TailwindCSS: Security Patches and a Symlink Fix
Three dependency upgrades closed out high-severity vulnerabilities in Next.js and PostCSS, while a separate fix resolved a long-standing hot-reload bug affecting symlinked files across Tailwind's build tool integrations.
Duration: PT2M11S
Episode overview
This episode is a short developer briefing from TailwindCSS.
It explains recent repository work in plain language.
- Show: TailwindCSS
- Published: 2026-07-28T13:05:52Z
- Audio duration: PT2M11S
Transcript excerpt
This excerpt keeps the crawler page concise. Listen to the episode or use the RSS feed for the full update.
Good day, it's July 28th, 2026, and here's your TailwindCSS briefing.
The headline today is security. Three pull requests, all from anupamme, patched high-severity vulnerabilities flagged by automated scanning. PR 20359 upgraded Next.js to close a middleware bypass issue in App Router applications. PRs 20360 and 20361 upgraded PostCSS twice, addressing two separate path traversal…
The second theme is reliability in the development workflow. Robin Malfait's PR 20356 fixed a real gap in how Tailwind's file watcher handles symlinks. If a symlinked file's actual source lived outside the project's auto-detected scope, edits to that file wouldn't trigger hot reload in Vite, PostCSS, Webpack, or the…
A related commit, 4c12866, fixed a CI reliability issue: an upgrade test was writing an invalid gitignore file with indented lines, which a newer globby release started parsing differently. Switching to a proper dedent-based template literal resolved it, keeping the test suite green.
What's next: if you're running Tailwind with symlinked source files, verify hot reload now works as expected. And if you maintain your own dependency scanning, treat these PostCSS and Next.js CVEs as a prompt to…
Tha…
Nearby episodes from TailwindCSS
- Weekly Recap - Watch Mode, File Scanning, and Patch Stabilization
- Locking Down Gitignored Source Scanning
- Symlinked Sources and the Vite Watcher Gap
- Fixing Broken Custom Variants with @scope
- A Patch Release Cleans Up the Toolchain
- Correctness Fixes Land Before 4.3.3
- Reliability and Reach
- Weekly Recap - CSS Engine Internals & Precision Fixes