.dev/doc/go1.26#new-garbage-collector">new garbage collector</a> that comes with Go 1.26.</li> <li>The Go compiler is now more aggressive with allocating memory on the stack.</li> <li>The executable format that the Go linker uses has undergone several changes.</li> <li>The WebAssembly build now unconditionally makes use of the sign extension and non-trapping floating-point to integer conversion instructions.</li> </ul> <p>You can read the <a href="https://go.dev/doc/go1.26">Go 1.26 release notes</a> for more information.</p> </li> </ul> <h2>0.27.7</h2> <ul> <li> <p>Fix lowering of define semantics for TypeScript parameter properties (<a href="https://redirect.github.com/evanw/esbuild/issues/4421">#4421</a>)</p> <p>The previous release incorrectly generated class fields for TypeScript parameter properties even when the configured target environment does not support class fields. With this release, the generated class fields will now be correctly lowered in this case:</p> <pre lang="ts"><code>// Original code class Foo { constructor(public x = 1) {} y = 2 } <p>// Old output (with --loader=ts --target=es2021)<br /> class Foo {<br /> constructor(x = 1) {<br /> this.x = x;<br /> __publicField(this, "y", 2);<br /> }<br /> x;<br /> }</p> <p></code></pre></p> </li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/evanw/esbuild/commit/6a794dff68e6a43539f6da671e3080efdf11ca70"><code>6a794df</code></a> publish 0.28.0 to npm</li> <li><a href="https://github.com/evanw/esbuild/commit/64ee0ea63b2ff303caafc9610c388dc72c882c23"><code>64ee0ea</code></a> fix <a href="https://redirect.github.com/evanw/esbuild/issues/4435">#4435</a>: support <code>with { type: text }</code> imports</li> <li><a href="https://github.com/evanw/esbuild/commit/ef65aeeaacdb71eade186f888975b1de89574314"><code>ef65aee</code></a> fix sort order in <code>snapshots_packagejson.txt</code></li> <li><a href="https://github.com/evanw/esbuild/commit/1a26a8ecbc39aaf1379c524a0274a08fbcbed655"><code>1a26a8e</code></a> try to fix <code>test-old-ts</code>, also shuffle CI tasks</li> <li><a href="https://github.com/evanw/esbuild/commit/556ce6c1fc00d7c0917fbfada01ed8e5251bc510"><code>556ce6c</code></a> use <code>''</code> instead of <code>null</code> to omit build hashes</li> <li><a href="https://github.com/evanw/esbuild/commit/8e675a81a473ea69a46a69792f1386bb110dd877"><code>8e675a8</code></a> ci: allow missing binary hashes for tests</li> <li><a href="https://github.com/evanw/esbuild/commit/7067763b904fe8a522fa840a4a48c5fbd4c395e0"><code>7067763</code></a> Reapply "update go 1.25.7 => 1.26.1"</li> <li><a href="https://github.com/evanw/esbuild/commit/39473a952ab3b450d0578b698a8b8d2a02332e0d"><code>39473a9</code></a> fix <a href="https://redirect.github.com/evanw/esbuild/issues/4343">#4343</a>: integrity check for binary download</li> <li><a href="https://github.com/evanw/esbuild/commit/2025c9ff6ab15ba6b0f9d074fd732250cc46e4a3"><code>2025c9f</code></a> publish 0.27.7 to npm</li> <li><a href="https://github.com/evanw/esbuild/commit/c6b586e4904f47e8d5f783a2813660c13e2672e7"><code>c6b586e</code></a> fix typo in <code>Makefile</code> for <code>@esbuild/win32-x64</code></li> <li>Additional commits viewable in <a href="https://github.com/evanw/esbuild/compare/v0.27.4...v0.28.0">compare view</a></li> </ul> </details> <br /> Updates `esbuild-node-externals` from 1.20.1 to 1.22.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/pradel/esbuild-node-externals/releases">esbuild-node-externals's releases</a>.</em></p> <blockquote> <h2>esbuild-node-externals: v1.22.0</h2> <h2><a href="https://github.com/pradel/esbuild-node-externals/compare/esbuild-node-externals-v1.21.0...esbuild-node-externals-v1.22.0">1.22.0</a> (2026-04-08)</h2> <h3>Features</h3> <ul> <li>replace find-up with empathic to have smaller installation (<a href="https://redirect.github.com/pradel/esbuild-node-externals/issues/86">#86</a>) (<a href="https://github.com/pradel/esbuild-node-externals/commit/87229fc8268ebaed346172ba4534777d133e6f14">87229fc</a>)</li> </ul> <h2>esbuild-node-externals: v1.21.0</h2> <h2><a href="https://github.com/pradel/esbuild-node-externals/compare/esbuild-node-externals-v1.20.1...esbuild-node-externals-v1.21.0">1.21.0</a> (2026-04-03)</h2> <h3>Features</h3> <ul> <li>add esbuild 0.28 to the allowed range (<a href="https://redirect.github.com/pradel/esbuild-node-externals/issues/84">#84</a>) (<a href="https://github.com/pradel/esbuild-node-externals/commit/e66160f843ffe526f0e4dde4dd4e9f6896d0399b">e66160f</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/pradel/esbuild-node-externals/commit/bbaed41660111d1851907aea47534b87aa66e1ff"><code>bbaed41</code></a> chore(main): release esbuild-node-externals 1.22.0 (<a href="https://redirect.github.com/pradel/esbuild-node-externals/issues/87">#87</a>)</li> <li><a href="https://github.com/pradel/esbuild-node-externals/commit/87229fc8268ebaed346172ba4534777d133e6f14"><code>87229fc</code></a> feat: replace find-up with empathic to have smaller installation (<a href="https://redirect.github.com/pradel/esbuild-node-externals/issues/86">#86</a>)</li> <li><a href="https://github.com/pradel/esbuild-node-externals/commit/1b60aa3b4ec5dc7be3e3bee692ca5d5306a47a88"><code>1b60aa3</code></a> chore(main): release esbuild-node-externals 1.21.0 (<a href="https://redirect.github.com/pradel/esbuild-node-externals/issues/85">#85</a>)</li> <li><a href="https://github.com/pradel/esbuild-node-externals/commit/e66160f843ffe526f0e4dde4dd4e9f6896d0399b"><code>e66160f</code></a> feat: add esbuild 0.28 to the allowed range (<a href="https://redirect.github.com/pradel/esbuild-node-externals/issues/84">#84</a>)</li> <li>See full diff in <a href="https://github.com/pradel/esbuild-node-externals/compare/esbuild-node-externals-v1.20.1...esbuild-node-externals-v1.22.0">compare view</a></li> </ul> </details> <br /> Updates `eslint` from 10.0.3 to 10.4.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/eslint/eslint/releases">eslint's releases</a>.</em></p> <blockquote> <h2>v10.4.0</h2> <h2>Features</h2> <ul> <li><a href="https://github.com/eslint/eslint/commit/1a45ec596af1dd5f880e6874cb8f24dafb6a7ecf"><code>1a45ec5</code></a> feat: check sequence expressions in <code>for-direction</code> (<a href="https://redirect.github.com/eslint/eslint/issues/20701">#20701</a>) (kuldeep kumar)</li> <li><a href="https://github.com/eslint/eslint/commit/450040bd89b989b3531824c6be45feb5fe3d936b"><code>450040b</code></a> feat: add <code>includeIgnoreFile()</code> to <code>eslint/config</code> (<a href="https://redirect.github.com/eslint/eslint/issues/20735">#20735</a>) (Kirk Waiblinger)</li> </ul> <h2>Bug Fixes</h2> <ul> <li><a href="https://github.com/eslint/eslint/commit/544c0c3da589166ad8e5d634f35d3d06701c57be"><code>544c0c3</code></a> fix: escape code path DOT labels in debug output (<a href="https://redirect.github.com/eslint/eslint/issues/20866">#20866</a>) (Pixel998)</li> <li><a href="https://github.com/eslint/eslint/commit/6799431203f2579632d0870f98ba132067f4040c"><code>6799431</code></a> fix: update dependency <code>@eslint/config-helpers</code> to ^0.6.0 (<a href="https://redirect.github.com/eslint/eslint/issues/20850">#20850</a>) (renovate[bot])</li> <li><a href="https://github.com/eslint/eslint/commit/f078fef5005dceb14fc162aab7c7200e027688dd"><code>f078fef</code></a> fix: handle non-array deprecated rule replacements (<a href="https://redirect.github.com/eslint/eslint/issues/20825">#20825</a>) (xbinaryx)</li> </ul> <h2>Documentation</h2> <ul> <li><a href="https://github.com/eslint/eslint/commit/7e52a7151fb92eec0e0f67fe4e5ddbd1ccce796f"><code>7e52a71</code></a> docs: add mention of <code>@eslint-react/eslint-plugin</code> (<a href="https://redirect.github.com/eslint/eslint/issues/20869">#20869</a>) (Pavel)</li> <li><a href="https://github.com/eslint/eslint/commit/db3468ba746407d7f286f18f7ea9db6df0e3bc08"><code>db3468b</code></a> docs: tweak wording around ambiguous CJS-vs-ESM config (<a href="https://redirect.github.com/eslint/eslint/issues/20865">#20865</a>) (Kirk Waiblinger)</li> <li><a href="https://github.com/eslint/eslint/commit/90846643ec6e97d447ae0d831fabe6d17b0a998a"><code>9084664</code></a> docs: Update README (GitHub Actions Bot)</li> <li><a href="https://github.com/eslint/eslint/commit/9cc73875046e3c4b8313644cbb1e99e26b36bd3f"><code>9cc7387</code></a> docs: Update README (GitHub Actions Bot)</li> <li><a href="https://github.com/eslint/eslint/commit/3d7b5484407403817aa9071a394d336d8ea96eb5"><code>3d7b548</code></a> docs: Update README (GitHub Actions Bot)</li> <li><a href="https://github.com/eslint/eslint/commit/191ec3c0a3f94ce0f110df761f0b2b8949011ccb"><code>191ec3c</code></a> docs: Update README (GitHub Actions Bot)</li> </ul> <h2>Chores</h2> <ul> <li><a href="https://github.com/eslint/eslint/commit/6616856f28fa514a30f87b5539fc100d739a94bf"><code>6616856</code></a> chore: upgrade knip to v6 (<a href="https://redirect.github.com/eslint/eslint/issues/20875">#20875</a>) (Pixel998)</li> <li><a href="https://github.com/eslint/eslint/commit/d13b084a3ad02f926e9addaa35fc383759ea5554"><code>d13b084</code></a> ci: ensure auto-created PRs run CI (<a href="https://redirect.github.com/eslint/eslint/issues/20860">#20860</a>) (lumir)</li> <li><a href="https://github.com/eslint/eslint/commit/e71c7af86dce9acc1d18cb12d2184309f6841594"><code>e71c7af</code></a> ci: bump pnpm/action-setup from 6.0.5 to 6.0.7 (<a href="https://redirect.github.com/eslint/eslint/issues/20862">#20862</a>) (dependabot[bot])</li> <li><a href="https://github.com/eslint/eslint/commit/d84393dea170f54191fd20c8268b52c81c0ccd99"><code>d84393d</code></a> test: add unit tests for SuppressionsService.applySuppressions() (<a href="https://redirect.github.com/eslint/eslint/issues/20863">#20863</a>) (kuldeep kumar)</li> <li><a href="https://github.com/eslint/eslint/commit/24db8cb8e6f07fba667121777a15b1785486be94"><code>24db8cb</code></a> test: add tests for SuppressionsService.save() (<a href="https://redirect.github.com/eslint/eslint/issues/20802">#20802</a>) (kuldeep kumar)</li> <li><a href="https://github.com/eslint/eslint/commit/2ef0549cac4a9537e4c3a26b9f3edd4c99476bf6"><code>2ef0549</code></a> chore: update ecosystem plugins (<a href="https://redirect.github.com/eslint/eslint/issues/20857">#20857</a>) (github-actions[bot])</li> <li><a href="https://github.com/eslint/eslint/commit/a4297918d264d229a06cd96051ef9b91c7b86732"><code>a429791</code></a> ci: remove <code>eslint-webpack-plugin</code> types integration test (<a href="https://redirect.github.com/eslint/eslint/issues/20668">#20668</a>) (Milos Djermanovic)</li> <li><a href="https://github.com/eslint/eslint/commit/9e37386aa7f2ce220b2ef74a6afbac5f6b3527c5"><code>9e37386</code></a> chore: replace <code>recast</code> with range approach in code-sample-minimizer (<a href="https://redirect.github.com/eslint/eslint/issues/20682">#20682</a>) (Copilot)</li> <li><a href="https://github.com/eslint/eslint/commit/0dd1f9ffc9a07704d46e2a4c8d4ccc0d0908b0c0"><code>0dd1f9f</code></a> test: disable warning for <code>vm.constants.USE_MAIN_CONTEXT_DEFAULT_LOADER</code> (<a href="https://redirect.github.com/eslint/eslint/issues/20845">#20845</a>) (Francesco Trotta)</li> <li><a href="https://github.com/eslint/eslint/commit/9da3c7bc92d9579f8db19ecb56e718538d09db2b"><code>9da3c7b</code></a> refactor: remove deprecated <code>meta.language</code> and migrate <code>meta.dialects</code> (<a href="https://redirect.github.com/eslint/eslint/issues/20716">#20716</a>) (Pixel998)</li> <li><a href="https://github.com/eslint/eslint/commit/2099ed12a0a74c3d7f0808514362af2499b4fe2b"><code>2099ed1</code></a> refactor: add <code>meta.defaultOptions</code> to more rules, enable linting (<a href="https://redirect.github.com/eslint/eslint/issues/20800">#20800</a>) (xbinaryx)</li> <li><a href="https://github.com/eslint/eslint/commit/f1dfbc9ca57196de7092e1888cc99427bd6fe06e"><code>f1dfbc9</code></a> chore: update ecosystem plugins (<a href="https://redirect.github.com/eslint/eslint/issues/20836">#20836</a>) (github-actions[bot])</li> <li><a href="https://github.com/eslint/eslint/commit/c75941390c14728806cd4baef4f6072f6de78318"><code>c759413</code></a> ci: bump pnpm/action-setup from 6.0.3 to 6.0.5 (<a href="https://redirect.github.com/eslint/eslint/issues/20843">#20843</a>) (dependabot[bot])</li> <li><a href="https://github.com/eslint/eslint/commit/5b817d6fdc9ae2c35b528dc662b2eca8f40f64aa"><code>5b817d6</code></a> test: add unit tests for lib/shared/ast-utils (<a href="https://redirect.github.com/eslint/eslint/issues/20838">#20838</a>) (kuldeep kumar)</li> <li><a href="https://github.com/eslint/eslint/commit/1c13ae3934c198c494e5958fa3a68b33244ff06a"><code>1c13ae3</code></a> test: add unit tests for lib/shared/severity (<a href="https://redirect.github.com/eslint/eslint/issues/20835">#20835</a>) (kuldeep kumar)</li> </ul> <h2>v10.3.0</h2> <h2>Features</h2> <ul> <li><a href="https://github.com/eslint/eslint/commit/379571a975f2b24d88037b9de2e72ec61d004130"><code>379571a</code></a> feat: add suggestions for no-unused-private-class-members (<a href="https://redirect.github.com/eslint/eslint/issues/20773">#20773</a>) (sethamus)</li> </ul> <h2>Bug Fixes</h2> <ul> <li><a href="https://github.com/eslint/eslint/commit/b6ae5cf07b9b51802367539cb24b245b61eaa37c"><code>b6ae5cf</code></a> fix: handle unavailable require cache (<a href="https://redirect.github.com/eslint/eslint/issues/20812">#20812</a>) (Simon Podlipsky)</li> <li><a href="https://github.com/eslint/eslint/commit/6fb3685bcbe9a6f72fd7dfb9129686b6fb96b0bd"><code>6fb3685</code></a> fix: rule suggestions cause continuation in class body (<a href="https://redirect.github.com/eslint/eslint/issues/20787">#20787</a>) (Milos Djermanovic)</li> </ul> <h2>Documentation</h2> <ul> <li><a href="https://github.com/eslint/eslint/commit/32cc7ab4ec653ce89da92deb5c40a9f4fc707fe5"><code>32cc7ab</code></a> docs: fix typos in docs and comments (<a href="https://redirect.github.com/eslint/eslint/issues/20809">#20809</a>) (Tanuj Kanti)</li> <li><a href="https://github.com/eslint/eslint/commit/7f479376a2fa463d823ab762db6bb37ce8d2ee8f"><code>7f47937</code></a> docs: Update README (GitHub Actions Bot)</li> </ul> <h2>Chores</h2> <ul> <li><a href="https://github.com/eslint/eslint/commit/d32235ec19ceea211fa86452afa383ca05f5c2f9"><code>d32235e</code></a> ci: use pnpm in <code>eslint-flat-config-utils</code> type integration test (<a href="https://redirect.github.com/eslint/eslint/issues/20826">#20826</a>) (Francesco Trotta)</li> <li><a href="https://github.com/eslint/eslint/commit/3ffb14ea517de750ed1181579ef844af342e4096"><code>3ffb14e</code></a> chore: clean up typos in comments and JSDoc (<a href="https://redirect.github.com/eslint/eslint/issues/20821">#20821</a>) (Pixel998)</li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/eslint/eslint/commit/452c4010c07dc2e36fe6ec6a8c48298878e86887"><code>452c401</code></a> 10.4.0</li> <li><a href="https://github.com/eslint/eslint/commit/b6417e8b55c9525070d6e168b485ce6ff21688ed"><code>b6417e8</code></a> Build: changelog update for 10.4.0</li> <li><a href="https://github.com/eslint/eslint/commit/6616856f28fa514a30f87b5539fc100d739a94bf"><code>6616856</code></a> chore: upgrade knip to v6 (<a href="https://redirect.github.com/eslint/eslint/issues/20875">#20875</a>)</li> <li><a href="https://github.com/eslint/eslint/commit/d13b084a3ad02f926e9addaa35fc383759ea5554"><code>d13b084</code></a> ci: ensure auto-created PRs run CI (<a href="https://redirect.github.com/eslint/eslint/issues/20860">#20860</a>)</li> <li><a href="https://github.com/eslint/eslint/commit/7e52a7151fb92eec0e0f67fe4e5ddbd1ccce796f"><code>7e52a71</code></a> docs: add mention of <code>@eslint-react/eslint-plugin</code> (<a href="https://redirect.github.com/eslint/eslint/issues/20869">#20869</a>)</li> <li><a href="https://github.com/eslint/eslint/commit/e71c7af86dce9acc1d18cb12d2184309f6841594"><code>e71c7af</code></a> ci: bump pnpm/action-setup from 6.0.5 to 6.0.7 (<a href="https://redirect.github.com/eslint/eslint/issues/20862">#20862</a>)</li> <li><a href="https://github.com/eslint/eslint/commit/544c0c3da589166ad8e5d634f35d3d06701c57be"><code>544c0c3</code></a> fix: escape code path DOT labels in debug output (<a href="https://redirect.github.com/eslint/eslint/issues/20866">#20866</a>)</li> <li><a href="https://github.com/eslint/eslint/commit/db3468ba746407d7f286f18f7ea9db6df0e3bc08"><code>db3468b</code></a> docs: tweak wording around ambiguous CJS-vs-ESM config (<a href="https://redirect.github.com/eslint/eslint/issues/20865">#20865</a>)</li> <li><a href="https://github.com/eslint/eslint/commit/d84393dea170f54191fd20c8268b52c81c0ccd99"><code>d84393d</code></a> test: add unit tests for SuppressionsService.applySuppressions() (<a href="https://redirect.github.com/eslint/eslint/issues/20863">#20863</a>)</li> <li><a href="https://github.com/eslint/eslint/commit/90846643ec6e97d447ae0d831fabe6d17b0a998a"><code>9084664</code></a> docs: Update README</li> <li>Additional commits viewable in <a href="https://github.com/eslint/eslint/compare/v10.0.3...v10.4.0">compare view</a></li> </ul> </details> <br /> Updates `eslint-config-next` from 16.1.7 to 16.2.6 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vercel/next.js/releases">eslint-config-next's releases</a>.</em></p> <blockquote> <h2>v16.2.6</h2> <blockquote> <p>[!NOTE] This release contains security fixes and backported bug fixes. It does <strong>not</strong> include all pending features/changes on canary.</p> </blockquote> <h3>Security Fixes</h3> <p>The following advisories have been addressed:</p> <p><strong>High:</strong></p> <ul> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-8h8q-6873-q5fj">GHSA-8h8q-6873-q5fj: Denial of Service with Server Components</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-267c-6grr-h53f">GHSA-267c-6grr-h53f: Middleware / Proxy bypass in App Router applications via segment-prefetch routes</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-26hh-7cqf-hhc6">GHSA-26hh-7cqf-hhc6: Middleware / Proxy bypass in App Router applications via segment-prefetch routes - <strong>Incomplete Fix Follow-Up</strong></a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-mg66-mrh9-m8jx">GHSA-mg66-mrh9-m8jx: Denial of Service via connection exhaustion in applications using Cache Components</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-492v-c6pp-mqqv">GHSA-492v-c6pp-mqqv: Middleware / Proxy bypass through dynamic route parameter injection</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-c4j6-fc7j-m34r">GHSA-c4j6-fc7j-m34r: Server-side request forgery in applications using WebSocket upgrades</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-36qx-fr4f-26g5">GHSA-36qx-fr4f-26g5: Middleware / Proxy bypass in Pages Router applications using i18n</a></li> </ul> <p><strong>Moderate:</strong></p> <ul> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-ffhc-5mcf-pf4q">GHSA-ffhc-5mcf-pf4q: Cross-site scripting in App Router applications using CSP nonces</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-gx5p-jg67-6x7h">GHSA-gx5p-jg67-6x7h: Cross-site scripting in beforeInteractive scripts with untrusted input</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-h64f-5h5j-jqjh">GHSA-h64f-5h5j-jqjh: Denial of Service in the Image Optimization API</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-wfc6-r584-vfw7">GHSA-wfc6-r584-vfw7: Cache poisoning in React Server Component responses</a></li> </ul> <p><strong>Low:</strong></p> <ul> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-vfv6-92ff-j949">GHSA-vfv6-92ff-j949: Cache poisoning via collisions in React Server Component cache-busting</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-3g8h-86w9-wvmq">GHSA-3g8h-86w9-wvmq: Middleware / Proxy redirects can be cache-poisoned</a></li> </ul> <h3>Core Changes</h3> <ul> <li>fix: preserve HTTP access fallbacks during prerender recovery (<a href="https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next/issues/92231">#92231</a>)</li> <li>Fix fallback route params case in app-page handler (<a href="https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next/issues/91737">#91737</a>)</li> <li>Fix invalid HTML response for route-level RSC requests in deployment adapter (<a href="https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next/issues/91541">#91541</a>)</li> <li>Patch setHeader for direct route handlers (<a href="https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next/issues/93101">#93101</a>)</li> <li>Include deployment id in <code>cacheHandlers</code> keys (<a href="https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next/issues/93453">#93453</a>)</li> <li>Fix double-encoding of URL pathname parts in client param parsing (<a href="https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next/issues/93491">#93491</a>)</li> </ul> <h2>v16.2.5</h2> <blockquote> <p>[!NOTE] This release contains security fixes and backported bug fixes. It does <strong>not</strong> include all pending features/changes on canary.</p> </blockquote> <h3>Security Fixes</h3> <p>The following advisories have been addressed:</p> <p><strong>High:</strong></p> <ul> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-8h8q-6873-q5fj">GHSA-8h8q-6873-q5fj: Denial of Service with Server Components</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-267c-6grr-h53f">GHSA-267c-6grr-h53f: Middleware / Proxy bypass in App Router applications via segment-prefetch routes</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-mg66-mrh9-m8jx">GHSA-mg66-mrh9-m8jx: Denial of Service via connection exhaustion in applications using Cache Components</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-492v-c6pp-mqqv">GHSA-492v-c6pp-mqqv: Middleware / Proxy bypass through dynamic route parameter injection</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-c4j6-fc7j-m34r">GHSA-c4j6-fc7j-m34r: Server-side request forgery in applications using WebSocket upgrades</a></li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vercel/next.js/commit/ee6e79b1792a4d401ddf2480f40a83549fe8e722"><code>ee6e79b</code></a> v16.2.6</li> <li><a href="https://github.com/vercel/next.js/commit/766148f9cd48c0e218acafcd0f15defc14871bf4"><code>766148f</code></a> v16.2.5</li> <li><a href="https://github.com/vercel/next.js/commit/2275bd8598c88e8652d1271e74bcf972f72f4f38"><code>2275bd8</code></a> v16.2.4</li> <li><a href="https://github.com/vercel/next.js/commit/d5f649b2f4affdad1009cb178c1e3b37f4f1ad3f"><code>d5f649b</code></a> v16.2.3</li> <li><a href="https://github.com/vercel/next.js/commit/52faae3d94641584e13691238df5be158d0f00fb"><code>52faae3</code></a> v16.2.2</li> <li><a href="https://github.com/vercel/next.js/commit/ed7d2cef246dcb3e2955c018fd8b2027e0ff8eed"><code>ed7d2ce</code></a> v16.2.1</li> <li><a href="https://github.com/vercel/next.js/commit/c5c94dffbf084e66b172a9c6ff23d80c24973764"><code>c5c94df</code></a> v16.2.0</li> <li><a href="https://github.com/vercel/next.js/commit/3683192a6bea9011222e9b236f8000b5266f3fe6"><code>3683192</code></a> v16.2.0-canary.104</li> <li><a href="https://github.com/vercel/next.js/commit/668981482a3f9de97c4c1371e940e0f84972c080"><code>6689814</code></a> v16.2.0-canary.103</li> <li><a href="https://github.com/vercel/next.js/commit/ad66dbc89b356867c308110dc5365a696c763991"><code>ad66dbc</code></a> v16.2.0-canary.102</li> <li>Additional commits viewable in <a href="https://github.com/vercel/next.js/commits/v16.2.6/packages/eslint-config-next">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for eslint-config-next since your current version.</p> </details> <br /> Updates `tailwindcss` from 4.2.2 to 4.3.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/tailwindlabs/tailwindcss/releases">tailwindcss's releases</a>.</em></p> <blockquote> <h2>v4.3.0</h2> <h3>Added</h3> <ul> <li>Add <code>@container-size</code> utility (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/18901">#18901</a>)</li> <li>Add <code>scrollbar-{auto,thin,none}</code> utilities for <code>scrollbar-width</code>, and <code>scrollbar-thumb-*</code> / <code>scrollbar-track-*</code> color utiliti... _Description has been truncated_ --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

GiteaMirror added the pull-request label 2026-06-02 05:23:30 -05:00

GiteaMirror closed this issue

2026-06-02 05:23:30 -05:00

Sign in to join this conversation.

Branches Tags

main

crowdin_dev

dev

dependabot/npm_and_yarn/npm-dependencies-8b2d4a9f3a

dependabot/go_modules/install/go-install-dependencies-3804ca7238

dependabot/docker/docker-dependencies-4faa477378

dependabot/github_actions/github-actions-dependencies-6d79802a48

api-improvements

feat/remember-last-idp-on-smart-login-form

refactor/batch-status-requests

dependabot/npm_and_yarn/multi-5f1280885e

fix/non-semver-version-error

private-resource-page

resource-launcher

backhaul

exit-node-reconnect

feat/command-palette

ssh

delete-account

msg-delivery

org-only-idp

cicd

patch

site-targets-auto-login

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/pangolin#22515

[PR #3078] [CLOSED] Bump the dev-minor-updates group across 1 directory with 13 updates #22515

📋 Pull Request Information

📝 Commits (1)

📊 Changes

📄 Description

v1.66.0

v1.65.3

v1.65.2

v1.65.1

v1.65.0

v1.64.0

v1.63.0

v1.62.0

v1.61.6

v1.61.5

v1.61.4

v1.61.3

v1.61.2

v1.61.1

v1.61.0

v1.60.2

v1.60.1

1.66.0 (2026-05-13)

Added

1.65.3 (2026-05-13)

Changed

1.65.2 (2026-05-13)

Changed

1.65.1 (2026-05-13)

Changed

1.65.0 (2026-05-05)

Added

1.64.0 (2026-04-27)

Added

1.63.0 (2026-04-24)

Added

1.62.0 (2026-04-23)

v4.3.0

Added

Fixed

v4.2.4

Fixed

v4.2.3

Fixed

[4.3.0] - 2026-05-08

Added

Fixed

[4.2.4] - 2026-04-21

Fixed

[4.2.3] - 2026-04-20

Fixed

@​tanstack/react-query-devtools@​5.100.9

Patch Changes

@​tanstack/react-query-devtools@​5.100.8

Patch Changes

@​tanstack/react-query-devtools@​5.100.7

Patch Changes

@​tanstack/react-query-devtools@​5.100.6

Patch Changes

5.100.10

Patch Changes

5.100.9

Patch Changes

5.100.8

Patch Changes

5.100.7

Patch Changes

5.100.6

Patch Changes

5.100.5

Patch Changes

v0.28.0

v0.27.7

0.28.0

0.27.7

esbuild-node-externals: v1.22.0

1.22.0 (2026-04-08)

Features

esbuild-node-externals: v1.21.0

1.21.0 (2026-04-03)

`@tanstack/react-query-devtools@5`.100.9

`@tanstack/react-query-devtools@5`.100.8

`@tanstack/react-query-devtools@5`.100.7

`@tanstack/react-query-devtools@5`.100.6