tailwind-merge-{v2, v3} vulnerable dependencies

[diegoRodriVa]

• I have searched the Issues to see if this bug has already been reported
• I have tested the latest version

Steps to reproduce

1. Download the package from NPM
2. Audit dependencies and inspect the package in node_modules
3. Check that there is a dependency to tailwind-merge-v2 and tailwind-merge-v3:

"dependencies": {
"@floating-ui/core": "1.7.4",
"@floating-ui/react": "0.27.17",
"@iarna/toml": "2.2.5",
"chokidar": "4.0.3",
"comment-json": "4.5.1",
"debounce": "3.0.0",
"deepmerge-ts": "7.1.5",
"klona": "2.0.6",
"magic-string": "0.30.21",
"oxc-parser": "0.112.0",
"package-manager-detector": "1.6.0",
"tailwind-merge-v2": "npm:tailwind-merge@2.6.1",
"tailwind-merge-v3": "npm:tailwind-merge@3.4.0"
}

Current behavior

We have vulnerabilities due to using those packages.

Expected behavior

Fix and remove those packages from npm.js as the projects have been removed.

Context

I am auditing the security of my project, and I am using this package.

[diegoRodriVa]

Here are the packages:

https://www.npmjs.com/package/tailwind-merge-v2
https://www.npmjs.com/package/tailwind-merge-v3

[diegoRodriVa]

Closed due to found another comment where they say it is a false positive.

[ranieuwe]

This is a false positive, but it does get hit by GitHub Advanced Security scanners (GHAS) which blocks checkins for flowbite-react because of these dependencies.

GHSA-53q4-wj32-3vv9
GHSA-3679-84c2-v5xm

There's no way around it, except for making an exception at an org level (not happening). Believe these aliases should just be removed.