Conversation
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…ases. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
npm 11 no longer installs vitest's optional jsdom peer, leaving the root-hoisted vitest unable to resolve it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
IS-9818 Update .nvmrc to Node 24.19.0.
…ing.message.too.long. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…itation. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…ion-key-leak IS-11627 Add localised error-area messages for token-unknown and binding.message.too.long
IS-11684 Add h5 and h6 heading styling in Curity CSS
…-imports IS-11682 Consume UI Kit CSS from source instead of the built artifact
Contributor
Author
|
Superseded by #301, which carries the same merge plus a README section explaining the new branching model to consumers of this repository. That change could not be added here because this PR's head is |
Contributor
There was a problem hiding this comment.
Pull request overview
Merges dev into main as the first step toward making main the development trunk, aligning default-branch tooling (Dependabot/security alerts/dependency graph) with the branch where active development happens.
Changes:
- Standardizes Curity CSS consumption via
@curity/ui-kit-css(package export) instead of importing the builtlib/dist/index.cssfile directly. - Updates Node/npm requirements to match
.nvmrc(24.19.0 / 11.17.0) and simplifies prestart/prebuild scripts by removing CSS-lib watch/build steps. - Expands CSS typography support (h5/h6) and updates docs + identity-server translations for new error keys.
Reviewed changes
Copilot reviewed 37 out of 38 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| src/self-service-portal/app/tsconfig.app.json | Removes now-unused TS path alias for the CSS package. |
| src/self-service-portal/app/src/main.tsx | Switches CSS import to @curity/ui-kit-css package entry. |
| src/self-service-portal/app/previewer/main.tsx | Switches CSS import to @curity/ui-kit-css package entry. |
| src/self-service-portal/app/package.json | Bumps engines, removes CSS-lib watch/build steps, pins Cypress version. |
| src/identity-server/vite.plugins.ts | Adds clarification comment about watch-mode limitations for static-copied CSS themes. |
| src/identity-server/vite.config.ts | Removes custom “watch css-lib source” plugin in styles mode. |
| src/identity-server/styles/index.js | Switches CSS import to @curity/ui-kit-css package entry. |
| src/identity-server/README.md | Updates prerequisites to point to .nvmrc rather than hardcoded versions. |
| src/identity-server/package.json | Bumps engines, simplifies scripts, and adds @curity/ui-kit-css dependency. |
| src/identity-server/messages/core/sv/views/error/401/messages | Adds token-unknown message (sv). |
| src/identity-server/messages/core/sv/views/error/400/messages | Adds binding.message.too.long message (sv). |
| src/identity-server/messages/core/pt/views/error/401/messages | Adds token-unknown message (pt). |
| src/identity-server/messages/core/pt/views/error/400/messages | Adds binding.message.too.long message (pt). |
| src/identity-server/messages/core/pt-pt/views/error/401/messages | Adds token-unknown message (pt-pt). |
| src/identity-server/messages/core/pt-pt/views/error/400/messages | Adds binding.message.too.long message (pt-pt). |
| src/identity-server/messages/core/en/views/error/401/messages | Adds token-unknown message (en). |
| src/identity-server/messages/core/en/views/error/400/messages | Adds binding.message.too.long message (en). |
| src/haapi-react-sdk/package.json | Bumps engines to the .nvmrc versions. |
| src/haapi-react-app/src/shared/util/css/styles.css | Switches CSS import to @curity/ui-kit-css package entry. |
| src/haapi-react-app/previewer/shared/styles/previewer.css | Switches CSS import to @curity/ui-kit-css package entry. |
| src/haapi-react-app/package.json | Bumps engines, removes CSS-lib watch steps, adds @curity/ui-kit-css dependency. |
| src/common/css/package.json | Introduces exports for @curity/ui-kit-css (source entry + legacy dist path). |
| src/common/css/lib/vite.config.js | Simplifies dev server settings for CSS lib build. |
| src/common/css/lib/src/base/base-type.css | Adds h5/h6 base typography sizing rules. |
| src/common/css/lib/readme.md | Updates usage instructions to import "@curity/ui-kit-css". |
| src/common/css/lib/package.json | Removes unused scripts/deps tied to prior CSS-lib watch workflow. |
| src/common/css/docs/src/styles/global.css | Updates typography styling to include h5/h6 and adjusts h4 sizing. |
| src/common/css/docs/src/pages/introduction/gettingstarted.mdx | Updates guidance for bundled vs non-bundled CSS usage and refreshes updatedAt. |
| src/common/css/docs/src/pages/index.mdx | Updates usage snippet to import "@curity/ui-kit-css". |
| src/common/css/docs/src/pages/content/typography.mdx | Documents h5/h6 headings and adds examples. |
| src/common/css/docs/src/components/Install.mdx | Updates install instructions to cloning the repository. |
| src/common/css/docs/src/components/BaseHead.astro | Switches CSS import to @curity/ui-kit-css package entry. |
| src/common/component-library/tsconfig.app.json | Removes now-unused TS path alias for the CSS package. |
| src/common/component-library/README.md | Updates prerequisites and clarifies runtime requirement to load Curity CSS. |
| src/common/component-library/package.json | Bumps engines and removes CSS package from dependencies/prebuild. |
| package.json | Bumps engines, simplifies prestart build list, and adds jsdom devDependency. |
| package-lock.json | Updates lockfile for engine bumps and dependency graph changes. |
| .nvmrc | Updates pinned Node version to 24.19.0. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
IS-11744 — merges
devintomainas the first step of makingmainthe development trunk. Part of IS-11678.mainhas until now mirrored the exact released state, which made Dependabot's security updates unmergeable by policy: they always target the default branch. Withmainas the trunk, security PRs, Dependabot alerts and the dependency graph are all computed against the branch we actually develop on. Releases stay identified byui-kit-<version>tags and version branches.What this brings
19 commits from
dev. 38 files changed, +415 / −1034.Verified before opening:
git merge-tree.main. Of the 4 commitsmainhas thatdevdoes not, three are merge commits and one isf2c2dab("changing Dependabot configuration"), which created.github/dependabot.yml— anddevalready holds a byte-identical copy of that file.This is a real merge, not a reset:
mainis not being force-moved todev.After this lands
target-branch: "dev"from.github/dependabot.ymlso version updates land onmaintoo.main, any already fixed by this merge will close itself.dev(Bump @rollup/plugin-commonjs from 25.0.8 to 29.0.3 #244, Bump @rollup/plugin-typescript from 11.1.6 to 12.3.0 #245, Bump eslint-plugin-react-refresh from 0.4.20 to 0.5.3 #246, Bump concurrently from 8.2.2 to 10.0.3 #247, Bump @eslint/js from 9.35.0 to 10.0.1 #248) with@dependabot recreate.devmust not be deleted before that — deleting a branch auto-closes the PRs targeting it, and Dependabot does not recreate a closed PR for the same version.There are currently 52 open Dependabot alerts on
main(3 critical, 33 high, 12 moderate, 4 low); this merge is the first step in clearing them.🤖 Generated with Claude Code