[dependabot]

Bumps the development group with 6 updates:

Package	From	To
oxlint-plugin-react-doctor	0.9.18	0.9.22
ultracite	8.1.0	8.1.1
@tailwindcss/postcss	4.3.3	4.3.4
tailwindcss	4.3.3	4.3.4
@electric-sql/pglite	0.5.13	0.5.14
@electric-sql/pglite-pgvector	0.0.14	0.0.15

Updates oxlint-plugin-react-doctor from 0.9.18 to 0.9.22

Release notes

Sourced from oxlint-plugin-react-doctor's releases.

oxlint-plugin-react-doctor@0.9.22

Patch Changes

• #2326 ad51b5a Thanks @​aidenybai! - Treat an effect cleanup that only reads a proven local runtime binding as empty. Preserve cleanup exemptions for global identifiers and member reads that can run getters, and keep no-op filtering conservative in other rules. no-mirror-prop-effect, no-event-trigger-state, no-effect-event-handler, no-effect-chain and rendering-hydration-no-flicker also stop skipping effects with proven empty or read-only inline cleanups. Unknown cleanup factories and other effectful returns remain conservative.

oxlint-plugin-react-doctor@0.9.21

Patch Changes

• #2320 5a2c6f5 Thanks @​aidenybai! - Report an unguarded useReducer dispatch after await or inside a microtask or Promise callback when it goes through a transparent local setter helper, such as queueMicrotask(() => assign(dispatch, action)), exactly where the direct dispatch is reported. Only no-set-state-after-await-in-effect accepts the forwarded dispatch, because it already counts a direct dispatch. The prop-change rules, which compare writes against useState initializers, stay unchanged. Imported, reassigned, asynchronous, deferred and conditional helpers, and reassigned dispatch bindings, stay outside the proof.

• #2319 39152dc Thanks @​aidenybai! - Report react-hooks-js/set-state-in-effect when an effect updates state synchronously through a transparent local setter helper, such as useEffect(() => assign(setValue, next)), which React Compiler does not follow. A new forwarded-set-state-in-effect rule finds the write with the forwarded setter proof, runs only when the compiler rule is enabled, and React Doctor reports its finding under the compiler's rule key, message and docs link, so react-hooks/set-state-in-effect disable comments, ignores and scoring treat it like the compiler finding. Compiler-visible synchronous setter calls retain duplicate suppression. Ref-derived measurements and guarded ref writes remain allowed. Imported, reassigned, asynchronous, deferred, conditional and multi-statement forwarding helpers stay outside the proof.

oxlint-plugin-react-doctor@0.9.20

Patch Changes

• #2317 2c5d72c Thanks @​aidenybai! - Report an unguarded state update after await or inside a microtask or Promise callback when it goes through a transparent local setter helper, such as queueMicrotask(() => assign(setValue, next)), exactly where the direct setter call is reported. Cleanup guards still protect the forwarded write. Imported, reassigned, asynchronous, deferred, conditional, and multi-statement helpers stay outside the proof. Preserve transparent TypeScript setter arguments and implicit undefined writes, and exclude bound/call/apply argument shifts from the forwarding proof.

  Keep resource lifecycle exemptions when the same setter is forwarded through immutable aliases, and register the deferred-write rule in cross-file cache metadata.

• #2315 8a7c60a Thanks @​aidenybai! - Report state adjusted after a prop change through a transparent local setter helper, such as assign(setValue, ""), exactly where the direct setter call is reported, including functional updaters and layout effects. Evaluate the forwarded write at its call site for the released object URL, portal mount, request map, resource lifecycle, and external work checks. Imported, reassigned, asynchronous, deferred, conditional, and multi-statement helpers stay outside the proof.

  Preserve resource lifecycle and asynchronous loading exemptions when related event or completion writers also use transparent setter helpers.

• #2316 b713862 Thanks @​aidenybai! - Report an effect that resets all state after a prop change through a transparent local setter helper, such as assign(setKey, ""), exactly where the direct reset is reported, including layout effects. A reload forwarded through the same helper from an asynchronous callback now counts as a loading lifecycle, and a handler that writes through the helper keeps the hidden-until-reset exemption. Imported, reassigned, asynchronous, deferred, conditional, and multi-statement helpers stay outside the proof.

  Keep setter identity stable across immutable aliases when counting reset state and recognizing asynchronous reloads. Resource lifecycle handlers retain their exemptions when their writes are forwarded through the same proven helper.

oxlint-plugin-react-doctor@0.9.19

Patch Changes

• #2000 9a79847 Thanks @​aidenybai! - Let rules declare the code that owns a finding separately from its diagnostic location. With --scope contextual, exhaustive-deps now reports existing dependency findings when their hook call or resolved local callback changes. Ownership survives lint-cache replay and stays out of public JSON reports and score requests.

  Add JSX element scope for alt-text and click-events-have-key-events, and function scope for rules-of-hooks. Existing scan defaults and other scopes are unchanged.

• #2311 813bd63 Thanks @​aidenybai! - Recognize synchronous derived-state writes through transparent local helpers that receive a React state setter. Preserve external, deferred, mutable, and independently editable state, including event writes through readonly setter aliases for direct and forwarded effect writes. Compare forwarded values with their existing state initializer. Withhold the forwarding proof for reassigned helpers and parameters whose defaults or destructuring can perform additional work.

• #2313 be55f78 Thanks @​aidenybai! - Detect unguarded state updates in inline microtask and proven native Promise callbacks started by effects with changing dependencies. Preserve cleanup guards, stable dependencies, and opaque or shadowed thenables.

  Exclude inert generator callbacks and mutated or escaped Promise receivers, and cache immutable provenance checks for shared Promise bindings.

• #2312 e5c7c99 Thanks @​aidenybai! - Detect redundant state derivation, initialization, adjustment, and resets in React useLayoutEffect, including imported aliases. Preserve layout measurement and resource lifecycle exemptions, and describe avoidable renders without implying stale content must be painted.

• #2308 a4bcd7f Thanks @​NisargIO! - Stop treating an empty effect cleanup as a real one. return () => {}, return () => undefined, a direct const function binding, or flag ? () => {} : undefined no longer silences no-adjust-state-on-prop-change, no-chain-state-updates, no-effect-event-handler, no-event-handler, no-pass-data-to-parent, or the derived-state rules' cleanup-managed state check. Cleanups that do work during parameter evaluation and disposer calls opposite inline or named empty functions still exempt the effect. Mutable bindings and unproven callback factories retain the existing conservative exemption.

• #2011 84ad0c8 Thanks @​skoshx! - Fix unsafe-json-in-html false positive for JSON.stringify().replaceAll("<", "\\u003c")

  The unsafe-json-in-html rule now recognizes .replaceAll("<", "\\u003c") as a safe escape pattern, equivalent to the already-recognized .replace(/</g, "\\u003c") form. This resolves false positives when developers use the more explicit .replaceAll method to escape less-than characters in JSON-LD or other JSON embedded in HTML/script tags.

• #2309 95cd1d4 Thanks @​aidenybai! - Detect missing cleanup for native timers called through globalThis, window, self, global, and proven constant aliases. Recognize matching qualified clearInterval and clearTimeout calls while preserving shadowed receiver and timer handle checks. Exclude qualified timer methods that have been overwritten, deleted, or updated, and never count an overridden clear method as cleanup.

... (truncated)

Changelog

Sourced from oxlint-plugin-react-doctor's changelog.

0.9.22

Patch Changes

• #2326 ad51b5a Thanks @​aidenybai! - Treat an effect cleanup that only reads a proven local runtime binding as empty. Preserve cleanup exemptions for global identifiers and member reads that can run getters, and keep no-op filtering conservative in other rules. no-mirror-prop-effect, no-event-trigger-state, no-effect-event-handler, no-effect-chain and rendering-hydration-no-flicker also stop skipping effects with proven empty or read-only inline cleanups. Unknown cleanup factories and other effectful returns remain conservative.

0.9.21

Patch Changes

• #2320 5a2c6f5 Thanks @​aidenybai! - Report an unguarded useReducer dispatch after await or inside a microtask or Promise callback when it goes through a transparent local setter helper, such as queueMicrotask(() => assign(dispatch, action)), exactly where the direct dispatch is reported. Only no-set-state-after-await-in-effect accepts the forwarded dispatch, because it already counts a direct dispatch. The prop-change rules, which compare writes against useState initializers, stay unchanged. Imported, reassigned, asynchronous, deferred and conditional helpers, and reassigned dispatch bindings, stay outside the proof.

• #2319 39152dc Thanks @​aidenybai! - Report react-hooks-js/set-state-in-effect when an effect updates state synchronously through a transparent local setter helper, such as useEffect(() => assign(setValue, next)), which React Compiler does not follow. A new forwarded-set-state-in-effect rule finds the write with the forwarded setter proof, runs only when the compiler rule is enabled, and React Doctor reports its finding under the compiler's rule key, message and docs link, so react-hooks/set-state-in-effect disable comments, ignores and scoring treat it like the compiler finding. Compiler-visible synchronous setter calls retain duplicate suppression. Ref-derived measurements and guarded ref writes remain allowed. Imported, reassigned, asynchronous, deferred, conditional and multi-statement forwarding helpers stay outside the proof.

0.9.20

Patch Changes

• #2317 2c5d72c Thanks @​aidenybai! - Report an unguarded state update after await or inside a microtask or Promise callback when it goes through a transparent local setter helper, such as queueMicrotask(() => assign(setValue, next)), exactly where the direct setter call is reported. Cleanup guards still protect the forwarded write. Imported, reassigned, asynchronous, deferred, conditional, and multi-statement helpers stay outside the proof. Preserve transparent TypeScript setter arguments and implicit undefined writes, and exclude bound/call/apply argument shifts from the forwarding proof.

  Keep resource lifecycle exemptions when the same setter is forwarded through immutable aliases, and register the deferred-write rule in cross-file cache metadata.

• #2315 8a7c60a Thanks @​aidenybai! - Report state adjusted after a prop change through a transparent local setter helper, such as assign(setValue, ""), exactly where the direct setter call is reported, including functional updaters and layout effects. Evaluate the forwarded write at its call site for the released object URL, portal mount, request map, resource lifecycle, and external work checks. Imported, reassigned, asynchronous, deferred, conditional, and multi-statement helpers stay outside the proof.

  Preserve resource lifecycle and asynchronous loading exemptions when related event or completion writers also use transparent setter helpers.

• #2316 b713862 Thanks @​aidenybai! - Report an effect that resets all state after a prop change through a transparent local setter helper, such as assign(setKey, ""), exactly where the direct reset is reported, including layout effects. A reload forwarded through the same helper from an asynchronous callback now counts as a loading lifecycle, and a handler that writes through the helper keeps the hidden-until-reset exemption. Imported, reassigned, asynchronous, deferred, conditional, and multi-statement helpers stay outside the proof.

  Keep setter identity stable across immutable aliases when counting reset state and recognizing asynchronous reloads. Resource lifecycle handlers retain their exemptions when their writes are forwarded through the same proven helper.

0.9.19

Patch Changes

• #2000 9a79847 Thanks @​aidenybai! - Let rules declare the code that owns a finding separately from its diagnostic location. With --scope contextual, exhaustive-deps now reports existing dependency findings when their hook call or resolved local callback changes. Ownership survives lint-cache replay and stays out of public JSON reports and score requests.

  Add JSX element scope for alt-text and click-events-have-key-events, and function scope for rules-of-hooks. Existing scan defaults and other scopes are unchanged.

• #2311 813bd63 Thanks @​aidenybai! - Recognize synchronous derived-state writes through transparent local helpers that receive a React state setter. Preserve external, deferred, mutable, and independently editable state, including event writes through readonly setter aliases for direct and forwarded effect writes. Compare forwarded values with their existing state initializer. Withhold the forwarding proof for reassigned helpers and parameters whose defaults or destructuring can perform additional work.

• #2313 be55f78 Thanks @​aidenybai! - Detect unguarded state updates in inline microtask and proven native Promise callbacks started by effects with changing dependencies. Preserve cleanup guards, stable dependencies, and opaque or shadowed thenables.

  Exclude inert generator callbacks and mutated or escaped Promise receivers, and cache immutable provenance checks for shared Promise bindings.

• #2312 e5c7c99 Thanks @​aidenybai! - Detect redundant state derivation, initialization, adjustment, and resets in React useLayoutEffect, including imported aliases. Preserve layout measurement and resource lifecycle exemptions, and describe avoidable renders without implying stale content must be painted.

• #2308 a4bcd7f Thanks @​NisargIO! - Stop treating an empty effect cleanup as a real one. return () => {}, return () => undefined, a direct const function binding, or flag ? () => {} : undefined no longer silences no-adjust-state-on-prop-change, no-chain-state-updates, no-effect-event-handler, no-event-handler, no-pass-data-to-parent, or the derived-state rules' cleanup-managed state check. Cleanups that do work during parameter evaluation and disposer calls opposite inline or named empty functions still exempt the effect. Mutable bindings and unproven callback factories retain the existing conservative exemption.

• #2011 84ad0c8 Thanks @​skoshx! - Fix unsafe-json-in-html false positive for JSON.stringify().replaceAll("<", "\\u003c")

... (truncated)

Commits

• 9791c32 chore: version packages (#2329)
• ad51b5a fix: treat an effect cleanup that only reads a binding as empty (#2326)
• 8552771 chore: version packages (#2323)
• 5a2c6f5 FPFNFIXAPEX: report reducer dispatch through transparent setter helpers (#2320)
• 39152dc FPFNFIXAPEX: report setState in effects through transparent setter helpers (#...
• 367ec1b chore: version packages (#2318)
• 2c5d72c FPFNFIXAPEX: report deferred state writes through transparent setter helpers ...
• b713862 FPFNFIXAPEX: report full state resets through transparent setter helpers (#2316)
• 8a7c60a FPFNFIXAPEX: report prop adjustments through transparent setter helpers (#2315)
• 4a3bc02 chore: version packages (#2004)
• Additional commits viewable in compare view

Updates ultracite from 8.1.0 to 8.1.1

Release notes

Sourced from ultracite's releases.

ultracite@8.1.1

Patch Changes

• 79d73d9: Update Biome to 2.6.4. The release adds 30 nursery rules, which the Biome presets leave off, and promotes or removes none, so the presets are unchanged and the @biomejs/biome peer range stays at ^2.6.2. The useSortedProperties assist that core turns on now follows stylelint-config-recess-order 7.9.0, so ultracite fix can reorder CSS properties it used to leave alone, such as scroll-behavior, anchor positioning and multi-column layout. It also no longer offers a sort that would change which of two overlapping declarations wins. noShorthandPropertyOverrides also recognises overrides of logical border, corner shape, position-try, text-box and transition-behavior properties. The Markdown formatter stays off in core: 2.6.4 fixes the dropped space before inline code, but it still rewrites a literal [ ] in prose to []. See the 2.6.4 release notes.

• 3572b86: Update the ESLint packages init installs: typescript-eslint 8.72.1, eslint-plugin-vue 10.12, eslint-plugin-storybook 10.6.5, @tanstack/eslint-plugin-query 5.105.1, @react-native/eslint-plugin 0.88.1, globals 17.14 and eslint-plugin-react-doctor 0.9.21, plus the Oxlint JS plugin oxlint-plugin-react-doctor 0.9.21. The presets were checked against ESLint 10.14.

  The Vue preset turns on eslint-plugin-vue's three new rules automatically: vue/no-content-outside-block reports content outside the top-level blocks of a .vue file, which the compiler drops; vue/no-define-model-default reports a default in defineModel(); and vue/no-props-shadow reports <script setup> declarations that shadow a prop. The new block-lang required and require-explicit-emits ignoreMixins options stay at their defaults: the first would reject components without a given block, and the second skips components that use mixins.

  react-doctor 0.9.21 adds react-doctor/forwarded-set-state-in-effect, which reports a state setter passed from an effect to a helper that calls it synchronously, such as useEffect(() => syncFrom(id, setValue), [id]). It is on in the ESLint React preset and in ultracite/oxlint/js-plugins. Setters handed to subscriptions, timers and listeners aren't reported.

• 6675a90: Update oxfmt to 0.75.0. The release changes no options. It fixes a run of formatting bugs, among them parentheses dropped around private in checks and instantiation expressions, a ; dropped before class members named in or instanceof, and its width heuristics now measure display width, so lines with wide characters (such as CJK text) can wrap differently after upgrading. Its prettier-plugin-astro integration now needs @astrojs/compiler-rs 0.5, which is the version ultracite init installs. See the 0.75.0 release notes for the full list.

• 3e83844: Update oxlint to 1.90.0 and enable its new type-aware rule, typescript/no-unsafe-enum-assignment, in the core Oxlint preset. It reports a value assigned, returned or passed where an enum is expected when it doesn't share that enum's type, such as const fruit: Fruit = 1, matching the @typescript-eslint rule of the same name that the ESLint type-aware preset already enables. Like the other type-aware rules, it only runs with oxlint --type-aware and oxlint-tsgolint installed, and oxlint 1.90 needs oxlint-tsgolint 7.0.2005 or later. Older oxlint releases fail to parse a config that names the rule, so the oxlint peer range moves to ^1.90.0.

  The release also makes a few rules report cases they used to miss: array-callback-return checks callbacks passed with extra arguments, no-useless-concat sees through parentheses, and jest/no-conditional-expect checks function expression callbacks. See the 1.90.0 release notes.

  Requires oxlint >= 1.90.0

Commits

• 9294814 Version Packages (#861)
• d23f3c5 Re-measure the provider pages for the toolchain update
• 3572b86 Update the ESLint plugins, Vue to 10.12 and react-doctor to 0.9.21
• 79d73d9 Update Biome to 2.6.4
• 6675a90 Update oxfmt to 0.75.0
• 3e83844 Update oxlint to 1.90.0 and enable no-unsafe-enum-assignment
• 62a10ca Bump actions/setup-node from 7.0.0 to 7.1.0 (#860)
• 8e0d593 Add the function style research post
• See full diff in compare view

Updates @tailwindcss/postcss from 4.3.3 to 4.3.4

Release notes

Sourced from @​tailwindcss/postcss's releases.

v4.3.4

Added

• Add @tailwindcss/turbopack, a Turbopack loader for using Tailwind CSS with Next.js (#20367)

Fixed

• Ensure watch mode detects changes to symlinked @source files whose real paths aren't otherwise scanned (#20356)
• Ensure variants using @scope wrap generated utilities instead of nesting inside them (#20369)
• Ensure nested @scope rules preserve their scoping semantics when flattened (#20369)
• Preserve declarations directly inside @scope by wrapping them in :where(:scope) (#20369)
• Ensure generated utilities include a space in empty var() fallbacks (e.g. var(--tw-blur,) → var(--tw-blur, )) (#20373)
• Canonicalization: convert arbitrary breakpoint and container query variants to named equivalents (e.g. max-[64rem]:flex → max-lg:flex) (#20380)
• Prevent @tailwindcss/vite from crashing on every edit under Vite's experimental bundledDev mode (#20379)
• Ensure @tailwindcss/oxide falls back to WASM on platforms without native bindings (#20383)
• Extract class candidates from Ruby %w and %W literals using angle brackets or custom delimiters (e.g. %w<flex>, %w|flex|), including in Slim and Haml templates (#20387)
• Preserve whitespace in --default(…) values in functional @utility definitions (e.g. --default(box alphabetic) no longer becomes boxalphabetic) (#20392)
• Ensure automatic source detection respects negation-based .gitignore files (e.g. /* followed by !/… patterns) (#20397)
• Ensure root theme('…') namespace lookups in JavaScript plugins and config files return the full namespace object instead of the value of its DEFAULT key (#20399)
• Skip ignored directories when generating watch globs instead of walking their contents on every rebuild (#20408)
• Drop invalid UTF-8 candidates during class detection (#20389)
• Prevent @tailwindcss/vite from forcing full-page reloads for scanned files that Vite does not handle as modules (e.g. .php files) (#20414)
• Canonicalization: don't merge utilities that reference different theme variables set to CSS-wide keywords like unset (#20417)
• Don't generate utilities when a modifier is used that would otherwise be silently ignored (e.g. rounded-sm/[5], shadow-sm/foo, stroke-2/50) (#20419)
• Preserve and, or, and not inside selectors in supports-[…] variants (e.g. supports-[selector(a:not(.foo))]:flex) (#20420)
• Don't warn about Angular's ::ng-deep and :host-context() when optimizing CSS (#20434)
• Don't generate CSS for candidates containing an empty additional modifier (e.g. bg-red-500/50/ and group-hover/foo//bar:flex) (#20466)
• Ensure min-*, max-*, and container query variants with decimal values are sorted numerically (e.g. min-[40.25rem] before min-[40.5rem]) (#20512)
• Ensure CSS comments ending with \*/ are closed correctly instead of swallowing the CSS that follows (e.g. /* C:\temp\*/) (#20508)
• Improve style invalidation performance of group-* and peer-* variants (#20513)
• Ensure cached compilers release their loadModule and loadStylesheet callbacks after compilation (#20531)
• Canonicalization: preserve & when moving a pseudo-element into * or ** (e.g. [&_::before]:flex → **:[&::before]:flex) (#20550)
• Ensure the Set.prototype.intersection polyfill in canonicalizeCandidates(…) returns the intersection instead of the first set on Node.js < 22 (#20562)
• Canonicalization: ensure inline theme(…) alphas with more than 2 decimals migrate to a percentage modifier with the same opacity (e.g. theme(colors.red.500/.12345) → text-red-500/[12.345%], not text-red-500/[12.345]) (#20563)
• Canonicalization: preserve inline theme(…) alphas as an arbitrary percentage when a custom --opacity-* theme value would change the opacity (e.g. theme(colors.red.500/50%) → text-red-500/[50%] with --opacity-50: 10%) (#20563)
• Ensure the @property fallback isn't applied in Safari versions that no longer support margin-trim: inline (#20569)
• Treat viewport units like dvmin and svi and font-relative units like cap and rex as lengths in arbitrary values (e.g. text-[10dvmin] generates font-size instead of color) (#20516)
• Write plugin logs to stderr in tailwindcss canonicalize so they don't end up in the results on stdout (#20561)
• Extract class shorthands on later lines when Pug text, comments, or quoted attribute values contain unbalanced brackets, or a quote that doesn't start a string (e.g. input(pattern=/"/.source)) (#20547, #20572)
• Underline the correct occurrence of an unsupported data type in --value(…) warnings (#20554)
• Canonicalization: prefer an existing candidate when collapsing utilities over another utility with the same default theme value (e.g. text-foreground text-primary → text-primary, not text-card-checked-border) (#20540)
• Canonicalization: don't collapse utilities into a utility that uses another theme variable with the same default value (e.g. mt-card mb-card → my-card, not my-4) (#20574)
• Ensure @tailwindcss/postcss rewrites relative url(…)s of stylesheets that are inlined before it runs (e.g. @imports in Vite) in optimized builds (#20576)
• Drop nested rules that put a combinator after a pseudo-element when using pseudo-element variants (e.g. selection:* on a utility with a nested & > * rule) (#20575)
• Don't generate CSS for arbitrary values with unbalanced parentheses or brackets (e.g. w-[calc(1px] or [--x:a[b]) (#20577)
• Canonicalization: prevent collapse: true from taking exponentially longer when classes are linked through a utility that sets many properties (e.g. sr-only) (#20558)
• Ensure & is substituted inside :-moz-any(…) and :-webkit-any(…) in custom variants (e.g. @custom-variant firefox (:-moz-any(&));) (#20486)
• Ensure the standalone macOS binaries have a valid code signature, so macOS 27 no longer kills them at launch (#20578)
• Ensure @tailwindcss/turbopack and @tailwindcss/webpack rebuild when the input CSS changes (e.g. next dev with Turbopack no longer serves the CSS of the previous edit) (#20582)
• Canonicalization: don't drop a utility that sets a --tw-* variable when an unrelated property has the same value (e.g. link mt-4 no longer becomes mt-4 when link sets margin-top: 16px and --tw-translate-x: 16px) (#20593)

... (truncated)

Changelog

Sourced from @​tailwindcss/postcss's changelog.

[4.3.4] - 2026-11-02

Added

• Add @tailwindcss/turbopack, a Turbopack loader for using Tailwind CSS with Next.js (#20367)

Fixed

• Ensure watch mode detects changes to symlinked @source files whose real paths aren't otherwise scanned (#20356)
• Ensure variants using @scope wrap generated utilities instead of nesting inside them (#20369)
• Ensure nested @scope rules preserve their scoping semantics when flattened (#20369)
• Preserve declarations directly inside @scope by wrapping them in :where(:scope) (#20369)
• Ensure generated utilities include a space in empty var() fallbacks (e.g. var(--tw-blur,) → var(--tw-blur, )) (#20373)
• Canonicalization: convert arbitrary breakpoint and container query variants to named equivalents (e.g. max-[64rem]:flex → max-lg:flex) (#20380)
• Prevent @tailwindcss/vite from crashing on every edit under Vite's experimental bundledDev mode (#20379)
• Ensure @tailwindcss/oxide falls back to WASM on platforms without native bindings (#20383)
• Extract class candidates from Ruby %w and %W literals using angle brackets or custom delimiters (e.g. %w<flex>, %w|flex|), including in Slim and Haml templates (#20387)
• Preserve whitespace in --default(…) values in functional @utility definitions (e.g. --default(box alphabetic) no longer becomes boxalphabetic) (#20392)
• Ensure automatic source detection respects negation-based .gitignore files (e.g. /* followed by !/… patterns) (#20397)
• Ensure root theme('…') namespace lookups in JavaScript plugins and config files return the full namespace object instead of the value of its DEFAULT key (#20399)
• Skip ignored directories when generating watch globs instead of walking their contents on every rebuild (#20408)
• Drop invalid UTF-8 candidates during class detection (#20389)
• Prevent @tailwindcss/vite from forcing full-page reloads for scanned files that Vite does not handle as modules (e.g. .php files) (#20414)
• Canonicalization: don't merge utilities that reference different theme variables set to CSS-wide keywords like unset (#20417)
• Don't generate utilities when a modifier is used that would otherwise be silently ignored (e.g. rounded-sm/[5], shadow-sm/foo, stroke-2/50) (#20419)
• Preserve and, or, and not inside selectors in supports-[…] variants (e.g. supports-[selector(a:not(.foo))]:flex) (#20420)
• Don't warn about Angular's ::ng-deep and :host-context() when optimizing CSS (#20434)
• Don't generate CSS for candidates containing an empty additional modifier (e.g. bg-red-500/50/ and group-hover/foo//bar:flex) (#20466)
• Ensure min-*, max-*, and container query variants with decimal values are sorted numerically (e.g. min-[40.25rem] before min-[40.5rem]) (#20512)
• Ensure CSS comments ending with \*/ are closed correctly instead of swallowing the CSS that follows (e.g. /* C:\temp\*/) (#20508)
• Improve style invalidation performance of group-* and peer-* variants (#20513)
• Ensure cached compilers release their loadModule and loadStylesheet callbacks after compilation (#20531)
• Canonicalization: preserve & when moving a pseudo-element into * or ** (e.g. [&_::before]:flex → **:[&::before]:flex) (#20550)
• Ensure the Set.prototype.intersection polyfill in canonicalizeCandidates(…) returns the intersection instead of the first set on Node.js < 22 (#20562)
• Canonicalization: ensure inline theme(…) alphas with more than 2 decimals migrate to a percentage modifier with the same opacity (e.g. theme(colors.red.500/.12345) → text-red-500/[12.345%], not text-red-500/[12.345]) (#20563)
• Canonicalization: preserve inline theme(…) alphas as an arbitrary percentage when a custom --opacity-* theme value would change the opacity (e.g. theme(colors.red.500/50%) → text-red-500/[50%] with --opacity-50: 10%) (#20563)
• Ensure the @property fallback isn't applied in Safari versions that no longer support margin-trim: inline (#20569)
• Treat viewport units like dvmin and svi and font-relative units like cap and rex as lengths in arbitrary values (e.g. text-[10dvmin] generates font-size instead of color) (#20516)
• Write plugin logs to stderr in tailwindcss canonicalize so they don't end up in the results on stdout (#20561)
• Extract class shorthands on later lines when Pug text, comments, or quoted attribute values contain unbalanced brackets, or a quote that doesn't start a string (e.g. input(pattern=/"/.source)) (#20547, #20572)
• Underline the correct occurrence of an unsupported data type in --value(…) warnings (#20554)
• Canonicalization: prefer an existing candidate when collapsing utilities over another utility with the same default theme value (e.g. text-foreground text-primary → text-primary, not text-card-checked-border) (#20540)
• Canonicalization: don't collapse utilities into a utility that uses another theme variable with the same default value (e.g. mt-card mb-card → my-card, not my-4) (#20574)
• Ensure @tailwindcss/postcss rewrites relative url(…)s of stylesheets that are inlined before it runs (e.g. @imports in Vite) in optimized builds (#20576)
• Drop nested rules that put a combinator after a pseudo-element when using pseudo-element variants (e.g. selection:* on a utility with a nested & > * rule) (#20575)
• Don't generate CSS for arbitrary values with unbalanced parentheses or brackets (e.g. w-[calc(1px] or [--x:a[b]) (#20577)
• Canonicalization: prevent collapse: true from taking exponentially longer when classes are linked through a utility that sets many properties (e.g. sr-only) (#20558)
• Ensure & is substituted inside :-moz-any(…) and :-webkit-any(…) in custom variants (e.g. @custom-variant firefox (:-moz-any(&));) (#20486)
• Ensure the standalone macOS binaries have a valid code signature, so macOS 27 no longer kills them at launch (#20578)
• Ensure @tailwindcss/turbopack and @tailwindcss/webpack rebuild when the input CSS changes (e.g. next dev with Turbopack no longer serves the CSS of the previous edit) (#20582)

... (truncated)

Commits

• 2626ae6 4.3.4 (#20447)
• e8f8b19 Rewrite url(…)s of stylesheets inlined before @tailwindcss/postcss in opt...
• 931db16 Use margin-trim: block in the @property fallback detection (#20569)
• 05c3a87 Bump dependencies (#20381)
• See full diff in compare view

Updates tailwindcss from 4.3.3 to 4.3.4

Release notes

Sourced from tailwindcss's releases.

v4.3.4

Added

• Add @tailwindcss/turbopack, a Turbopack loader for using Tailwind CSS with Next.js (#20367)

Fixed

• Ensure watch mode detects changes to symlinked @source files whose real paths aren't otherwise scanned (#20356)
• Ensure variants using @scope wrap generated utilities instead of nesting inside them (#20369)
• Ensure nested @scope rules preserve their scoping semantics when flattened (#20369)
• Preserve declarations directly inside @scope by wrapping them in :where(:scope) (#20369)
• Ensure generated utilities include a space in empty var() fallbacks (e.g. var(--tw-blur,) → var(--tw-blur, )) (#20373)
• Canonicalization: convert arbitrary breakpoint and container query variants to named equivalents (e.g. max-[64rem]:flex → max-lg:flex) (#20380)
• Prevent @tailwindcss/vite from crashing on every edit under Vite's experimental bundledDev mode (#20379)
• Ensure @tailwindcss/oxide falls back to WASM on platforms without native bindings (#20383)
• Extract class candidates from Ruby %w and %W literals using angle brackets or custom delimiters (e.g. %w<flex>, %w|flex|), including in Slim and Haml templates (#20387)
• Preserve whitespace in --default(…) values in functional @utility definitions (e.g. --default(box alphabetic) no longer becomes boxalphabetic) (#20392)
• Ensure automatic source detection respects negation-based .gitignore files (e.g. /* followed by !/… patterns) (#20397)
• Ensure root theme('…') namespace lookups in JavaScript plugins and config files return the full namespace object instead of the value of its DEFAULT key (#20399)
• Skip ignored directories when generating watch globs instead of walking their contents on every rebuild (#20408)
• Drop invalid UTF-8 candidates during class detection (#20389)
• Prevent @tailwindcss/vite from forcing full-page reloads for scanned files that Vite does not handle as modules (e.g. .php files) (#20414)
• Canonicalization: don't merge utilities that reference different theme variables set to CSS-wide keywords like unset (#20417)
• Don't generate utilities when a modifier is used that would otherwise be silently ignored (e.g. rounded-sm/[5], shadow-sm/foo, stroke-2/50) (#20419)
• Preserve and, or, and not inside selectors in supports-[…] variants (e.g. supports-[selector(a:not(.foo))]:flex) (#20420)
• Don't warn about Angular's ::ng-deep and :host-context() when optimizing CSS (#20434)
• Don't generate CSS for candidates containing an empty additional modifier (e.g. bg-red-500/50/ and group-hover/foo//bar:flex) (#20466)
• Ensure min-*, max-*, and container query variants with decimal values are sorted numerically (e.g. min-[40.25rem] before min-[40.5rem]) (#20512)
• Ensure CSS comments ending with \*/ are closed correctly instead of swallowing the CSS that follows (e.g. /* C:\temp\*/) (#20508)
• Improve style invalidation performance of group-* and peer-* variants (#20513)
• Ensure cached compilers release their loadModule and loadStylesheet callbacks after compilation (#20531)
• Canonicalization: preserve & when moving a pseudo-element into * or ** (e.g. [&_::before]:flex → **:[&::before]:flex) (#20550)
• Ensure the Set.prototype.intersection polyfill in canonicalizeCandidates(…) returns the intersection instead of the first set on Node.js < 22 (#20562)
• Canonicalization: ensure inline theme(…) alphas with more than 2 decimals migrate to a percentage modifier with the same opacity (e.g. theme(colors.red.500/.12345) → text-red-500/[12.345%], not text-red-500/[12.345]) (#20563)
...

Description has been truncated

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
vecstore-sdk	Ready	Preview	Nov 5, 2026 10:08pm UTC

[changeset-bot]

⚠️ No Changeset found

Latest commit: 1e60ebb

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 2d6b392f-9a2f-4a23-bc13-6983f410af31

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​electric-sql/​pglite-pgvector@​0.0.14 ⏵ 0.0.15	+1			+1
	tailwindcss@​4.3.3 ⏵ 4.3.4	+1		+1
	ultracite@​8.1.0 ⏵ 8.1.1			+1
	oxlint-plugin-react-doctor@​0.9.18 ⏵ 0.9.22	+1		+1
	@​electric-sql/​pglite@​0.5.13 ⏵ 0.5.14			+1	+1
	@​tailwindcss/​postcss@​4.3.3 ⏵ 4.3.4	+1		+1

View full report

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/vecstore-sdk@78

commit: 1e60ebb

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.