v3: Drop the braces dependency chain (fast-glob, micromatch, chokidar v3)

.npmrc

@@ -0,0 +1,4 @@
+# `@swc/cli` 0.1.x declares an optional peer dependency on chokidar v3 (used only by
+# `swc --watch`), which conflicts with the chokidar v4 Tailwind CSS depends on. Newer
+# versions of `@swc/cli` accept chokidar v4 but require Node.js 16+.
+legacy-peer-deps=true

CHANGELOG.md

@@ -7,6 +7,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Changed
+
+- Replace `fast-glob`, `micromatch` and `chokidar` v3 with `tinyglobby`, `picomatch` and `chokidar` v4 to drop the vulnerable `braces` dependency; the minimum supported Node.js version is now 14.18 ([#20541](https://github.com/tailwindlabs/tailwindcss/pull/20541))
+
 ### Fixed
 
 - Ensure classes are extracted when a variant precedes an arbitrary variant containing a quoted attribute selector (e.g. `focus-visible:[&:not([aria-selected="true"])]:bg-red-500`) ([#20374](https://github.com/tailwindlabs/tailwindcss/pull/20374))

integrations/package.json

@@ -12,6 +12,7 @@
     ]
   },
   "devDependencies": {
+    "chokidar": "^3.6.0",
     "isomorphic-fetch": "^3.0.0",
     "jest": "^26.6.3"
   }