Skip to content

chore(deps): bump tailwindcss from 4.3.2 to 4.3.3#117

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/tailwindcss-4.3.3
Closed

chore(deps): bump tailwindcss from 4.3.2 to 4.3.3#117
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/tailwindcss-4.3.3

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 17, 2026 •
edited
Loading

Copy link
Copy Markdown

Bumps tailwindcss from 4.3.2 to 4.3.3.

Release notes

Sourced from tailwindcss's releases.

v4.3.3

Fixed

  • Support --watch --poll[=ms] in @tailwindcss/cli when filesystem events are unreliable or unavailable (#20297)
  • Canonicalization: match arbitrary hex colors against theme colors case-insensitively (e.g. bg-[#fff] and bg-[#FFF] → bg-white) (#20298)
  • Prevent Preflight from overriding Firefox's native iframe:focus-visible outline styles (#20292)
  • Ensure theme('colors.foo') in JS plugins resolves correctly when both --color-foo and --color-foo-bar exist (#20299)
  • Ensure fractional opacity modifiers work with named shadow sizes like shadow-sm/12.5, text-shadow-sm/12.5, drop-shadow-sm/12.5, and inset-shadow-sm/12.5 (#20302)
  • Parse selectors like [data-foo]div as two selectors instead of one (#20303)
  • Ensure @tailwindcss/postcss rebuilds when a preprocessor like Sass changes the input CSS without changing the input file on disk (#20310)
  • Ensure CSS nesting is handled even when Lightning CSS isn't run, such as in @tailwindcss/browser and Tailwind Play (#20124)
  • Prevent achromatic theme colors from shifting hue when mixed in polar color spaces like oklch (#20314)
  • Ensure --spacing(0) is optimized to 0px instead of 0 so it remains a <length> when used in calc(…) (#20319)
  • Load @parcel/watcher only when needed in @tailwindcss/cli --watch mode, so one-off builds and --watch --poll work when @parcel/watcher can't be loaded (#20325)
  • Use explicit platform fonts instead of system-ui and ui-sans-serif so CJK text respects the page's lang attribute on Windows (#20318)
  • Prevent @tailwindcss/upgrade from rewriting ignored files when run from a subdirectory (#20329)
  • Ensure earlier @source rules pointing to nested files are scanned when later @source rules point to files in parent folders (#20335)
  • Prevent @tailwindcss/vite from triggering full page reloads when scanned files are processed by Vite but haven't been loaded as modules yet (#20336)
Changelog

Sourced from tailwindcss's changelog.

[4.3.3] - 2026-07-16

Fixed

  • Support --watch --poll[=ms] in @tailwindcss/cli when filesystem events are unreliable or unavailable (#20297)
  • Canonicalization: match arbitrary hex colors against theme colors case-insensitively (e.g. bg-[#fff] and bg-[#FFF] → bg-white) (#20298)
  • Prevent Preflight from overriding Firefox's native iframe:focus-visible outline styles (#20292)
  • Ensure theme('colors.foo') in JS plugins resolves correctly when both --color-foo and --color-foo-bar exist (#20299)
  • Ensure fractional opacity modifiers work with named shadow sizes like shadow-sm/12.5, text-shadow-sm/12.5, drop-shadow-sm/12.5, and inset-shadow-sm/12.5 (#20302)
  • Parse selectors like [data-foo]div as two selectors instead of one (#20303)
  • Ensure @tailwindcss/postcss rebuilds when a preprocessor like Sass changes the input CSS without changing the input file on disk (#20310)
  • Ensure CSS nesting is handled even when Lightning CSS isn't run, such as in @tailwindcss/browser and Tailwind Play (#20124)
  • Prevent achromatic theme colors from shifting hue when mixed in polar color spaces like oklch (#20314)
  • Ensure --spacing(0) is optimized to 0px instead of 0 so it remains a <length> when used in calc(…) (#20319)
  • Load @parcel/watcher only when needed in @tailwindcss/cli --watch mode, so one-off builds and --watch --poll work when @parcel/watcher can't be loaded (#20325)
  • Use explicit platform fonts instead of system-ui and ui-sans-serif so CJK text respects the page's lang attribute on Windows (#20318)
  • Prevent @tailwindcss/upgrade from rewriting ignored files when run from a subdirectory (#20329)
  • Ensure earlier @source rules pointing to nested files are scanned when later @source rules point to files in parent folders (#20335)
  • Prevent @tailwindcss/vite from triggering full page reloads when scanned files are processed by Vite but haven't been loaded as modules yet (#20336)
Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 17, 2026
@dependabot
chore(deps): bump tailwindcss from 4.3.2 to 4.3.3
50a7ed1 
Bumps [tailwindcss](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss) from 4.3.2 to 4.3.3.
- [Release notes](https://github.com/tailwindlabs/tailwindcss/releases)
- [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md)
- [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.3.3/packages/tailwindcss)

---
updated-dependencies:
- dependency-name: tailwindcss
  dependency-version: 4.3.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/tailwindcss-4.3.3 branch from 20c6034 to 50a7ed1 Compare July 17, 2026 20:20
agjs added a commit that referenced this pull request Jul 20, 2026
@agjs
chore(deps): consolidate the 14 dependabot bumps (#164)
b7f8bfa 
* chore(deps): consolidate the 14 open dependabot bumps

Single PR superseding the open dependabot PRs:
- fast-check 3.23.2 → 4.9.0 (packages/core) — full suite green on v4 (#93/#99)
- astro 7.0.9 → 7.1.3 (root + apps/docs) — clears GHSA-4g3v-8h47-v7g6 (#158/#162)
- @astrojs/react 5.0.6 → 6.0.1 (#114), @astrojs/sitemap 3.7.2 → 3.7.3 (#116)
- astro-mermaid 2.0.1 → 2.1.0 (#119)
- tailwindcss + @tailwindcss/vite 4.3.2 → 4.3.3 (#115/#117)
- wrangler 4.110.0/4.111.0 → 4.112.0 (#161), @ast-grep/cli 0.43.0 → 0.44.1 (#118)

Validated: typecheck + lint + full suite (2820) green. Docs build + osv run by CI.
NOTE: the transitive brace-expansion CVE (not a dependabot PR) is separate and may
still need an override; GH Actions bumps (#160 checkout, #112 lychee) are workflow
YAML, follow-up.

* fix(deps): pin brace-expansion to patched 5.0.7 (CVE-2026-13149)

New high-severity ReDoS advisory CVE-2026-13149 / GHSA-3jxr-9vmj-r5cp (published
~2026-07-20 21:00) affects brace-expansion <1.1.16 / <2.1.2 / <5.0.7. The lockfile
had 1.1.15 and 5.0.6 (transitive via eslint→minimatch/glob — a real runtime dep of
the published package, so it is FIXED, not ignored). Override forces all instances
to 5.0.7 (patched; API is a single stable expand() fn across majors). typecheck +
lint (uses minimatch/glob) + full suite green.

* fix(deps): pin js-yaml to patched 4.3.0 (GHSA-52cp-r559-cp3m)

The astro/tooling bumps pulled js-yaml 4.2.0 (High ReDoS, GHSA-52cp-r559-cp3m,
fixed 4.3.0). Transitive, 4.x only (no 3.x consumers) → override to 4.3.0.
osv-scanner local run: 'No issues found', exit 0. typecheck + lint + full suite green.
@agjs

agjs commented Jul 20, 2026

Copy link
Copy Markdown
Owner

Superseded by #164 (consolidated dependabot bumps), merged to main.

@agjs agjs closed this Jul 20, 2026
@dependabot @github

dependabot Bot commented on behalf of github Jul 20, 2026

Copy link
Copy Markdown
Author

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/tailwindcss-4.3.3 branch July 20, 2026 22:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@agjs