chore(deps): update npm dependencies

[deniswsrosa]

Summary

Updates direct npm dependencies for couchbase-examples/nextjs-quickstart and regenerates package-lock.json with the existing npm workflow (Node 24 / npm 11).

This PR was opened by @deniswsrosa on 2026-07-06. It was refreshed on 2026-09-29 as part of Hermes Kanban task t_93148fc1 (board couchbase-examples) rather than opening a second dependency PR. The refresh:

1. Merged main, which fixes the package-lock.json conflict left by Bump ws from 8.20.1 to 8.21.1 #206 (ws bump).
2. Refreshed every direct dependency to its latest stable compatible release, and raised the tar override to 7.5.22. npm audit now reports 0 vulnerabilities; before, there was a critical node-tar advisory reached through couchbase → cmake-js.
3. Completed the Tailwind CSS 4 migration. The original commit bumped tailwindcss to v4 and switched the PostCSS plugin, but styles/globals.css still used the v3 @tailwind directives. Tailwind 4 ignores those, so most utilities were never generated and the app rendered unstyled: invisible heroicons, no spacing or colors. CI didn't catch this because the Jest suite only covers the API routes. This PR applies the official @tailwindcss/upgrade codemod output:
   • @import 'tailwindcss' plus a border-color compatibility layer so borders keep their v3 color
   • renames for utilities whose scale changed in v4: shadow-sm→shadow-xs, rounded→rounded-sm, flex-shrink-0→shrink-0, and an arbitrary left offset→left-128
   • removes tailwind.config.cjs (v4 detects content automatically)
   • removes autoprefixer, which Tailwind 4 handles itself (the Gemini review suggested this too)

Updated dependencies (vs main)

Ecosystem	Dependency	Previous	Updated	Type	Notes
npm	@headlessui/react	^1.7.19	^2.2.10	dependency	Major; Dialog.Panel/Transition.Child still supported, UI verified
npm	axios	^1.18.0	^1.20.0	dependency	Minor
npm	couchbase	^4.7.0	^4.7.1	dependency	Patch
npm	next	^16.2.9	^16.3.7	dependency	Minor
npm	qs	^6.15.2	^6.16.0	dependency	Minor
npm	react	^18.3.1	^19.3.0	dependency	Major
npm	react-dom	^18.3.1	^19.3.0	dependency	Major
npm	@tailwindcss/postcss	not present	^4.3.3	devDependency	PostCSS adapter required by Tailwind 4
npm	autoprefixer	^10.5.0	removed	devDependency	Tailwind 4 does vendor prefixing itself
npm	env-cmd	^10.1.0	^11.0.0	devDependency	Major; -f usage unchanged
npm	eslint	^9.39.4	^9.39.5	devDependency	Held on 9.x, see risk notes
npm	eslint-config-next	^16.2.9	^16.3.7	devDependency	Minor
npm	eslint-config-prettier	^8.10.2	^10.1.8	devDependency	Major
npm	jest	^29.7.0	^30.5.2	devDependency	Major
npm	jest-environment-jsdom	^29.7.0	^30.5.2	devDependency	Major
npm	next-test-api-route-handler	^5.0.5	^5.0.7	devDependency	Patch
npm	postcss	^8.5.15	^8.5.28	devDependency	Patch
npm	prettier	^3.8.4	^3.9.9	devDependency	Minor
npm	tailwindcss	^3.4.19	^4.3.3	devDependency	Major; migration completed in this PR
npm	tar (override)	7.5.16	7.5.22	override	Fixes critical node-tar advisories (transitive via couchbase → cmake-js)

Overlapping Dependabot PRs: this PR covers the direct bumps from #217 and #212, and the lockfile regeneration resolves the transitive bumps in #216, #215, #214, #213, #211, #210 and #209. Those PRs can be closed once this merges.

Validation

All commands ran locally from a clean npm ci on Node v24.21.0 / npm 11.19.0, against a disposable local Couchbase Server 7.6.4 container set up the same way as CI (kv, n1ql and index services, memory-optimized indexes, Administrator/password, bucket user_profile).

npm ci
npm run init-db:default
npm run check
npm test
CB_USERNAME=Administrator CB_PASSWORD=password CB_CONNECT_STRING=couchbase://localhost CB_BUCKET=user_profile npm run build
npm audit
npm outdated

Check	Result
npm ci	✅ exit 0
npm run init-db:default	✅ exit 0 (bucket, scope/collection and indexes created)
npm run check (prettier + eslint --max-warnings=0)	✅ exit 0
npm test	✅ exit 0, 4 suites / 6 tests passed
npm run build (Next.js 16.3.7 Turbopack, sample data + indexes)	✅ exit 0
npm audit	✅ 0 vulnerabilities
npm outdated	only eslint 10.x remains (held intentionally)

Browser evidence

I ran npm run dev:default against the local Couchbase and drove it with Playwright (Chromium, 1280×800). The walkthrough loads the directory list, searches for a user, opens their profile, adds a new user through the Headless UI modal, then searches for the new record, which was written to Couchbase and read back.

Profile view (after search)

Add-user modal (Headless UI v2 + Tailwind 4)

Created user read back from Couchbase

Initial list view: screenshot

Walkthrough video: Open the UI walkthrough (webm)

The browser logged no page errors. The only console messages were dev-mode HMR websocket handshake failures, caused by the Docker port mapping used locally; they are unrelated to the app.

Risk notes

• Several major bumps: React 19, Headless UI 2, Tailwind 4, Jest 30, env-cmd 11, eslint-config-prettier 10. The API tests and the browser walkthrough pass, but a quick visual check of the Vercel preview is still worthwhile. Tailwind 4 has small visual differences from v3 by design, such as slightly different default ring and shadow rendering.
• eslint held on 9.x: eslint-plugin-react@7.37.5, pulled in by eslint-config-next, only declares peer support up to eslint ^9.7, and an earlier eslint 10 attempt failed with scopeManager.addGlobals is not a function.
• The original commit also added .github/dependency-update-evidence/depupdate-20260703T172451Z-tests-passing.png. This refresh left it alone; the owner can drop it before merge if the repo doesn't want committed evidence images.
• No npm audit fix --force was used.

Rollback

Revert this PR to restore the previous package.json, package-lock.json, postcss.config.cjs, tailwind.config.cjs, styles/globals.css and component class names.

---

Hermes task: t_93148fc1 (board couchbase-examples): reconcile the dependency sweep through this existing PR instead of opening a duplicate.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
couchbase-nextjs-quickstart	Ready	Preview	Sep 29, 2026 11:55pm UTC
nextjs-quickstart	Ready	Preview	Sep 29, 2026 11:55pm UTC

[gemini-code-assist]

Code Review

This pull request updates several dependencies in package.json, notably upgrading React to v19 and Tailwind CSS to v4, and updates postcss.config.cjs to use @tailwindcss/postcss. The review feedback recommends removing autoprefixer from both package.json and postcss.config.cjs because Tailwind CSS v4 handles vendor prefixing automatically.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[gemini-code-assist]

With Tailwind CSS v4, vendor prefixing is handled automatically by Lightning CSS under the hood. As a result, autoprefixer is no longer required as a dependency and can be safely removed.

Suggested change

	"@tailwindcss/postcss": "^4.3.2",
	"autoprefixer": "^10.5.2",
	"@tailwindcss/postcss": "^4.3.2",

[gemini-code-assist]

Since Tailwind CSS v4 includes built-in vendor prefixing, autoprefixer is no longer needed. You should remove autoprefixer: {}, from your PostCSS plugins configuration to simplify the setup.

[ejscribner]

@dex-the-ai do we need to take this comment?

[dex-the-ai]

@ejscribner Yes, and it's already done. Gemini is right: Tailwind 4's @tailwindcss/postcss plugin runs Lightning CSS, which adds vendor prefixes itself, so autoprefixer isn't needed anymore. It was removed in b53f6fe (part of the Tailwind 4 migration):

• postcss.config.cjs now has only '@tailwindcss/postcss': {}
• autoprefixer is gone from package.json devDependencies, and nothing in package-lock.json depends on it (npm ls autoprefixer returns empty)

I checked the current head (cc1cad3) again: npm ci, npm run check (prettier + eslint) and next build all pass. The compiled CSS still has -webkit-* prefixes (for example -webkit-appearance), so we don't lose prefixing. No new commit was needed.

[dex-the-ai]

Hermes refreshed this PR for Kanban task t_93148fc1 (board couchbase-examples) instead of opening a duplicate dependency PR. @deniswsrosa, heads-up, since this is your branch. I only added commits on top of yours (fast-forward push, no force push, your commit is untouched):

• ae98d1b: merge main, which resolves the package-lock.json conflict from Bump ws from 8.20.1 to 8.21.1 #206
• 57c32ea: refresh direct deps to their latest stable compatible versions and bump the tar override to 7.5.22 (npm audit now reports 0 vulnerabilities)
• b53f6fe: complete the Tailwind 4 migration. globals.css was still on the v3 @tailwind directives, so the app rendered unstyled under Tailwind 4 (icons invisible, no layout). I applied the official @tailwindcss/upgrade codemod output and removed autoprefixer, as the Gemini review suggested.

Local validation on Node 24.21.0 against a local Couchbase 7.6.4: npm ci, npm run init-db:default, npm run check, npm test (4 suites / 6 tests), npm run build and npm audit all pass. I also ran a Playwright UI walkthrough (list → search → profile → add user → read back). Screenshots and video are embedded in the updated PR description.

Evidence video: https://res.cloudinary.com/dhwqj0ps2/video/upload/v1790719683/pr-evidence/couchbase-examples/nextjs-quickstart/pr-205/t_93148fc1-ui-walkthrough-video.webm

[ejscribner]

@dex-the-ai please remove this file, it is unwanted clutter

[dex-the-ai]

@ejscribner Done — removed .github/dependency-update-evidence/depupdate-20260703T172451Z-tests-passing.png in cc1cad3. Nothing else in the repo referenced it, and the PR diff no longer includes any .github/ files. This is a file deletion only, so no application code changed.

[ejscribner]

@dex-the-ai can you address the comment above from gemini-code-assist:

medium
Since Tailwind CSS v4 includes built-in vendor prefixing, autoprefixer is no longer needed. You should remove autoprefixer: {}, from your PostCSS plugins configuration to simplify the setup.

#205 (comment)

[dex-the-ai]

@ejscribner This Gemini suggestion was already applied in b53f6fe: autoprefixer: {} is gone from postcss.config.cjs, and autoprefixer is gone from package.json. That also covers Gemini's matching suggestion on package.json. Tailwind 4's @tailwindcss/postcss adds vendor prefixes itself through Lightning CSS.

I checked the current head (cc1cad3) again: npm ci, npm run check and next build pass, and the built CSS still has vendor prefixes. There's a longer answer in the review thread: #205 (comment). No new commit was needed.