IS-11744 Consolidate on main: merge dev and document the branching model

[markoweb]

IS-11744 — makes main the development trunk: merges dev into it and documents what that means for consumers of this repository. Part of IS-11678.

Replaces #300, which could not carry the README change because its head was dev.

Why

main has until now mirrored the exact released state, which made Dependabot's security updates unmergeable by policy — they always target the default branch, and main was not allowed to contain anything beyond the release. With main as the trunk, security PRs, Dependabot alerts and the dependency graph are all computed against the branch we actually develop on.

What changes for consumers

This is the breaking part, and the reason for the README section: main is no longer a snapshot of the latest release. Anyone cloning or tracking main from now on gets development state.

The released state was already identified by the ui-kit-<version> tags and the version/* branches, so nothing new has to be built — but it does have to be said out loud. The new Branches and releases section in the README tells consumers to pin a tag such as ui-kit-11.4.0, or a version branch such as version/11.4, rather than follow main.

The product documentation currently instructs customers to clone this repository without specifying a tag; that is tracked as a separate action item in IS-11678 and needs updating in the Identity Server docs.

Contents

19 commits from dev plus the README section. Verified before opening:

• No conflicts — the merge was clean.
• Nothing is lost from main. Of the 4 commits main had that dev did not, three are merge commits and one is f2c2dab ("changing Dependabot configuration"), which created .github/dependabot.yml — and dev already holds a byte-identical copy.

This is a real merge, not a reset: main is not being force-moved to dev.

After this lands

1. Remove target-branch: "dev" from .github/dependabot.yml so version updates land on main too.
2. Let Dependabot re-run — of the 13 security PRs currently open against main, any already fixed by this merge will close itself.
3. Recover the 5 stale version-update PRs still based on dev (Bump @rollup/plugin-commonjs from 25.0.8 to 29.0.3 #244, Bump @rollup/plugin-typescript from 11.1.6 to 12.3.0 #245, Bump eslint-plugin-react-refresh from 0.4.20 to 0.5.3 #246, Bump concurrently from 8.2.2 to 10.0.3 #247, Bump @eslint/js from 9.35.0 to 10.0.1 #248) with @dependabot recreate. dev must not be deleted before that — deleting a branch auto-closes the PRs targeting it, and Dependabot does not recreate a closed PR for the same version.

There are currently 52 open Dependabot alerts on main (3 critical, 33 high, 12 moderate, 4 low); this is the first step in clearing them.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR completes the consolidation of development onto main by merging in the prior dev work and documenting the new branching/release model for repository consumers. Alongside the README guidance, it brings in a set of development-trunk updates across the monorepo (Node/npm baselines, CSS package consumption, and related build/docs/message updates).

Changes:

• Document that main is now the development trunk and that released states are identified via ui-kit-<version> tags and version/* branches.
• Update Node/npm engine requirements across workspaces (and .nvmrc), plus dependency/tooling adjustments (e.g., jsdom, Cypress pin).
• Consolidate Curity CSS consumption to @curity/ui-kit-css via package exports, simplify prebuild/prestart scripts accordingly, and update associated docs/styles/messages.

Reviewed changes

Copilot reviewed 38 out of 39 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
src/self-service-portal/app/tsconfig.app.json	Removes CSS path mapping now that CSS is imported via package entrypoint.
src/self-service-portal/app/src/main.tsx	Switches Curity CSS import to @curity/ui-kit-css.
src/self-service-portal/app/previewer/main.tsx	Switches Curity CSS import to @curity/ui-kit-css.
src/self-service-portal/app/package.json	Updates engines/scripts; removes CSS-lib watch/build steps; pins Cypress.
src/identity-server/vite.plugins.ts	Adds clarification comment for static CSS copy behavior in watch mode.
src/identity-server/vite.config.ts	Removes custom watch plugin for CSS lib source in styles mode.
src/identity-server/styles/index.js	Switches Curity CSS import to @curity/ui-kit-css.
src/identity-server/README.md	Updates prerequisites to reference .nvmrc versions.
src/identity-server/package.json	Updates engines/scripts; simplifies build steps; adds @curity/ui-kit-css dependency.
src/identity-server/messages/core/sv/views/error/401/messages	Adds token-unknown localized message.
src/identity-server/messages/core/sv/views/error/400/messages	Adds binding.message.too.long localized message.
src/identity-server/messages/core/pt/views/error/401/messages	Adds token-unknown localized message.
src/identity-server/messages/core/pt/views/error/400/messages	Adds binding.message.too.long localized message.
src/identity-server/messages/core/pt-pt/views/error/401/messages	Adds token-unknown localized message.
src/identity-server/messages/core/pt-pt/views/error/400/messages	Adds binding.message.too.long localized message.
src/identity-server/messages/core/en/views/error/401/messages	Adds token-unknown localized message.
src/identity-server/messages/core/en/views/error/400/messages	Adds binding.message.too.long localized message.
src/haapi-react-sdk/package.json	Updates engines to new Node/npm baseline.
src/haapi-react-app/src/shared/util/css/styles.css	Switches CSS import to @curity/ui-kit-css.
src/haapi-react-app/previewer/shared/styles/previewer.css	Switches CSS import to @curity/ui-kit-css.
src/haapi-react-app/package.json	Updates engines/scripts; removes CSS-lib watch/build steps; adds @curity/ui-kit-css.
src/common/css/package.json	Introduces exports for CSS entrypoint; simplifies start/build scripts.
src/common/css/lib/vite.config.js	Removes dev server config for CSS lib build.
src/common/css/lib/src/base/base-type.css	Adds h5/h6 typography rules (and .h5/.h6 classes).
src/common/css/lib/readme.md	Updates import example to @curity/ui-kit-css.
src/common/css/lib/package.json	Removes start and related watch-copy behavior; simplifies deps.
src/common/css/docs/src/styles/global.css	Extends heading styling to include h5/h6 and adjusts sizing.
src/common/css/docs/src/pages/introduction/gettingstarted.mdx	Updates usage guidance to match new consumption model and build flow.
src/common/css/docs/src/pages/index.mdx	Updates import snippet to @curity/ui-kit-css.
src/common/css/docs/src/pages/content/typography.mdx	Adds h5/h6 examples and explanatory text.
src/common/css/docs/src/components/Install.mdx	Changes install snippet to cloning the repo.
src/common/css/docs/src/components/BaseHead.astro	Switches Curity CSS import to @curity/ui-kit-css.
src/common/component-library/tsconfig.app.json	Removes CSS path mapping.
src/common/component-library/README.md	Updates prerequisites; clarifies runtime requirement to load Curity CSS.
src/common/component-library/package.json	Updates engines/scripts; removes @curity/ui-kit-css dependency.
README.md	Adds “Branches and releases” section describing new trunk model.
package.json	Updates engines; updates prestart; adds jsdom devDependency.
package-lock.json	Lockfile updates reflecting engine/dependency/script changes.
.nvmrc	Updates Node version to 24.19.0.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.