Switch npm publish to use Dotenvx Ops' new Rotation Tokens (ROTs) (#715)
This will allow us to start dogfooding our own solution for third-party API key rotation. Third-party API key rotation would drastically improve security industry wide. Please get in touch if this is interesting to you.
Allow import path specifiers starting with #/ (#4361)
Previously the specification for package.json disallowed import path specifiers starting with #/, but this restriction has recently been relaxed and support for it is being added across the JavaScript ecosystem. One use case is using it for a wildcard pattern such as mapping #/* to ./src/* (previously you had to use another character such as #_* instead, which was more confusing). There is some more context in nodejs/node#49182.
Allow import path specifiers starting with #/ (#4361)
Previously the specification for package.json disallowed import path specifiers starting with #/, but this restriction has recently been relaxed and support for it is being added across the JavaScript ecosystem. One use case is using it for a wildcard pattern such as mapping #/* to ./src/* (previously you had to use another character such as #_* instead, which was more confusing). There is some more context in nodejs/node#49182.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.
## 📋 Pull Request Information
**Original PR:** https://github.com/fosrl/pangolin/pull/2099
**Author:** [@dependabot[bot]](https://github.com/apps/dependabot)
**Created:** 12/17/2025
**Status:** ❌ Closed
**Base:** `main` ← **Head:** `dependabot/npm_and_yarn/dev-patch-updates-b97953d8ab`
---
### 📝 Commits (1)
- [`030b7c7`](https://github.com/fosrl/pangolin/commit/030b7c7e832cbd184df511cd5461a73136689d77) Bump the dev-patch-updates group across 1 directory with 5 updates
### 📊 Changes
**2 files changed** (+198 additions, -198 deletions)
<details>
<summary>View changed files</summary>
📝 `package-lock.json` (+193 -193)
📝 `package.json` (+5 -5)
</details>
### 📄 Description
Bumps the dev-patch-updates group with 5 updates in the / directory:
| Package | From | To |
| --- | --- | --- |
| [@dotenvx/dotenvx](https://github.com/dotenvx/dotenvx) | `1.51.1` | `1.51.2` |
| [@tailwindcss/postcss](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-postcss) | `4.1.17` | `4.1.18` |
| [esbuild](https://github.com/evanw/esbuild) | `0.27.1` | `0.27.2` |
| [react-email](https://github.com/resend/react-email/tree/HEAD/packages/react-email) | `5.0.7` | `5.0.8` |
| [tailwindcss](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss) | `4.1.17` | `4.1.18` |
Updates `@dotenvx/dotenvx` from 1.51.1 to 1.51.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/dotenvx/dotenvx/releases"><code>@dotenvx/dotenvx</code>'s releases</a>.</em></p>
<blockquote>
<h2>v1.51.2</h2>
<p>see <a href="https://github.com/dotenvx/dotenvx/blob/main/CHANGELOG.md">CHANGELOG</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/dotenvx/dotenvx/blob/main/CHANGELOG.md"><code>@dotenvx/dotenvx</code>'s changelog</a>.</em></p>
<blockquote>
<h2><a href="https://github.com/dotenvx/dotenvx/compare/v1.51.1...v1.51.2">1.51.2</a> (2025-12-12)</h2>
<h3>Changed</h3>
<ul>
<li>Switch <code>npm publish</code> to use <a href="https://dotenvx.com/ops">Dotenvx Ops'</a> new Rotation Tokens (ROTs) (<a href="https://redirect.github.com/dotenvx/dotenvx/pull/715">#715</a>)</li>
</ul>
<blockquote>
<p>This will allow us to start dogfooding our own solution for third-party API key rotation. Third-party API key rotation would drastically improve security industry wide. Please <a href="https://dotenvx.com/support">get in touch</a> if this is interesting to you.</p>
</blockquote>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/dotenvx/dotenvx/commit/996adb49618e2b76306b332ea0aab71697df240c"><code>996adb4</code></a> 1.51.2</li>
<li><a href="https://github.com/dotenvx/dotenvx/commit/8c55137d81b6c26adf038c31e35c16bdf0d8c341"><code>8c55137</code></a> Merge pull request <a href="https://redirect.github.com/dotenvx/dotenvx/issues/715">#715</a> from dotenvx/rot-token</li>
<li><a href="https://github.com/dotenvx/dotenvx/commit/3466b42599f657622848300467539eb6efd9cbfb"><code>3466b42</code></a> changelog 🪵</li>
<li><a href="https://github.com/dotenvx/dotenvx/commit/064fa27e7826e4aeb80adf11274edf0d5e89ef63"><code>064fa27</code></a> changelog 🪵</li>
<li><a href="https://github.com/dotenvx/dotenvx/commit/a6a199ffc896c7b640c5420b1c7bacddae15fc76"><code>a6a199f</code></a> switch to publishing via Dotenvx Rotation Token (ROT)</li>
<li>See full diff in <a href="https://github.com/dotenvx/dotenvx/compare/v1.51.1...v1.51.2">compare view</a></li>
</ul>
</details>
<br />
Updates `@tailwindcss/postcss` from 4.1.17 to 4.1.18
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/tailwindlabs/tailwindcss/releases"><code>@tailwindcss/postcss</code>'s releases</a>.</em></p>
<blockquote>
<h2>v4.1.18</h2>
<h3>Fixed</h3>
<ul>
<li>Ensure validation of <code>source(…)</code> happens relative to the file it is in (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19274">#19274</a>)</li>
<li>Include filename and line numbers in CSS parse errors (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19282">#19282</a>)</li>
<li>Skip comments in Ruby files when checking for class names (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19243">#19243</a>)</li>
<li>Skip over arbitrary property utilities with a top-level <code>!</code> in the value (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19243">#19243</a>)</li>
<li>Support environment API in <code>@tailwindcss/vite</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/18970">#18970</a>)</li>
<li>Preserve case of theme keys from JS configs and plugins (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19337">#19337</a>)</li>
<li>Write source maps correctly on the CLI when using <code>--watch</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19373">#19373</a>)</li>
<li>Handle special defaults (like <code>ringColor.DEFAULT</code>) in JS configs (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19348">#19348</a>)</li>
<li>Improve backwards compatibility for <code>content</code> theme key from JS configs (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19381">#19381</a>)</li>
<li>Upgrade: Handle <code>future</code> and <code>experimental</code> config keys (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19344">#19344</a>)</li>
<li>Try to canonicalize any arbitrary utility to a bare value (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19379">#19379</a>)</li>
<li>Validate candidates similarly to Oxide (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19397">#19397</a>)</li>
<li>Canonicalization: combine <code>text-*</code> and <code>leading-*</code> classes (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19396">#19396</a>)</li>
<li>Correctly handle duplicate CLI arguments (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19416">#19416</a>)</li>
<li>Don’t emit color-mix fallback rules inside <code>@keyframes</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19419">#19419</a>)</li>
<li>CLI: Don't hang when output is <code>/dev/stdout</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19421">#19421</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md"><code>@tailwindcss/postcss</code>'s changelog</a>.</em></p>
<blockquote>
<h2>[4.1.18] - 2025-12-11</h2>
<h3>Fixed</h3>
<ul>
<li>Ensure validation of <code>source(…)</code> happens relative to the file it is in (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19274">#19274</a>)</li>
<li>Include filename and line numbers in CSS parse errors (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19282">#19282</a>)</li>
<li>Skip comments in Ruby files when checking for class names (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19243">#19243</a>)</li>
<li>Skip over arbitrary property utilities with a top-level <code>!</code> in the value (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19243">#19243</a>)</li>
<li>Support environment API in <code>@tailwindcss/vite</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/18970">#18970</a>)</li>
<li>Preserve case of theme keys from JS configs and plugins (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19337">#19337</a>)</li>
<li>Write source maps correctly on the CLI when using <code>--watch</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19373">#19373</a>)</li>
<li>Handle special defaults (like <code>ringColor.DEFAULT</code>) in JS configs (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19348">#19348</a>)</li>
<li>Improve backwards compatibility for <code>content</code> theme key from JS configs (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19381">#19381</a>)</li>
<li>Upgrade: Handle <code>future</code> and <code>experimental</code> config keys (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19344">#19344</a>)</li>
<li>Try to canonicalize any arbitrary utility to a bare value (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19379">#19379</a>)</li>
<li>Validate candidates similarly to Oxide (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19397">#19397</a>)</li>
<li>Canonicalization: combine <code>text-*</code> and <code>leading-*</code> classes (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19396">#19396</a>)</li>
<li>Correctly handle duplicate CLI arguments (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19416">#19416</a>)</li>
<li>Don’t emit color-mix fallback rules inside <code>@keyframes</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19419">#19419</a>)</li>
<li>CLI: Don't hang when output is <code>/dev/stdout</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19421">#19421</a>)</li>
</ul>
<h2>[3.4.19] - 2025-12-10</h2>
<h3>Fixed</h3>
<ul>
<li>Don’t break <code>sibling-*()</code> functions when used inside <code>calc(…)</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19335">#19335</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/tailwindlabs/tailwindcss/commit/9b32f7cb2fd341e1f9ddbe40a4d61d2f272ae33f"><code>9b32f7c</code></a> Release v4.1.18 (<a href="https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-postcss/issues/19431">#19431</a>)</li>
<li><a href="https://github.com/tailwindlabs/tailwindcss/commit/9c8cf8ac19dd5e742794d33e249b4f9c69b3fa5c"><code>9c8cf8a</code></a> Fix formatting of path in README.md (<a href="https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-postcss/issues/19407">#19407</a>)</li>
<li>See full diff in <a href="https://github.com/tailwindlabs/tailwindcss/commits/v4.1.18/packages/@tailwindcss-postcss">compare view</a></li>
</ul>
</details>
<br />
Updates `esbuild` from 0.27.1 to 0.27.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/evanw/esbuild/releases">esbuild's releases</a>.</em></p>
<blockquote>
<h2>v0.27.2</h2>
<ul>
<li>
<p>Allow import path specifiers starting with <code>#/</code> (<a href="https://redirect.github.com/evanw/esbuild/pull/4361">#4361</a>)</p>
<p>Previously the specification for <code>package.json</code> disallowed import path specifiers starting with <code>#/</code>, but this restriction <a href="https://redirect.github.com/nodejs/node/pull/60864">has recently been relaxed</a> and support for it is being added across the JavaScript ecosystem. One use case is using it for a wildcard pattern such as mapping <code>#/*</code> to <code>./src/*</code> (previously you had to use another character such as <code>#_*</code> instead, which was more confusing). There is some more context in <a href="https://redirect.github.com/nodejs/node/issues/49182">nodejs/node#49182</a>.</p>
<p>This change was contributed by <a href="https://github.com/hybrist"><code>@hybrist</code></a>.</p>
</li>
<li>
<p>Automatically add the <code>-webkit-mask</code> prefix (<a href="https://redirect.github.com/evanw/esbuild/issues/4357">#4357</a>, <a href="https://redirect.github.com/evanw/esbuild/issues/4358">#4358</a>)</p>
<p>This release automatically adds the <code>-webkit-</code> vendor prefix for the <a href="https://developer.mozilla.org/en-US/docs/Web/CSS/Reference/Properties/mask"><code>mask</code></a> CSS shorthand property:</p>
<pre lang="css"><code>/* Original code */
main {
mask: url(x.png) center/5rem no-repeat
}
<p>/* Old output (with --target=chrome110) */<br />
main {<br />
mask: url(x.png) center/5rem no-repeat;<br />
}</p>
<p>/* New output (with --target=chrome110) */<br />
main {<br />
-webkit-mask: url(x.png) center/5rem no-repeat;<br />
mask: url(x.png) center/5rem no-repeat;<br />
}<br />
</code></pre></p>
<p>This change was contributed by <a href="https://github.com/BPJEnnova"><code>@BPJEnnova</code></a>.</p>
</li>
<li>
<p>Additional minification of <code>switch</code> statements (<a href="https://redirect.github.com/evanw/esbuild/issues/4176">#4176</a>, <a href="https://redirect.github.com/evanw/esbuild/issues/4359">#4359</a>)</p>
<p>This release contains additional minification patterns for reducing <code>switch</code> statements. Here is an example:</p>
<pre lang="js"><code>// Original code
switch (x) {
case 0:
foo()
break
case 1:
default:
bar()
}
<p>// Old output (with --minify)<br />
switch(x){case 0:foo();break;case 1:default:bar()}</p>
<p>// New output (with --minify)<br />
</code></pre></p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/evanw/esbuild/blob/main/CHANGELOG.md">esbuild's changelog</a>.</em></p>
<blockquote>
<h2>0.27.2</h2>
<ul>
<li>
<p>Allow import path specifiers starting with <code>#/</code> (<a href="https://redirect.github.com/evanw/esbuild/pull/4361">#4361</a>)</p>
<p>Previously the specification for <code>package.json</code> disallowed import path specifiers starting with <code>#/</code>, but this restriction <a href="https://redirect.github.com/nodejs/node/pull/60864">has recently been relaxed</a> and support for it is being added across the JavaScript ecosystem. One use case is using it for a wildcard pattern such as mapping <code>#/*</code> to <code>./src/*</code> (previously you had to use another character such as <code>#_*</code> instead, which was more confusing). There is some more context in <a href="https://redirect.github.com/nodejs/node/issues/49182">nodejs/node#49182</a>.</p>
<p>This change was contributed by <a href="https://github.com/hybrist"><code>@hybrist</code></a>.</p>
</li>
<li>
<p>Automatically add the <code>-webkit-mask</code> prefix (<a href="https://redirect.github.com/evanw/esbuild/issues/4357">#4357</a>, <a href="https://redirect.github.com/evanw/esbuild/issues/4358">#4358</a>)</p>
<p>This release automatically adds the <code>-webkit-</code> vendor prefix for the <a href="https://developer.mozilla.org/en-US/docs/Web/CSS/Reference/Properties/mask"><code>mask</code></a> CSS shorthand property:</p>
<pre lang="css"><code>/* Original code */
main {
mask: url(x.png) center/5rem no-repeat
}
<p>/* Old output (with --target=chrome110) */<br />
main {<br />
mask: url(x.png) center/5rem no-repeat;<br />
}</p>
<p>/* New output (with --target=chrome110) */<br />
main {<br />
-webkit-mask: url(x.png) center/5rem no-repeat;<br />
mask: url(x.png) center/5rem no-repeat;<br />
}<br />
</code></pre></p>
<p>This change was contributed by <a href="https://github.com/BPJEnnova"><code>@BPJEnnova</code></a>.</p>
</li>
<li>
<p>Additional minification of <code>switch</code> statements (<a href="https://redirect.github.com/evanw/esbuild/issues/4176">#4176</a>, <a href="https://redirect.github.com/evanw/esbuild/issues/4359">#4359</a>)</p>
<p>This release contains additional minification patterns for reducing <code>switch</code> statements. Here is an example:</p>
<pre lang="js"><code>// Original code
switch (x) {
case 0:
foo()
break
case 1:
default:
bar()
}
<p>// Old output (with --minify)<br />
switch(x){case 0:foo();break;case 1:default:bar()}</p>
<p></code></pre></p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/evanw/esbuild/commit/cd832972927f1f67b6d2cc895c06a8759c1cf309"><code>cd83297</code></a> publish 0.27.2 to npm</li>
<li><a href="https://github.com/evanw/esbuild/commit/275972174750a04391ce5518514e57519bb8f55a"><code>2759721</code></a> additional tests for <code>switch</code> with <code>break</code></li>
<li><a href="https://github.com/evanw/esbuild/commit/fd2b4b36cf7c54be5841a41f8737af058e88e93c"><code>fd2b4b3</code></a> update release notes</li>
<li><a href="https://github.com/evanw/esbuild/commit/c8d93a7081e0e581b04e861674a8b2fec089fe74"><code>c8d93a7</code></a> fix <a href="https://redirect.github.com/evanw/esbuild/issues/4357">#4357</a>: -webkit- prefix for mask shorthand (<a href="https://redirect.github.com/evanw/esbuild/issues/4358">#4358</a>)</li>
<li><a href="https://github.com/evanw/esbuild/commit/92ff12c2e8a44210178bbdb19d403e918cff2e38"><code>92ff12c</code></a> compat table: update <code>@types/node</code></li>
<li><a href="https://github.com/evanw/esbuild/commit/a35eceb40ff67d2b599555a15b75bc2298b590a6"><code>a35eceb</code></a> compat table: fix a type error with the new types</li>
<li><a href="https://github.com/evanw/esbuild/commit/f5989842e91920aee7a013ec021b996ee0e37210"><code>f598984</code></a> fix <code>make compat-table</code> to install dependencies</li>
<li><a href="https://github.com/evanw/esbuild/commit/f7f6df011a69b06f6fe612edf77528307345c4d8"><code>f7f6df0</code></a> release notes for <a href="https://redirect.github.com/evanw/esbuild/issues/4361">#4361</a></li>
<li><a href="https://github.com/evanw/esbuild/commit/6f8ec15b15e70ff29a1966bf7b3bd24f8d6a0f5a"><code>6f8ec15</code></a> fix: allow subpath imports that start with <code>#/</code> (<a href="https://redirect.github.com/evanw/esbuild/issues/4361">#4361</a>)</li>
<li><a href="https://github.com/evanw/esbuild/commit/f7ae61f6b2a77dc2fc3229a6bb21fb44c3fb8f5b"><code>f7ae61f</code></a> minify some switch statements to if-else statement</li>
<li>Additional commits viewable in <a href="https://github.com/evanw/esbuild/compare/v0.27.1...v0.27.2">compare view</a></li>
</ul>
</details>
<br />
Updates `react-email` from 5.0.7 to 5.0.8
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/resend/react-email/releases">react-email's releases</a>.</em></p>
<blockquote>
<h2>react-email@5.0.8</h2>
<p>No release notes provided.</p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/resend/react-email/blob/canary/packages/react-email/CHANGELOG.md">react-email's changelog</a>.</em></p>
<blockquote>
<h2>5.0.8</h2>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/resend/react-email/commit/dec085f7db0040060d9a088f1a70897eeda90ac1"><code>dec085f</code></a> chore(root): version packages (<a href="https://github.com/resend/react-email/tree/HEAD/packages/react-email/issues/2730">#2730</a>)</li>
<li><a href="https://github.com/resend/react-email/commit/c5c86d8390b32d446a72a303b7a66cb1915c6bf7"><code>c5c86d8</code></a> fix(deps): update dependency next to v16.0.9 [security] (<a href="https://github.com/resend/react-email/tree/HEAD/packages/react-email/issues/2727">#2727</a>)</li>
<li>See full diff in <a href="https://github.com/resend/react-email/commits/react-email@5.0.8/packages/react-email">compare view</a></li>
</ul>
</details>
<br />
Updates `tailwindcss` from 4.1.17 to 4.1.18
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/tailwindlabs/tailwindcss/releases">tailwindcss's releases</a>.</em></p>
<blockquote>
<h2>v4.1.18</h2>
<h3>Fixed</h3>
<ul>
<li>Ensure validation of <code>source(…)</code> happens relative to the file it is in (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19274">#19274</a>)</li>
<li>Include filename and line numbers in CSS parse errors (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19282">#19282</a>)</li>
<li>Skip comments in Ruby files when checking for class names (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19243">#19243</a>)</li>
<li>Skip over arbitrary property utilities with a top-level <code>!</code> in the value (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19243">#19243</a>)</li>
<li>Support environment API in <code>@tailwindcss/vite</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/18970">#18970</a>)</li>
<li>Preserve case of theme keys from JS configs and plugins (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19337">#19337</a>)</li>
<li>Write source maps correctly on the CLI when using <code>--watch</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19373">#19373</a>)</li>
<li>Handle special defaults (like <code>ringColor.DEFAULT</code>) in JS configs (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19348">#19348</a>)</li>
<li>Improve backwards compatibility for <code>content</code> theme key from JS configs (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19381">#19381</a>)</li>
<li>Upgrade: Handle <code>future</code> and <code>experimental</code> config keys (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19344">#19344</a>)</li>
<li>Try to canonicalize any arbitrary utility to a bare value (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19379">#19379</a>)</li>
<li>Validate candidates similarly to Oxide (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19397">#19397</a>)</li>
<li>Canonicalization: combine <code>text-*</code> and <code>leading-*</code> classes (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19396">#19396</a>)</li>
<li>Correctly handle duplicate CLI arguments (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19416">#19416</a>)</li>
<li>Don’t emit color-mix fallback rules inside <code>@keyframes</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19419">#19419</a>)</li>
<li>CLI: Don't hang when output is <code>/dev/stdout</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19421">#19421</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md">tailwindcss's changelog</a>.</em></p>
<blockquote>
<h2>[4.1.18] - 2025-12-11</h2>
<h3>Fixed</h3>
<ul>
<li>Ensure validation of <code>source(…)</code> happens relative to the file it is in (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19274">#19274</a>)</li>
<li>Include filename and line numbers in CSS parse errors (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19282">#19282</a>)</li>
<li>Skip comments in Ruby files when checking for class names (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19243">#19243</a>)</li>
<li>Skip over arbitrary property utilities with a top-level <code>!</code> in the value (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19243">#19243</a>)</li>
<li>Support environment API in <code>@tailwindcss/vite</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/18970">#18970</a>)</li>
<li>Preserve case of theme keys from JS configs and plugins (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19337">#19337</a>)</li>
<li>Write source maps correctly on the CLI when using <code>--watch</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19373">#19373</a>)</li>
<li>Handle special defaults (like <code>ringColor.DEFAULT</code>) in JS configs (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19348">#19348</a>)</li>
<li>Improve backwards compatibility for <code>content</code> theme key from JS configs (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19381">#19381</a>)</li>
<li>Upgrade: Handle <code>future</code> and <code>experimental</code> config keys (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19344">#19344</a>)</li>
<li>Try to canonicalize any arbitrary utility to a bare value (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19379">#19379</a>)</li>
<li>Validate candidates similarly to Oxide (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19397">#19397</a>)</li>
<li>Canonicalization: combine <code>text-*</code> and <code>leading-*</code> classes (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19396">#19396</a>)</li>
<li>Correctly handle duplicate CLI arguments (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19416">#19416</a>)</li>
<li>Don’t emit color-mix fallback rules inside <code>@keyframes</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19419">#19419</a>)</li>
<li>CLI: Don't hang when output is <code>/dev/stdout</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19421">#19421</a>)</li>
</ul>
<h2>[3.4.19] - 2025-12-10</h2>
<h3>Fixed</h3>
<ul>
<li>Don’t break <code>sibling-*()</code> functions when used inside <code>calc(…)</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19335">#19335</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/tailwindlabs/tailwindcss/commit/9b32f7cb2fd341e1f9ddbe40a4d61d2f272ae33f"><code>9b32f7c</code></a> Release v4.1.18 (<a href="https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss/issues/19431">#19431</a>)</li>
<li><a href="https://github.com/tailwindlabs/tailwindcss/commit/820d90797cbe00f7bce6345a44aa78dc646b29ac"><code>820d907</code></a> Expose <code>candidatesToAst</code> to the language server (<a href="https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss/issues/19405">#19405</a>)</li>
<li><a href="https://github.com/tailwindlabs/tailwindcss/commit/478e9590971b5ca0800f7d3a9ecc92e655fe6659"><code>478e959</code></a> Don’t emit color-mix fallback rules inside <code>@keyframes</code> (<a href="https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss/issues/19419">#19419</a>)</li>
<li><a href="https://github.com/tailwindlabs/tailwindcss/commit/a5f4644507d98487007a69d6542619d0cd8d6208"><code>a5f4644</code></a> Validate named values in candidate parser (<a href="https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss/issues/19397">#19397</a>)</li>
<li><a href="https://github.com/tailwindlabs/tailwindcss/commit/229121dd1476d38d5916b2ada01a37df1bf33e33"><code>229121d</code></a> Canonicalization: combine <code>text-*</code> and <code>leading-*</code> classes (<a href="https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss/issues/19396">#19396</a>)</li>
<li><a href="https://github.com/tailwindlabs/tailwindcss/commit/243615e3f228d20bd04fd4c173bf515d40dd184d"><code>243615e</code></a> Handle backwards compatibility for <code>content</code> theme from JS configs (<a href="https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss/issues/19381">#19381</a>)</li>
<li><a href="https://github.com/tailwindlabs/tailwindcss/commit/764275143eaac5f6ef7abb6dd22e51a6cd2f9dd1"><code>7642751</code></a> Improve compatibility with special default values in JS configs (<a href="https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss/issues/19348">#19348</a>)</li>
<li><a href="https://github.com/tailwindlabs/tailwindcss/commit/af481175e775c46a9ab78e6764c2fbaeec058474"><code>af48117</code></a> remove unnecessary intermediate check</li>
<li><a href="https://github.com/tailwindlabs/tailwindcss/commit/9e436f7751e7f68d7bd44d28c4f58293ae0a4c7e"><code>9e436f7</code></a> Try to canonicalize any arbitrary utility to a bare value (<a href="https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss/issues/19379">#19379</a>)</li>
<li><a href="https://github.com/tailwindlabs/tailwindcss/commit/479b725cd33f9b3b00e0ccd0a4473d0f96deae1d"><code>479b725</code></a> Bump Vitest to v4 (<a href="https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss/issues/19216">#19216</a>)</li>
<li>Additional commits viewable in <a href="https://github.com/tailwindlabs/tailwindcss/commits/v4.1.18/packages/tailwindcss">compare view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions
</details>
---
<sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
📋 Pull Request Information
Original PR: https://github.com/fosrl/pangolin/pull/2099
Author: @dependabot[bot]
Created: 12/17/2025
Status: ❌ Closed
Base:
main← Head:dependabot/npm_and_yarn/dev-patch-updates-b97953d8ab📝 Commits (1)
030b7c7Bump the dev-patch-updates group across 1 directory with 5 updates📊 Changes
2 files changed (+198 additions, -198 deletions)
View changed files
📝
package-lock.json(+193 -193)📝
package.json(+5 -5)📄 Description
Bumps the dev-patch-updates group with 5 updates in the / directory:
1.51.11.51.24.1.174.1.180.27.10.27.25.0.75.0.84.1.174.1.18Updates
@dotenvx/dotenvxfrom 1.51.1 to 1.51.2Release notes
Sourced from
@dotenvx/dotenvx's releases.Changelog
Sourced from
@dotenvx/dotenvx's changelog.Commits
996adb41.51.28c55137Merge pull request #715 from dotenvx/rot-token3466b42changelog 🪵064fa27changelog 🪵a6a199fswitch to publishing via Dotenvx Rotation Token (ROT)Updates
@tailwindcss/postcssfrom 4.1.17 to 4.1.18Release notes
Sourced from
@tailwindcss/postcss's releases.Changelog
Sourced from
@tailwindcss/postcss's changelog.Commits
9b32f7cRelease v4.1.18 (#19431)9c8cf8aFix formatting of path in README.md (#19407)Updates
esbuildfrom 0.27.1 to 0.27.2Release notes
Sourced from esbuild's releases.
... (truncated)
Changelog
Sourced from esbuild's changelog.
... (truncated)
Commits
cd83297publish 0.27.2 to npm2759721additional tests forswitchwithbreakfd2b4b3update release notesc8d93a7fix #4357: -webkit- prefix for mask shorthand (#4358)92ff12ccompat table: update@types/nodea35ecebcompat table: fix a type error with the new typesf598984fixmake compat-tableto install dependenciesf7f6df0release notes for #43616f8ec15fix: allow subpath imports that start with#/(#4361)f7ae61fminify some switch statements to if-else statementUpdates
react-emailfrom 5.0.7 to 5.0.8Release notes
Sourced from react-email's releases.
Changelog
Sourced from react-email's changelog.
Commits
dec085fchore(root): version packages (#2730)c5c86d8fix(deps): update dependency next to v16.0.9 [security] (#2727)Updates
tailwindcssfrom 4.1.17 to 4.1.18Release notes
Sourced from tailwindcss's releases.
Changelog
Sourced from tailwindcss's changelog.
Commits
9b32f7cRelease v4.1.18 (#19431)820d907ExposecandidatesToAstto the language server (#19405)478e959Don’t emit color-mix fallback rules inside@keyframes(#19419)a5f4644Validate named values in candidate parser (#19397)229121dCanonicalization: combinetext-*andleading-*classes (#19396)243615eHandle backwards compatibility forcontenttheme from JS configs (#19381)7642751Improve compatibility with special default values in JS configs (#19348)af48117remove unnecessary intermediate check9e436f7Try to canonicalize any arbitrary utility to a bare value (#19379)479b725Bump Vitest to v4 (#19216)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot mergewill merge this PR after your CI passes on it@dependabot squash and mergewill squash and merge this PR after your CI passes on it@dependabot cancel mergewill cancel a previously requested merge and block automerging@dependabot reopenwill reopen this PR if it is closed@dependabot closewill close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.