Upgrading @astrojs/tailwind 4 to 5
Breaking4.0.0 → 5.1.5Security1Platform2New1Changed8Fixed6
SecurityFixes the `add` command accepting arbitrary values that could lead to command injections; it now accepts only valid npmjs.org names.#15419 ↗
BreakingUpgrade verdict
2 platform requirement changes and a security fix.
In plain terms
- A temporary workaround for an older Node version is gone, since the online Stackblitz environment now runs Node 22 by default.
- This package now requires Node.js 22.12.0 or newer to run.
- The add command could be abused with crafted input to run unintended commands; it now only accepts valid npm package names.
Must act 3 items need code or config changes
@astrojs/tailwind publishes an official migration guide for version 5. It covers more than the release notes do.
V6 upgrade guidance ↗What you must change
Security1
Fixes the
add command accepting arbitrary values that could lead to command injections; it now accepts only valid npmjs.org names.add--addPlatform2
Removes temporary support for Node >=20.19.1 because Stackblitz now uses Node 22 by default.
Increases minimum Node.js version to 22.12.0.