build(deps): Bump tailwind-merge from 2.6.0 to 3.7.0

[dependabot]

Bumps tailwind-merge from 2.6.0 to 3.7.0.

Release notes

Sourced from tailwind-merge's releases.

tailwind-merge@3.7.0

New Features

• Prepare some upcoming changes by @​dcastil in dcastil/tailwind-merge#713
  • Theme getters returned by fromTheme now expose the theme key they read as a themeKey property, so tooling can identify the referenced theme scale without calling the getter.
  • Release tags now include the package name, starting with tailwind-merge@3.7.0.

Bug Fixes

• Fix arbitrary values using color() or light-dark() being classified as lengths instead of colors by @​ddussi in dcastil/tailwind-merge#712
• Fix bare bg-conic not merging with other background image classes by @​dcastil in dcastil/tailwind-merge#708
• Fix columns-auto not conflicting with other columns classes by @​dcastil in dcastil/tailwind-merge#707
• Fix container sizes like inline-2xl not merging by @​dcastil in dcastil/tailwind-merge#706
• Fix max-h-none missing in max-h class group by @​mutewinter in dcastil/tailwind-merge#704
• Fix axis shorthands like px not overriding logical sides like ps by @​dcastil in dcastil/tailwind-merge#705
• Fix leading-none being removed when the leading theme scale is overridden by @​chatman-media in dcastil/tailwind-merge#689
• Fix deprecated shadow-inner being classified as shadow color instead of shadow by @​dcastil in dcastil/tailwind-merge#703

Documentation

• Add Deno to install instructions by @​bartlomieju in dcastil/tailwind-merge#687
• Add missing text-shadow theme key to configuration docs by @​dcastil in dcastil/tailwind-merge@3e6d208

Other

• Switch package manager from yarn to pnpm by @​dcastil in dcastil/tailwind-merge#680
• Harden CI security by @​dcastil in dcastil/tailwind-merge#679

Full Changelog: v3.6.0...v3.7.0

Thanks to @​brandonmcconnell, @​manavm1990, @​langy, @​roboflow, @​syntaxfm, @​getsentry, @​codecov, a private sponsor, @​openclaw, @​sourcegraph, @​cesarvcanal, @​CasperKristiansson, @​jbisasky, @​frontendmasters and more via @​thnxdev for sponsoring tailwind-merge! ❤️

Commits

• 511d68a tailwind-merge@3.7.0
• 2461127 Release tooling: Pass the namespaced tag prefix and commit message to pnpm's ...
• 9d41508 add changelog for tailwind-merge@3.7.0
• c78a80f Configurator: Reuse runtime lookups during pruning
• 49c317d Monorepo: Fix contributing link and include package coverage
• 7b565ca Configurator: prune a generated config to a project's used classes (core step)
• d83e013 Releases: auto-re-pin tag-pinned links on every version bump
• b71fd41 Docs: pin every in-repo file link to a release tag instead of main
• ee29441 Docs: point the ThemeObject JSDoc link at the packaged docs location
• 9521b10 Releases: per-package pipeline with namespaced tags
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for tailwind-merge since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[changeset-bot]

⚠️ No Changeset found

Latest commit: 2960025

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs-v2	Ready	Preview	Sep 21, 2026 8:52pm UTC
nebula	Ready	Preview	Sep 21, 2026 8:52pm UTC
thirdweb_playground	Error		Sep 21, 2026 8:52pm UTC
thirdweb-www	Ready	Preview	Sep 21, 2026 8:52pm UTC
wallet-ui	Ready	Preview	Sep 21, 2026 8:52pm UTC

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 6a9271e4-7fa5-42bf-9d1b-2702379ca664

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	tailwind-merge@​3.3.1 ⏵ 3.7.0	+1		+1	-1

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm @walletconnect/sign-client is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → npm/@abstract-foundation/agw-react@1.10.0 → npm/@walletconnect/sign-client@2.23.7 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@walletconnect/sign-client@2.23.7. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm yargs is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → npm/storybook@9.1.20 → npm/vitest@4.1.11 → npm/@coinbase/wallet-mobile-sdk@1.1.2 → npm/expo-application@6.0.1 → npm/@mobile-wallet-protocol/client@1.0.0 → npm/expo-linking@8.0.8 → npm/@abstract-foundation/agw-react@1.10.0 → npm/expo-web-browser@15.0.9 → npm/yargs@17.7.3 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/yargs@17.7.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report