[dependabot]

Bumps the web-development group with 9 updates in the /apps/web directory:

Package	From	To
@next/bundle-analyzer	16.4.2	16.4.6
@playwright/test	1.64.1	1.65.0
@tailwindcss/cli	4.3.3	4.3.5
@tailwindcss/postcss	4.3.3	4.3.5
@types/google.maps	3.66.9	3.66.10
baseline-browser-mapping	2.11.34	2.11.35
dotenv	18.0.9	18.0.10
eslint-config-next	16.4.2	16.4.6
tailwindcss	4.3.3	4.3.5

Updates @next/bundle-analyzer from 16.4.2 to 16.4.6

Release notes

Sourced from @​next/bundle-analyzer's releases.

v16.4.6

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• [lts-active] Pin Tailwind to 4.3.3 in create-next-app and tests (#101061, #101176) (#101307)
• [lts-active] Automatically compress route handler responses if not already compressed (#101280)
• [lts-active] Turbopack GC fixes for dev (#100279, #100370) (#101308)

Credits

Huge thanks to @​lukesandberg and @​eps1lon for helping!

v16.4.5

This release contains security fixes for the following advisories:

Moderate

• Cross-tenant sensitive information disclosure in Next.js 'use cache' when called through unstable_cache
• Cache leak across root param values in nested 'use cache' functions (follow-up)
• Cache poisoning of shared fallback shells in Cache Components via request-supplied placeholder route params
• Cross-user cache disclosure and poisoning in Next.js use cache with binary arguments
• Cross-client response injection and disclosure in self-hosted Next.js applications forwarding fetched responses
• SVG rejection bypass in Next.js image optimization
• HttpOnly cookie exposure through internal response header on Next.js Edge runtime routes

v16.4.4

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary. The announced security released for November will be published tomorrow.

Core Changes

• [lts-active] test: disable the reads fallback params after a client navigation deployment test (#100668)
• [lts-active] Reload on missed Turbopack startup CSS updates (#100619)
• [lts-active] Revert "Optimize strict module factory chunks (#98421)" (#100866)
• [lts-active] Emit the Turbopack shared-runtime bootstrap in the PPR resume so it gets the CSP nonce (#100907)
• [lts-active] [ci] Pin deploy test deployments to Node.js 22.x (#100886)
• [lts-active] fix(analyze): use route summaries as the analyzer route index (#100974)
• [lts-active] Use fast-jwt instead of jsonwebtoken (#100885)

Credits

Huge thanks to @​icyJoseph, @​mischnic, @​wbinnssmith, @​lukesandberg, and @​eps1lon for helping!

v16.4.3

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

... (truncated)

Commits

• 54b876b v16.4.6
• 4e5335a v16.4.5
• b175f52 v16.4.4
• 29bbeab v16.4.3
• See full diff in compare view

Updates @playwright/test from 1.64.1 to 1.65.0

Release notes

Sourced from @​playwright/test's releases.

v1.65.0

🥟 Run tests with Bun

The test runner now runs under Bun. Bun transpiles your TypeScript test files itself, so Playwright does not use Babel or its compilation cache. Pass the --bun flag, because without it bunx playwright test runs on Node.js:

bunx --bun playwright test

Our CI runs the test runner tests under Bun 1.4.3 on Linux. Some features work differently under Bun:

• There is no watch mode. UI mode does not run tests again when files change, and --only-changed does not follow imports.
• Bun loads modules itself, so --tsconfig and the JSX options in tsconfig.json have no effect, and custom ESM loaders are not supported.
• Stack traces do not include async frames, and API names do not include the class name: click instead of locator.click. This changes some step locations, step titles and error messages.
• Console output of a test does not get into the trace and UI mode.

🚨 Reports with only failures

New failures reporter prints failures and successful retries as they occur, followed by a summary, without progress output.

New onlyFailures option of the HTML, JSON and JUnit reporters keeps only tests with unexpected outcomes, flaky tests and interrupted tests:

// playwright.config.ts
import { defineConfig } from '@playwright/test';
export default defineConfig({
reporter: [
['failures'],
['html', { onlyFailures: true }],
],
});

🎯 Test runner

• New built-in -exclusive- test lock runs a test only when no other tests are running. All other tests continue to run in parallel with each other:

  test('restart the server', { lock: '-exclusive-' }, async () => {
    // No other test runs while this one is running.
  });

• test.skip(), test.fixme(), test.fail() and test.slow() now accept only a description. It is recorded in the test annotation:

  test('upload a file', async ({ page }) => {
    test.skip('Not implemented yet');
  });

... (truncated)

Commits

• a1f35e1 chore: mark v1.65.0 (#43925)
• a99c1ab cherry-pick(#43918): Revert "fix(docker): use latest stable Chrome for Testin...
• 6f9a7f5 cherry-pick(#43914): docs(release-notes): update Chromium version for 1.65
• daf93bb cherry-pick(#43912): feat(chromium): roll to r1254
• 6545e89 cherry-pick(#43902): chore(deps): bump runtime deps
• 0347448 fix(test runner): track shared ESM dependencies for only-changed (#43837)
• 86e6924 fix(clock): cancel real-time timer when replay ends paused (#43873)
• d745ae0 fix(route): wait for all active handlers before disabling interception (#43889)
• 6e3f5ff docs: release notes for v1.65 (#43874)
• aa33d27 fix(chromium): honor Linux config directories for channel connections (#43884)
• Additional commits viewable in compare view

Updates @tailwindcss/cli from 4.3.3 to 4.3.5

Release notes

Sourced from @​tailwindcss/cli's releases.

v4.3.5

Fixed

• Canonicalization: improve performance in projects with many functional variant values (e.g. a matchVariant plugin with thousands of values) (#20663)
• Don't crash or create a fallback with the wrong color for a color-mix(…) without a color interpolation method (e.g. color-mix(var(--color-red-500)) or color-mix(currentcolor 50%, transparent)) (#20658, #20666)
• Ensure @tailwindcss/oxide-wasm32-wasi loads instead of hanging forever (e.g. with NAPI_RS_FORCE_WASI=error or in WebContainers) (#20667)
• Remove as: '*.css' from the @tailwindcss/turbopack setup in its README, because it breaks CSS modules (#20660)
• Ignore <!-- and --> between top-level rules in CSS instead of throwing or swallowing the next rule (e.g. a { color: red } --> b { color: blue }) (#20665)
• Ensure @tailwindcss/oxide-wasm32-wasi detects changed and new source files after the first scan (e.g. in WebContainers) (#20487)
• Prevent type errors with skipLibCheck: false caused by imports of unshipped modules in the @tailwindcss/node type declarations (#20632)

v4.3.4

Added

• Add @tailwindcss/turbopack, a Turbopack loader for using Tailwind CSS with Next.js (#20367)

Fixed

• Ensure watch mode detects changes to symlinked @source files whose real paths aren't otherwise scanned (#20356)
• Ensure variants using @scope wrap generated utilities instead of nesting inside them (#20369)
• Ensure nested @scope rules preserve their scoping semantics when flattened (#20369)
• Preserve declarations directly inside @scope by wrapping them in :where(:scope) (#20369)
• Ensure generated utilities include a space in empty var() fallbacks (e.g. var(--tw-blur,) → var(--tw-blur, )) (#20373)
• Canonicalization: convert arbitrary breakpoint and container query variants to named equivalents (e.g. max-[64rem]:flex → max-lg:flex) (#20380)
• Prevent @tailwindcss/vite from crashing on every edit under Vite's experimental bundledDev mode (#20379)
• Ensure @tailwindcss/oxide falls back to WASM on platforms without native bindings (@tailwindcss/oxide-wasm32-wasi now installs on all platforms, but only loads when no native binding is available) (#20383)
• Extract class candidates from Ruby %w and %W literals using angle brackets or custom delimiters (e.g. %w<flex>, %w|flex|), including in Slim and Haml templates (#20387)
• Preserve whitespace in --default(…) values in functional @utility definitions (e.g. --default(box alphabetic) no longer becomes boxalphabetic) (#20392)
• Ensure automatic source detection respects negation-based .gitignore files (e.g. /* followed by !/… patterns) (#20397)
• Ensure root theme('…') namespace lookups in JavaScript plugins and config files return the full namespace object instead of the value of its DEFAULT key (#20399)
• Skip ignored directories when generating watch globs instead of walking their contents on every rebuild (#20408)
• Drop invalid UTF-8 candidates during class detection (#20389)
• Prevent @tailwindcss/vite from forcing full-page reloads for scanned files that Vite does not handle as modules (e.g. .php files) (#20414)
• Canonicalization: don't merge utilities that reference different theme variables set to CSS-wide keywords like unset (#20417)
• Don't generate utilities when a modifier is used that would otherwise be silently ignored (e.g. rounded-sm/[5], shadow-sm/foo, stroke-2/50) (#20419)
• Preserve and, or, and not inside selectors in supports-[…] variants (e.g. supports-[selector(a:not(.foo))]:flex) (#20420)
• Don't warn about Angular's ::ng-deep and :host-context() when optimizing CSS (#20434)
• Don't generate CSS for candidates containing an empty additional modifier (e.g. bg-red-500/50/ and group-hover/foo//bar:flex) (#20466)
• Ensure min-*, max-*, and container query variants with decimal values are sorted numerically (e.g. min-[40.25rem] before min-[40.5rem]) (#20512)
• Ensure CSS comments ending with \*/ are closed correctly instead of swallowing the CSS that follows (e.g. /* C:\temp\*/) (#20508)
• Improve style invalidation performance of group-* and peer-* variants (#20513)
• Ensure cached compilers release their loadModule and loadStylesheet callbacks after compilation (#20531)
• Canonicalization: preserve & when moving a pseudo-element into * or ** (e.g. [&_::before]:flex → **:[&::before]:flex) (#20550)
• Ensure the Set.prototype.intersection polyfill in canonicalizeCandidates(…) returns the intersection instead of the first set on Node.js < 22 (#20562)
• Canonicalization: ensure inline theme(…) alphas with more than 2 decimals migrate to a percentage modifier with the same opacity (e.g. theme(colors.red.500/.12345) → text-red-500/[12.345%], not text-red-500/[12.345]) (#20563)
• Canonicalization: preserve inline theme(…) alphas as an arbitrary percentage when a custom --opacity-* theme value would change the opacity (e.g. theme(colors.red.500/50%) → text-red-500/[50%] with --opacity-50: 10%) (#20563)
• Ensure the @property fallback isn't applied in Safari versions that no longer support margin-trim: inline (#20569)
• Treat viewport units like dvmin and svi and font-relative units like cap and rex as lengths in arbitrary values (e.g. text-[10dvmin] generates font-size instead of color) (#20516)
• Write plugin logs to stderr in tailwindcss canonicalize so they don't end up in the results on stdout (#20561)
• Extract class shorthands on later lines when Pug text, comments, or quoted attribute values contain unbalanced brackets, or a quote that doesn't start a string (e.g. input(pattern=/"/.source)) (#20547, #20572)

... (truncated)

Changelog

Sourced from @​tailwindcss/cli's changelog.

[4.3.5] - 2026-11-06

Fixed

• Canonicalization: improve performance in projects with many functional variant values (e.g. a matchVariant plugin with thousands of values) (#20663)
• Don't crash or create a fallback with the wrong color for a color-mix(…) without a color interpolation method (e.g. color-mix(var(--color-red-500)) or color-mix(currentcolor 50%, transparent)) (#20658, #20666)
• Ensure @tailwindcss/oxide-wasm32-wasi loads instead of hanging forever (e.g. with NAPI_RS_FORCE_WASI=error or in WebContainers) (#20667)
• Remove as: '*.css' from the @tailwindcss/turbopack setup in its README, because it breaks CSS modules (#20660)
• Ignore <!-- and --> between top-level rules in CSS instead of throwing or swallowing the next rule (e.g. a { color: red } --> b { color: blue }) (#20665)
• Ensure @tailwindcss/oxide-wasm32-wasi detects changed and new source files after the first scan (e.g. in WebContainers) (#20487)
• Prevent type errors with skipLibCheck: false caused by imports of unshipped modules in the @tailwindcss/node type declarations (#20632)

[4.3.4] - 2026-11-02

Added

• Add @tailwindcss/turbopack, a Turbopack loader for using Tailwind CSS with Next.js (#20367)

Fixed

• Ensure watch mode detects changes to symlinked @source files whose real paths aren't otherwise scanned (#20356)
• Ensure variants using @scope wrap generated utilities instead of nesting inside them (#20369)
• Ensure nested @scope rules preserve their scoping semantics when flattened (#20369)
• Preserve declarations directly inside @scope by wrapping them in :where(:scope) (#20369)
• Ensure generated utilities include a space in empty var() fallbacks (e.g. var(--tw-blur,) → var(--tw-blur, )) (#20373)
• Canonicalization: convert arbitrary breakpoint and container query variants to named equivalents (e.g. max-[64rem]:flex → max-lg:flex) (#20380)
• Prevent @tailwindcss/vite from crashing on every edit under Vite's experimental bundledDev mode (#20379)
• Ensure @tailwindcss/oxide falls back to WASM on platforms without native bindings (@tailwindcss/oxide-wasm32-wasi now installs on all platforms, but only loads when no native binding is available) (#20383)
• Extract class candidates from Ruby %w and %W literals using angle brackets or custom delimiters (e.g. %w<flex>, %w|flex|), including in Slim and Haml templates (#20387)
• Preserve whitespace in --default(…) values in functional @utility definitions (e.g. --default(box alphabetic) no longer becomes boxalphabetic) (#20392)
• Ensure automatic source detection respects negation-based .gitignore files (e.g. /* followed by !/… patterns) (#20397)
• Ensure root theme('…') namespace lookups in JavaScript plugins and config files return the full namespace object instead of the value of its DEFAULT key (#20399)
• Skip ignored directories when generating watch globs instead of walking their contents on every rebuild (#20408)
• Drop invalid UTF-8 candidates during class detection (#20389)
• Prevent @tailwindcss/vite from forcing full-page reloads for scanned files that Vite does not handle as modules (e.g. .php files) (#20414)
• Canonicalization: don't merge utilities that reference different theme variables set to CSS-wide keywords like unset (#20417)
• Don't generate utilities when a modifier is used that would otherwise be silently ignored (e.g. rounded-sm/[5], shadow-sm/foo, stroke-2/50) (#20419)
• Preserve and, or, and not inside selectors in supports-[…] variants (e.g. supports-[selector(a:not(.foo))]:flex) (#20420)
• Don't warn about Angular's ::ng-deep and :host-context() when optimizing CSS (#20434)
• Don't generate CSS for candidates containing an empty additional modifier (e.g. bg-red-500/50/ and group-hover/foo//bar:flex) (#20466)
• Ensure min-*, max-*, and container query variants with decimal values are sorted numerically (e.g. min-[40.25rem] before min-[40.5rem]) (#20512)
• Ensure CSS comments ending with \*/ are closed correctly instead of swallowing the CSS that follows (e.g. /* C:\temp\*/) (#20508)
• Improve style invalidation performance of group-* and peer-* variants (#20513)
• Ensure cached compilers release their loadModule and loadStylesheet callbacks after compilation (#20531)
• Canonicalization: preserve & when moving a pseudo-element into * or ** (e.g. [&_::before]:flex → **:[&::before]:flex) (#20550)
• Ensure the Set.prototype.intersection polyfill in canonicalizeCandidates(…) returns the intersection instead of the first set on Node.js < 22 (#20562)
• Canonicalization: ensure inline theme(…) alphas with more than 2 decimals migrate to a percentage modifier with the same opacity (e.g. theme(colors.red.500/.12345) → text-red-500/[12.345%], not text-red-500/[12.345]) (#20563)
• Canonicalization: preserve inline theme(…) alphas as an arbitrary percentage when a custom --opacity-* theme value would change the opacity (e.g. theme(colors.red.500/50%) → text-red-500/[50%] with --opacity-50: 10%) (#20563)
• Ensure the @property fallback isn't applied in Safari versions that no longer support margin-trim: inline (#20569)
• Treat viewport units like dvmin and svi and font-relative units like cap and rex as lengths in arbitrary values (e.g. text-[10dvmin] generates font-size instead of color) (#20516)

... (truncated)

Commits

• 9b2c925 4.3.5 (#20672)
• 2626ae6 4.3.4 (#20447)
• 1a38f84 Write plugin logs to stderr in canonicalize (#20561)
• 9798a8a fix: correct two comment typos (#20507)
• 05c3a87 Bump dependencies (#20381)
• See full diff in compare view

Updates @tailwindcss/postcss from 4.3.3 to 4.3.5

Release notes

Sourced from @​tailwindcss/postcss's releases.

v4.3.5

Fixed

• Canonicalization: improve performance in projects with many functional variant values (e.g. a matchVariant plugin with thousands of values) (#20663)
• Don't crash or create a fallback with the wrong color for a color-mix(…) without a color interpolation method (e.g. color-mix(var(--color-red-500)) or color-mix(currentcolor 50%, transparent)) (#20658, #20666)
• Ensure @tailwindcss/oxide-wasm32-wasi loads instead of hanging forever (e.g. with NAPI_RS_FORCE_WASI=error or in WebContainers) (#20667)
• Remove as: '*.css' from the @tailwindcss/turbopack setup in its README, because it breaks CSS modules (#20660)
• Ignore <!-- and --> between top-level rules in CSS instead of throwing or swallowing the next rule (e.g. a { color: red } --> b { color: blue }) (#20665)
• Ensure @tailwindcss/oxide-wasm32-wasi detects changed and new source files after the first scan (e.g. in WebContainers) (#20487)
• Prevent type errors with skipLibCheck: false caused by imports of unshipped modules in the @tailwindcss/node type declarations (#20632)

v4.3.4

Added

• Add @tailwindcss/turbopack, a Turbopack loader for using Tailwind CSS with Next.js (#20367)

Fixed

• Ensure watch mode detects changes to symlinked @source files whose real paths aren't otherwise scanned (#20356)
• Ensure variants using @scope wrap generated utilities instead of nesting inside them (#20369)
• Ensure nested @scope rules preserve their scoping semantics when flattened (#20369)
• Preserve declarations directly inside @scope by wrapping them in :where(:scope) (#20369)
• Ensure generated utilities include a space in empty var() fallbacks (e.g. var(--tw-blur,) → var(--tw-blur, )) (#20373)
• Canonicalization: convert arbitrary breakpoint and container query variants to named equivalents (e.g. max-[64rem]:flex → max-lg:flex) (#20380)
• Prevent @tailwindcss/vite from crashing on every edit under Vite's experimental bundledDev mode (#20379)
• Ensure @tailwindcss/oxide falls back to WASM on platforms without native bindings (@tailwindcss/oxide-wasm32-wasi now installs on all platforms, but only loads when no native binding is available) (#20383)
• Extract class candidates from Ruby %w and %W literals using angle brackets or custom delimiters (e.g. %w<flex>, %w|flex|), including in Slim and Haml templates (#20387)
• Preserve whitespace in --default(…) values in functional @utility definitions (e.g. --default(box alphabetic) no longer becomes boxalphabetic) (#20392)
• Ensure automatic source detection respects negation-based .gitignore files (e.g. /* followed by !/… patterns) (#20397)
• Ensure root theme('…') namespace lookups in JavaScript plugins and config files return the full namespace object instead of the value of its DEFAULT key (#20399)
• Skip ignored directories when generating watch globs instead of walking their contents on every rebuild (#20408)
• Drop invalid UTF-8 candidates during class detection (#20389)
• Prevent @tailwindcss/vite from forcing full-page reloads for scanned files that Vite does not handle as modules (e.g. .php files) (#20414)
• Canonicalization: don't merge utilities that reference different theme variables set to CSS-wide keywords like unset (#20417)
• Don't generate utilities when a modifier is used that would otherwise be silently ignored (e.g. rounded-sm/[5], shadow-sm/foo, stroke-2/50) (#20419)
• Preserve and, or, and not inside selectors in supports-[…] variants (e.g. supports-[selector(a:not(.foo))]:flex) (#20420)
• Don't warn about Angular's ::ng-deep and :host-context() when optimizing CSS (#20434)
• Don't generate CSS for candidates containing an empty additional modifier (e.g. bg-red-500/50/ and group-hover/foo//bar:flex) (#20466)
• Ensure min-*, max-*, and container query variants with decimal values are sorted numerically (e.g. min-[40.25rem] before min-[40.5rem]) (#20512)
• Ensure CSS comments ending with \*/ are closed correctly instead of swallowing the CSS that follows (e.g. /* C:\temp\*/) (#20508)
• Improve style invalidation performance of group-* and peer-* variants (#20513)
• Ensure cached compilers release their loadModule and loadStylesheet callbacks after compilation (#20531)
• Canonicalization: preserve & when moving a pseudo-element into * or ** (e.g. [&_::before]:flex → **:[&::before]:flex) (#20550)
• Ensure the Set.prototype.intersection polyfill in canonicalizeCandidates(…) returns the intersection instead of the first set on Node.js < 22 (#20562)
• Canonicalization: ensure inline theme(…) alphas with more than 2 decimals migrate to a percentage modifier with the same opacity (e.g. theme(colors.red.500/.12345) → text-red-500/[12.345%], not text-red-500/[12.345]) (#20563)
• Canonicalization: preserve inline theme(…) alphas as an arbitrary percentage when a custom --opacity-* theme value would change the opacity (e.g. theme(colors.red.500/50%) → text-red-500/[50%] with --opacity-50: 10%) (#20563)
• Ensure the @property fallback isn't applied in Safari versions that no longer support margin-trim: inline (#20569)
• Treat viewport units like dvmin and svi and font-relative units like cap and rex as lengths in arbitrary values (e.g. text-[10dvmin] generates font-size instead of color) (#20516)
• Write plugin logs to stderr in tailwindcss canonicalize so they don't end up in the results on stdout (#20561)
• Extract class shorthands on later lines when Pug text, comments, or quoted attribute values contain unbalanced brackets, or a quote that doesn't start a string (e.g. input(pattern=/"/.source)) (#20547, #20572)

... (truncated)

Changelog

Sourced from @​tailwindcss/postcss's changelog.

[4.3.5] - 2026-11-06

Fixed

• Canonicalization: improve performance in projects with many functional variant values (e.g. a matchVariant plugin with thousands of values) (#20663)
• Don't crash or create a fallback with the wrong color for a color-mix(…) without a color interpolation method (e.g. color-mix(var(--color-red-500)) or color-mix(currentcolor 50%, transparent)) (#20658, #20666)
• Ensure @tailwindcss/oxide-wasm32-wasi loads instead of hanging forever (e.g. with NAPI_RS_FORCE_WASI=error or in WebContainers) (#20667)
• Remove as: '*.css' from the @tailwindcss/turbopack setup in its README, because it breaks CSS modules (#20660)
• Ignore <!-- and --> between top-level rules in CSS instead of throwing or swallowing the next rule (e.g. a { color: red } --> b { color: blue }) (#20665)
• Ensure @tailwindcss/oxide-wasm32-wasi detects changed and new source files after the first scan (e.g. in WebContainers) (#20487)
• Prevent type errors with skipLibCheck: false caused by imports of unshipped modules in the @tailwindcss/node type declarations (#20632)

[4.3.4] - 2026-11-02

Added

• Add @tailwindcss/turbopack, a Turbopack loader for using Tailwind CSS with Next.js (#20367)

Fixed

• Ensure watch mode detects changes to symlinked @source files whose real paths aren't otherwise scanned (#20356)
• Ensure variants using @scope wrap generated utilities instead of nesting inside them (#20369)
• Ensure nested @scope rules preserve their scoping semantics when flattened (#20369)
• Preserve declarations directly inside @scope by wrapping them in :where(:scope) (#20369)
• Ensure generated utilities include a space in empty var() fallbacks (e.g. var(--tw-blur,) → var(--tw-blur, )) (#20373)
• Canonicalization: convert arbitrary breakpoint and container query variants to named equivalents (e.g. max-[64rem]:flex → max-lg:flex) (#20380)
• Prevent @tailwindcss/vite from crashing on every edit under Vite's experimental bundledDev mode (#20379)
• Ensure @tailwindcss/oxide falls back to WASM on platforms without native bindings (@tailwindcss/oxide-wasm32-wasi now installs on all platforms, but only loads when no native binding is available) (#20383)
• Extract class candidates from Ruby %w and %W literals using angle brackets or custom delimiters (e.g. %w<flex>, %w|flex|), including in Slim and Haml templates (#20387)
• Preserve whitespace in --default(…) values in functional @utility definitions (e.g. --default(box alphabetic) no longer becomes boxalphabetic) (#20392)
• Ensure automatic source detection respects negation-based .gitignore files (e.g. /* followed by !/… patterns) (#20397)
• Ensure root theme('…') namespace lookups in JavaScript plugins and config files return the full namespace object instead of the value of its DEFAULT key (#20399)
• Skip ignored directories when generating watch globs instead of walking their contents on every rebuild (#20408)
• Drop invalid UTF-8 candidates during class detection (#20389)
• Prevent @tailwindcss/vite from forcing full-page reloads for scanned files that Vite does not handle as modules (e.g. .php files) (#20414)
• Canonicalization: don't merge utilities that reference different theme variables set to CSS-wide keywords like unset (#20417)
• Don't generate utilities when a modifier is used that would otherwise be silently ignored (e.g. rounded-sm/[5], shadow-sm/foo, stroke-2/50) (#20419)
• Preserve and, or, and not inside selectors in supports-[…] variants (e.g. supports-[selector(a:not(.foo))]:flex) (#20420)
• Don't warn about Angular's ::ng-deep and :host-context() when optimizing CSS (#20434)
• Don't generate CSS for candidates containing an empty additional modifier (e.g. bg-red-500/50/ and group-hover/foo//bar:flex) (#20466)
• Ensure min-*, max-*, and container query variants with decimal values are sorted numerically (e.g. min-[40.25rem] before min-[40.5rem]) (#20512)
• Ensure CSS comments ending with \*/ are closed correctly instead of swallowing the CSS that follows (e.g. /* C:\temp\*/) (#20508)
• Improve style invalidation performance of group-* and peer-* variants (#20513)
• Ensure cached compilers release their loadModule and loadStylesheet callbacks after compilation (#20531)
• Canonicalization: preserve & when moving a pseudo-element into * or ** (e.g. [&_::before]:flex → **:[&::before]:flex) (#20550)
• Ensure the Set.prototype.intersection polyfill in canonicalizeCandidates(…) returns the intersection instead of the first set on Node.js < 22 (#20562)
• Canonicalization: ensure inline theme(…) alphas with more than 2 decimals migrate to a percentage modifier with the same opacity (e.g. theme(colors.red.500/.12345) → text-red-500/[12.345%], not text-red-500/[12.345]) (#20563)
• Canonicalization: preserve inline theme(…) alphas as an arbitrary percentage when a custom --opacity-* theme value would change the opacity (e.g. theme(colors.red.500/50%) → text-red-500/[50%] with --opacity-50: 10%) (#20563)
• Ensure the @property fallback isn't applied in Safari versions that no longer support margin-trim: inline (#20569)
• Treat viewport units like dvmin and svi and font-relative units like cap and rex as lengths in arbitrary values (e.g. text-[10dvmin] generates font-size instead of color) (#20516)

... (truncated)

Commits

• 9b2c925 4.3.5 (#20672)
• 2626ae6 4.3.4 (#20447)
• e8f8b19 Rewrite url(…)s of stylesheets inlined before @tailwindcss/postcss in opt...
• 931db16 Use margin-trim: block in the @property fallback detection (#20569)
• 05c3a87 Bump dependencies (#20381)
• See full diff in compare view

Updates @types/google.maps from 3.66.9 to 3.66.10

Commits

• See full diff in compare view

Updates baseline-browser-mapping from 2.11.34 to 2.11.35

Commits

• cc41ca0 Patch to 2.11.35 because browser or feature data changed
• 75c7f38 Browser or feature data changed
• da69b21 Updating static site
• See full diff in compare view

Updates dotenv from 18.0.9 to 18.0.10

Changelog

Sourced from dotenv's changelog.

18.0.10 (2026-11-08)

Changed

• Fix dotenv.parse in Vite by moving the CLI shebang to a separate entry point (#1082)

Commits

• 7ed8f36 18.0.10
• 2c291ba Merge pull request #1082 from motdotla/dotenv-18-fe
• 9b4bf24 Changelog
• a3734e8 separate run to its own entry
• 3d11a6e npm audit fix
• 32ab610 Merge pull request #1078 from NgoQuocViet2001/fix-cli-ignored-signal-hang
• 7c67590 fix(cli): exit when the command dies from SIGPIPE
• c40119a Merge pull request #1077 from renanmpimentel/test/home-path-array
• 0084cb3 test: cover home expansion in path arrays
• 513aafd npm audit fix
• See full diff in compare view

Updates eslint-config-next from 16.4.2 to 16.4.6

Release notes

Sourced from eslint-config-next's releases.

v16.4.6

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• [lts-active] Pin Tailwind to 4.3.3 in create-next-app and tests (#101061, #101176) (#101307)
• [lts-active] Automatically compress route handler responses if not already compressed (#101280)
• [lts-active] Turbopack GC fixes for dev (#100279, #100370) (#101308)

Credits

Huge thanks to @​lukesandberg and @​eps1lon for helping!

v16.4.5

This release contains security fixes for the following advisories:

Moderate

• Cross-tenant sensitive information disclosure in Next.js 'use cache' when called through unstable_cache
• Cache leak across root param values in nested 'use cache' functions (follow-up)
• Cache poisoning of shared fallback shells in Cache Components via request-supplied placeholder route params
• Cross-user cache disclosure and poisoning in Next.js use cache with binary arguments
• Cross-client response injection and disclosure in self-hosted Next.js applications forwarding fetched responses
• SVG rejection bypass in Next.js image optimization
• HttpOnly cookie exposure through internal response header on Next.js Edge runtime routes

v16.4.4

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary. The announced security released for November will be published tomorrow.

Core Changes

• [lts-active] test: disable the reads fallback params after a client navigation deployment test (