chore(deps): consolidate react-dom, tailwindcss, @tailwindcss/postcss bumps

[os-zhuang]

Fixes #157

What this does

One pnpm install regenerating pnpm-lock.yaml once, replacing three stalled/conflicted Dependabot PRs that each rewrite the same lockfile. Per the adjudication on #157: consolidate, don't rebase, and don't touch @dependabot (sanitizer rewrites the mention — see #49).

Package changes and which Dependabot PR each discharges

Package	Before	After	Discharges
react-dom	19.2.6	19.2.7	#49
tailwindcss	4.3.0	4.3.3	#46
@tailwindcss/postcss	4.3.0	4.3.3	#50

apps/docs/package.json declared minimums were updated to match what landed:

• react-dom: ^19.2.6 → 19.2.7 (exact, not caret — see note below)
• tailwindcss: ^4.3.0 → ^4.3.3
• @tailwindcss/postcss: ^4.3.0 → ^4.3.3

Once this merges, #46, #49, and #50 close as superseded against this commit.

Note: react-dom is pinned exact, not caret

A react-dom@19.2.8 patch was published upstream after #49 was filed. Regenerating with "react-dom": "^19.2.7" (matching the method note's "carets already permit their targets") resolved to 19.2.8, not the 19.2.7 this card names, and produced a real peer-dependency conflict:

apps/docs
└─┬ react-dom 19.2.8
  └── ✕ unmet peer react@^19.2.8: found 19.2.7

react (currently ^19.2.7, already resolved to 19.2.7) is out of scope for this card, so bumping it to keep pace with react-dom@19.2.8 isn't an option here. Pinning react-dom to the exact 19.2.7 named in #157 avoids the unmet peer and keeps the change to exactly the three named targets. Exact (no-caret) pins are an existing convention in this file (next, fumadocs-core, fumadocs-mdx, fumadocs-ui are all pinned exact already), so this isn't a new style. Re-running pnpm install after the pin resolves cleanly with no peer warning.

Out of scope, verified unchanged

• chore(deps-dev): bump @opennextjs/cloudflare from 1.19.11 to 1.20.1 #48 (@opennextjs/cloudflare 1.19.11 → 1.20.1): declared range is unchanged (^1.13.0), and the regenerated lockfile still resolves it to 1.19.11 — confirmed via grep -n "@opennextjs/cloudflare@" pnpm-lock.yaml.
• engines blocks: untouched in every package.json (git diff shows no engines hunks anywhere).

Transitive drift (full lockfile diff, package-identity level)

Parsed the packages: section of both lockfiles (before = origin/main at ca34d36, after = this branch) and diffed by name@version. No packages added or removed — only version changes, all consistent with the three bumps:

Package	Before	After
react-dom	19.2.6	19.2.7
tailwindcss	4.3.0	4.3.3
@tailwindcss/postcss	4.3.0	4.3.3
@tailwindcss/node	4.3.0	4.3.3
@tailwindcss/oxide (+ 11 platform variants)	4.3.0	4.3.3
enhanced-resolve	5.22.0	5.24.5
postcss	8.4.31, 8.5.15	8.4.31, 8.5.15, 8.5.26 (added, multi-resolution)
nanoid	3.3.12	3.3.12, 3.3.18 (added, multi-resolution)

postcss/nanoid gained an additional co-resolved version rather than replacing the old one — normal pnpm behavior when a transitive consumer (here, the tailwindcss/@tailwindcss/postcss 4.3.3 chain) now asks for a range the previously-pinned version doesn't satisfy, while other consumers still pin the old one.

Verification

Commit under test: af66c76

$ node .github/scripts/check-node-floor.mjs
## Node floor

| Declaration | Value | Floor |
| --- | --- | --- |
| `package.json` | `>=22.12.0` | 22.12.0 |
| `apps/docs/package.json` | `>=22.12.0` | 22.12.0 |
| `tools/ci-scripts/package.json` | `>=22.12.0` | 22.12.0 |
| `.node-version` | `22` | pin |

Scanned `pnpm-lock.yaml`: 430 `engines` block(s), 430 with a `node` range.
Highest floor the tree requires: **22.0.0** (@cloudflare/kv-asset-handler@0.5.0, miniflare@4.20260526.0, wrangler@4.95.0).

✅ Every declared floor clears what the dependency tree requires, and the declarations agree.
$ echo EXIT=$?
EXIT=0

$ npx turbo run type-check build test --force --concurrency=2
   • Packages in scope: @objectos/ci-scripts, @objectos/docs
   • Running type-check, build, test in 2 packages
 Tasks:    3 successful, 3 total
 Cached:    0 cached, 3 total
$ echo EXIT=$?
EXIT=0

git status --porcelain after all of the above: only apps/docs/package.json and pnpm-lock.yaml modified — no stray generated files, no breach of the file surface named in #157.

Draft

Opening as draft per the standard flow; CI will run the full gate farm on push. No .changeset — this repo has no changeset workflow (docs site, no packages/).

---

Generated by Claude Code