Tailwind CSS version 1.4.0 represents an incremental update on version 1.3.5, offering enhancements and refinements to this utility-first CSS framework. Both versions share the same core philosophy of rapidly building custom user interfaces through composable utility classes, but subtle differences exist in their dependency structures and distribution characteristics. Key dependencies like bytes, chalk, lodash, postcss, resolve, fs-extra, detective, node-emoji, postcss-js, autoprefixer, normalize.css, pretty-hrtime, postcss-nested, reduce-css-calc, and postcss-functions remain consistent, ensuring a familiar development environment. However, version 1.4.0 introduces @fullhuman/postcss-purgecss and browserslist as dependencies, indicating expanded capabilities in CSS purging and browser compatibility management.
From a developer's perspective, the upgrade from version 1.3.5 to 1.4.0 presents several benefits. The introduction of @fullhuman/postcss-purgecss likely helps optimize the final CSS output by removing unused styles, leading to smaller file sizes and improved website performance. The inclusion of browserslist signifies a stronger focus on cross-browser compatibility. Developers will appreciate the framework's continued reliance on robust devDependencies such as jest, eslint, prettier, and @babel/* tools, which ensures adherence to best practices and simplifies the development workflow. Version 1.4.0 also showcases a larger unpacked size (7.3MB vs. 4.6MB), potentially hinting at expanded functionality or refined utility classes beyond the added dependencies.
All the vulnerabilities related to the version 1.4.0 of the package
PostCSS line return parsing error
An issue was discovered in PostCSS before 8.4.31. It affects linters using PostCSS to parse external Cascading Style Sheets (CSS). There may be \r discrepancies, as demonstrated by @font-face{ font:(\r/*);} in a rule.
This vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by PostCSS, it will be included in the PostCSS output in CSS nodes (rules, properties) despite being originally included in a comment.
