Ignore <!-- and --> between top-level rules in the CSS parser - #20665

## pnpm-workspace.yaml (default)

## Dependency Updates

| Package | From | To | Type |
| --- | --- | --- | --- |
| `@better-auth/cimd` | 1.7.17 | 1.7.18 | patch |
| `@better-auth/mcp` | 1.7.17 | 1.7.18 | patch |
| `@better-auth/oauth-provider` | 1.7.17 | 1.7.18 | patch |
| `@better-auth/passkey` | 1.7.17 | 1.7.18 | patch |
| `@better-auth/sso` | 1.7.17 | 1.7.18 | patch |
| `@react-email/ui` | 6.11.6 | 6.11.7 | patch |
| `@tailwindcss/vite` | 4.3.4 | 4.3.5 | patch |
| `better-auth` | 1.7.17 | 1.7.18 | patch |
| `mdast-util-to-markdown` | 2.2.2 | 2.2.3 | patch |
| `react-email` | 6.11.6 | 6.11.7 | patch |
| `seroval` | 1.7.7 | 1.7.8 | patch |
| `tailwindcss` | 4.3.4 | 4.3.5 | patch |

## Release Notes

<details>
<summary><b>@<!---->better-auth/cimd</b> (1.7.17 → 1.7.18)</summary>

> [!IMPORTANT]
> **Action required**
>
> - If you use `getTestInstance` with `testWith: "mysql"`, run a MySQL
server at `127.0.0.1:3306` with the `root` password set to
`root_password`.
([#12244](better-auth/better-auth#12244))

## `better-auth`

### Bug Fixes

- Fixed "revoke all sessions" with `secondaryStorage` and
`storeSessionInDatabase` to also revoke sessions created while the
revocation is running, except sessions created by a
`session.delete.after` hook, which stay active
([#12259](better-auth/better-auth#12259))
- Fixed `getTestInstance` from `better-auth/test` to close its own
Postgres connection pool and SQLite database when the test file
finishes, while with Vitest's default `sequence.hooks: "stack"` your
`afterAll` hooks still run first and can keep using the instance
([#12250](better-auth/better-auth#12250))
- Fixed `getTestInstance` with `testWith: "mysql"` hanging, and added a
separate database per instance so several instances can run in one test
file ([#12244](better-auth/better-auth#12244))

For detailed changes, see
[`CHANGELOG`](https://github.com/better-auth/better-auth/blob/4946a1e3b66905c7374c7c52bd851fc43c6f83de/packages/better-auth/CHANGELOG.md)

## `@better-auth/core`

### Bug Fixes

- fix(core): accept introspected tokens when verifyOptions.typ is set
([#12249](better-auth/better-auth#12249))

For detailed changes, see
[`CHANGELOG`](https://github.com/better-auth/better-auth/blob/4946a1e3b66905c7374c7c52bd851fc43c6f83de/packages/core/CHANGELOG.md)

## Contributors

Thanks to everyone who contributed to this release:

@<!---->gustavovalverde

**Full changelog:**
[`v1.7.17...v1.7.18`](better-auth/better-auth@v1.7.17...v1.7.18)

</details>

<details>
<summary><b>@<!---->better-auth/mcp</b> (1.7.17 → 1.7.18)</summary>

> [!IMPORTANT]
> **Action required**
>
> - If you use `getTestInstance` with `testWith: "mysql"`, run a MySQL
server at `127.0.0.1:3306` with the `root` password set to
`root_password`.
([#12244](better-auth/better-auth#12244))

## `better-auth`

### Bug Fixes

- Fixed "revoke all sessions" with `secondaryStorage` and
`storeSessionInDatabase` to also revoke sessions created while the
revocation is running, except sessions created by a
`session.delete.after` hook, which stay active
([#12259](better-auth/better-auth#12259))
- Fixed `getTestInstance` from `better-auth/test` to close its own
Postgres connection pool and SQLite database when the test file
finishes, while with Vitest's default `sequence.hooks: "stack"` your
`afterAll` hooks still run first and can keep using the instance
([#12250](better-auth/better-auth#12250))
- Fixed `getTestInstance` with `testWith: "mysql"` hanging, and added a
separate database per instance so several instances can run in one test
file ([#12244](better-auth/better-auth#12244))

For detailed changes, see
[`CHANGELOG`](https://github.com/better-auth/better-auth/blob/4946a1e3b66905c7374c7c52bd851fc43c6f83de/packages/better-auth/CHANGELOG.md)

## `@better-auth/core`

### Bug Fixes

- fix(core): accept introspected tokens when verifyOptions.typ is set
([#12249](better-auth/better-auth#12249))

For detailed changes, see
[`CHANGELOG`](https://github.com/better-auth/better-auth/blob/4946a1e3b66905c7374c7c52bd851fc43c6f83de/packages/core/CHANGELOG.md)

## Contributors

Thanks to everyone who contributed to this release:

@<!---->gustavovalverde

**Full changelog:**
[`v1.7.17...v1.7.18`](better-auth/better-auth@v1.7.17...v1.7.18)

</details>

<details>
<summary><b>@<!---->better-auth/oauth-provider</b> (1.7.17 →
1.7.18)</summary>

> [!IMPORTANT]
> **Action required**
>
> - If you use `getTestInstance` with `testWith: "mysql"`, run a MySQL
server at `127.0.0.1:3306` with the `root` password set to
`root_password`.
([#12244](better-auth/better-auth#12244))

## `better-auth`

### Bug Fixes

- Fixed "revoke all sessions" with `secondaryStorage` and
`storeSessionInDatabase` to also revoke sessions created while the
revocation is running, except sessions created by a
`session.delete.after` hook, which stay active
([#12259](better-auth/better-auth#12259))
- Fixed `getTestInstance` from `better-auth/test` to close its own
Postgres connection pool and SQLite database when the test file
finishes, while with Vitest's default `sequence.hooks: "stack"` your
`afterAll` hooks still run first and can keep using the instance
([#12250](better-auth/better-auth#12250))
- Fixed `getTestInstance` with `testWith: "mysql"` hanging, and added a
separate database per instance so several instances can run in one test
file ([#12244](better-auth/better-auth#12244))

For detailed changes, see
[`CHANGELOG`](https://github.com/better-auth/better-auth/blob/4946a1e3b66905c7374c7c52bd851fc43c6f83de/packages/better-auth/CHANGELOG.md)

## `@better-auth/core`

### Bug Fixes

- fix(core): accept introspected tokens when verifyOptions.typ is set
([#12249](better-auth/better-auth#12249))

For detailed changes, see
[`CHANGELOG`](https://github.com/better-auth/better-auth/blob/4946a1e3b66905c7374c7c52bd851fc43c6f83de/packages/core/CHANGELOG.md)

## Contributors

Thanks to everyone who contributed to this release:

@<!---->gustavovalverde

**Full changelog:**
[`v1.7.17...v1.7.18`](better-auth/better-auth@v1.7.17...v1.7.18)

</details>

<details>
<summary><b>@<!---->better-auth/passkey</b> (1.7.17 → 1.7.18)</summary>

> [!IMPORTANT]
> **Action required**
>
> - If you use `getTestInstance` with `testWith: "mysql"`, run a MySQL
server at `127.0.0.1:3306` with the `root` password set to
`root_password`.
([#12244](better-auth/better-auth#12244))

## `better-auth`

### Bug Fixes

- Fixed "revoke all sessions" with `secondaryStorage` and
`storeSessionInDatabase` to also revoke sessions created while the
revocation is running, except sessions created by a
`session.delete.after` hook, which stay active
([#12259](better-auth/better-auth#12259))
- Fixed `getTestInstance` from `better-auth/test` to close its own
Postgres connection pool and SQLite database when the test file
finishes, while with Vitest's default `sequence.hooks: "stack"` your
`afterAll` hooks still run first and can keep using the instance
([#12250](better-auth/better-auth#12250))
- Fixed `getTestInstance` with `testWith: "mysql"` hanging, and added a
separate database per instance so several instances can run in one test
file ([#12244](better-auth/better-auth#12244))

For detailed changes, see
[`CHANGELOG`](https://github.com/better-auth/better-auth/blob/4946a1e3b66905c7374c7c52bd851fc43c6f83de/packages/better-auth/CHANGELOG.md)

## `@better-auth/core`

### Bug Fixes

- fix(core): accept introspected tokens when verifyOptions.typ is set
([#12249](better-auth/better-auth#12249))

For detailed changes, see
[`CHANGELOG`](https://github.com/better-auth/better-auth/blob/4946a1e3b66905c7374c7c52bd851fc43c6f83de/packages/core/CHANGELOG.md)

## Contributors

Thanks to everyone who contributed to this release:

@<!---->gustavovalverde

**Full changelog:**
[`v1.7.17...v1.7.18`](better-auth/better-auth@v1.7.17...v1.7.18)

</details>

<details>
<summary><b>@<!---->better-auth/sso</b> (1.7.17 → 1.7.18)</summary>

> [!IMPORTANT]
> **Action required**
>
> - If you use `getTestInstance` with `testWith: "mysql"`, run a MySQL
server at `127.0.0.1:3306` with the `root` password set to
`root_password`.
([#12244](better-auth/better-auth#12244))

## `better-auth`

### Bug Fixes

- Fixed "revoke all sessions" with `secondaryStorage` and
`storeSessionInDatabase` to also revoke sessions created while the
revocation is running, except sessions created by a
`session.delete.after` hook, which stay active
([#12259](better-auth/better-auth#12259))
- Fixed `getTestInstance` from `better-auth/test` to close its own
Postgres connection pool and SQLite database when the test file
finishes, while with Vitest's default `sequence.hooks: "stack"` your
`afterAll` hooks still run first and can keep using the instance
([#12250](better-auth/better-auth#12250))
- Fixed `getTestInstance` with `testWith: "mysql"` hanging, and added a
separate database per instance so several instances can run in one test
file ([#12244](better-auth/better-auth#12244))

For detailed changes, see
[`CHANGELOG`](https://github.com/better-auth/better-auth/blob/4946a1e3b66905c7374c7c52bd851fc43c6f83de/packages/better-auth/CHANGELOG.md)

## `@better-auth/core`

### Bug Fixes

- fix(core): accept introspected tokens when verifyOptions.typ is set
([#12249](better-auth/better-auth#12249))

For detailed changes, see
[`CHANGELOG`](https://github.com/better-auth/better-auth/blob/4946a1e3b66905c7374c7c52bd851fc43c6f83de/packages/core/CHANGELOG.md)

## Contributors

Thanks to everyone who contributed to this release:

@<!---->gustavovalverde

**Full changelog:**
[`v1.7.17...v1.7.18`](better-auth/better-auth@v1.7.17...v1.7.18)

</details>

<details>
<summary><b>@<!---->tailwindcss/vite</b> (4.3.4 → 4.3.5)</summary>

### Fixed

- Canonicalization: improve performance in projects with many functional
variant values (e.g. a `matchVariant` plugin with thousands of values)
([#20663](tailwindlabs/tailwindcss#20663))
- Don't crash or create a fallback with the wrong color for a
`color-mix(…)` without a color interpolation method (e.g.
`color-mix(var(--color-red-500))` or `color-mix(currentcolor 50%,
transparent)`)
([#20658](tailwindlabs/tailwindcss#20658),
[#20666](tailwindlabs/tailwindcss#20666))
- Ensure `@tailwindcss/oxide-wasm32-wasi` loads instead of hanging
forever (e.g. with `NAPI_RS_FORCE_WASI=error` or in WebContainers)
([#20667](tailwindlabs/tailwindcss#20667))
- Remove `as: '*.css'` from the `@tailwindcss/turbopack` setup in its
README, because it breaks CSS modules
([#20660](tailwindlabs/tailwindcss#20660))
- Ignore `<!--` and `-->` between top-level rules in CSS instead of
throwing or swallowing the next rule (e.g. `a { color: red } --> b {
color: blue }`)
([#20665](tailwindlabs/tailwindcss#20665))
- Ensure `@tailwindcss/oxide-wasm32-wasi` detects changed and new source
files after the first scan (e.g. in WebContainers)
([#20487](tailwindlabs/tailwindcss#20487))
- Prevent type errors with `skipLibCheck: false` caused by imports of
unshipped modules in the `@tailwindcss/node` type declarations
([#20632](tailwindlabs/tailwindcss#20632))

</details>

<details>
<summary><b>better-auth</b> (1.7.17 → 1.7.18)</summary>

> [!IMPORTANT]
> **Action required**
>
> - If you use `getTestInstance` with `testWith: "mysql"`, run a MySQL
server at `127.0.0.1:3306` with the `root` password set to
`root_password`.
([#12244](better-auth/better-auth#12244))

## `better-auth`

### Bug Fixes

- Fixed "revoke all sessions" with `secondaryStorage` and
`storeSessionInDatabase` to also revoke sessions created while the
revocation is running, except sessions created by a
`session.delete.after` hook, which stay active
([#12259](better-auth/better-auth#12259))
- Fixed `getTestInstance` from `better-auth/test` to close its own
Postgres connection pool and SQLite database when the test file
finishes, while with Vitest's default `sequence.hooks: "stack"` your
`afterAll` hooks still run first and can keep using the instance
([#12250](better-auth/better-auth#12250))
- Fixed `getTestInstance` with `testWith: "mysql"` hanging, and added a
separate database per instance so several instances can run in one test
file ([#12244](better-auth/better-auth#12244))

For detailed changes, see
[`CHANGELOG`](https://github.com/better-auth/better-auth/blob/4946a1e3b66905c7374c7c52bd851fc43c6f83de/packages/better-auth/CHANGELOG.md)

## `@better-auth/core`

### Bug Fixes

- fix(core): accept introspected tokens when verifyOptions.typ is set
([#12249](better-auth/better-auth#12249))

For detailed changes, see
[`CHANGELOG`](https://github.com/better-auth/better-auth/blob/4946a1e3b66905c7374c7c52bd851fc43c6f83de/packages/core/CHANGELOG.md)

## Contributors

Thanks to everyone who contributed to this release:

@<!---->gustavovalverde

**Full changelog:**
[`v1.7.17...v1.7.18`](better-auth/better-auth@v1.7.17...v1.7.18)

</details>

<details>
<summary><b>mdast-util-to-markdown</b> (2.2.2 → 2.2.3)</summary>

#### Fix

* db77617 Fix to drop empty attention

#### Performance

* 3f85e8d Fix performance of many touching attention runs

**Full Changelog**:
syntax-tree/mdast-util-to-markdown@2.2.2...2.2.3

</details>

<details>
<summary><b>react-email</b> (6.11.6 → 6.11.7)</summary>

### Patch Changes

* d8a0778: Preserve custom utility theme-variable overrides when
resolving email styles, including local declaration order and
importance.
* 2b3d241: Resolve tsconfig path aliases in dynamic import template
literals on Windows, so editing a file inside an aliased directory
reloads the preview.

</details>

<details>
<summary><b>seroval</b> (1.7.7 → 1.7.8)</summary>

### Patch Changes

- Harden string encoding and stream error handling.

</details>

<details>
<summary><b>tailwindcss</b> (4.3.4 → 4.3.5)</summary>

### Fixed

- Canonicalization: improve performance in projects with many functional
variant values (e.g. a `matchVariant` plugin with thousands of values)
([#20663](tailwindlabs/tailwindcss#20663))
- Don't crash or create a fallback with the wrong color for a
`color-mix(…)` without a color interpolation method (e.g.
`color-mix(var(--color-red-500))` or `color-mix(currentcolor 50%,
transparent)`)
([#20658](tailwindlabs/tailwindcss#20658),
[#20666](tailwindlabs/tailwindcss#20666))
- Ensure `@tailwindcss/oxide-wasm32-wasi` loads instead of hanging
forever (e.g. with `NAPI_RS_FORCE_WASI=error` or in WebContainers)
([#20667](tailwindlabs/tailwindcss#20667))
- Remove `as: '*.css'` from the `@tailwindcss/turbopack` setup in its
README, because it breaks CSS modules
([#20660](tailwindlabs/tailwindcss#20660))
- Ignore `<!--` and `-->` between top-level rules in CSS instead of
throwing or swallowing the next rule (e.g. `a { color: red } --> b {
color: blue }`)
([#20665](tailwindlabs/tailwindcss#20665))
- Ensure `@tailwindcss/oxide-wasm32-wasi` detects changed and new source
files after the first scan (e.g. in WebContainers)
([#20487](tailwindlabs/tailwindcss#20487))
- Prevent type errors with `skipLibCheck: false` caused by imports of
unshipped modules in the `@tailwindcss/node` type declarations
([#20632](tailwindlabs/tailwindcss#20632))

</details>

---
*This PR was auto-generated by
[catalog-update-action](https://github.com/brandhaug/catalog-update-action).*

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

This PR contains the following updates:

| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [@tailwindcss/postcss](https://tailwindcss.com) ([source](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-postcss)) | [`4.3.3` → `4.3.5`](https://renovatebot.com/diffs/npm/@tailwindcss%2fpostcss/4.3.3/4.3.5) | ![age](https://developer.mend.io/api/mc/badges/age/npm/@tailwindcss%2fpostcss/4.3.5?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@tailwindcss%2fpostcss/4.3.3/4.3.5?slim=true) |
| [tailwindcss](https://tailwindcss.com) ([source](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss)) | [`4.3.3` → `4.3.5`](https://renovatebot.com/diffs/npm/tailwindcss/4.3.3/4.3.5) | ![age](https://developer.mend.io/api/mc/badges/age/npm/tailwindcss/4.3.5?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/tailwindcss/4.3.3/4.3.5?slim=true) |

---

> ⚠️ **Warning**
>
> Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/2097) for more information.

---

### Release Notes

<details>
<summary>tailwindlabs/tailwindcss (@&#8203;tailwindcss/postcss)</summary>

### [`v4.3.5`](https://github.com/tailwindlabs/tailwindcss/blob/HEAD/CHANGELOG.md#435---2026-11-06)

[Compare Source](tailwindlabs/tailwindcss@v4.3.4...v4.3.5)

##### Fixed

- Canonicalization: improve performance in projects with many functional variant values (e.g. a `matchVariant` plugin with thousands of values) ([#&#8203;20663](tailwindlabs/tailwindcss#20663))
- Don't crash or create a fallback with the wrong color for a `color-mix(…)` without a color interpolation method (e.g. `color-mix(var(--color-red-500))` or `color-mix(currentcolor 50%, transparent)`) ([#&#8203;20658](tailwindlabs/tailwindcss#20658), [#&#8203;20666](tailwindlabs/tailwindcss#20666))
- Ensure `@tailwindcss/oxide-wasm32-wasi` loads instead of hanging forever (e.g. with `NAPI_RS_FORCE_WASI=error` or in WebContainers) ([#&#8203;20667](tailwindlabs/tailwindcss#20667))
- Remove `as: '*.css'` from the `@tailwindcss/turbopack` setup in its README, because it breaks CSS modules ([#&#8203;20660](tailwindlabs/tailwindcss#20660))
- Ignore `<!--` and `-->` between top-level rules in CSS instead of throwing or swallowing the next rule (e.g. `a { color: red } --> b { color: blue }`) ([#&#8203;20665](tailwindlabs/tailwindcss#20665))
- Ensure `@tailwindcss/oxide-wasm32-wasi` detects changed and new source files after the first scan (e.g. in WebContainers) ([#&#8203;20487](tailwindlabs/tailwindcss#20487))
- Prevent type errors with `skipLibCheck: false` caused by imports of unshipped modules in the `@tailwindcss/node` type declarations ([#&#8203;20632](tailwindlabs/tailwindcss#20632))

### [`v4.3.4`](https://github.com/tailwindlabs/tailwindcss/blob/HEAD/CHANGELOG.md#434---2026-11-02)

[Compare Source](tailwindlabs/tailwindcss@v4.3.3...v4.3.4)

##### Added

- Add `@tailwindcss/turbopack`, a Turbopack loader for using Tailwind CSS with Next.js ([#&#8203;20367](tailwindlabs/tailwindcss#20367))

##### Fixed

- Ensure watch mode detects changes to symlinked `@source` files whose real paths aren't otherwise scanned ([#&#8203;20356](tailwindlabs/tailwindcss#20356))
- Ensure variants using `@scope` wrap generated utilities instead of nesting inside them ([#&#8203;20369](tailwindlabs/tailwindcss#20369))
- Ensure nested `@scope` rules preserve their scoping semantics when flattened ([#&#8203;20369](tailwindlabs/tailwindcss#20369))
- Preserve declarations directly inside `@scope` by wrapping them in `:where(:scope)` ([#&#8203;20369](tailwindlabs/tailwindcss#20369))
- Ensure generated utilities include a space in empty `var()` fallbacks (e.g. `var(--tw-blur,)` → `var(--tw-blur, )`) ([#&#8203;20373](tailwindlabs/tailwindcss#20373))
- Canonicalization: convert arbitrary breakpoint and container query variants to named equivalents (e.g. `max-[64rem]:flex` → `max-lg:flex`) ([#&#8203;20380](tailwindlabs/tailwindcss#20380))
- Prevent `@tailwindcss/vite` from crashing on every edit under Vite's experimental `bundledDev` mode ([#&#8203;20379](tailwindlabs/tailwindcss#20379))
- Ensure `@tailwindcss/oxide` falls back to WASM on platforms without native bindings (`@tailwindcss/oxide-wasm32-wasi` now installs on all platforms, but only loads when no native binding is available) ([#&#8203;20383](tailwindlabs/tailwindcss#20383))
- Extract class candidates from Ruby `%w` and `%W` literals using angle brackets or custom delimiters (e.g. `%w<flex>`, `%w|flex|`), including in Slim and Haml templates ([#&#8203;20387](tailwindlabs/tailwindcss#20387))
- Preserve whitespace in `--default(…)` values in functional `@utility` definitions (e.g. `--default(box alphabetic)` no longer becomes `boxalphabetic`) ([#&#8203;20392](tailwindlabs/tailwindcss#20392))
- Ensure automatic source detection respects negation-based `.gitignore` files (e.g. `/*` followed by `!/…` patterns) ([#&#8203;20397](tailwindlabs/tailwindcss#20397))
- Ensure root `theme('…')` namespace lookups in JavaScript plugins and config files return the full namespace object instead of the value of its `DEFAULT` key ([#&#8203;20399](tailwindlabs/tailwindcss#20399))
- Skip ignored directories when generating watch globs instead of walking their contents on every rebuild ([#&#8203;20408](tailwindlabs/tailwindcss#20408))
- Drop invalid UTF-8 candidates during class detection ([#&#8203;20389](tailwindlabs/tailwindcss#20389))
- Prevent `@tailwindcss/vite` from forcing full-page reloads for scanned files that Vite does not handle as modules (e.g. `.php` files) ([#&#8203;20414](tailwindlabs/tailwindcss#20414))
- Canonicalization: don't merge utilities that reference different theme variables set to CSS-wide keywords like `unset` ([#&#8203;20417](tailwindlabs/tailwindcss#20417))
- Don't generate utilities when a modifier is used that would otherwise be silently ignored (e.g. `rounded-sm/[5]`, `shadow-sm/foo`, `stroke-2/50`) ([#&#8203;20419](tailwindlabs/tailwindcss#20419))
- Preserve `and`, `or`, and `not` inside selectors in `supports-[…]` variants (e.g. `supports-[selector(a:not(.foo))]:flex`) ([#&#8203;20420](tailwindlabs/tailwindcss#20420))
- Don't warn about Angular's `::ng-deep` and `:host-context()` when optimizing CSS ([#&#8203;20434](tailwindlabs/tailwindcss#20434))
- Don't generate CSS for candidates containing an empty additional modifier (e.g. `bg-red-500/50/` and `group-hover/foo//bar:flex`) ([#&#8203;20466](tailwindlabs/tailwindcss#20466))
- Ensure `min-*`, `max-*`, and container query variants with decimal values are sorted numerically (e.g. `min-[40.25rem]` before `min-[40.5rem]`) ([#&#8203;20512](tailwindlabs/tailwindcss#20512))
- Ensure CSS comments ending with `\*/` are closed correctly instead of swallowing the CSS that follows (e.g. `/* C:\temp\*/`) ([#&#8203;20508](tailwindlabs/tailwindcss#20508))
- Improve style invalidation performance of `group-*` and `peer-*` variants ([#&#8203;20513](tailwindlabs/tailwindcss#20513))
- Ensure cached compilers release their `loadModule` and `loadStylesheet` callbacks after compilation ([#&#8203;20531](tailwindlabs/tailwindcss#20531))
- Canonicalization: preserve `&` when moving a pseudo-element into `*` or `**` (e.g. `[&_::before]:flex` → `**:[&::before]:flex`) ([#&#8203;20550](tailwindlabs/tailwindcss#20550))
- Ensure the `Set.prototype.intersection` polyfill in `canonicalizeCandidates(…)` returns the intersection instead of the first set on Node.js < 22 ([#&#8203;20562](tailwindlabs/tailwindcss#20562))
- Canonicalization: ensure inline `theme(…)` alphas with more than 2 decimals migrate to a percentage modifier with the same opacity (e.g. `theme(colors.red.500/.12345)` → `text-red-500/[12.345%]`, not `text-red-500/[12.345]`) ([#&#8203;20563](tailwindlabs/tailwindcss#20563))
- Canonicalization: preserve inline `theme(…)` alphas as an arbitrary percentage when a custom `--opacity-*` theme value would change the opacity (e.g. `theme(colors.red.500/50%)` → `text-red-500/[50%]` with `--opacity-50: 10%`) ([#&#8203;20563](tailwindlabs/tailwindcss#20563))
- Ensure the `@property` fallback isn't applied in Safari versions that no longer support `margin-trim: inline` ([#&#8203;20569](tailwindlabs/tailwindcss#20569))
- Treat viewport units like `dvmin` and `svi` and font-relative units like `cap` and `rex` as lengths in arbitrary values (e.g. `text-[10dvmin]` generates `font-size` instead of `color`) ([#&#8203;20516](tailwindlabs/tailwindcss#20516))
- Write plugin logs to stderr in `tailwindcss canonicalize` so they don't end up in the results on stdout ([#&#8203;20561](tailwindlabs/tailwindcss#20561))
- Extract class shorthands on later lines when Pug text, comments, or quoted attribute values contain unbalanced brackets, or a quote that doesn't start a string (e.g. `input(pattern=/"/.source)`) ([#&#8203;20547](tailwindlabs/tailwindcss#20547), [#&#8203;20572](tailwindlabs/tailwindcss#20572))
- Underline the correct occurrence of an unsupported data type in `--value(…)` warnings ([#&#8203;20554](tailwindlabs/tailwindcss#20554))
- Canonicalization: prefer an existing candidate when collapsing utilities over another utility with the same default theme value (e.g. `text-foreground text-primary` → `text-primary`, not `text-card-checked-border`) ([#&#8203;20540](tailwindlabs/tailwindcss#20540))
- Canonicalization: don't collapse utilities into a utility that uses another theme variable with the same default value (e.g. `mt-card mb-card` → `my-card`, not `my-4`) ([#&#8203;20574](tailwindlabs/tailwindcss#20574))
- Ensure `@tailwindcss/postcss` rewrites relative `url(…)`s of stylesheets that are inlined before it runs (e.g. `@import`s in Vite) in optimized builds ([#&#8203;20576](tailwindlabs/tailwindcss#20576))
- Drop nested rules that put a combinator after a pseudo-element when using pseudo-element variants (e.g. `selection:*` on a utility with a nested `& > *` rule) ([#&#8203;20575](tailwindlabs/tailwindcss#20575))
- Don't generate CSS for arbitrary values with unbalanced parentheses or brackets (e.g. `w-[calc(1px]` or `[--x:a[b]`) ([#&#8203;20577](tailwindlabs/tailwindcss#20577))
- Canonicalization: prevent `collapse: true` from taking exponentially longer when classes are linked through a utility that sets many properties (e.g. `sr-only`) ([#&#8203;20558](tailwindlabs/tailwindcss#20558))
- Ensure `&` is substituted inside `:-moz-any(…)` and `:-webkit-any(…)` in custom variants (e.g. `@custom-variant firefox (:-moz-any(&));`) ([#&#8203;20486](tailwindlabs/tailwindcss#20486))
- Ensure the standalone macOS binaries have a valid code signature, so macOS 27 no longer kills them at launch ([#&#8203;20578](tailwindlabs/tailwindcss#20578))
- Ensure `@tailwindcss/turbopack` and `@tailwindcss/webpack` rebuild when the input CSS changes (e.g. `next dev` with Turbopack no longer serves the CSS of the previous edit) ([#&#8203;20582](tailwindlabs/tailwindcss#20582))
- Canonicalization: don't drop a utility that sets a `--tw-*` variable when an unrelated property has the same value (e.g. `link mt-4` no longer becomes `mt-4` when `link` sets `margin-top: 16px` and `--tw-translate-x: 16px`) ([#&#8203;20593](tailwindlabs/tailwindcss#20593))
- Decode single-digit hexadecimal escapes in theme variable and `@utility` names as the CSS spec does (e.g. `@theme { --color-\0: red; }` no longer registers `--color-0`) ([#&#8203;20591](tailwindlabs/tailwindcss#20591))
- Don't treat `!important` inside strings, comments or `url()` in declaration values as the important flag (e.g. `content: "a !important b"`) ([#&#8203;20627](tailwindlabs/tailwindcss#20627))
- Parse a custom property at the end of the input when it has no trailing `;` (e.g. `--foo: bar` as the last declaration) ([#&#8203;20653](tailwindlabs/tailwindcss#20653))
- Keep a declaration without a `;` at the end of the CSS input (e.g. `color: red`) ([#&#8203;20655](tailwindlabs/tailwindcss#20655))

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - "before 9am on tuesday"
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about these updates again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4yMDYuMiIsInVwZGF0ZWRJblZlciI6IjQ0LjIwNi4yIiwidGFyZ2V0QnJhbmNoIjoiZGV2ZWxvcCIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiLCJyZW5vdmF0ZSJdfQ==-->

Reviewed-on: https://code.futo.org/harbor/harbor/pulls/2257

This PR contains the following updates:

| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [@tailwindcss/vite](https://tailwindcss.com) ([source](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-vite)) | [`4.3.4` → `4.3.5`](https://renovatebot.com/diffs/npm/@tailwindcss%2fvite/4.3.4/4.3.5) | ![age](https://developer.mend.io/api/mc/badges/age/npm/@tailwindcss%2fvite/4.3.5?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@tailwindcss%2fvite/4.3.4/4.3.5?slim=true) |
| [tailwindcss](https://tailwindcss.com) ([source](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss)) | [`4.3.4` → `4.3.5`](https://renovatebot.com/diffs/npm/tailwindcss/4.3.4/4.3.5) | ![age](https://developer.mend.io/api/mc/badges/age/npm/tailwindcss/4.3.5?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/tailwindcss/4.3.4/4.3.5?slim=true) |

---

### Release Notes

<details>
<summary>tailwindlabs/tailwindcss (@&#8203;tailwindcss/vite)</summary>

### [`v4.3.5`](https://github.com/tailwindlabs/tailwindcss/blob/HEAD/CHANGELOG.md#435---2026-11-06)

[Compare Source](tailwindlabs/tailwindcss@v4.3.4...v4.3.5)

##### Fixed

- Canonicalization: improve performance in projects with many functional variant values (e.g. a `matchVariant` plugin with thousands of values) ([#&#8203;20663](tailwindlabs/tailwindcss#20663))
- Don't crash or create a fallback with the wrong color for a `color-mix(…)` without a color interpolation method (e.g. `color-mix(var(--color-red-500))` or `color-mix(currentcolor 50%, transparent)`) ([#&#8203;20658](tailwindlabs/tailwindcss#20658), [#&#8203;20666](tailwindlabs/tailwindcss#20666))
- Ensure `@tailwindcss/oxide-wasm32-wasi` loads instead of hanging forever (e.g. with `NAPI_RS_FORCE_WASI=error` or in WebContainers) ([#&#8203;20667](tailwindlabs/tailwindcss#20667))
- Remove `as: '*.css'` from the `@tailwindcss/turbopack` setup in its README, because it breaks CSS modules ([#&#8203;20660](tailwindlabs/tailwindcss#20660))
- Ignore `<!--` and `-->` between top-level rules in CSS instead of throwing or swallowing the next rule (e.g. `a { color: red } --> b { color: blue }`) ([#&#8203;20665](tailwindlabs/tailwindcss#20665))
- Ensure `@tailwindcss/oxide-wasm32-wasi` detects changed and new source files after the first scan (e.g. in WebContainers) ([#&#8203;20487](tailwindlabs/tailwindcss#20487))
- Prevent type errors with `skipLibCheck: false` caused by imports of unshipped modules in the `@tailwindcss/node` type declarations ([#&#8203;20632](tailwindlabs/tailwindcss#20632))

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about these updates again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4yMjIuNSIsInVwZGF0ZWRJblZlciI6IjQ0LjIyMi41IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->