chore(deps-dev): bump tailwindcss from 3.4.19 to 4.2.4#308
Closed
dependabot[bot] wants to merge 1 commit into
Closed
chore(deps-dev): bump tailwindcss from 3.4.19 to 4.2.4#308dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
9692d25 to
d4ae700
Compare
d4ae700 to
4a65f2a
Compare
4a65f2a to
89960a6
Compare
89960a6 to
363e68b
Compare
363e68b to
baf5ede
Compare
baf5ede to
582aac0
Compare
582aac0 to
ab567c2
Compare
ab567c2 to
28c8ee6
Compare
28c8ee6 to
2fe6b90
Compare
2fe6b90 to
bfba65d
Compare
bfba65d to
f21c739
Compare
Bumps [tailwindcss](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss) from 3.4.19 to 4.2.4. - [Release notes](https://github.com/tailwindlabs/tailwindcss/releases) - [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md) - [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.2.4/packages/tailwindcss) --- updated-dependencies: - dependency-name: tailwindcss dependency-version: 4.2.4 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
f21c739 to
8c89598
Compare
jedrazb
added a commit
that referenced
this pull request
May 9, 2026
Two issues caught reviewing the PR-author signer model against a real
Dependabot PR:
1. The GraphQL query only fetched databaseId from the User fragment,
so Bot-authored PRs returned databaseId=null. The empty-id check
then exited 1 with "no identifiable author" — even though the bot
was already in the allowlist. Fixed by adding `... on Bot` to the
fragment list and letting cla_should_skip short-circuit before
requiring databaseId.
2. GraphQL's Actor.login for Bot type returns the bare slug
("dependabot") while every other GitHub API surface — REST,
webhook payloads, commit authors — uses the "[bot]" suffix
("dependabot[bot]"). Our allowlist uses the suffixed form, so
the comparison silently failed. Added a normalization step that
appends "[bot]" when __typename is Bot.
Verified against PR #308 (real Dependabot response):
{"__typename":"Bot","databaseId":49699333,"login":"dependabot"}
43 tests passing, including a new bot-login normalization test.
jedrazb
added a commit
that referenced
this pull request
May 9, 2026
* cla: PR author is the signer of record + ping them on first ask
Switches the gate from per-commit-author to PR-author. The PR author is
the GitHub identity submitting the contribution and accepting the CLA's
representations; git's commit.author field is local-config metadata, not
legal personhood. Closes the bypass where AI tools or unconfigured git
clients commit with placeholder emails (example.invalid), which used to
let the gate flip to "all signed" with zero linked authors.
GraphQL query reduced from per-commit walk to a single pullRequest.author
field. Renderer simplified: no more multi-contributor matrix or
unknown-committer surfacing — there's exactly one potential signer per PR.
Bot's "please sign" comment now starts with an @-mention of the PR
author, so they get a single notification when the bot first asks.
Edits to the sticky comment on subsequent runs don't re-notify.
Net: -84 lines across cla.sh + cla.test.sh. 37 tests passing.
* review: handle Bot PR authors (Dependabot, Renovate)
Two issues caught reviewing the PR-author signer model against a real
Dependabot PR:
1. The GraphQL query only fetched databaseId from the User fragment,
so Bot-authored PRs returned databaseId=null. The empty-id check
then exited 1 with "no identifiable author" — even though the bot
was already in the allowlist. Fixed by adding `... on Bot` to the
fragment list and letting cla_should_skip short-circuit before
requiring databaseId.
2. GraphQL's Actor.login for Bot type returns the bare slug
("dependabot") while every other GitHub API surface — REST,
webhook payloads, commit authors — uses the "[bot]" suffix
("dependabot[bot]"). Our allowlist uses the suffixed form, so
the comparison silently failed. Added a normalization step that
appends "[bot]" when __typename is Bot.
Verified against PR #308 (real Dependabot response):
{"__typename":"Bot","databaseId":49699333,"login":"dependabot"}
43 tests passing, including a new bot-login normalization test.
Contributor
Author
|
Superseded by #457. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps tailwindcss from 3.4.19 to 4.2.4.
Release notes
Sourced from tailwindcss's releases.
... (truncated)
Changelog
Sourced from tailwindcss's changelog.
... (truncated)
Commits
69ad7cc4.2.4 (#19948)2e3fa494.2.3 (#19944)df6209aCanonicalize negative arbitrary values (#19858)52fd421Small refactor of canonicalization tests (#19851)c385fd3usetest.eachinstead of manual loop0d6e038fix index in test name88a2d22Add more canonicalization rules for deprecated utilities (#19849)2c1ef9eUse--placeholder-colorinstead of--background-colorforplaceholder-*...28d5268Collapse more utilities by expanding their declarations (#19842)b55d960fix(canonicalize): collapse arbitrary values into shorthand utilities (#19837)Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for tailwindcss since your current version.