chore(v3): merge epic/v3 into reorg - #681
Merged
wesleyboar merged 102 commits intoAug 6, 2026
Merged
Conversation
## Overview Prepare for v2.54.0 release.
## Overview Define `@mixin`s for `.align-*` classes. <sup>So [TACC/Core-CMS](https://github.com/TACC/Core-) can use them to align images that have such classes but are within an `<a>` or `<figure>`.</sup> ## Related - required by https://github.com/TACC/Core-CMS/pull/___ ## Changes - **adds** (and uses) simple mixins for simple classes ## Testing 1. `npm run build:css` has no change to `dist/` ## UI Skipped. <sup>The fact that `dist/` is unchanged on build means build output is identical.</sup>
Bumps [picomatch](https://github.com/micromatch/picomatch) from 2.3.1 to 2.3.2. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/micromatch/picomatch/releases">picomatch's releases</a>.</em></p> <blockquote> <h2>2.3.2</h2> <p>This is a security release fixing several security relevant issues.</p> <h2>What's Changed</h2> <ul> <li>fix: exception when glob pattern contains constructor by <a href="https://github.com/Jason3S"><code>@Jason3S</code></a> in <a href="https://redirect.github.com/micromatch/picomatch/pull/144">micromatch/picomatch#144</a></li> <li>Fix for <a href="https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj">CVE-2026-33671</a></li> <li>Fix for <a href="https://github.com/micromatch/picomatch/security/advisories/GHSA-3v7f-55p6-f55p">CVE-2026-33672</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/micromatch/picomatch/compare/2.3.1...2.3.2">https://github.com/micromatch/picomatch/compare/2.3.1...2.3.2</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md">picomatch's changelog</a>.</em></p> <blockquote> <h1>Release history</h1> <p><strong>All notable changes to this project will be documented in this file.</strong></p> <p>The format is based on <a href="http://keepachangelog.com/en/1.0.0/">Keep a Changelog</a> and this project adheres to <a href="http://semver.org/spec/v2.0.0.html">Semantic Versioning</a>.</p> <!-- raw HTML omitted --> <ul> <li>Changelogs are for humans, not machines.</li> <li>There should be an entry for every single version.</li> <li>The same types of changes should be grouped.</li> <li>Versions and sections should be linkable.</li> <li>The latest version comes first.</li> <li>The release date of each versions is displayed.</li> <li>Mention whether you follow Semantic Versioning.</li> </ul> <!-- raw HTML omitted --> <!-- raw HTML omitted --> <p>Changelog entries are classified using the following labels <em>(from <a href="http://keepachangelog.com/">keep-a-changelog</a></em>):</p> <ul> <li><code>Added</code> for new features.</li> <li><code>Changed</code> for changes in existing functionality.</li> <li><code>Deprecated</code> for soon-to-be removed features.</li> <li><code>Removed</code> for now removed features.</li> <li><code>Fixed</code> for any bug fixes.</li> <li><code>Security</code> in case of vulnerabilities.</li> </ul> <!-- raw HTML omitted --> <h2>4.0.0 (2024-02-07)</h2> <h3>Fixes</h3> <ul> <li>Fix bad text values in parse <a href="https://redirect.github.com/micromatch/picomatch/issues/126">#126</a>, thanks to <a href="https://github.com/connor4312"><code>@connor4312</code></a></li> </ul> <h3>Changed</h3> <ul> <li>Remove process global to work outside of node <a href="https://redirect.github.com/micromatch/picomatch/issues/129">#129</a>, thanks to <a href="https://github.com/styfle"><code>@styfle</code></a></li> <li>Add sideEffects to package.json <a href="https://redirect.github.com/micromatch/picomatch/issues/128">#128</a>, thanks to <a href="https://github.com/frandiox"><code>@frandiox</code></a></li> <li>Removed <code>os</code>, make compatible browser environment. See <a href="https://redirect.github.com/micromatch/picomatch/issues/124">#124</a>, thanks to <a href="https://github.com/gwsbhqt"><code>@gwsbhqt</code></a></li> </ul> <h2>3.0.1</h2> <h3>Fixes</h3> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/micromatch/picomatch/commit/81cba8d4b767cab3cb29d26eb4f691eed75b73b2"><code>81cba8d</code></a> Publish 2.3.2</li> <li><a href="https://github.com/micromatch/picomatch/commit/fc1f6b69006e9435caf8fb40d8aff378bc0b7bce"><code>fc1f6b6</code></a> Merge commit from fork</li> <li><a href="https://github.com/micromatch/picomatch/commit/eec17aee5428a7249e9ca5adbb8a0d28fa29619b"><code>eec17ae</code></a> Merge commit from fork</li> <li><a href="https://github.com/micromatch/picomatch/commit/78f8ca4362d9e66cadea97b93e292f10096452ed"><code>78f8ca4</code></a> Merge pull request <a href="https://redirect.github.com/micromatch/picomatch/issues/156">#156</a> from micromatch/backport-144</li> <li><a href="https://github.com/micromatch/picomatch/commit/3f4f10eaa65bf3a52e8f2999674cd27e11fa3c9b"><code>3f4f10e</code></a> Merge pull request <a href="https://redirect.github.com/micromatch/picomatch/issues/144">#144</a> from Jason3S/jdent-object-properties</li> <li>See full diff in <a href="https://github.com/micromatch/picomatch/compare/2.3.1...2.3.2">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/TACC/Core-Styles/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
## Overview / Changes Use `@define-mixin` and `@mixin` for figure and blockquote mixins. > [!TIP] > Backwards-compatible. ## Related - used by https://github.com/TACC/Core-CMS/pull/__ ## Testing 1. `npm run build:css` 2. No _functional_ change to `/dist`.[^1] [^1]: Diff of `/dist` is build-noise from mixin expansion + selector de-grouping; behavior is unchanged; deprecated .x-figure* and .x-blockquote* compatibility exists, just as separate rulesets. I manually reviewed and suspected this. A.I. verified it independently. ## UI Skipped.
## Overview Fix caption text not legible on dark section cuz dark text was used. ## Related - required by TACC/tup-ui#537 ## Changes - **changes** dark color tex to lower opacity text ## Testing 1. Compare caption on http://localhost:3001/components/preview/html-elements--docs before and after. 2. Verify color changes because of `opacity` not `color`. ## UI | before | after | | - | - | | <img width="900" height="475" alt="Screenshot 2026-03-26 at 15 14 58" src="https://github.com/user-attachments/assets/0175570c-93f3-4438-8280-733ed8ebfdd4" /> | <img width="900" height="475" alt="Screenshot 2026-03-26 at 15 16 01" src="https://github.com/user-attachments/assets/275dc3f5-440f-4d90-a4a9-095fa27fbd50" /> |
## Overview Restore `#222222` as value for `--global-color-primary--xx-dark`. The `#000000` was an overcorrection, and is too stark. ## Related - required by TACC/tup-ui#537 - reported in [2026-03-19 TUP Testing Session: Release v1.1.21 (-rc1)](https://tacc-main.atlassian.net/wiki/x/AQCbRg) ## Changes - **changed** "Primitives/v2" `dark-2x` token back to `TACC#222` from `#000` ## Testing TACC/tup-ui#537 will have me test colors again on TUP client dev server. ## UI Skipped. Simple token change. Diff shows what I expect.
## Overview Prepare for v2.54.0-rc1 release.
- Changed "bin" from a string to an object to specify "core-styles" as the command. - Updated "repository" field to use an object format with "type" and "url" properties.
## Overview Prepare for v2.54.1-rc1 release.
## Overview Allow publishing "release candidate" versions to NPM via script. ## Changes - Changed the way version numbers are extracted and used in the script. - Updated checks for published versions to use the new version number variable. - Added logic to handle release candidate tags during npm publish. ## Testing This is how I published [`v2.54.1-rc1` on NPM](https://www.npmjs.com/package/@tacc/core-styles/v/2.54.1-rc1).
## Overview
Feed list should not hide overflow, because:
- that crops focus outline
- the text can just wrap
<sup>if editor makes it too long[^1]</sup>
[^1]: A pattern library's CSS is to style, not to stop ridiculous text
content from being used.
## Related
- found during [2026-03-19 TUP Testing Session: Release v1.1.21
(-rc1)](https://tacc-main.atlassian.net/wiki/pages/resumedraft.action?draftId=1184563201)
- mirrored by
TACC/tup-ui@6838ca0
## Changes
- **deletes** styles
## Testing & UI
https://github.com/user-attachments/assets/66c53e7a-4d1d-4dd4-b960-8c9b1ddea02a
| text can wrap |
| - |
| <img width="900" height="475" alt="text can wrap"
src="https://github.com/user-attachments/assets/90e677a2-a939-41bf-bffb-dc6c89c37b3a"
/> |
## Overview Prepare to release `v2.54.1`.
Bumps [handlebars](https://github.com/handlebars-lang/handlebars.js) from 4.7.8 to 4.7.9. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/handlebars-lang/handlebars.js/releases">handlebars's releases</a>.</em></p> <blockquote> <h2>v4.7.9</h2> <ul> <li>fix: enable shell mode for spawn to resolve Windows EINVAL issue - e0137c2</li> <li>fix type "RuntimeOptions" also accepting string partials - eab1d14</li> <li>feat(types): set <code>hash</code> to be a <code>Record<string, any></code> - de4414d</li> <li>fix non-contiguous program indices - 4512766</li> <li>refactor: rename i to startPartIndex - e497a35</li> <li>security: fix security issues - 68d8df5 <ul> <li><a href="https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-2w6w-674q-4c4q">https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-2w6w-674q-4c4q</a></li> <li><a href="https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-3mfm-83xf-c92r">https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-3mfm-83xf-c92r</a></li> <li><a href="https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-xhpv-hc6g-r9c6">https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-xhpv-hc6g-r9c6</a></li> <li><a href="https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-xjpj-3mr7-gcpf">https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-xjpj-3mr7-gcpf</a></li> <li><a href="https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-9cx6-37pm-9jff">https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-9cx6-37pm-9jff</a></li> <li><a href="https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-2qvq-rjwj-gvw9">https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-2qvq-rjwj-gvw9</a></li> <li><a href="https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-7rx3-28cr-v5wh">https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-7rx3-28cr-v5wh</a></li> <li><a href="https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-442j-39wm-28r2">https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-442j-39wm-28r2</a></li> </ul> </li> </ul> <p><a href="https://github.com/handlebars-lang/handlebars.js/compare/v4.7.8...v4.7.9">Commits</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/handlebars-lang/handlebars.js/blob/v4.7.9/release-notes.md">handlebars's changelog</a>.</em></p> <blockquote> <h2>v4.7.9 - March 26th, 2026</h2> <ul> <li>fix: enable shell mode for spawn to resolve Windows EINVAL issue - e0137c2</li> <li>fix type "RuntimeOptions" also accepting string partials - eab1d14</li> <li>feat(types): set <code>hash</code> to be a <code>Record<string, any></code> - de4414d</li> <li>fix non-contiguous program indices - 4512766</li> <li>refactor: rename i to startPartIndex - e497a35</li> <li>security: fix security issues - 68d8df5</li> </ul> <p><a href="https://github.com/handlebars-lang/handlebars.js/compare/v4.7.8...v4.7.9">Commits</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/handlebars-lang/handlebars.js/commit/dce542c9a660048d31f0981ac8a45c08b919bddb"><code>dce542c</code></a> v4.7.9</li> <li><a href="https://github.com/handlebars-lang/handlebars.js/commit/8a41389ba5b2624b6f43a5463d8e2533b843a562"><code>8a41389</code></a> Update release notes</li> <li><a href="https://github.com/handlebars-lang/handlebars.js/commit/68d8df5a88e0a26fe9e6084c5c6aaebe67b07da2"><code>68d8df5</code></a> Fix security issues</li> <li><a href="https://github.com/handlebars-lang/handlebars.js/commit/b2a083136b11e1da9f0f47a11f749a9830a49328"><code>b2a0831</code></a> Fix browser tests</li> <li><a href="https://github.com/handlebars-lang/handlebars.js/commit/9f98c1629834abf8de5a127caff8a2eab03d2c12"><code>9f98c16</code></a> Fix release script</li> <li><a href="https://github.com/handlebars-lang/handlebars.js/commit/45443b4290475dfb7cec32a85d344f12ab345eb9"><code>45443b4</code></a> Revert "Improve partial indenting performance"</li> <li><a href="https://github.com/handlebars-lang/handlebars.js/commit/8841a5f6d35096aee95d68e1e49636a4cb5c661e"><code>8841a5f</code></a> Fix CI errors with linting</li> <li><a href="https://github.com/handlebars-lang/handlebars.js/commit/e0137c26f2202593bca7cc25184e733e87d54709"><code>e0137c2</code></a> fix: enable shell mode for spawn to resolve Windows EINVAL issue</li> <li><a href="https://github.com/handlebars-lang/handlebars.js/commit/e914d6037ffb0dd371f7e4823cdb019732ae66d7"><code>e914d60</code></a> Improve rendering performance</li> <li><a href="https://github.com/handlebars-lang/handlebars.js/commit/7de4b41c344a5d702edca93d1841b59642fa32bd"><code>7de4b41</code></a> Upgrade GitHub Actions checkout and setup-node on 4.x branch</li> <li>Additional commits viewable in <a href="https://github.com/handlebars-lang/handlebars.js/compare/v4.7.8...v4.7.9">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/TACC/Core-Styles/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
## Overview Adds a Bootstrap 4 extension for the [media object](https://getbootstrap.com/docs/4.6/components/media-object/), `.media-link` modifier which aligns thumbnail and body. Demo has variant markup for Bootstrap and TACC. ## Related - used by TACC/tup-ui#535 ## Changes - **added** stylesheet - **added** demo ## Testing 1. Run `npm run build:css` and confirm `dist/core-styles.bootstrap4.css` includes `.media-link`. 2. Run `npm start` (or `npm run build:demo`) and open the Bootstrap 3. [**Media** pattern](http://localhost:3000/components/detail/media); confirm examples match intended layout. ## UI <img width="900" height="475" alt="boostrap media extended by tacc" src="https://github.com/user-attachments/assets/100b5780-146c-4b71-91db-3dfb1e97c6fd" />
> [!IMPORTANT] > This is the missing commit from TACC#620.
Not legible enough on white background. Was legible enough on black background, and still is.
Explained the pull request template with additional comments.
## Overview Adds an `o-section--style-accent` variant (pale blue band). ## Related - required by TACC/Core-CMS-Custom#531 ## Changes - **added** accent style block `section…accent` - **updated** template, config, readme - **built** `dist/` ## Testing 1. `npm run build:css` — confirm `dist/objects/o-section.css` includes accent selectors and warning tokens 2. `npm start` — open [o-section--style-accent](http://localhost:3000/components/preview/o-section--style-accent) and confirm it reads clearly next to default, muted, and nested variants ## UI <img width="1783" height="5585" alt="localhost_3000_components_preview_o-section--style-accent" src="https://github.com/user-attachments/assets/415c7ec8-5ddb-44bb-8f44-475bb1d452f7" /> ## Notes Aggregated `dist/` edits (e.g. `core-styles.*.css`, `x-blockquote`, `x-figure`, `html-elements.docs`) are from the shared CSS build picking up selector list changes, not separate feature work.
## Overview
Restore borders between pairs of the same style section.
## Related
- lost at some point, dunno when
## Changes
- **added** border
- **changed** border colors (for sections)
## Testing
1. `npm run build:css`
2. `npm start`
3. Open:
- http://localhost:3000/components/preview/o-section--style-light
- http://localhost:3000/components/preview/o-section--style-muted
- http://localhost:3000/components/preview/o-section--style-accent
- http://localhost:3000/components/preview/o-section--style-dark
## UI
| Light | Muted |
| - | - |
| <img width="900" height="295" alt="light"
src="https://github.com/user-attachments/assets/6ac22a6d-cb70-47e5-a61c-efb720c1a40e"
/> | <img width="900" height="295" alt="muted"
src="https://github.com/user-attachments/assets/35b52820-a4ca-4758-b67c-53ec15509a1a"
/> |
| Dark | Accent |
| - | - |
| <img width="900" height="295" alt="dark"
src="https://github.com/user-attachments/assets/396caedc-d274-4dd1-a45d-d02571508910"
/> | <img width="900" height="295" alt="accent"
src="https://github.com/user-attachments/assets/305d99d0-e73d-40bb-a839-43103e8668f7"
/> |
<!--
## Notes
Optional: rollout, follow-ups, known limitations, unrelated dist churn.
-->
## Overview Colors of headings in sections (besides light) had poor color contrast ## Related - required by TACC/Core-CMS-Custom#531 ## Changes - **added** `h2` color overrides ## Testing [Color contrast](https://webaim.org/resources/linkcontrastchecker/) of heading passes AA: - http://localhost:3000/components/preview/o-section--style-muted - http://localhost:3000/components/preview/o-section--style-accent - http://localhost:3000/components/preview/o-section--style-dark ## UI <img width="900" height="470" alt="screenshot of section headings" src="https://github.com/user-attachments/assets/0a4b9db2-241f-44a6-b382-2383ca25cde9" /> ## Notes Color contrast of heading with link is not great, but we don't create headings with links inside them; the whole link might be a heading. If we start doing link inside, I'll handle that case.
## Overview Prepare for v2.55.0 release.
Bumps [lodash](https://github.com/lodash/lodash) from 4.17.23 to 4.18.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/lodash/lodash/releases">lodash's releases</a>.</em></p> <blockquote> <h2>4.18.1</h2> <h2>Bugs</h2> <p>Fixes a <code>ReferenceError</code> issue in <code>lodash</code> <code>lodash-es</code> <code>lodash-amd</code> and <code>lodash.template</code> when using the <code>template</code> and <code>fromPairs</code> functions from the modular builds. See <a href="https://redirect.github.com/lodash/lodash/issues/6167#issuecomment-4165269769">lodash/lodash#6167</a></p> <p>These defects were related to how lodash distributions are built from the main branch using <a href="https://github.com/lodash-archive/lodash-cli">https://github.com/lodash-archive/lodash-cli</a>. When internal dependencies change inside lodash functions, equivalent updates need to be made to a mapping in the lodash-cli. (hey, it was ahead of its time once upon a time!). We know this, but we missed it in the last release. It's the kind of thing that passes in CI, but fails bc the build is not the same thing you tested.</p> <p>There is no diff on main for this, but you can see the diffs for each of the npm packages on their respective branches:</p> <ul> <li><code>lodash</code>: <a href="https://github.com/lodash/lodash/compare/4.18.0-npm...4.18.1-npm">https://github.com/lodash/lodash/compare/4.18.0-npm...4.18.1-npm</a></li> <li><code>lodash-es</code>: <a href="https://github.com/lodash/lodash/compare/4.18.0-es...4.18.1-es">https://github.com/lodash/lodash/compare/4.18.0-es...4.18.1-es</a></li> <li><code>lodash-amd</code>: <a href="https://github.com/lodash/lodash/compare/4.18.0-amd...4.18.1-amd">https://github.com/lodash/lodash/compare/4.18.0-amd...4.18.1-amd</a></li> <li><code>lodash.template</code><a href="https://github.com/lodash/lodash/compare/4.18.0-npm-packages...4.18.1-npm-packages">https://github.com/lodash/lodash/compare/4.18.0-npm-packages...4.18.1-npm-packages</a></li> </ul> <h2>4.18.0</h2> <h2>v4.18.0</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/lodash/lodash/compare/4.17.23...4.18.0">https://github.com/lodash/lodash/compare/4.17.23...4.18.0</a></p> <h3>Security</h3> <p><strong><code>_.unset</code> / <code>_.omit</code></strong>: Fixed prototype pollution via <code>constructor</code>/<code>prototype</code> path traversal (<a href="https://github.com/lodash/lodash/security/advisories/GHSA-f23m-r3pf-42rh">GHSA-f23m-r3pf-42rh</a>, <a href="https://github.com/lodash/lodash/commit/fe8d32eda854377349a4f922ab7655c8e5df9a0b">fe8d32e</a>). Previously, array-wrapped path segments and primitive roots could bypass the existing guards, allowing deletion of properties from built-in prototypes. Now <code>constructor</code> and <code>prototype</code> are blocked unconditionally as non-terminal path keys, matching <code>baseSet</code>. Calls that previously returned <code>true</code> and deleted the property now return <code>false</code> and leave the target untouched.</p> <p><strong><code>_.template</code></strong>: Fixed code injection via <code>imports</code> keys (<a href="https://github.com/lodash/lodash/security/advisories/GHSA-r5fr-rjxr-66jc">GHSA-r5fr-rjxr-66jc</a>, CVE-2026-4800, <a href="https://github.com/lodash/lodash/commit/879aaa93132d78c2f8d20c60279da9f8b21576d6">879aaa9</a>). Fixes an incomplete patch for CVE-2021-23337. The <code>variable</code> option was validated against <code>reForbiddenIdentifierChars</code> but <code>importsKeys</code> was left unguarded, allowing code injection via the same <code>Function()</code> constructor sink. <code>imports</code> keys containing forbidden identifier characters now throw <code>"Invalid imports option passed into _.template"</code>.</p> <h3>Docs</h3> <ul> <li>Add security notice for <code>_.template</code> in threat model and API docs (<a href="https://redirect.github.com/lodash/lodash/pull/6099">#6099</a>)</li> <li>Document <code>lower > upper</code> behavior in <code>_.random</code> (<a href="https://redirect.github.com/lodash/lodash/pull/6115">#6115</a>)</li> <li>Fix quotes in <code>_.compact</code> jsdoc (<a href="https://redirect.github.com/lodash/lodash/pull/6090">#6090</a>)</li> </ul> <h3><code>lodash.*</code> modular packages</h3> <p><a href="https://redirect.github.com/lodash/lodash/pull/6157">Diff</a></p> <p>We have also regenerated and published a select number of the <code>lodash.*</code> modular packages.</p> <p>These modular packages had fallen out of sync significantly from the minor/patch updates to lodash. Specifically, we have brought the following packages up to parity w/ the latest lodash release because they have had CVEs on them in the past:</p> <ul> <li><a href="https://www.npmjs.com/package/lodash.orderby">lodash.orderby</a></li> <li><a href="https://www.npmjs.com/package/lodash.tonumber">lodash.tonumber</a></li> <li><a href="https://www.npmjs.com/package/lodash.trim">lodash.trim</a></li> <li><a href="https://www.npmjs.com/package/lodash.trimend">lodash.trimend</a></li> <li><a href="https://www.npmjs.com/package/lodash.sortedindexby">lodash.sortedindexby</a></li> <li><a href="https://www.npmjs.com/package/lodash.zipobjectdeep">lodash.zipobjectdeep</a></li> <li><a href="https://www.npmjs.com/package/lodash.unset">lodash.unset</a></li> <li><a href="https://www.npmjs.com/package/lodash.omit">lodash.omit</a></li> <li><a href="https://www.npmjs.com/package/lodash.template">lodash.template</a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/lodash/lodash/commit/cb0b9b9212521c08e3eafe7c8cb0af1b42b6649e"><code>cb0b9b9</code></a> release(patch): bump main to 4.18.1 (<a href="https://redirect.github.com/lodash/lodash/issues/6177">#6177</a>)</li> <li><a href="https://github.com/lodash/lodash/commit/75535f57883b7225adb96de1cfc1cd4169cfcb51"><code>75535f5</code></a> chore: prune stale advisory refs (<a href="https://redirect.github.com/lodash/lodash/issues/6170">#6170</a>)</li> <li><a href="https://github.com/lodash/lodash/commit/62e91bc6a39c98d85b9ada8c44d40593deaf82a4"><code>62e91bc</code></a> docs: remove n_ Node.js < 6 REPL note from README (<a href="https://redirect.github.com/lodash/lodash/issues/6165">#6165</a>)</li> <li><a href="https://github.com/lodash/lodash/commit/59be2de61f8aa9461c7856533b51d31b7d8babc4"><code>59be2de</code></a> release(minor): bump to 4.18.0 (<a href="https://redirect.github.com/lodash/lodash/issues/6161">#6161</a>)</li> <li><a href="https://github.com/lodash/lodash/commit/af634573030f979194871da7c68f79420992f53d"><code>af63457</code></a> fix: broken tests for _.template 879aaa9</li> <li><a href="https://github.com/lodash/lodash/commit/1073a7693e1727e0cf3641e5f71f75ddcf8de7c0"><code>1073a76</code></a> fix: linting issues</li> <li><a href="https://github.com/lodash/lodash/commit/879aaa93132d78c2f8d20c60279da9f8b21576d6"><code>879aaa9</code></a> fix: validate imports keys in _.template</li> <li><a href="https://github.com/lodash/lodash/commit/fe8d32eda854377349a4f922ab7655c8e5df9a0b"><code>fe8d32e</code></a> fix: block prototype pollution in baseUnset via constructor/prototype traversal</li> <li><a href="https://github.com/lodash/lodash/commit/18ba0a32f42fd02117f096b032f89c984173462d"><code>18ba0a3</code></a> refactor(fromPairs): use baseAssignValue for consistent assignment (<a href="https://redirect.github.com/lodash/lodash/issues/6153">#6153</a>)</li> <li><a href="https://github.com/lodash/lodash/commit/b8190803d48d60b8c80ad45d39125f32fa618cb2"><code>b819080</code></a> ci: add dist sync validation workflow (<a href="https://redirect.github.com/lodash/lodash/issues/6137">#6137</a>)</li> <li>Additional commits viewable in <a href="https://github.com/lodash/lodash/compare/4.17.23...4.18.1">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/TACC/Core-Styles/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Wesley B <62723358+wesleyboar@users.noreply.github.com>
## Overview Add `--global-color-accent--light-alt` to color--cms.auto.css`. ## Related - required by TACC/Core-CMS-Custom#531 ## Changes - **added** `--global-color-accent--light-alt` math ## Testing Via TACC/Core-CMS-Custom#531, verify footer has purple links. ## UI | Before (Blue) | After (Purple) | | - | - | | <img width="350" height="240" alt="before" src="https://github.com/user-attachments/assets/89d93673-6945-4646-86c5-7aaa0ab76d6e" /> | <img width="350" height="240" alt="after" src="https://github.com/user-attachments/assets/aebbf79b-2127-47f0-b88f-190671db1a0f" /> |
## Overview / Changes For dark section and the footer: - fix color contrast - make colors consistent ## Related - required by TACC/Core-CMS-Custom#531 ## Testing & UI > [!WARNING] > Undocumented. I apply changes I tested on TACC and ECEP clients.
## Overview Prepare for vv2.57.3-rc5 release.
Strips a leading `v` from the version input so typing `v2.57.3-rc5` or `2.57.3-rc5` both produce the correct `v2.57.3-rc5` tag. Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
## Overview Prepare for v2.57.3 release.
Added guidelines for updating dependencies and formatting commits and pull requests.
…er (TACC#672) Bumps [ws](https://github.com/websockets/ws), [engine.io-client](https://github.com/socketio/socket.io), [engine.io](https://github.com/socketio/socket.io) and [socket.io-adapter](https://github.com/socketio/socket.io). These dependencies needed to be updated together. Updates `ws` from 8.18.3 to 8.21.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/websockets/ws/releases">ws's releases</a>.</em></p> <blockquote> <h2>8.21.1</h2> <h1>Bug fixes</h1> <ul> <li>Empty fragments are now counted toward the limit (a2f4e7c0).</li> <li>The default values of the <code>maxBufferedChunks</code> and <code>maxFragments</code> options have been reduced (f197ac65).</li> </ul> <h2>8.21.0</h2> <h1>Features</h1> <ul> <li>Introduced the <code>maxBufferedChunks</code> and <code>maxFragments</code> options (2b2abd45).</li> </ul> <h1>Bug fixes</h1> <ul> <li>Fixed a remote memory exhaustion DoS vulnerability (2b2abd45).</li> </ul> <p>A high volume of tiny fragments and data chunks could be sent by a peer, using modest network traffic, to crash a <code>ws</code> server or client due to OOM.</p> <pre lang="js"><code>import { WebSocket, WebSocketServer } from 'ws'; <p>const wss = new WebSocketServer({ port: 0 }, function () { const data = Buffer.alloc(1); const options = { fin: false }; const { port } = wss.address(); const ws = new WebSocket(<code>ws://localhost:${port}</code>);</p> <p>ws.on('open', function () { (function send() { ws.send(data, options, function (err) { if (err) return; send(); }); })(); });</p> <p>ws.on('error', console.error); ws.on('close', function (code, reason) { console.log(<code>client close - code: ${code} reason: ${reason.toString()}</code>); }); });</p> <p>wss.on('connection', function (ws) { ws.on('error', console.error); ws.on('close', function (code, reason) { console.log(<code>server close - code: ${code} reason: ${reason.toString()}</code>); }); }); </code></pre></p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/websockets/ws/commit/ae1de54330cef77e487548890fabfeb9aae1d83d"><code>ae1de54</code></a> [dist] 8.21.1</li> <li><a href="https://github.com/websockets/ws/commit/8e9511b86b3fc6deebbd97dd9af7c9056deea8d1"><code>8e9511b</code></a> [ci] Trust Coveralls Homebrew tap</li> <li><a href="https://github.com/websockets/ws/commit/f197ac65140920bdcecdab74bfc69c2d7858e55d"><code>f197ac6</code></a> [fix] Lower default values of <code>maxBufferedChunks</code> and <code>maxFragments</code></li> <li><a href="https://github.com/websockets/ws/commit/8df8265c2f63fd44af3193a98e23cf38888cd991"><code>8df8265</code></a> [ci] Update actions/checkout action to v7</li> <li><a href="https://github.com/websockets/ws/commit/a2f4e7c046c2112bbce6fef39a083dac77d6f0d2"><code>a2f4e7c</code></a> [fix] Count empty fragments toward the limit (<a href="https://redirect.github.com/websockets/ws/issues/2329">#2329</a>)</li> <li><a href="https://github.com/websockets/ws/commit/e79f912cb3f492ae04c28feb9459a209e186b0ad"><code>e79f912</code></a> [pkg] Approve install scripts for bufferutil and utf-8-validate</li> <li><a href="https://github.com/websockets/ws/commit/4ea355d6d3069394994f82ca1b6d38c32ba208fb"><code>4ea355d</code></a> [doc] Document 32-bit signed integer coercion for option values</li> <li><a href="https://github.com/websockets/ws/commit/2120f4c8c625a76316792680a231496e1b615252"><code>2120f4c</code></a> [example] Remove uuid dependency</li> <li><a href="https://github.com/websockets/ws/commit/4c534a6b8a5224a563af116e85c6ced7d4ca60cf"><code>4c534a6</code></a> [security] Add latest vulnerability to SECURITY.md</li> <li><a href="https://github.com/websockets/ws/commit/bca91adf15677e47dbe4f959653452727be28b94"><code>bca91ad</code></a> [dist] 8.21.0</li> <li>Additional commits viewable in <a href="https://github.com/websockets/ws/compare/8.18.3...8.21.1">compare view</a></li> </ul> </details> <br /> Updates `engine.io-client` from 6.6.4 to 6.6.6 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/socketio/socket.io/releases">engine.io-client's releases</a>.</em></p> <blockquote> <h2>engine.io-client@6.6.6</h2> <p>The <code>ws</code> dependency was bumped to <code>~8.21.0</code> following <a href="https://github.com/advisories/GHSA-96hv-2xvq-fx4p">CVE-2026-48779</a>.</p> <h3>Bug Fixes</h3> <ul> <li>preserve transport literal suggestions (<a href="https://redirect.github.com/socketio/socket.io/issues/5469">#5469</a>) (<a href="https://github.com/socketio/socket.io/commit/d8f392eec724f9f6d78a9523f8ef7a383a807a6d">d8f392e</a>)</li> </ul> <h3>Dependencies</h3> <ul> <li><a href="https://github.com/websockets/ws/releases/tag/8.21.0"><code>ws@~8.21.0</code></a> (<a href="https://github.com/websockets/ws/compare/8.20.1...8.21.0">diff</a>)</li> </ul> <h2>engine.io-client@6.6.5</h2> <p>The <code>ws</code> dependency was bumped to <code>~8.20.1</code> following <a href="https://github.com/advisories/GHSA-58qx-3vcg-4xpx">CVE-2026-45736</a>.</p> <p>Note from the <code>ws</code> maintainers:</p> <blockquote> <p>Although the calculated CVSS severity is medium, the actual severity is believed to be low, as the flaw is only exploitable through misuse that is unlikely in practice.</p> </blockquote> <h3>Dependencies</h3> <ul> <li><a href="https://github.com/websockets/ws/releases/tag/8.20.1"><code>ws@~8.20.1</code></a> (<a href="https://github.com/websockets/ws/compare/8.18.3...8.20.1">diff</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/socketio/socket.io/commit/22cc483786a5084b8c6d8595e46f7d99d1587fea"><code>22cc483</code></a> chore(release): engine.io-client@6.6.6</li> <li><a href="https://github.com/socketio/socket.io/commit/9dbec8128fa76c3143e93cf41991e903adfdc6da"><code>9dbec81</code></a> chore(release): engine.io@6.6.9</li> <li><a href="https://github.com/socketio/socket.io/commit/3ad4e1f2dcf0e8b7d1bb05892be5ede2ab100abf"><code>3ad4e1f</code></a> docs: improve example with PM2</li> <li><a href="https://github.com/socketio/socket.io/commit/0e5afeeba45b1b3dc926584253ac93e9d0c9eae1"><code>0e5afee</code></a> docs: add example with PM2</li> <li><a href="https://github.com/socketio/socket.io/commit/eab9623c8476308e735472ce1bf70e90eb3de604"><code>eab9623</code></a> docs(eio): correct maxHttpBufferSize default in JSDoc (<a href="https://redirect.github.com/socketio/socket.io/issues/5508">#5508</a>)</li> <li><a href="https://github.com/socketio/socket.io/commit/c17890c5e5bd3a2f2e40ca240059906c51156d49"><code>c17890c</code></a> docs: add documentation about WebTransport</li> <li><a href="https://github.com/socketio/socket.io/commit/20df6ae561e379dabdceecbdf0532ac052994cc9"><code>20df6ae</code></a> docs(examples): add client-side load balancing example</li> <li><a href="https://github.com/socketio/socket.io/commit/16d19236132293c415f511aa5631de558be9ab70"><code>16d1923</code></a> ci(publish): enable staged publishing</li> <li><a href="https://github.com/socketio/socket.io/commit/ad48a9bac723303d8bde81c4394828822abe57e0"><code>ad48a9b</code></a> docs(examples): add example with HTTP/2</li> <li><a href="https://github.com/socketio/socket.io/commit/190572d2459681a757e23e6010939ac5e53fdfcf"><code>190572d</code></a> refactor(eio-client): remove XMLHttpRequest from the definition file</li> <li>Additional commits viewable in <a href="https://github.com/socketio/socket.io/compare/engine.io-client@6.6.4...engine.io-client@6.6.6">compare view</a></li> </ul> </details> <br /> Updates `engine.io` from 6.6.5 to 6.6.9 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/socketio/socket.io/releases">engine.io's releases</a>.</em></p> <blockquote> <h2>engine.io@6.6.9</h2> <p>The <code>ws</code> dependency was bumped to <code>~8.21.0</code> following <a href="https://github.com/advisories/GHSA-96hv-2xvq-fx4p">CVE-2026-48779</a>.</p> <h3>Dependencies</h3> <ul> <li><a href="https://github.com/websockets/ws/releases/tag/8.21.0"><code>ws@~8.21.0</code></a> (<a href="https://github.com/websockets/ws/compare/8.20.1...8.21.0">diff</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/socketio/socket.io/commit/9dbec8128fa76c3143e93cf41991e903adfdc6da"><code>9dbec81</code></a> chore(release): engine.io@6.6.9</li> <li><a href="https://github.com/socketio/socket.io/commit/3ad4e1f2dcf0e8b7d1bb05892be5ede2ab100abf"><code>3ad4e1f</code></a> docs: improve example with PM2</li> <li><a href="https://github.com/socketio/socket.io/commit/0e5afeeba45b1b3dc926584253ac93e9d0c9eae1"><code>0e5afee</code></a> docs: add example with PM2</li> <li><a href="https://github.com/socketio/socket.io/commit/eab9623c8476308e735472ce1bf70e90eb3de604"><code>eab9623</code></a> docs(eio): correct maxHttpBufferSize default in JSDoc (<a href="https://redirect.github.com/socketio/socket.io/issues/5508">#5508</a>)</li> <li><a href="https://github.com/socketio/socket.io/commit/c17890c5e5bd3a2f2e40ca240059906c51156d49"><code>c17890c</code></a> docs: add documentation about WebTransport</li> <li><a href="https://github.com/socketio/socket.io/commit/20df6ae561e379dabdceecbdf0532ac052994cc9"><code>20df6ae</code></a> docs(examples): add client-side load balancing example</li> <li><a href="https://github.com/socketio/socket.io/commit/16d19236132293c415f511aa5631de558be9ab70"><code>16d1923</code></a> ci(publish): enable staged publishing</li> <li><a href="https://github.com/socketio/socket.io/commit/ad48a9bac723303d8bde81c4394828822abe57e0"><code>ad48a9b</code></a> docs(examples): add example with HTTP/2</li> <li><a href="https://github.com/socketio/socket.io/commit/190572d2459681a757e23e6010939ac5e53fdfcf"><code>190572d</code></a> refactor(eio-client): remove XMLHttpRequest from the definition file</li> <li><a href="https://github.com/socketio/socket.io/commit/fad463c54d04799e1592361b0fd8344a5fab960d"><code>fad463c</code></a> docs(examples): fix duplicate self messages (<a href="https://redirect.github.com/socketio/socket.io/issues/5341">#5341</a>)</li> <li>Additional commits viewable in <a href="https://github.com/socketio/socket.io/compare/engine.io@6.6.5...engine.io@6.6.9">compare view</a></li> </ul> </details> <br /> Updates `socket.io-adapter` from 2.5.6 to 2.5.8 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/socketio/socket.io/releases">socket.io-adapter's releases</a>.</em></p> <blockquote> <h2>socket.io-adapter@2.5.8</h2> <p>The <code>ws</code> dependency was bumped to <code>~8.21.0</code> following <a href="https://github.com/advisories/GHSA-96hv-2xvq-fx4p">CVE-2026-48779</a>.</p> <h2>socket.io-adapter@2.5.7</h2> <p>The <code>ws</code> dependency was bumped to <code>~8.20.1</code> following <a href="https://github.com/advisories/GHSA-58qx-3vcg-4xpx">CVE-2026-45736</a>.</p> <p>Note from the <code>ws</code> maintainers:</p> <blockquote> <p>Although the calculated CVSS severity is medium, the actual severity is believed to be low, as the flaw is only exploitable through misuse that is unlikely in practice.</p> </blockquote> <h3>Bug Fixes</h3> <ul> <li>do not skip local broadcast when publishAndReturnOffset throws (<a href="https://redirect.github.com/socketio/socket/issues/5457">#5457</a>) (<a href="https://github.com/socketio/socket/commit/f6301588ca65de270ecfe22da9023d7ec79ba23a">f630158</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/socketio/socket.io/commit/ac83bfad2eb8bdd1ceddd46ddb1b4ee692d7262d"><code>ac83bfa</code></a> chore(release): socket.io-adapter@2.5.8</li> <li><a href="https://github.com/socketio/socket.io/commit/22cc483786a5084b8c6d8595e46f7d99d1587fea"><code>22cc483</code></a> chore(release): engine.io-client@6.6.6</li> <li><a href="https://github.com/socketio/socket.io/commit/9dbec8128fa76c3143e93cf41991e903adfdc6da"><code>9dbec81</code></a> chore(release): engine.io@6.6.9</li> <li><a href="https://github.com/socketio/socket.io/commit/3ad4e1f2dcf0e8b7d1bb05892be5ede2ab100abf"><code>3ad4e1f</code></a> docs: improve example with PM2</li> <li><a href="https://github.com/socketio/socket.io/commit/0e5afeeba45b1b3dc926584253ac93e9d0c9eae1"><code>0e5afee</code></a> docs: add example with PM2</li> <li><a href="https://github.com/socketio/socket.io/commit/eab9623c8476308e735472ce1bf70e90eb3de604"><code>eab9623</code></a> docs(eio): correct maxHttpBufferSize default in JSDoc (<a href="https://redirect.github.com/socketio/socket.io/issues/5508">#5508</a>)</li> <li><a href="https://github.com/socketio/socket.io/commit/c17890c5e5bd3a2f2e40ca240059906c51156d49"><code>c17890c</code></a> docs: add documentation about WebTransport</li> <li><a href="https://github.com/socketio/socket.io/commit/20df6ae561e379dabdceecbdf0532ac052994cc9"><code>20df6ae</code></a> docs(examples): add client-side load balancing example</li> <li><a href="https://github.com/socketio/socket.io/commit/16d19236132293c415f511aa5631de558be9ab70"><code>16d1923</code></a> ci(publish): enable staged publishing</li> <li><a href="https://github.com/socketio/socket.io/commit/ad48a9bac723303d8bde81c4394828822abe57e0"><code>ad48a9b</code></a> docs(examples): add example with HTTP/2</li> <li>Additional commits viewable in <a href="https://github.com/socketio/socket.io/compare/socket.io-adapter@2.5.6...socket.io-adapter@2.5.8">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/TACC/Core-Styles/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
## Overview Height of `<input type="file">` was cut short, cutting off its native browser UI. ## Related - mimicked by TACC/Core-CMS-Custom#544 ## Changes - **added** selector qualifier ## Testing & UI https://github.com/user-attachments/assets/c3dde447-c247-4734-96fc-11d2b3e4f44a
Bumps [svgo](https://github.com/svg/svgo) from 2.8.2 to 2.8.3. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/svg/svgo/releases">svgo's releases</a>.</em></p> <blockquote> <h2>v2.8.3</h2> <h2>What's Changed</h2> <h3>Security</h3> <ul> <li><a href="https://svgo.dev/docs/plugins/removeScripts/">removeScriptElement</a>, make <code><script></code> handling namespace aware. By <a href="https://github.com/SethFalco"><code>@SethFalco</code></a></li> </ul> <h2>Support</h2> <p>SVGO v2 is not officially supported, please consider upgrading to SVGO v4 instead. We've backported this fix as there are security implications, but there is no commitment to do this for more complex changes in future.</p> <p>Consider reading our <a href="https://svgo.dev/docs/migrations/migration-from-v2-to-v3/">Migration Guide from v2 to v3</a> and <a href="https://svgo.dev/docs/migrations/migration-from-v3-to-v4/">Migration Guide from v3 to v4</a> which should ease the process.</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/svg/svgo/commit/628e3bc7336625a30365d0a9b60185307d852466"><code>628e3bc</code></a> Merge commit from fork</li> <li>See full diff in <a href="https://github.com/svg/svgo/compare/v2.8.2...v2.8.3">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/TACC/Core-Styles/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
## Overview Adds a demo section that combines `.container` directly on an `.o-section`, to make the wide-viewport fake-background gap bug reproducible in this repo's own component preview. ## Related - Reproduction case for the fix in [TACC#675](TACC#675) ## Changes - **added** an "Accent Section (with `.container`)" demo variant combining `.container` and `.o-section` classes on the same element ## Testing 1. `npm start` 2. Visit the `o-section` component preview 3. Zoom out (or use an ultra-wide viewport) past ~3160px effective width 4. Observe the gap in the fake background on the new "Accent Section (with `.container`)" demo ## UI | before | after | | - | - | | <img width="900" height="535" alt="before" src="https://github.com/user-attachments/assets/c396a277-db7b-42a9-831d-5ca306238bbe" /> | <img width="900" height="535" alt="after" src="https://github.com/user-attachments/assets/88b85d2e-c6c2-48fd-b100-5b85b3332b51" /> |
## Overview Fixes gray background gaps (on wide screens) beside sections that use a "fake" full-width background (`o-section--style`). ## Related - similar to [TACC/Core-CMS#1218](TACC/Core-CMS#1218) ## Changes - **changed** `/src/**/o-section.css` ## Testing 1. `npm start` 2. View a demo with a styled `container o-section` at a wide viewport (e.g. 1920px). 3. Verify the fake full-width background has no gaps. | before | after | | - | - | | <img width="900" height="535" alt="before" src="https://github.com/user-attachments/assets/c396a277-db7b-42a9-831d-5ca306238bbe" /> | <img width="900" height="535" alt="after" src="https://github.com/user-attachments/assets/88b85d2e-c6c2-48fd-b100-5b85b3332b51" /> |
## Overview Prepare for v2.57.4 release.
## Overview Add new (not final) client to "Known Clients" list: - https://github.com/TACC/Core-CMS-Custom <sub>since https://github.com/TACC/Core-CMS-Custom/pull/293</sub>
Bumps [socket.io-parser](https://github.com/socketio/socket.io) from 4.2.5 to 4.2.7. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/socketio/socket.io/releases">socket.io-parser's releases</a>.</em></p> <blockquote> <h2>socket.io-parser@4.2.7</h2> <h3>Bug Fixes</h3> <ul> <li>honor toJSON() when deconstructing a binary packet (<a href="https://redirect.github.com/socketio/socket.io/issues/5518">#5518</a>) (<a href="https://github.com/socketio/socket.io/commit/57f111439513809c633f2554be2f3104e4ad432c">57f1114</a>)</li> <li>reject binary packets with zero attachments (<a href="https://github.com/socketio/socket.io/commit/7c6ef571a00656718e9e05e3b948fd1758b2a7b4">7c6ef57</a>)</li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/spokodev"><code>@spokodev</code></a> made their first contribution in <a href="https://redirect.github.com/socketio/socket.io/pull/5518">socketio/socket.io#5518</a></li> </ul> <h2>socket.io-parser@4.2.6</h2> <p>This release includes a fix for <a href="https://github.com/socketio/socket.io/security/advisories/GHSA-677m-j7p3-52f9">CVE-2026-33151</a>. Please upgrade as soon as possible.</p> <h3>Bug Fixes</h3> <ul> <li>add a limit to the number of binary attachments (<a href="https://github.com/socketio/socket.io/commit/b25738c416c4e32fbff62ee182afa8f6d0dacf78">b25738c</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/socketio/socket.io/commit/4054894738817f5a2125e6e6b18e79d92c75ab33"><code>4054894</code></a> chore(release): socket.io-parser@4.2.7</li> <li><a href="https://github.com/socketio/socket.io/commit/7c6ef571a00656718e9e05e3b948fd1758b2a7b4"><code>7c6ef57</code></a> fix(parser): reject binary packets with zero attachments</li> <li><a href="https://github.com/socketio/socket.io/commit/57f111439513809c633f2554be2f3104e4ad432c"><code>57f1114</code></a> fix(parser): honor toJSON() when deconstructing a binary packet (<a href="https://redirect.github.com/socketio/socket.io/issues/5518">#5518</a>)</li> <li><a href="https://github.com/socketio/socket.io/commit/8d2e4f7b8671ed2c4fa1fca9ec6f68e5cf82266e"><code>8d2e4f7</code></a> docs(security): add CVE-2026-59724 and CVE-2026-59725</li> <li><a href="https://github.com/socketio/socket.io/commit/d2d753fed4435015c2d83fe62e676b44e07fa3f7"><code>d2d753f</code></a> refactor(sio): align client file matching in Node.js HTTP server</li> <li><a href="https://github.com/socketio/socket.io/commit/dfb5ab3b6a2f00d1ecb226939022ea56e5701124"><code>dfb5ab3</code></a> fix(sio): prevent uWebSockets.js from serving missing client files</li> <li><a href="https://github.com/socketio/socket.io/commit/dcbd96154352dd84c189b41e5c0ec0df4b7fe6a5"><code>dcbd961</code></a> perf(eio): optimize polling request body buffering</li> <li><a href="https://github.com/socketio/socket.io/commit/6bb2e7f5fb7c548f0776328b4a19719723e27efd"><code>6bb2e7f</code></a> refactor(sio): internalize base64id dependency</li> <li><a href="https://github.com/socketio/socket.io/commit/a80711a8c3b11a3e75a84de567ac4d84820f4714"><code>a80711a</code></a> refactor(eio): internalize base64id dependency</li> <li><a href="https://github.com/socketio/socket.io/commit/8bead0f4c6fba027996bb9eab02f05120f35513d"><code>8bead0f</code></a> chore: upgrade to TypeScript 6</li> <li>Additional commits viewable in <a href="https://github.com/socketio/socket.io/compare/socket.io-parser@4.2.5...socket.io-parser@4.2.7">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/TACC/Core-Styles/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Sync epic/v3 with 90 commits from main. - resolved dist/* modify/delete conflicts by keeping v3's deletion (dist is not committed on v3) - resolved 4 renamed source files (headings--cms, headings--docs, html-elements.docs, s-footer) using main's content with v3's .postcss import extensions - renamed 5 new source files added by main (x-headings*, typography-headings--cms/docs) from .css to .postcss to match v3's source convention - regenerated package-lock.json via npm install after keeping v3's package.json version
Sync epic/v3--reorg with epic/v3's merge of main. - resolved add/add and file-location conflicts for new bootstrap4/content/typography-headings and tools/x-headings* files by placing them per the reorg's client-library directory structure - resolved headings config.yml variants by combining reorg's own portal variant with main's new cms-vs-bootstrap/docs-vs-bootstrap variants - resolved s-footer.postcss by keeping reorg's c-button import path and adding main's new media-queries import - resolved s-footer.hbs by keeping main's newer isPortalOrCMS note and reorg's Bootstrap4 side-effects caveat - removed headings--cms.hbs, superseded by the generic headings.hbs view
PR Summary by Qodochore(v3): consolidate release workflow and expand Bootstrap4 patterns
AI Description
Diagram
High-Level Assessment
Files changed (68)
|
Code Review by Qodo
1.
|
![qodo-code-review[bot]](https://avatars.githubusercontent.com/in/484649?s=60&v=4){kind=small}
Comment on lines
+4
to
+7
| @import url("./bootstrap4/components/alert.css"); | ||
| @import url("./bootstrap4/components/btn.css"); | ||
| @import url("./bootstrap4/components/card.css"); | ||
| @import url("./bootstrap4/components/media.css"); |
There was a problem hiding this comment.
1. Missing dist/ rebuild artifacts 📘 Rule violation ☼ Reliability
Files under src/lib/_imports/... were added/modified, but the PR does not include regenerated dist/ build outputs as required. This can leave published build artifacts stale relative to source changes.
Agent Prompt
## Issue description
Compliance requires regenerated `dist/` artifacts when files under `src/lib/_imports/...` change. This PR changes those imports but does not include updated `dist/` outputs.
## Issue Context
The PR adds new Bootstrap 4 component imports (e.g., `alert.css`, `media.css`) under `src/lib/_imports/...`, which should be reflected in generated build outputs.
## Fix Focus Areas
- src/lib/_imports/core-styles.bootstrap4.css[4-7]
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
- alert.css imported x-message.css, but v3 only has x-message.postcss - html-elements.docs.postcss used top-level `& dt` with no enclosing selector Relates-to TACC#680
The `& dt` rule had no enclosing selector, so `&` resolved to `:scope` (i.e. the whole document) instead of scoping to main content like the sibling element styles do. Relates-to TACC#680 (discussion)
…instead Superseded by merging TACC#682 in next commit, so the fix is properly sourced from main rather than living only on this branch.
…' into chore/v3-merge-main # Conflicts: # dist/core-styles.docs.css # dist/elements/html-elements.docs.css # src/lib/_imports/elements/html-elements.docs.postcss
…e/v3-reorg-merge-epic
Simpler than scoping to main content: the `&` was unnecessary since the rule already applied everywhere via `:scope` (same net effect as no `&` at all), so just drop it instead of adding new scoping.
…' into chore/v3-merge-main # Conflicts: # dist/core-styles.docs.css # dist/elements/html-elements.docs.css # src/lib/_imports/elements/html-elements.docs.postcss
…e/v3-reorg-merge-epic
## Overview Syncs `epic/v3` with `main` (90 commits behind). > [!WARNING] > Performed by AI, Claude Sonnet 5 (under my direction). ## Related - updates TACC#454 ## Changes - **merged** `main` into `epic/v3` - **resolved** `dist/*` modify/delete conflicts by keeping `epic/v3`'s deletion (`dist/` is not committed on v3) - **resolved** 4 renamed source files (`headings--cms`, `headings--docs`, `html-elements.docs`, `s-footer`) using `main`'s content with v3's `.postcss` import extensions - **renamed** 5 new source files added by `main` (`x-headings*`, `typography-headings--cms`/`docs`) from `.css` to `.postcss` to match v3's source convention - **regenerated** `package-lock.json` via `npm install`, keeping v3's `package.json` version ## Testing 1. `npm run build` - no errors 2. `npm run lint` - `No dist files found in source. Ready to publish.` --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: Garrett Edmonds <43251554+edmondsgarrett@users.noreply.github.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
epic/v3 was squash-merged for PR TACC#680, so this branch's history has no shared ancestor with origin/epic/v3 even though the tree content is already identical (verified via `git diff origin/epic/v3 <old-tip>` showing zero differences). Using the 'ours' strategy to record this branch as up to date with epic/v3 without re-resolving conflicts that were already resolved via the (squashed) merge history.
wesleyboar
added a commit
that referenced
this pull request
Aug 6, 2026
epic/v3's content (incl. main, via #680/#682) was already applied to epic/v3--reorg via #681's chain propagation, but #681 was squash-merged, severing the ancestry link again (same issue as #680 on epic/v3). Recording this merge with the 'ours' strategy (verified zero net content change) so future `git merge epic/v3` (and transitively `git merge main`) operations compute the correct merge-base.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Overview
Syncs
epic/v3--reorgwithepic/v3's merge ofmain.Related
epic/v3first)Changes
epic/v3(withmainmerged in) intoepic/v3--reorgbootstrap4/content/typography-headingsandtools/x-headings*files per the reorg's client-library directory structureportalheadings variant with main's newcms-vs-bootstrap/docs-vs-bootstrapvariantsheadings--cms.hbs, superseded by the genericheadings.hbsviewTesting
npm run build- no errorsnpm run lint-No dist files found in source. Ready to publish.UI
…