mirror of
https://github.com/rcourtman/Pulse.git
synced 2026-10-24 12:42:49 +00:00
rcourtman
9e7a5ffdeb
GHSA-vfj7-8cjw-p6xm affects every braces release and has no fix, so the required frontend audit failed with seven high findings on any pull request that changes the dependency graph. Tailwind CSS 3 (chokidar, fast-glob, micromatch) and jscpd 4 (@jscpd/finder, fast-glob) were the only paths in, both dev-only, and no override can remove braces from fast-glob or micromatch. Tailwind CSS 4.3.3 through @tailwindcss/vite and jscpd 5.4.0 leave none; npm audit over the full graph reports zero. The stylesheet keeps the v3 rendering. It pins the v3 palette (inlined, so opacity modifiers compile to static colors), font stacks and line heights, keeps v3's cascade order by placing former component and unlayered rules around the generated utilities, and restores v3 hover on touch devices, gray-200 default borders, the 3px blue ring, placeholder color, button cursor, table-cell padding and the space-* and divide-* child selectors. The 900/950 shades Pulse overrode with 25% alpha are opaque now and their callers say /25, because v4 multiplies an opacity modifier into a translucent color instead of replacing it. Opacity modifiers on var() colors that v3 never generated are removed. Utility order changed from lexical to numeric, so a few caller overrides that silently lost in v3 would start to win. Touch targets keep their authored 44px phone size (the Machines row stays 32px); cosmetic overrides v3 never applied are removed, and overrides it did apply use the important suffix. Contract-Neutral: Tailwind CSS 4 migration for GHSA-vfj7-8cjw-p6xm: utility class renames and stylesheet compatibility, no subsystem contract change