fix(deps): replace tailwind-merge aliases with peer dependency

[Rishikesh183]

Summary

• Removes tailwind-merge-v2 and tailwind-merge-v3 aliased dependencies from packages/ui/package.json
• Adds tailwind-merge as a peer dependency (^2 || ^3)
• Updates src/helpers/tailwind-merge.ts to import from tailwind-merge directly

Motivation

tailwind-merge-v2 and tailwind-merge-v3 are malicious packages on the npm registry (GHSA-53q4-wj32-3vv9, GHSA-3679-84c2-v5xm). Although npm aliases prevented the malicious packages from ever being installed, security scanners (GitHub Advanced Security, npm audit) read the package names from package.json and flag any downstream project that uses flowbite-react — blocking PRs in corporate environments.

Fixes the concern raised in #1665.

Breaking change

tailwind-merge must now be installed explicitly:

• Tailwind CSS v3 users: npm install tailwind-merge@^2
• Tailwind CSS v4 users: npm install tailwind-merge@^3

Summary by CodeRabbit

• Chores
  • Updated tailwind-merge dependency structure. The package now requires tailwind-merge (v2 or v3) as a peer dependency, giving consumers flexibility in version selection. Simplified internal dependency resolution logic.

[vercel]

@Rishikesh183 is attempting to deploy a commit to the Bergside Team on Vercel.

A member of the Team first needs to authorize it.

[changeset-bot]

⚠️ No Changeset found

Latest commit: d6e2404

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 49657a93-6621-440c-897a-09de219162b0

📥 Commits

Reviewing files that changed from the base of the PR and between 0f526aa and d6e2404.

📒 Files selected for processing (2)

• packages/ui/package.json
• packages/ui/src/helpers/tailwind-merge.ts

---

📝 Walkthrough

Walkthrough

The PR removes versioned tailwind-merge package aliases from dependencies and adds tailwind-merge as a peer dependency supporting both v2 and v3. The twMerge helper is refactored to use a single extendTailwindMerge implementation and simplified caching by prefix only, eliminating version-detection logic.

Changes

Tailwind Merge Refactor

Layer / File(s)	Summary
Dependency contract migration packages/ui/package.json	Removed tailwind-merge-v2 and tailwind-merge-v3 from dependencies; added tailwind-merge to peerDependencies with ^2 || ^3 version range.
Helper implementation simplification packages/ui/src/helpers/tailwind-merge.ts	Removed version-detection import and dynamic v2/v3 selection logic; refactored to use single extendTailwindMerge call and simplified cache key from ${prefix}.${version} to prefix-only lookup.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~5 minutes

Possibly related issues

• flowbite-react@0.12.17 still references tailwind-merge-v2 and tailwind-merge-v3 alias packages #1672 — This PR directly addresses the issue by removing the aliased tailwind-merge-v2/v3 dependencies and refactoring the twMerge helper to use a single implementation, aligning with the upstream package.

Suggested labels

bug

Suggested reviewers

• rluders

Poem

🐰 The merge got tangled, version by version,
Now one path forward, simpler conversion,
Peer dependencies, lighter and bright,
Tailwind's a-flowing, everything right! ✨

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: removing tailored aliases and adding a peer dependency for tailwind-merge.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 ESLint

If the error stems from missing dependencies, add them to the package.json file. For unrecoverable errors (e.g., due to private dependencies), disable the tool in the CodeRabbit configuration.

packages/ui/src/helpers/tailwind-merge.ts

Oops! Something went wrong! :(

ESLint: 8.57.0

ESLint couldn't find the plugin "eslint-plugin-react".

(The package "eslint-plugin-react" was not found when loaded as a Node module from the directory "/packages/ui".)

It's likely that the plugin isn't installed correctly. Try reinstalling by running the following:

npm install eslint-plugin-react@latest --save-dev

The plugin "eslint-plugin-react" was referenced from the config file in "packages/ui/.eslintrc.cjs".

If you still can't figure out the problem, please stop by https://eslint.org/chat/help to chat with the team.

Tip

💬 Introducing Slack Agent: The best way for teams to turn conversations into code.

Slack Agent is built on CodeRabbit's deep understanding of your code, so your team can collaborate across the entire SDLC without losing context.

• Generate code and open pull requests
• Plan features and break down work
• Investigate incidents and troubleshoot customer tickets together
• Automate recurring tasks and respond to alerts with triggers
• Summarize progress and report instantly

Built for teams:

• Shared memory across your entire org—no repeating context
• Per-thread sandboxes to safely plan and execute work
• Governance built-in—scoped access, auditability, and budget controls

One agent for your entire SDLC. Right inside Slack.

👉 Get started

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}