[dependabot]

Bumps the npm-version-updates group with 21 updates in the / directory:

Package	From	To
openid-client	6.8.4	6.8.8
@builder.io/qwik	1.20.0	1.20.3
@builder.io/qwik-city	1.20.0	1.20.3
@commitlint/config-conventional	20.5.3	21.2.4
@eslint/js	9.39.4	10.0.1
@playwright/test	1.60.0	1.64.1
@tailwindcss/vite	4.3.0	4.3.3
@types/node	22.19.19	26.6.5
@zitadel/qwik-auth	1.1.7	1.1.8
eslint	9.39.4	10.13.0
eslint-plugin-qwik	1.20.0	1.20.3
globals	16.5.0	17.13.0
knip	5.88.1	6.43.0
prettier	3.8.3	3.9.10
prettier-plugin-tailwindcss	0.8.0	0.8.1
tailwindcss	4.3.0	4.3.3
typescript	5.9.3	7.0.2
typescript-eslint	8.60.0	8.72.0
typescript-plugin-css-modules	5.2.0	5.3.0
vite	7.3.5	8.3.5
vite-tsconfig-paths	4.3.2	6.1.1

Updates openid-client from 6.8.4 to 6.8.8

Release notes

Sourced from openid-client's releases.

v6.8.8

Fixes

• apply the default HTTP request timeout (af32783)
• calculate token lifetimes using elapsed time (e816bf0)
• isolate lazy client authentication handler caches (d687796)
• passport: handle rejected async verification callbacks (d730f80)
• preserve clock settings across DCR nonce retries (5433d68)
• release: separate changelog sections (57fcbc6)
• retain polling abort signals through response processing (b26170e)
• select a unique decryption key when kid is omitted (10ba026)

Refactor

• share grant polling lifecycle and retry handling (b931c40)

v6.8.7

Fixes

• allow destructuring the claims helper (38bd8c0), references #887

v6.8.6

Fixes

• avoid undefined user-agent in fetchProtectedResource (492c3c3), references #885

v6.8.5

Fixes

• types: expose custom fetch duplex option (a125bc8)
• types: use portable oauth4webapi declarations (2cab98f)

Documentation

• improve API index tables (c6e4ae3)
• update README.md and SECURITY.md to reflect passed EOL dates (d3721c2)

Changelog

Sourced from openid-client's changelog.

6.8.8 (2026-09-05)

Fixes

• apply the default HTTP request timeout (af32783)
• calculate token lifetimes using elapsed time (e816bf0)
• isolate lazy client authentication handler caches (d687796)
• passport: handle rejected async verification callbacks (d730f80)
• preserve clock settings across DCR nonce retries (5433d68)
• release: separate changelog sections (57fcbc6)
• retain polling abort signals through response processing (b26170e)
• select a unique decryption key when kid is omitted (10ba026)

Refactor

• share grant polling lifecycle and retry handling (b931c40)

6.8.7 (2026-08-20)

Fixes

• allow destructuring the claims helper (38bd8c0), references #887

6.8.6 (2026-08-18)

Fixes

• avoid undefined user-agent in fetchProtectedResource (492c3c3), references #885

6.8.5 (2026-08-11)

Fixes

• types: expose custom fetch duplex option (a125bc8)
• types: use portable oauth4webapi declarations (2cab98f)

Documentation

• improve API index tables (c6e4ae3)
• update README.md and SECURITY.md to reflect passed EOL dates (d3721c2)

Commits

• 04c5982 chore(release): 6.8.8
• 5eccf2e chore: bump packages
• d730f80 fix(passport): handle rejected async verification callbacks
• b931c40 refactor: share grant polling lifecycle and retry handling
• d687796 fix: isolate lazy client authentication handler caches
• e816bf0 fix: calculate token lifetimes using elapsed time
• 10ba026 fix: select a unique decryption key when kid is omitted
• b26170e fix: retain polling abort signals through response processing
• af32783 fix: apply the default HTTP request timeout
• 5433d68 fix: preserve clock settings across DCR nonce retries
• Additional commits viewable in compare view

Updates @builder.io/qwik from 1.20.0 to 1.20.3

Release notes

Sourced from @​builder.io/qwik's releases.

@​builder.io/qwik-city@1.20.3

Patch Changes

• 🐞🩹 ignore spoofable X-Forwarded-Host and X-Forwarded-Proto headers unless trustForwardedHeaders is enabled

• 🐞🩹 keep deeply nested form parsing work proportional

• 🐞🩹 prevent shared function pollution when parsing conflicting form field paths (by @​github-actions in #9274)

@​builder.io/qwik@1.20.3

No release notes provided.

@​builder.io/qwik-city@1.20.2

Patch Changes

• 🐞🩹 limit request bodies to 10 MiB by default in the Node, Deno, Bun, Cloudflare Pages, Netlify Edge and Vercel Edge adapters (and AWS Lambda / Firebase through Node); configurable with the new requestBodyLimit option (by @​github-actions in #9074)

• 🐞🩹 prevent private responses from entering shared Cloudflare caches (by @​Varixo in 0585c24)

• 🐞🩹 prevent excessive array lengths from form field indexes (by @​Varixo in b40324c)

• 🐞🩹 catch-all route matching no longer hangs on paths containing // (by @​wmertens in #9072)

• 🐞🩹 redirect() now strips ASCII tab/LF/CR from the URL, so targets like /<TAB>/example.com can no longer redirect to another origin (by @​github-actions in #9074)

@​builder.io/qwik@1.20.2

Patch Changes

• 🐞🩹 prevent development image tooling from requesting private network resources (by @​github-actions in #9074)

• 🐞🩹 dev server image auto fix endpoint accepted cross-site requests and paths outside src (by @​Varixo in 85efa68)

@​builder.io/qwik@1.20.1

Patch Changes

• Async functions in useComputed$ are no longer deprecated, since they now remain supported in Qwik v2. (by @​wmertens in #8888)

• ✨ qwik migrate-v2 now migrates renamed and removed APIs, tsconfig.json, package.json and Vite 8, adds options that keep the v1 behavior where v2 changed it, and lists the changes that need manual attention. (by @​Varixo in #9015)

• 🐞🩹 prevent unsafe virtual attribute names in server-rendered HTML (by @​github-actions in #9035)

• 🐞🩹 Rollup now has stable hashes with large parallel builds, so now Qwik doesn't enforce the workaround any more. (by @​wmertens in #8691)

• 🐞🩹 useConstant() now retains a null factory result instead of re-running the factory on every render. The retention guard changed from != null to !== undefined, so any defined value (including null) is cached for the lifetime of the component; only a factory that returns undefined is re-run on each render. (by @​youdie006 in #8827)

@​builder.io/qwik-city@1.20.1

Patch Changes

• 🐞🩹 prevent static middleware from reading files outside configured directories (by @​github-actions in #9035)

Changelog

Sourced from @​builder.io/qwik's changelog.

1.20.3

1.20.2

Patch Changes

• 🐞🩹 prevent development image tooling from requesting private network resources (by @​github-actions in #9074)

• 🐞🩹 dev server image auto fix endpoint accepted cross-site requests and paths outside src (by @​Varixo in 85efa68)

1.20.1

Patch Changes

• Async functions in useComputed$ are no longer deprecated, since they now remain supported in Qwik v2. (by @​wmertens in #8888)

• ✨ qwik migrate-v2 now migrates renamed and removed APIs, tsconfig.json, package.json and Vite 8, adds options that keep the v1 behavior where v2 changed it, and lists the changes that need manual attention. (by @​Varixo in #9015)

• 🐞🩹 prevent unsafe virtual attribute names in server-rendered HTML (by @​github-actions in #9035)

• 🐞🩹 Rollup now has stable hashes with large parallel builds, so now Qwik doesn't enforce the workaround any more. (by @​wmertens in #8691)

• 🐞🩹 useConstant() now retains a null factory result instead of re-running the factory on every render. The retention guard changed from != null to !== undefined, so any defined value (including null) is cached for the lifetime of the component; only a factory that returns undefined is re-run on each render. (by @​youdie006 in #8827)

Commits

• 26e9859 Version Packages
• b9e9d5c Version Packages
• f9dd695 Merge v1 and preserve image endpoint security tests
• 85efa68 fix(vite): confine the dev image fix endpoint
• f4b6239 fix(optimizer): prevent dev image tooling from requesting private network res...
• 249078d Version Packages
• c022fd6 fix: release version
• ddf5a58 Merge commit from fork
• 00ee4e4 refactor(cli): keep objectProperty private in migrate-v2
• b5c9268 refactor(cli): share the request handler export pattern in migrate-v2
• Additional commits viewable in compare view

Updates @builder.io/qwik-city from 1.20.0 to 1.20.3

Release notes

Sourced from @​builder.io/qwik-city's releases.

@​builder.io/qwik-city@1.20.3

Patch Changes

• 🐞🩹 ignore spoofable X-Forwarded-Host and X-Forwarded-Proto headers unless trustForwardedHeaders is enabled

• 🐞🩹 keep deeply nested form parsing work proportional

• 🐞🩹 prevent shared function pollution when parsing conflicting form field paths (by @​github-actions in #9274)

@​builder.io/qwik-city@1.20.2

Patch Changes

• 🐞🩹 limit request bodies to 10 MiB by default in the Node, Deno, Bun, Cloudflare Pages, Netlify Edge and Vercel Edge adapters (and AWS Lambda / Firebase through Node); configurable with the new requestBodyLimit option (by @​github-actions in #9074)

• 🐞🩹 prevent private responses from entering shared Cloudflare caches (by @​Varixo in 0585c24)

• 🐞🩹 prevent excessive array lengths from form field indexes (by @​Varixo in b40324c)

• 🐞🩹 catch-all route matching no longer hangs on paths containing // (by @​wmertens in #9072)

• 🐞🩹 redirect() now strips ASCII tab/LF/CR from the URL, so targets like /<TAB>/example.com can no longer redirect to another origin (by @​github-actions in #9074)

@​builder.io/qwik-city@1.20.1

Patch Changes

• 🐞🩹 prevent static middleware from reading files outside configured directories (by @​github-actions in #9035)

Changelog

Sourced from @​builder.io/qwik-city's changelog.

1.20.3

Patch Changes

• 🐞🩹 ignore spoofable X-Forwarded-Host and X-Forwarded-Proto headers unless trustForwardedHeaders is enabled

• 🐞🩹 keep deeply nested form parsing work proportional

• 🐞🩹 prevent shared function pollution when parsing conflicting form field paths (by @​github-actions in #9274)

1.20.2

Patch Changes

• 🐞🩹 limit request bodies to 10 MiB by default in the Node, Deno, Bun, Cloudflare Pages, Netlify Edge and Vercel Edge adapters (and AWS Lambda / Firebase through Node); configurable with the new requestBodyLimit option (by @​github-actions in #9074)

• 🐞🩹 prevent private responses from entering shared Cloudflare caches (by @​Varixo in 0585c24)

• 🐞🩹 prevent excessive array lengths from form field indexes (by @​Varixo in b40324c)

• 🐞🩹 catch-all route matching no longer hangs on paths containing // (by @​wmertens in #9072)

• 🐞🩹 redirect() now strips ASCII tab/LF/CR from the URL, so targets like /<TAB>/example.com can no longer redirect to another origin (by @​github-actions in #9074)

1.20.1

Patch Changes

• 🐞🩹 prevent static middleware from reading files outside configured directories (by @​github-actions in #9035)

Commits

• d1e4e38 fix: finalize v1.20.3 release preparation
• 2fec922 Merge pull request #9274 from QwikDev/changeset-release/v1
• 26e9859 Version Packages
• 2a08300 Merge commit from fork
• 6574c6e fix(qwik-city): ignore spoofable forwarded headers by default
• 934cd9a fix(qwik-city): keep deeply nested form parsing work proportional
• 5e95c55 fix(qwik-city): prevent unsafe form value traversal
• b9e9d5c Version Packages
• b45b6b3 test(qwik-city): fix Cloudflare Pages request-handler mock
• 33f2db5 Merge commit from fork
• Additional commits viewable in compare view

Updates @commitlint/config-conventional from 20.5.3 to 21.2.4

Release notes

Sourced from @​commitlint/config-conventional's releases.

v21.2.4

21.2.4 (2026-10-18)

Bug Fixes

• fix(load): replace config file arrays with seed arrays by @​escapedcat in conventional-changelog/commitlint#5056
• fix: update dependency jsonc to v3 by @​renovate[bot] in conventional-changelog/commitlint#5020

Performance Improvements

• perf(load): load typescript configs with jiti directly by @​escapedcat in conventional-changelog/commitlint#5052

Docs, etc

• docs: add AGENTS.md with commit type guidance by @​escapedcat in conventional-changelog/commitlint#5053
• test(ensure): pin case conversion of digits, punctuation and accents by @​escapedcat in conventional-changelog/commitlint#5055

Full Changelog: conventional-changelog/commitlint@v21.2.3...v21.2.4

v21.2.3

21.2.3 (2026-09-19)

Bug Fixes

• fix(types): correct breaking-change-exclamation-mark rule config type by @​lazerg in conventional-changelog/commitlint#4954
• fix(config-nx-scopes): read scopes from the nx project graph by @​dylanpulver in conventional-changelog/commitlint#4957
• fix(lint): trim trailing whitespace off the message handed to ignore matchers by @​dylanpulver in conventional-changelog/commitlint#4960
• fix(load): detect dynamic await support on node majors above 20 by @​dylanpulver in conventional-changelog/commitlint#4961
• fix(rules): report the case that matched in case rule failure messages by @​dylanpulver in conventional-changelog/commitlint#4962
• fix(load): run the parser factory of scoped conventional-changelog presets by @​maximilliangrand in conventional-changelog/commitlint#4968

Refactor

• refactor(load): drop the node version check gating cosmiconfig loaders by @​dylanpulver in conventional-changelog/commitlint#4972

Chore, ci, build, etc.

• build: install pnpm via npm instead of corepack by @​escapedcat in conventional-changelog/commitlint#4948
• build: retire the docker compose dev environment by @​escapedcat in conventional-changelog/commitlint#4949
• build: verify pnpm tarball against the packageManager sha512 pin by @​escapedcat in conventional-changelog/commitlint#4952
• ci: stabilize Windows CI by raising Vitest default timeout by @​escapedcat with @​Copilot in conventional-changelog/commitlint#4959
• docs: drop the Node 24 config-loading workaround note by @​escapedcat in conventional-changelog/commitlint#4976
• chore: move pnpm settings from .npmrc to pnpm-workspace.yaml by @​escapedcat in conventional-changelog/commitlint#4977
• chore: swap pnpm resolutionMode time-based for minimumReleaseAge by @​escapedcat in conventional-changelog/commitlint#4984

... (truncated)

Changelog

Sourced from @​commitlint/config-conventional's changelog.

21.2.4 (2026-10-18)

Note: Version bump only for package @​commitlint/config-conventional

21.2.3 (2026-09-19)

Bug Fixes

• rules: report the case that matched in case rule failure messages (#4962) (9f5f7bc)

21.2.2 (2026-08-13)

Note: Version bump only for package @​commitlint/config-conventional

21.2.0 (2026-06-30)

Features

• resolve-extends: resolve pure-ESM presets (conventional-changelog v7/v9/v10) (#4859) (fdb566f)

21.1.0 (2026-06-23)

Note: Version bump only for package @​commitlint/config-conventional

21.0.2 (2026-05-29)

Note: Version bump only for package @​commitlint/config-conventional

... (truncated)

Commits

• d8e3656 v21.2.4
• 95d4056 v21.2.3
• 9f5f7bc fix(rules): report the case that matched in case rule failure messages (#4962)
• d00d190 v21.2.2
• 3146d04 docs(config-conventional): document rules that go beyond the spec (#4910)
• f2e8dae chore: update dependency typescript to v7 (#4886)
• 1b4e5bc v21.2.0
• fdb566f feat(resolve-extends): resolve pure-ESM presets (conventional-changelog v7/v9...
• 6f1c0af v21.1.0
• 8069048 v21.0.2
• Additional commits viewable in compare view

Updates @eslint/js from 9.39.4 to 10.0.1

Release notes

Sourced from @​eslint/js's releases.

v10.0.1

Bug Fixes

• c87d5bd fix: update eslint (#20531) (renovate[bot])
• d841001 fix: update minimatch to 10.2.1 to address security vulnerabilities (#20519) (루밀LuMir)
• 04c2147 fix: update error message for unused suppressions (#20496) (fnx)
• 38b089c fix: update dependency @​eslint/config-array to ^0.23.1 (#20484) (renovate[bot])

Documentation

• 5b3dbce docs: add AI acknowledgement section to templates (#20431) (루밀LuMir)
• 6f23076 docs: toggle nav in no-JS mode (#20476) (Tanuj Kanti)
• b69cfb3 docs: Update README (GitHub Actions Bot)

Chores

• e5c281f chore: updates for v9.39.3 release (Jenkins)
• 8c3832a chore: update @​typescript-eslint/parser to ^8.56.0 (#20514) (Milos Djermanovic)
• 8330d23 test: add tests for config-api (#20493) (Milos Djermanovic)
• 37d6e91 chore: remove eslint v10 prereleases from eslint-config-eslint deps (#20494) (Milos Djermanovic)
• da7cd0e refactor: cleanup error message templates (#20479) (Francesco Trotta)
• 84fb885 chore: package.json update for @​eslint/js release (Jenkins)
• 1f66734 chore: add eslint to peerDependencies of @eslint/js (#20467) (Milos Djermanovic)

v10.0.0

Breaking Changes

• f9e54f4 feat!: estimate rule-tester failure location (#20420) (ST-DDT)
• a176319 feat!: replace chalk with styleText and add color to ResultsMeta (#20227) (루밀LuMir)
• c7046e6 feat!: enable JSX reference tracking (#20152) (Pixel998)
• fa31a60 feat!: add name to configs (#20015) (Kirk Waiblinger)
• 3383e7e fix!: remove deprecated SourceCode methods (#20137) (Pixel998)
• 501abd0 feat!: update dependency minimatch to v10 (#20246) (renovate[bot])
• ca4d3b4 fix!: stricter rule tester assertions for valid test cases (#20125) (唯然)
• 96512a6 fix!: Remove deprecated rule context methods (#20086) (Nicholas C. Zakas)
• c69fdac feat!: remove eslintrc support (#20037) (Francesco Trotta)
• 208b5cc feat!: Use ScopeManager#addGlobals() (#20132) (Milos Djermanovic)
• a2ee188 fix!: add uniqueItems: true in no-invalid-regexp option (#20155) (Tanuj Kanti)
• a89059d feat!: Program range span entire source text (#20133) (Pixel998)
• 39a6424 fix!: assert 'text' is a string across all RuleFixer methods (#20082) (Pixel998)
• f28fbf8 fix!: Deprecate "always" and "as-needed" options of the radix rule (#20223) (Milos Djermanovic)
• aa3fb2b fix!: tighten func-names schema (#20119) (Pixel998)
• f6c0ed0 feat!: report eslint-env comments as errors (#20128) (Francesco Trotta)
• 4bf739f fix!: remove deprecated LintMessage#nodeType and TestCaseError#type (#20096) (Pixel998)
• 523c076 feat!: drop support for jiti < 2.2.0 (#20016) (michael faith)
• 454a292 feat!: update eslint:recommended configuration (#20210) (Pixel998)
• 4f880ee feat!: remove v10_* and inactive unstable_* flags (#20225) (sethamus)
• f18115c feat!: no-shadow-restricted-names report globalThis by default (#20027) (sethamus)
• c6358c3 feat!: Require Node.js ^20.19.0 || ^22.13.0 || >=24 (#20160) (Milos Djermanovic)

Features

• bff9091 feat: handle Array.fromAsync in array-callback-return (#20457) (Francesco Trotta)
• 290c594 feat: add self to no-implied-eval rule (#20468) (sethamus)
• 43677de feat: fix handling of function and class expression names in no-shadow (#20432) (Milos Djermanovic)

... (truncated)

Commits

• 84fb885 chore: package.json update for @​eslint/js release
• 1f66734 chore: add eslint to peerDependencies of @eslint/js (#20467)
• f3fbc2f chore: set @eslint/js version to 10.0.0 to skip releasing it (#20466)
• b4b3127 chore: package.json update for @​eslint/js release
• 0b14059 chore: package.json update for @​eslint/js release
• fa31a60 feat!: add name to configs (#20015)
• 1e2cad5 chore: package.json update for @​eslint/js release
• 454a292 feat!: update eslint:recommended configuration (#20210)
• c6358c3 feat!: Require Node.js ^20.19.0 || ^22.13.0 || >=24 (#20160)
• See full diff in compare view

Updates @playwright/test from 1.60.0 to 1.64.1

Release notes

Sourced from @​playwright/test's releases.

v1.64.1

Bug Fixes

• #43247 [Bug]: _electron.launch intermittently loses a packaged app's first window since 1.64.0
• #43242 [Regression]: Chromium 155+ aborts a preflighted cross-origin redirect whenever any route is registered (net::ERR_ABORTED)

v1.64.0

🧰 WebMCP

New page.webmcp and frame.webmcp give access to the tools that a page registers through the experimental WebMCP browser API, so you can test them like any other part of your app:

const browser = await chromium.launch({ args: ['--enable-features=WebMCP'] });
const page = await browser.newPage();
await page.goto('https://example.com');
for (const tool of await page.webmcp.tools())
console.log(tool.name, tool.description);
const result = await page.webmcp.callTool('add', { a: 2, b: 40 });
console.log(result.content[0].text); // "42"

Playwright MCP also supports WebMCP by default, with page-defined tools offered to the agent as webmcp_<tool>. Pass --no-webmcp to opt out.

playwright-cli exposes them as well:

playwright-cli webmcp-list
playwright-cli webmcp-call search_catalog --params '{"query":"cats"}'

🎬 Better videos

Videos can now be recorded at a custom frame rate, and the decorations for actions are styled with plain CSS:

// playwright.config.ts
import { defineConfig } from '@playwright/test';
export default defineConfig({
use: {
video: {
mode: 'on',
size: { width: 1920, height: 1080 },
fps: 60,
show: {
actions: {
style: {
point: 'width: 20px; height: 20px; border-radius: 50%; background: red',
</tr></table>

... (truncated)

Commits

• cfe490d cherry-pick(#43353): docs: release notes for v1.64 Python
• 866cbb8 chore: mark v1.64.1 (#43354)
• 1b29247 cherry-pick(#43250): fix(electron): do not drop windows that have not navigat...
• 632d976 cherry-pick(#43249): fix(chromium): disable AvoidCorsURLLoaderRestartOnRedirect
• 824d0c5 cherry-pick(#43217): chore(dotnet): fix async suffix of optional-arg overload...
• 606ecd8 cherry-pick(#43192): fix(locators): parse locators the way the client API bui...
• e4f872c cherry-pick(#43188): feat(api): expose asLocatorDescription via LocalUtils fo...
• f6a439e cherry-pick(#43189): docs(webmcp): expose WebMCP to all languages
• e2335c3 cherry-pick(#43174): fix(mcp): do not close the browser twice when the client...
• d2a436e cherry-pick(#43163): Revert "fix(blob): do not remove existing reports from o...
• Additional commits viewable in compare view

Updates @tailwindcss/vite from 4.3.0 to 4.3.3

Release notes

Sourced from @​tailwindcss/vite's releases.

v4.3.3

Fixed

• Support --watch --poll[=ms] in @tailwindcss/cli when filesystem events are unreliable or unavailable (#20297)
• Canonicalization: match arbitrary hex colors against theme colors case-insensitively (e.g. bg-[#fff] and bg-[#FFF] → bg-white) (#20298)
• Prevent Preflight from overriding Firefox's native iframe:focus-visible outline styles (#20292)
• Ensure theme('colors.foo') in JS plugins resolves correctly when both --color-foo and --color-foo-bar exist (#20299)
• Ensure fractional opacity modifiers work with named shadow sizes like shadow-sm/12.5, text-shadow-sm/12.5, drop-shadow-sm/12.5, and inset-shadow-sm/12.5 (#20302)
• Parse selectors like [data-foo]div as two selectors instead of one (#20303)
• Ensure @tailwindcss/postcss rebuilds when a preprocessor like Sass changes the input CSS without changing the input file on disk (#20310)
• Ensure CSS nesting is handled even when Lightning CSS isn't run, such as in @tailwindcss/browser and Tailwind Play (#20124)
• Prevent achromatic theme colors from shifting hue when mixed in polar color spaces like oklch (#20314)
• Ensure --spacing(0) is optimized to 0px instead of 0 so it remains a <length> when used in calc(…) (#20319)
• Load @parcel/watcher only when needed in @tailwindcss/cli --watch mode, so one-off builds and --watch --poll work when @parcel/watcher can't be loaded (#20325)
• Use explicit platform fonts instead of system-ui and ui-sans-serif so CJK text respects the page's lang attribute on Windows (#20318)
• Prevent @tailwindcss/upgrade from rewriting ignored files when run from a subdirectory (#20329)
• Ensure earlier @source rules pointing to nested files are scanned when later @source rules point to files in parent folders (#20335)
• Prevent @tailwindcss/vite from triggering full page reloads when scanned files are processed by Vite but haven't been loaded as modules yet (#20336)

v4.3.2

Fixed

• Support bare spacing values for auto-rows-* and auto-cols-* utilities (e.g. auto-rows-12 and auto-cols-16) (#20229)
• Prevent @tailwindcss/cli in --watch mode from crashing on Windows when @source points to a directory that doesn't exist (#20242)
• Prevent @tailwindcss/vite from crashing in Deno v2.8.x when context.parentURL is not a valid URL (#20245)
• Ensure @tailwindcss/cli in --watch mode rebuilds when the input CSS file changes in an ignored directory (#20246)
• Allow @variant rules used in addBase(…) to use custom variants defined later (#20247)
• Prevent @tailwindcss/vite from crashing during HMR when scanned files or directories are deleted (#20259)
• Generate font-size instead of color declarations for text-[--spacing(…)] (#20260)
• Prevent @source patterns from scanning unrelated sibling files and folders (#20263)
• Extract class candidates adjacent to Template Toolkit delimiters like %]…[% in .tt, .tt2, and .tx files (#20269)
• Extract class candidates from conditional Maud syntax like p.text-black[condition] (#20269)
• Prevent @position-try rules from triggering unknown at-rule warnings when optimizing CSS (#20277)
• Support class suggestions for named opacity modifiers from --opacity theme values (#20287)
• Prevent type errors in @tailwindcss/postcssDescription has been truncated