Revert "build(deps-dev): bump tailwindcss in the tailwind group (#624)" by guibranco · Pull Request #632 · ApiBR/vagas-aggregator-ui

guibranco · 2026-03-27T13:50:51Z

User description

📑 Description

This reverts commit b9f65d8.

✅ Checks

My pull request adheres to the code style of this project
My code requires changes to the documentation
I have updated the documentation as required
All the tests have passed

☢️ Does this introduce a breaking change?

Yes
No

Description

Reverted tailwindcss version to resolve compatibility issues.
Updated package-lock.json and package.json to reflect the changes.
Ensured all dependencies are correctly aligned with the reverted version.

Changes walkthrough 📝

Relevant files

Bug fix

package-lock.json `Revert tailwindcss version and update dependencies` package-lock.json Reverted `tailwindcss` version from `4.2.2` to `3.4.1`. Added new dependencies and updated existing ones. Removed unnecessary entries related to `tailwindcss`.	+1065/-18
package.json `Update tailwindcss version in package.json` package.json Updated `tailwindcss` version from `4.2.2` to `3.4.1`.	+1/-1

💡 Penify usage:
Comment /help on the PR to get a list of all available Penify tools and their descriptions

Summary by CodeRabbit

Chores
- Updated development dependencies for build compatibility.

This reverts commit b9f65d8.

code-genius-code-coverage · 2026-03-27T13:50:54Z

The files' contents are under analysis for test generation.

sourcery-ai · 2026-03-27T13:50:58Z

Reviewer's guide (collapsed on small PRs)

Reviewer's Guide

Reverts the previous Tailwind CSS dev-dependency upgrade, restoring the prior Tailwind version and aligning the lockfile accordingly.

File-Level Changes

Change	Details	Files
Restore Tailwind CSS devDependency to the previous major version and sync the lockfile.	Change the tailwindcss devDependency version from ^4.2.2 back to ^3.4.1. Update package-lock.json to reflect the restored tailwindcss version and dependency tree.	`package.json` `package-lock.json`

Tips and commands

Interacting with Sourcery

Trigger a new review: Comment @sourcery-ai review on the pull request.
Continue discussions: Reply directly to Sourcery's review comments.
Generate a GitHub issue from a review comment: Ask Sourcery to create an
issue from a review comment by replying to it. You can also reply to a
review comment with @sourcery-ai issue to create an issue from it.
Generate a pull request title: Write @sourcery-ai anywhere in the pull
request title to generate a title at any time. You can also comment
@sourcery-ai title on the pull request to (re-)generate the title at any time.
Generate a pull request summary: Write @sourcery-ai summary anywhere in
the pull request body to generate a PR summary at any time exactly where you
want it. You can also comment @sourcery-ai summary on the pull request to
(re-)generate the summary at any time.
Generate reviewer's guide: Comment @sourcery-ai guide on the pull
request to (re-)generate the reviewer's guide at any time.
Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
pull request to resolve all Sourcery comments. Useful if you've already
addressed all the comments and don't want to see them anymore.
Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
request to dismiss all existing Sourcery reviews. Especially useful if you
want to start fresh with a new review - don't forget to comment
@sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

Enable or disable review features such as the Sourcery-generated pull request
summary, the reviewer's guide, and others.
Change the review language.
Add, remove or edit custom review instructions.
Adjust other review settings.

Getting Help

Contact our support team for questions or feedback.
Visit our documentation for detailed guides and information.
Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

coderabbitai · 2026-03-27T13:51:10Z

📝 Walkthrough

Walkthrough

The tailwindcss development dependency in package.json has been downgraded from version ^4.2.2 to ^3.4.1, reducing the major version from 4 to 3 and the minor version accordingly.

Changes

Cohort / File(s)	Summary
Dependency Version Update `package.json`	Downgraded `tailwindcss` from `^4.2.2` to `^3.4.1`.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Poem

🐰 A Tailwind tale, oh what a sight,
From version four down to version three's light,
The CSS winds shift, the styles align,
One little bump makes everything fine! ✨

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and specifically describes the main change: reverting a tailwindcss version bump from PR `#624`, which directly corresponds to the package.json update shown in the changeset.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch feature/revert-tailwind-css

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

socket-security · 2026-03-27T13:51:20Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	tailwindcss@4.2.2 ⏵ 3.4.13	^-4		⁺³

View full report

socket-security · 2026-03-27T13:51:22Z

Caution

Review the following alerts detected in dependencies.

According to your organization's Security Policy, you must resolve all "Block" alerts before proceeding. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Block		System shell access: npm `commander` in module child_process Module: child_process Location: Package overview From: package-lock.json → `npm/tailwindcss@3.4.13` → `npm/commander@4.1.1` ℹ Read more on: This package \| This alert \| What is shell access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/commander@4.1.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		System shell access: npm `foreground-child` in module child_process Module: child_process Location: Package overview From: package-lock.json → `npm/tailwindcss@3.4.13` → `npm/foreground-child@3.3.0` ℹ Read more on: This package \| This alert \| What is shell access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/foreground-child@3.3.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Dynamic code execution: npm `function-bind` Eval Type: Function Location: Package overview From: package-lock.json → `npm/tailwindcss@3.4.13` → `npm/function-bind@1.1.2` ℹ Read more on: This package \| This alert \| What is dynamic code execution? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Avoid packages that use dynamic code execution like eval(), since this could potentially execute any code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/function-bind@1.1.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Deprecated by its maintainer: npm `glob` Reason: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me From: package-lock.json → `npm/tailwindcss@3.4.13` → `npm/glob@10.5.0` ℹ Read more on: This package \| This alert \| What is a deprecated package? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Research the state of the package and determine if there are non-deprecated versions that can be used, or if it should be replaced with a new, supported solution. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/glob@10.5.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Network access: npm `lru-cache` in module globalThis["fetch"] Module: globalThis["fetch"] Location: Package overview From: package-lock.json → `npm/tailwindcss@3.4.13` → `npm/lru-cache@10.4.3` ℹ Read more on: This package \| This alert \| What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/lru-cache@10.4.3`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Network access: npm `mz` in module dns Module: dns Location: Package overview From: package-lock.json → `npm/tailwindcss@3.4.13` → `npm/mz@2.7.0` ℹ Read more on: This package \| This alert \| What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/mz@2.7.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		System shell access: npm `mz` in module child_process Module: child_process Location: Package overview From: package-lock.json → `npm/tailwindcss@3.4.13` → `npm/mz@2.7.0` ℹ Read more on: This package \| This alert \| What is shell access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/mz@2.7.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Network access: npm `sucrase` in module globalThis["fetch"] Module: globalThis["fetch"] Location: Package overview From: package-lock.json → `npm/tailwindcss@3.4.13` → `npm/sucrase@3.35.0` ℹ Read more on: This package \| This alert \| What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/sucrase@3.35.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Dynamic code execution: npm `sucrase` Eval Type: eval Location: Package overview From: package-lock.json → `npm/tailwindcss@3.4.13` → `npm/sucrase@3.35.0` ℹ Read more on: This package \| This alert \| What is dynamic code execution? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Avoid packages that use dynamic code execution like eval(), since this could potentially execute any code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/sucrase@3.35.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Filesystem access: npm `@nodelib/fs.scandir` with module fs Module: fs Location: Package overview From: package-lock.json → `npm/tailwindcss@3.4.13` → `npm/@nodelib/fs.scandir@2.1.5` ℹ Read more on: This package \| This alert \| What is filesystem access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: If a package must read the file system, clarify what it will read and ensure it reads only what it claims to. If appropriate, packages can leave file system access to consumers and operate on data passed to it instead. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@nodelib/fs.scandir@2.1.5`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Potential code anomaly (AI signal): npm `@nodelib/fs.scandir` is 100.0% likely to have a medium risk anomaly Notes: The code is a conventional, well-structured implementation of a directory-reading utility that supports: reading with file types, optionally following symbolic links, and optionally returning full stat data. It uses standard Node.js filesystem patterns and a parallel task runner without obvious malicious behavior or data exfiltration. No hard-coded secrets or environment variable misuse detected. Overall security risk is low unless the surrounding project introduces insecure usage patterns; within this module itself, there is no malware or backdoor logic. Confidence: 1.00 Severity: 0.60 From: package-lock.json → `npm/tailwindcss@3.4.13` → `npm/@nodelib/fs.scandir@2.1.5` ℹ Read more on: This package \| This alert \| What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@nodelib/fs.scandir@2.1.5`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Filesystem access: npm `@nodelib/fs.stat` with module fs Module: fs Location: Package overview From: package-lock.json → `npm/tailwindcss@3.4.13` → `npm/@nodelib/fs.stat@2.0.5` ℹ Read more on: This package \| This alert \| What is filesystem access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: If a package must read the file system, clarify what it will read and ensure it reads only what it claims to. If appropriate, packages can leave file system access to consumers and operate on data passed to it instead. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@nodelib/fs.stat@2.0.5`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Potential code anomaly (AI signal): npm `@nodelib/fs.walk` is 100.0% likely to have a medium risk anomaly Notes: The code is a straightforward adapter between an asynchronous reader and a Node.js Readable stream. It cleanly forwards entries and errors to the stream. The main caution is ensuring read() is idempotent or that multiple invocations are avoided to prevent duplicate event handlers and potential memory leaks. Overall risk appears low to moderate, contingent on the behavior of the underlying _reader implementation. Confidence: 1.00 Severity: 0.60 From: package-lock.json → `npm/tailwindcss@3.4.13` → `npm/@nodelib/fs.walk@1.2.8` ℹ Read more on: This package \| This alert \| What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@nodelib/fs.walk@1.2.8`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Embedded URLs or IPs: npm `@pkgjs/parseargs` URLs: https://github.com/nodejs/node/pull/38248, Function.prototype.call Location: Package overview From: package-lock.json → `npm/tailwindcss@3.4.13` → `npm/@pkgjs/parseargs@0.11.0` ℹ Read more on: This package \| This alert \| What are URL strings? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Review all remote URLs to ensure they are intentional, pointing to trusted sources, and not being used for data exfiltration or loading untrusted code at runtime. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@pkgjs/parseargs@0.11.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Embedded URLs or IPs: npm `ansi-regex` with https://github.com URLs: https://github.com Location: Package overview From: package-lock.json → `npm/tailwindcss@3.4.13` → `npm/ansi-regex@5.0.1` ℹ Read more on: This package \| This alert \| What are URL strings? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Review all remote URLs to ensure they are intentional, pointing to trusted sources, and not being used for data exfiltration or loading untrusted code at runtime. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/ansi-regex@5.0.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Embedded URLs or IPs: npm `ansi-regex` with https://github.com URLs: https://github.com Location: Package overview From: package-lock.json → `npm/tailwindcss@3.4.13` → `npm/ansi-regex@6.1.0` ℹ Read more on: This package \| This alert \| What are URL strings? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Review all remote URLs to ensure they are intentional, pointing to trusted sources, and not being used for data exfiltration or loading untrusted code at runtime. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/ansi-regex@6.1.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Embedded URLs or IPs: npm `ansi-styles` URLs: https://github.com/Qix-/color-convert/blob/3f0e0d4e92e235796ccb17f6e85c72094a651f49/conversions.js Location: Package overview From: package-lock.json → `npm/tailwindcss@3.4.13` → `npm/ansi-styles@6.2.1` ℹ Read more on: This package \| This alert \| What are URL strings? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Review all remote URLs to ensure they are intentional, pointing to trusted sources, and not being used for data exfiltration or loading untrusted code at runtime. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/ansi-styles@6.2.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Potential code anomaly (AI signal): npm `any-promise` is 100.0% likely to have a medium risk anomaly Notes: The code implements a conventional, flexible Promise implementation loader for any-promise. It supports explicit, global, and auto-detected sources. The primary security concern is the possibility of loading untrusted code via dynamic require when an implementation is supplied or discovered through auto-detection. In trusted environments with strict dependency governance, this is acceptable but warrants input validation and potential pinning of the resolved module to mitigate supply-chain risks. Overall, the approach is standard for this type of loader with moderate supply-chain risk if inputs aren’t controlled. Confidence: 1.00 Severity: 0.60 From: package-lock.json → `npm/tailwindcss@3.4.13` → `npm/any-promise@1.3.0` ℹ Read more on: This package \| This alert \| What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/any-promise@1.3.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Unmaintained: npm `any-promise` was last published 10 years ago Last Publish: 5/8/2016, 12:15:06 PM From: package-lock.json → `npm/tailwindcss@3.4.13` → `npm/any-promise@1.3.0` ℹ Read more on: This package \| This alert \| What are unmaintained packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Package should publish periodic maintenance releases if they are maintained, or deprecate if they have no intention in further maintenance. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/any-promise@1.3.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Publisher changed: npm `anymatch` is now published by phated instead of paulmillr New Author: phated Previous Author: paulmillr From: package-lock.json → `npm/tailwindcss@3.4.13` → `npm/anymatch@3.1.3` ℹ Read more on: This package \| This alert \| What is new author? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Scrutinize new collaborator additions to packages because they now have the ability to publish code into your dependency tree. Packages should avoid frequent or unnecessary additions or changes to publishing rights. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/anymatch@3.1.3`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Unmaintained: npm `camelcase-css` was last published 8 years ago Last Publish: 8/11/2018, 12:59:21 AM From: package-lock.json → `npm/tailwindcss@3.4.13` → `npm/camelcase-css@2.0.1` ℹ Read more on: This package \| This alert \| What are unmaintained packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Package should publish periodic maintenance releases if they are maintained, or deprecate if they have no intention in further maintenance. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/camelcase-css@2.0.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Environment variable access: npm `chokidar` reads CHOKIDAR_USEPOLLING Env Vars: CHOKIDAR_USEPOLLING Location: Package overview From: package-lock.json → `npm/tailwindcss@3.4.13` → `npm/chokidar@3.6.0` ℹ Read more on: This package \| This alert \| What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/chokidar@3.6.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Environment variable access: npm `chokidar` reads CHOKIDAR_INTERVAL Env Vars: CHOKIDAR_INTERVAL Location: Package overview From: package-lock.json → `npm/tailwindcss@3.4.13` → `npm/chokidar@3.6.0` ℹ Read more on: This package \| This alert \| What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/chokidar@3.6.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Environment variable access: npm `chokidar` Env Vars: CHOKIDAR_PRINT_FSEVENTS_REQUIRE_ERROR Location: Package overview From: package-lock.json → `npm/tailwindcss@3.4.13` → `npm/chokidar@3.6.0` ℹ Read more on: This package \| This alert \| What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/chokidar@3.6.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Filesystem access: npm `chokidar` with module fs Module: fs Location: Package overview From: package-lock.json → `npm/tailwindcss@3.4.13` → `npm/chokidar@3.6.0` ℹ Read more on: This package \| This alert \| What is filesystem access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: If a package must read the file system, clarify what it will read and ensure it reads only what it claims to. If appropriate, packages can leave file system access to consumers and operate on data passed to it instead. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/chokidar@3.6.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Filesystem access: npm `chokidar` with module fsevents Module: fsevents Location: Package overview From: package-lock.json → `npm/tailwindcss@3.4.13` → `npm/chokidar@3.6.0` ℹ Read more on: This package \| This alert \| What is filesystem access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: If a package must read the file system, clarify what it will read and ensure it reads only what it claims to. If appropriate, packages can leave file system access to consumers and operate on data passed to it instead. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/chokidar@3.6.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
See 90 more rows in the dashboard

View full report

github-actions · 2026-03-27T13:51:23Z

Infisical secrets check: ✅ No secrets leaked!

💻 Scan logs

2026-03-27T13:51:19Z INF scanning for exposed secrets...
1:51PM INF 659 commits scanned.
2026-03-27T13:51:20Z INF scan completed in 1.45s
2026-03-27T13:51:20Z INF no leaks found

sourcery-ai

Hey - I've reviewed your changes and they look great!

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

penify-dev · 2026-03-27T13:51:42Z

PR Review 🔍

⏱️ Estimated effort to review [1-5]	2, because the changes are primarily version reverts and updates to package files, which are straightforward to review.
🧪 Relevant tests	No
⚡ Possible issues	No
🔒 Security concerns	No

penify-dev · 2026-03-27T13:51:53Z

PR Code Suggestions ✨

Category	Suggestion	Score
Compatibility	Verify compatibility of the new dependency version with existing packages Consider verifying the compatibility of the new version of `tailwindcss` with your existing dependencies to avoid potential issues. package.json [37] -"tailwindcss": "^3.4.1", +"tailwindcss": "^3.4.1", // Ensure compatibility with other dependencies Suggestion importance[1-10]: 7 Why: While the suggestion addresses an important aspect of dependency management, it does not directly improve the code itself but rather suggests a best practice.	7

Revert "build(deps-dev): bump tailwindcss in the tailwind group (#624)"

5ce91ce

This reverts commit b9f65d8.

github-actions Bot added the size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. label Mar 27, 2026

penify-dev Bot added the Bug fix label Mar 27, 2026

sourcery-ai Bot reviewed Mar 27, 2026

View reviewed changes

penify-dev Bot added the Review effort [1-5]: 2 Low review effort required for this pull request (effort level: 2) label Mar 27, 2026

guibranco enabled auto-merge (squash) March 27, 2026 13:51

gstraccini Bot added the ☑️ auto-merge Automatic merging of pull requests (gstraccini-bot) label Mar 27, 2026

gstraccini Bot assigned guibranco Mar 27, 2026

gstraccini Bot approved these changes Mar 27, 2026

View reviewed changes

guibranco disabled auto-merge March 27, 2026 13:53

guibranco merged commit 66f353b into main Mar 27, 2026
22 of 24 checks passed

guibranco deleted the feature/revert-tailwind-css branch March 27, 2026 13:53

Conversation

guibranco commented Mar 27, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

User description

📑 Description

✅ Checks

☢️ Does this introduce a breaking change?

Description

Changes walkthrough 📝

Summary by CodeRabbit

Uh oh!

code-genius-code-coverage Bot commented Mar 27, 2026

Uh oh!

sourcery-ai Bot commented Mar 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reviewer's Guide

File-Level Changes

Interacting with Sourcery

Customizing Your Experience

Getting Help

Uh oh!

coderabbitai Bot commented Mar 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Poem

Uh oh!

socket-security Bot commented Mar 27, 2026

Uh oh!

socket-security Bot commented Mar 27, 2026

Uh oh!

github-actions Bot commented Mar 27, 2026

Uh oh!

sourcery-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

penify-dev Bot commented Mar 27, 2026

PR Review 🔍

Uh oh!

penify-dev Bot commented Mar 27, 2026

PR Code Suggestions ✨

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

guibranco commented Mar 27, 2026 •

edited by coderabbitai Bot

Loading

sourcery-ai Bot commented Mar 27, 2026 •

edited

Loading

coderabbitai Bot commented Mar 27, 2026 •

edited

Loading