Skip to content

chore(deps-dev): bump tailwindcss from 3.4.19 to 4.2.4#308

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/tailwindcss-4.2.4
Closed

chore(deps-dev): bump tailwindcss from 3.4.19 to 4.2.4#308
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/tailwindcss-4.2.4

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github Apr 27, 2026

Bumps tailwindcss from 3.4.19 to 4.2.4.

Release notes

Sourced from tailwindcss's releases.

v4.2.4

Fixed

  • Ensure imports in @import and @plugin still resolve correctly when using Vite aliases in @tailwindcss/vite (#19947)

v4.2.3

Fixed

  • Canonicalization: improve canonicalizations for tracking-* utilities by preferring non-negative utilities (e.g. -tracking-tightertracking-wider) (#19827)
  • Fix crash due to invalid characters in candidate (exceeding valid unicode code point range) (#19829)
  • Ensure query params in imports are considered unique resources when using @tailwindcss/webpack (#19723)
  • Canonicalization: collapse arbitrary values into shorthand utilities (e.g. px-[1.2rem] py-[1.2rem]p-[1.2rem]) (#19837)
  • Canonicalization: collapse border-{t,b}-* into border-y-*, border-{l,r}-* into border-x-*, and border-{t,r,b,l}-* into border-* (#19842)
  • Canonicalization: collapse scroll-m{t,b}-* into scroll-my-*, scroll-m{l,r}-* into scroll-mx-*, and scroll-m{t,r,b,l}-* into scroll-m-* (#19842)
  • Canonicalization: collapse scroll-p{t,b}-* into scroll-py-*, scroll-p{l,r}-* into scroll-px-*, and scroll-p{t,r,b,l}-* into scroll-p-* (#19842)
  • Canonicalization: collapse overflow-{x,y}-* into overflow-* (#19842)
  • Canonicalization: collapse overscroll-{x,y}-* into overscroll-* (#19842)
  • Read from --placeholder-color instead of --background-color for placeholder-* utilities (#19843)
  • Upgrade: ensure files are not emptied out when killing the upgrade process while it's running (#19846)
  • Upgrade: use config.content when migrating from Tailwind CSS v3 to Tailwind CSS v4 (#19846)
  • Upgrade: never migrate files that are ignored by git (#19846)
  • Add .env and .env.* to default ignored content files (#19846)
  • Canonicalization: migrate overflow-ellipsis into text-ellipsis (#19849)
  • Canonicalization: migrate start-fullinset-s-full, start-autoinset-s-auto, start-pxinset-s-px, and start-<number>inset-s-<number> as well as negative versions (#19849)
  • Canonicalization: migrate end-fullinset-e-full, end-autoinset-e-auto, end-pxinset-e-px, and end-<number>inset-e-<number> as well as negative versions (#19849)
  • Canonicalization: move the - sign inside the arbitrary value -left-[9rem]left-[-9rem] (#19858)
  • Canonicalization: move the - sign outside the arbitrary value ml-[calc(-1*var(--width))]-ml-(--width) (#19858)
  • Improve performance when scanning JSONL / NDJSON files (#19862)
  • Support NODE_PATH environment variable in standalone CLI (#19617)

v4.2.2

Added

  • Support Vite 8 in @tailwindcss/vite (#19790)

Fixed

  • Don't crash when candidates contain prototype properties like row-constructor (#19725)
  • Canonicalize calc(var(--spacing)*…) expressions into --spacing(…) (#19769)
  • Fix crash in canonicalization step when handling utilities containing @property at-rules (e.g. shadow-sm border) (#19727)
  • Skip full reload for server only modules scanned by client CSS when using @tailwindcss/vite (#19745)
  • Improve canonicalization for bare values exceeding default spacing scale suggestions (e.g. w-1234 h-1234size-1234) (#19809)
  • Fix canonicalization resulting in empty list (e.g. w-5 h-5 size-5'' instead of size-5) (#19812)

v4.2.1

Fixed

  • Allow trailing dash in functional utility names for backwards compatibility (#19696)
  • Properly detect classes containing . characters within curly braces in MDX files (#19711)

... (truncated)

Changelog

Sourced from tailwindcss's changelog.

[4.2.4] - 2026-04-21

Fixed

  • Ensure imports in @import and @plugin still resolve correctly when using Vite aliases in @tailwindcss/vite (#19947)

[4.2.3] - 2026-04-20

Fixed

  • Canonicalization: improve canonicalization for tracking-* utilities by preferring non-negative utilities (e.g. -tracking-tightertracking-wider) (#19827)
  • Fix crash due to invalid characters in candidate (exceeding valid unicode code point range) (#19829)
  • Ensure query params in imports are considered unique resources when using @tailwindcss/webpack (#19723)
  • Canonicalization: collapse arbitrary values into shorthand utilities (e.g. px-[1.2rem] py-[1.2rem]p-[1.2rem]) (#19837)
  • Canonicalization: collapse border-{t,b}-* into border-y-*, border-{l,r}-* into border-x-*, and border-{t,r,b,l}-* into border-* (#19842)
  • Canonicalization: collapse scroll-m{t,b}-* into scroll-my-*, scroll-m{l,r}-* into scroll-mx-*, and scroll-m{t,r,b,l}-* into scroll-m-* (#19842)
  • Canonicalization: collapse scroll-p{t,b}-* into scroll-py-*, scroll-p{l,r}-* into scroll-px-*, and scroll-p{t,r,b,l}-* into scroll-p-* (#19842)
  • Canonicalization: collapse overflow-{x,y}-* into overflow-* (#19842)
  • Canonicalization: collapse overscroll-{x,y}-* into overscroll-* (#19842)
  • Read from --placeholder-color instead of --background-color for placeholder-* utilities (#19843)
  • Upgrade: ensure files are not emptied out when killing the upgrade process while it's running (#19846)
  • Upgrade: use config.content when migrating from Tailwind CSS v3 to Tailwind CSS v4 (#19846)
  • Upgrade: never migrate files that are ignored by git (#19846)
  • Add .env and .env.* to default ignored content files (#19846)
  • Canonicalization: migrate overflow-ellipsis into text-ellipsis (#19849)
  • Canonicalization: migrate start-fullinset-s-full, start-autoinset-s-auto, start-pxinset-s-px, and start-<number>inset-s-<number> as well as negative versions (#19849)
  • Canonicalization: migrate end-fullinset-e-full, end-autoinset-e-auto, end-pxinset-e-px, and end-<number>inset-e-<number> as well as negative versions (#19849)
  • Canonicalization: move the - sign inside the arbitrary value -left-[9rem]left-[-9rem] (#19858)
  • Canonicalization: move the - sign outside the arbitrary value ml-[calc(-1*var(--width))]-ml-(--width) (#19858)
  • Improve performance when scanning JSONL / NDJSON files (#19862)
  • Support NODE_PATH environment variable in standalone CLI (#19617)

[4.2.2] - 2026-03-18

Fixed

  • Don't crash when candidates contain prototype properties like row-constructor (#19725)
  • Canonicalize calc(var(--spacing)*…) expressions into --spacing(…) (#19769)
  • Fix crash in canonicalization step when handling utilities containing @property at-rules (e.g. shadow-sm border) (#19727)
  • Skip full reload for server only modules scanned by client CSS when using @tailwindcss/vite (#19745)
  • Add support for Vite 8 in @tailwindcss/vite (#19790)
  • Improve canonicalization for bare values exceeding default spacing scale suggestions (e.g. w-1234 h-1234size-1234) (#19809)
  • Fix canonicalization resulting in empty list (e.g. w-5 h-5 size-5'' instead of size-5) (#19812)
  • Resolve tsconfig paths to allow for @import '@/path/to/file'; when using @tailwindcss/vite (#19803)

[4.2.1] - 2026-02-23

Fixed

  • Allow trailing dash in functional utility names for backwards compatibility (#19696)

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for tailwindcss since your current version.


@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Apr 27, 2026
@vercel
Copy link
Copy Markdown

vercel Bot commented Apr 27, 2026

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
docx-editor Error Error May 8, 2026 2:48pm

Request Review

@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/tailwindcss-4.2.4 branch from 9692d25 to d4ae700 Compare April 29, 2026 08:37
@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/tailwindcss-4.2.4 branch from d4ae700 to 4a65f2a Compare April 29, 2026 09:21
@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/tailwindcss-4.2.4 branch from 4a65f2a to 89960a6 Compare April 29, 2026 16:26
@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/tailwindcss-4.2.4 branch from 89960a6 to 363e68b Compare April 30, 2026 05:42
@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/tailwindcss-4.2.4 branch from 363e68b to baf5ede Compare May 2, 2026 17:00
@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/tailwindcss-4.2.4 branch from baf5ede to 582aac0 Compare May 3, 2026 06:33
@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/tailwindcss-4.2.4 branch from 582aac0 to ab567c2 Compare May 4, 2026 05:54
@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/tailwindcss-4.2.4 branch from ab567c2 to 28c8ee6 Compare May 5, 2026 08:56
@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/tailwindcss-4.2.4 branch from 28c8ee6 to 2fe6b90 Compare May 6, 2026 10:44
@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/tailwindcss-4.2.4 branch from 2fe6b90 to bfba65d Compare May 7, 2026 10:08
@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/tailwindcss-4.2.4 branch from bfba65d to f21c739 Compare May 7, 2026 13:27
Bumps [tailwindcss](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss) from 3.4.19 to 4.2.4.
- [Release notes](https://github.com/tailwindlabs/tailwindcss/releases)
- [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md)
- [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.2.4/packages/tailwindcss)

---
updated-dependencies:
- dependency-name: tailwindcss
  dependency-version: 4.2.4
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/tailwindcss-4.2.4 branch from f21c739 to 8c89598 Compare May 8, 2026 14:48
jedrazb added a commit that referenced this pull request May 9, 2026
Two issues caught reviewing the PR-author signer model against a real
Dependabot PR:

1. The GraphQL query only fetched databaseId from the User fragment,
   so Bot-authored PRs returned databaseId=null. The empty-id check
   then exited 1 with "no identifiable author" — even though the bot
   was already in the allowlist. Fixed by adding `... on Bot` to the
   fragment list and letting cla_should_skip short-circuit before
   requiring databaseId.

2. GraphQL's Actor.login for Bot type returns the bare slug
   ("dependabot") while every other GitHub API surface — REST,
   webhook payloads, commit authors — uses the "[bot]" suffix
   ("dependabot[bot]"). Our allowlist uses the suffixed form, so
   the comparison silently failed. Added a normalization step that
   appends "[bot]" when __typename is Bot.

Verified against PR #308 (real Dependabot response):
  {"__typename":"Bot","databaseId":49699333,"login":"dependabot"}

43 tests passing, including a new bot-login normalization test.
jedrazb added a commit that referenced this pull request May 9, 2026
* cla: PR author is the signer of record + ping them on first ask

Switches the gate from per-commit-author to PR-author. The PR author is
the GitHub identity submitting the contribution and accepting the CLA's
representations; git's commit.author field is local-config metadata, not
legal personhood. Closes the bypass where AI tools or unconfigured git
clients commit with placeholder emails (example.invalid), which used to
let the gate flip to "all signed" with zero linked authors.

GraphQL query reduced from per-commit walk to a single pullRequest.author
field. Renderer simplified: no more multi-contributor matrix or
unknown-committer surfacing — there's exactly one potential signer per PR.

Bot's "please sign" comment now starts with an @-mention of the PR
author, so they get a single notification when the bot first asks.
Edits to the sticky comment on subsequent runs don't re-notify.

Net: -84 lines across cla.sh + cla.test.sh. 37 tests passing.

* review: handle Bot PR authors (Dependabot, Renovate)

Two issues caught reviewing the PR-author signer model against a real
Dependabot PR:

1. The GraphQL query only fetched databaseId from the User fragment,
   so Bot-authored PRs returned databaseId=null. The empty-id check
   then exited 1 with "no identifiable author" — even though the bot
   was already in the allowlist. Fixed by adding `... on Bot` to the
   fragment list and letting cla_should_skip short-circuit before
   requiring databaseId.

2. GraphQL's Actor.login for Bot type returns the bare slug
   ("dependabot") while every other GitHub API surface — REST,
   webhook payloads, commit authors — uses the "[bot]" suffix
   ("dependabot[bot]"). Our allowlist uses the suffixed form, so
   the comparison silently failed. Added a normalization step that
   appends "[bot]" when __typename is Bot.

Verified against PR #308 (real Dependabot response):
  {"__typename":"Bot","databaseId":49699333,"login":"dependabot"}

43 tests passing, including a new bot-login normalization test.
@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot Bot commented on behalf of github May 11, 2026

Superseded by #457.

@dependabot dependabot Bot closed this May 11, 2026
@dependabot dependabot Bot deleted the dependabot/npm_and_yarn/tailwindcss-4.2.4 branch May 11, 2026 22:34
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants