[Snyk] Upgrade tailwindcss from 3.4.18 to 4.1.13

[snyk-io]

Snyk has created this PR to upgrade tailwindcss from 3.4.18 to 4.1.13.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

• The recommended version is 78 versions ahead of your current version.

• The recommended version was released a month ago.

⚠️ Warning: This PR contains major version upgrade(s), and may be a breaking change.

Release notes

Package name: tailwindcss

• 4.1.13 - 2025-09-04
  

  Changed

  • Drop warning from browser build (#18731)
  • Drop exact duplicate declarations when emitting CSS (#18809)

  Fixed

  • Don't transition visibility when using transition (#18795)
  • Discard matched variants with unknown named values (#18799)
  • Discard matched variants with non-string values (#18799)
  • Show suggestions for known matchVariant values (#18798)
  • Replace deprecated clip with clip-path in sr-only (#18769)
  • Hide internal fields from completions in matchUtilities (#18820)
  • Ignore .vercel folders by default (can be overridden by @ source … rules) (#18855)
  • Consider variants starting with @- to be invalid (e.g. @-2xl:flex) (#18869)
  • Do not allow custom variants to start or end with a - or _ (#18867, #18872)
  • Upgrade: Migrate aria theme keys to @ custom-variant (#18815)
  • Upgrade: Migrate data theme keys to @ custom-variant (#18816)
  • Upgrade: Migrate supports theme keys to @ custom-variant (#18817)
• 4.1.12 - 2025-08-14
  

  Fixed

  • Don't consider the global important state in @ apply (#18404)
  • Add missing suggestions for flex-<number> utilities (#18642)
  • Fix trailing ) from interfering with extraction in Clojure keywords (#18345)
  • Detect classes inside Elixir charlist, word list, and string sigils (#18432)
  • Track source locations through @ plugin and @ config (#18345)
  • Allow boolean values of process.env.DEBUG in @ tailwindcss/node (#18485)
  • Ignore consecutive semicolons in the CSS parser (#18532)
  • Center the dropdown icon added to an input with a paired datalist by default (#18511)
  • Extract candidates in Slang templates (#18565)
  • Improve error messages when encountering invalid functional utility names (#18568)
  • Discard CSS AST objects with false or undefined properties (#18571)
  • Allow users to disable URL rebasing in @ tailwindcss/postcss via transformAssetUrls: false (#18321)
  • Fix false-positive migrations in addEventListener and JavaScript variable names (#18718)
  • Fix Standalone CLI showing default Bun help when run via symlink on Windows (#18723)
  • Read from --border-color-* theme keys in divide-* utilities for backwards compatibility (#18704)
  • Don't scan .hdr and .exr files for classes by default (#18734)
• 4.1.11 - 2025-06-26
  

  Fixed

  • Add heuristic to skip candidate migrations inside emit(…) (#18330)
  • Extract candidates with variants in Clojure/ClojureScript keywords (#18338)
  • Document --watch=always in the CLI's usage (#18337)
  • Add support for Vite 7 to @ tailwindcss/vite (#18384)
• 4.1.10 - 2025-06-11
  

  Fixed

  • Fix incorrectly generated CSS when using percentages in arbitrary values with calc (e.g. w-[calc(100%-var(--offset))]) (#18289)
• 4.1.9 - 2025-06-11
  

  Fixed

  • Correctly parse custom properties with strings containing semicolons (#18251)
  • Upgrade: Migrate arbitrary modifiers without percentage signs to bare values (e.g. /[0.16] → /16) (#18184)
  • Upgrade: Migrate CSS variable shorthands where fallback value contains function call (#18184)
  • Upgrade: Migrate negative arbitrary values to negative bare values (e.g. mb-[-32rem] → -mb-128) (#18212)
  • Upgrade: Do not migrate blur in wire:model.blur (#18216)
  • Don't add spaces around CSS dashed idents when formatting math expressions (#18220)
• 4.1.8 - 2025-05-28
  

  Added

  • Improve error messages when @ apply fails (#18059)

  Fixed

  • Upgrade: Do not migrate declarations that look like candidates in <style> blocks (#18057, 18068)
  • Upgrade: Don't error when looking for tailwindcss in pnpm monorepos (#18065)
  • Upgrade: Don't error when updating dependencies in pnpm monorepos (#18065)
  • Upgrade: Migrate deprecated order-none to order-0 (#18126)
  • Support Leptos class: attributes when extracting classes (#18093)
  • Fix "Cannot read properties of undefined" crash on malformed arbitrary value (#18133)
  • Upgrade: Migrate -mt-[0px] to mt-[0px] instead of the other way around (#18154)
  • Fix Haml pre-processing crash when there is no \n at the end of the file (#18155)
  • Ignore .pnpm-store folders by default (can be overridden by @ source … rules) (#18163)
  • Fix PostCSS crash when calling toJSON() (#18083)
• 4.1.7 - 2025-05-15
  

  Added

  • Upgrade: Migrate bare values to named values (#18000)
  • Upgrade: Added cache to improve template migration performance (#18025)

  Fixed

  • Allow _ before numbers during candidate extraction (#17961)
  • Prevent duplicate suggestions when using @ theme and @ utility together (#17675)
  • Ensure that media queries within ::before and ::after pseudo selectors create valid CSS rules in production builds (#17979)
  • Ensure that the standalone CLI does not leave temporary files behind (#17981)
  • Ensure -rotate-* utilities properly negate arbitrary values (#18014)
  • Ignore custom variants using :merge(…) selectors in legacy JS plugins (#18020)
  • Ensure classes containing . are properly extracted from Clojure files (#18038)
  • Upgrade: Fix error when using @ import … source(…) (#17963)
  • Upgrade: Change casing of utilities with named values to kebab-case to match updated theme variables (#18017)
  • Upgrade: Don't migrate strings that match utility names in Vue attribute bindings other than class (#18025)
• 4.1.6 - 2025-05-09
  

  Added

  • Upgrade: Automatically convert arbitrary values to named values when possible (e.g. h-[1lh] to h-lh) (#17831, #17854)
  • Upgrade: Update dependencies in parallel for improved performance (#17898)
  • Add detailed logging about @ source directives, discovered files and scanned files when using DEBUG=* (#17906, #17952)
  • Add support for generating source maps in development (#17775)

  Fixed

  • Ensure negative arbitrary scale values generate negative values (#17831)
  • Fix HAML extraction with embedded Ruby (#17846)
  • Don't scan files for utilities when using @ reference (#17836)
  • Fix incorrectly replacing _ with in arbitrary modifier shorthand bg-red-500/(--my_opacity) (#17889)
  • Don't scan .log files for classes by default (#17906)
  • Ensure that custom utilities applying other custom utilities don't swallow nested @ apply rules (#17925)
  • Download platform specific package if optionalDependencies are skipped (#17929)
• 4.1.5 - 2025-04-30
• 4.1.4 - 2025-04-14
• 4.1.3 - 2025-04-04
• 4.1.2 - 2025-04-03
• 4.1.1 - 2025-04-02
• 4.1.0 - 2025-04-01
• 4.0.17 - 2025-03-26
• 4.0.16 - 2025-03-25
• 4.0.15 - 2025-03-20
• 4.0.14 - 2025-03-13
• 4.0.13 - 2025-03-11
• 4.0.12 - 2025-03-07
• 4.0.11 - 2025-03-06
• 4.0.10 - 2025-03-05
• 4.0.9 - 2025-02-25
• 4.0.8 - 2025-02-21
• 4.0.7 - 2025-02-18
• 4.0.6 - 2025-02-10
• 4.0.5 - 2025-02-08
• 4.0.4 - 2025-02-06
• 4.0.3 - 2025-02-01
• 4.0.2 - 2025-01-31
• 4.0.1 - 2025-01-29
• 4.0.0 - 2025-01-21
• 4.0.0-beta.10 - 2025-01-21
• 4.0.0-beta.9 - 2025-01-09
• 4.0.0-beta.8 - 2024-12-17
• 4.0.0-beta.7 - 2024-12-13
• 4.0.0-beta.6 - 2024-12-06
• 4.0.0-beta.5 - 2024-12-04
• 4.0.0-beta.4 - 2024-11-29
• 4.0.0-beta.3 - 2024-11-27
• 4.0.0-beta.2 - 2024-11-22
• 4.0.0-beta.1 - 2024-11-21
• 4.0.0-alpha.36 - 2024-11-21
• 4.0.0-alpha.35 - 2024-11-20
• 4.0.0-alpha.34 - 2024-11-14
• 4.0.0-alpha.33 - 2024-11-12
• 4.0.0-alpha.32 - 2024-11-11
• 4.0.0-alpha.31 - 2024-10-30
• 4.0.0-alpha.30 - 2024-10-24
• 4.0.0-alpha.29 - 2024-10-23
• 4.0.0-alpha.28 - 2024-10-17
• 4.0.0-alpha.27 - 2024-10-15
• 4.0.0-alpha.26 - 2024-10-03
• 4.0.0-alpha.25 - 2024-09-24
• 4.0.0-alpha.24 - 2024-09-12
• 4.0.0-alpha.23 - 2024-09-05
• 4.0.0-alpha.22 - 2024-09-05
• 4.0.0-alpha.21 - 2024-09-02
• 4.0.0-alpha.20 - 2024-08-23
• 4.0.0-alpha.19 - 2024-08-09
• 4.0.0-alpha.18 - 2024-07-25
• 4.0.0-alpha.17 - 2024-07-04
• 4.0.0-alpha.16 - 2024-06-07
• 4.0.0-alpha.15 - 2024-05-08
• 4.0.0-alpha.14 - 2024-04-09
• 4.0.0-alpha.13 - 2024-04-04
• 4.0.0-alpha.12 - 2024-04-04
• 4.0.0-alpha.11 - 2024-03-27
• 4.0.0-alpha.10 - 2024-03-21
• 4.0.0-alpha.9 - 2024-03-13
• 4.0.0-alpha.8 - 2024-03-11
• 4.0.0-alpha.7 - 2024-03-08
• 4.0.0-alpha.6 - 2024-03-07
• 4.0.0-alpha.5 - 2024-03-06
• 4.0.0-alpha.4 - 2024-03-06
• 4.0.0-alpha.3 - 2024-03-06
• 4.0.0-alpha.2 - 2024-03-06
• 4.0.0-alpha.1 - 2024-03-05
• 3.4.18 - 2025-10-01
  

  Fixed

  • Improve support for raw supports-[…] queries in arbitrary values (#13605)
  • Fix require.cache error when loaded through a TypeScript file in Node 22.18+ (#18665)
  • Support import.meta.resolve(…) in configs for new enough Node.js versions (#18938)
  • Allow using newer versions of postcss-load-config for better ESM and TypeScript PostCSS config support with the CLI (#18938)
  • Remove irrelevant utility rules when matching important classes (#19030)

from tailwindcss GitHub release notes

---

Important

• Warning: This PR contains a major version upgrade, and may be a breaking change.
• Check the changes in this PR to ensure they won't cause issues with your project.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

• 🧐 View latest project report
• 📜 Customise PR templates
• 🛠 Adjust upgrade PR settings
• 🔕 Ignore this dependency or unsubscribe from future upgrade PRs

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Preview	Comments	Updated (UTC)
my-onchainkit-app	Ready	Preview	Comment	Oct 24, 2025 3:17pm
onchainkit-miniapp-manifest-generator	Error			Oct 24, 2025 3:17pm

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scanner	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
npm/tailwindcss	^4.1.13	🟢 6.1	Details Check Score Reason Code-Review 🟢 9 Found 19/20 approved changesets -- score normalized to 9 Maintained 🟢 10 30 commit(s) and 13 issue activity found in the last 90 days -- score normalized to 10 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Security-Policy ⚠️ 0 security policy file not detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected License 🟢 10 license file detected Binary-Artifacts 🟢 10 no binaries found in the repo Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md Fuzzing 🟢 10 project is fuzzed Signed-Releases ⚠️ 0 Project has not signed or included provenance with any releases. Packaging 🟢 10 packaging workflow detected SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0 Vulnerabilities ⚠️ 0 18 existing vulnerabilities detected

Scanned Files

• packages/create-onchain/templates/minikit-basic/package.json