update feature branch with develop#3161
Closed
sf-shikhar-prasoon wants to merge 1641 commits into
Closed
Conversation
Collaborator
⛔ Snyk checks have failed. 25 issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
vcua-mobify
temporarily deployed
to
extra-features-e2e
GitHub Actions
Inactive
jeremy-jung1
temporarily deployed
to
extra-features-e2e
GitHub Actions
Inactive
jeremy-jung1
temporarily deployed
to
extra-features-e2e
GitHub Actions
Inactive
jeremy-jung1
temporarily deployed
to
extra-features-e2e
GitHub Actions
Inactive
vcua-mobify
temporarily deployed
to
extra-features-e2e
GitHub Actions
Inactive
adamraya
temporarily deployed
to
extra-features-e2e
GitHub Actions
Inactive
jeremy-jung1
had a problem deploying
to
extra-features-e2e
GitHub Actions
Failure
shethj
temporarily deployed
to
extra-features-e2e
GitHub Actions
Inactive
shethj
temporarily deployed
to
extra-features-e2e
GitHub Actions
Inactive
vmarta
temporarily deployed
to
extra-features-e2e
GitHub Actions
Inactive
adamraya
temporarily deployed
to
extra-features-e2e
GitHub Actions
Inactive
shauryemahajanSF
temporarily deployed
to
extra-features-e2e
GitHub Actions
Inactive
shauryemahajanSF
temporarily deployed
to
extra-features-e2e
GitHub Actions
Inactive
jeremy-jung1
temporarily deployed
to
extra-features-e2e
GitHub Actions
Inactive
shauryemahajanSF
temporarily deployed
to
extra-features-e2e
GitHub Actions
Inactive
jeremy-jung1
temporarily deployed
to
extra-features-e2e
GitHub Actions
Inactive
jeremy-jung1
temporarily deployed
to
extra-features-e2e
GitHub Actions
Inactive
patricksullivansf
temporarily deployed
to
extra-features-e2e
GitHub Actions
Inactive
shauryemahajanSF
temporarily deployed
to
extra-features-e2e
GitHub Actions
Inactive
vmarta
temporarily deployed
to
extra-features-e2e
GitHub Actions
Inactive
jeremy-jung1
temporarily deployed
to
extra-features-e2e
GitHub Actions
Inactive
shethj
temporarily deployed
to
extra-features-e2e
GitHub Actions
Inactive
patricksullivansf
temporarily deployed
to
extra-features-e2e
GitHub Actions
Inactive
sf-henry-semaganda
temporarily deployed
to
extra-features-e2e
GitHub Actions
Inactive
vcua-mobify
temporarily deployed
to
extra-features-e2e
GitHub Actions
Inactive
jeremy-jung1
temporarily deployed
to
extra-features-e2e
GitHub Actions
Inactive
jeremy-jung1
temporarily deployed
to
extra-features-e2e
GitHub Actions
Inactive
jeremy-jung1
temporarily deployed
to
extra-features-e2e
GitHub Actions
Inactive
jeremy-jung1
temporarily deployed
to
extra-features-e2e
GitHub Actions
Inactive
…inxh/revert-retail-app-version-bump Revert "chore: revert retail-react-app version bump to unblock SDK release"
…se-3.18.x-to-develop
….x-to-develop # Conflicts: # packages/commerce-sdk-react/CHANGELOG.md # packages/commerce-sdk-react/package-lock.json # packages/commerce-sdk-react/package.json # packages/pwa-kit-create-app/CHANGELOG.md # packages/pwa-kit-dev/CHANGELOG.md # packages/pwa-kit-react-sdk/CHANGELOG.md # packages/pwa-kit-react-sdk/package-lock.json # packages/pwa-kit-runtime/CHANGELOG.md # packages/template-express-minimal/package-lock.json # packages/template-mrt-reference-app/package-lock.json # packages/template-retail-react-app/CHANGELOG.md # packages/template-retail-react-app/package-lock.json # packages/template-retail-react-app/package.json # packages/template-typescript-minimal/package-lock.json # packages/test-commerce-sdk-react/package-lock.json
….18.x-to-develop Merge release-3.18.x back to develop (v3.18.1 patch)
…dal-hooks # Conflicts: # packages/pwa-kit-runtime/CHANGELOG.md
PR's vendor.js is 395.33 KB gzip (was 394.78 KB on develop) — the new MrtDataStoreProvider context, useCustomSitePreferences / useCustomGlobalPreferences hooks, and the bootstrap-key wiring add ~0.55 KB to the shipped client bundle. Raise the budget by 2 kB so compile variance doesn't flake CI without giving up the guardrail.
…16_dal-hooks [DAL] Add MRT Data Store Context and Hooks for Template Usage
- Extract regex builder into babel-exclude.js so it can be tested without importing the full webpack config (which has heavy deps) - Update config.js to import from the new module - Fix copyright year to 2026 in config.test.js - Test now exercises the real production function Re: EXT_EXTENDS_WIN — it IS used at config.js:337 for webpack chunk splitting on Windows, so it's not dead code.
- Remove ESCAPED_SEP and EXT_EXTENDS_REGEX (unused after extracting buildBabelExcludeRegex) - Remove "on current platform" describe block that duplicated the explicit Windows/Unix test blocks
…pwa-kit-issue-3789 Fix Windows babel-loader exclude regex bug (#3789)
* Apply configurable domain to cookies created by slas proxy * Lint * Add initial docs for http-only * Apply suggestions * Apply suggestions
…SameSite (#3850) * Apply configurable domain to cookies created by slas proxy * Lint * Add plumbing for supporting Storefront Preview with HttpOnly cookies * Apply review adjustments * Address comments and apply suggestions * Update CSP to allow non-prod preview * Add soak and dev MRT to preview trusted list * Update CHANGELOG.md --------- Signed-off-by: vcua-mobify <47404250+vcua-mobify@users.noreply.github.com>
…pOnly session cookies (#3851) * Apply configurable domain to cookies created by slas proxy * Lint * Add plumbing for supporting Storefront Preview with HttpOnly cookies * Apply review adjustments * Add dynamic SameSite for Storefront Preview * Update CHANGELOG.md * Cleanup host scoped marker cookie if cookieDomain is set * Address comments and apply suggestions * Apply suggestions from PR 1 * Update CSP to allow non-prod preview * Add soak and dev MRT to preview trusted list * Update CHANGELOG.md --------- Signed-off-by: vcua-mobify <47404250+vcua-mobify@users.noreply.github.com>
* Apply configurable domain to cookies created by slas proxy * Lint * Add plumbing for supporting Storefront Preview with HttpOnly cookies * Apply review adjustments * Add dynamic SameSite for Storefront Preview * Update CHANGELOG.md * Cleanup host scoped marker cookie if cookieDomain is set * Address comments and apply suggestions * Apply suggestions from PR 1 * Update CSP to allow non-prod preview * Add soak and dev MRT to preview trusted list * Update CHANGELOG.md * Allow for token passthrough if bearer token is valid * Update CHANGELOG.md * Remove empty if block --------- Signed-off-by: vcua-mobify <47404250+vcua-mobify@users.noreply.github.com>
…9@) (#3855) * Fix: improve render stability of the search refinements panel The PLP rebuilds the productSearchResult.refinements array on every render, so the refinements panel recomputed its accordion default-open indexes each time and re-rendered unnecessarily. Memoize the effective (non-excluded) filters and derive a stable comma-joined key of their attribute IDs, then key the default-open index computation on that string so it only recomputes when the filter set actually changes. Adopts and cleans up the approach from the superseded community PR #2771 (drops a written-but-unread ref and an unused returned array), and adds the regression test that PR lacked. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * Chore: link CHANGELOG entry to the opened PR Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * Refactor: drop stale useLocalStorage TODO comments in refinements Per review: the useLocalStorage migration isn't on the roadmap, so the two TODO comments referencing it were stale stubs. Behavior unchanged. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The TCP readiness probe was already updated to dial 127.0.0.1 explicitly, but the npm_config_registry that lerna/npm child processes inherit was still set to http://localhost:4873/. On Node 18+ Linux runners with verbatim DNS, 'localhost' may resolve to ::1 first. Verdaccio binds 127.0.0.1 only (per local-npm-repo/config.yaml), so the request fails with 'ECONNREFUSED ::1:4873' and lerna publish aborts. Pin the registry URL to the same IPv4 loopback Verdaccio is bound to so name resolution can't pick the wrong address family.
…o-localhost-ipv6 Fix Verdaccio ECONNREFUSED ::1:4873 in dev generator
…e HttpOnly cookies (#3858) * @W-22828949@ Use access token expiry for customer_id and customer_type HttpOnly cookies In HttpOnly session-cookie mode, the SLAS proxy set the non-HttpOnly customer_id and customer_type cookies to the refresh-token TTL (up to 30/90 days). Align them to the access-token JWT exp instead - matching cc-at, cc-at-expires, uido, and id_token - by writing them in the access-token block. usid and enc_user_id stay refresh-TTL-aligned. This also keeps them in sync with the current access token on every access-token response (mirroring the client's handleTokenResponse), instead of only when a refresh token is present. * @W-22828949@ Add CHANGELOG entry for customer_id/customer_type access-token expiry
… SCAPI proxy (#3859) * @W-22846335@ Normalize lowercase bearer scheme to canonical Bearer on SCAPI proxy The SCAPI proxy detected an incoming Authorization bearer case-insensitively but forwarded it verbatim, so a lowercase `bearer <jwt>` reached SCAPI and 401'd on the scheme. Re-emit the canonical `Bearer <token>` (normalizing scheme case and collapsing a tab/multi-space separator) whenever a bearer-with-value is present; the token is forwarded unchanged so a fresh SSR bearer still wins over a stale cookie. Hardening/parity item — the SDK always sends canonical `Bearer`, so there is no known live break. The same normalization must be mirrored in MRT's CloudFront Lambda@Edge. * Update packages/pwa-kit-runtime/src/utils/ssr-server/configure-proxy.basic.test.js Co-authored-by: Joel Uong <88680517+joeluong-sfcc@users.noreply.github.com> Signed-off-by: vcua-mobify <47404250+vcua-mobify@users.noreply.github.com> --------- Signed-off-by: vcua-mobify <47404250+vcua-mobify@users.noreply.github.com> Co-authored-by: Joel Uong <88680517+joeluong-sfcc@users.noreply.github.com>
…3856) * Fix: Render search refinements panels open during SSR (@W-22819807@) ChakraUI v2's Accordion gates each item's open state on a descendant index that is -1 until a post-mount layout effect runs. renderToString runs no effects, so every refinement panel rendered closed server-side regardless of defaultIndex, then opened after hydration — a late relayout that could become the PLP largest-contentful-paint element. Replace the Accordion with a controlled RefinementDisclosure that applies its open state through the panel's hidden attribute, so panels render open server-side. Open state is lifted into Refinements (keyed by attributeId) and seeded to the server-equal all-open set; saved localStorage state is applied post-hydration to avoid a hydration mismatch for returning users. CategoryLinks becomes a self-owned disclosure, which also removes a pre-existing bug where its toggle corrupted a sibling filter's persisted state. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * Style: Single-line the Categories FormattedMessage label (@W-22819807@) * Fix: React to excludedFilters changes in refinements memo (@W-22819807@) * Fix: Restore refinement section dividers lost in the disclosure swap (@W-22819807@) * Style: Match refinement header weight and chevron padding to the Accordion (@W-22819807@) --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…age (#3860) * @W-22846346@ Refresh and retry on SCAPI 401 instead of a hard error page The commerce-sdk-react Auth layer decides whether to refresh purely from the expiry indicator (the cc-at-expires cookie in HttpOnly mode, or the JWT exp in localStorage mode), never from a 401 response. When the access token is invalid-but-unexpired (server-revoked, tampered, or after a SLAS signing-key rotation), the indicator still reads "valid", so ready() sends the bad token, SCAPI returns 401, and the SSR render path throws an HTTPError that the PWA Kit error boundary renders as a hard "This page isn't working - HTTPError 401" page -- even though a still-valid refresh token (cc-nx) usually exists. handleInvalidToken now adds 401-driven refresh-and-retry: for any 401 that isn't the "Customer credentials changed after token was issued." case, it clears the stale cc-at-expires indicator and refreshes, mirroring the existing 400 access_token_cookie_missing handler. Clearing the expiry first is required so _refreshAccessToken() doesn't short-circuit on the still-"valid" indicator. The caller (useAuthorizationHeader and the useQuery/useMutation custom-endpoint paths) retries the request exactly once, so a repeat 401 still propagates. The fix is mode-agnostic, covering both HttpOnly and localStorage; the gap was confirmed to reproduce in both. No MRT/proxy changes: the refresh round-trip, cookie rewrite, and bearer injection this relies on are already deployed and exercised by the normal expiry-driven refresh. * @W-22846346@ Add CHANGELOG entry for 401 refresh-and-retry (#3860)
* Port cancel order components from cancelOrderHook branch Cherry-pick cancellation-specific files onto fresh branch from develop: - cancel-order-modal (modal, constants, tests) - product-list component (reusable for order items) - use-order-products hook (fetches and merges product data with order items) * @W-22806923@ Cancel order UX aligned with storefront-next designs - Redesign cancel modal: dialog title with order number, native select dropdown for reason codes, "Keep order" / "Confirm cancellation" buttons - Add ORDER ACTIONS section on order-detail page with cancel button - Add cancel eligibility gating (OMS enabled, registered, status/shipping) - Show inline feedback alert on successful cancellation - Update status badge to Cancelled after cancel success - Add oms.enabled config flag - Fix shared/ui imports for product-list component - Rewrite cancel-order-modal tests for new design * Remove unused product-list and use-order-products These were ported from the old branch but the new cancel modal design does not display products inside the dialog. * Address PR review feedback - Add ownsOrder check to cancel eligibility - Default oms.enabled to false (opt-in) - Remove dead i18n messages from constants.js - Add label association for reason select (a11y) - Use red.700 for error feedback (matches storefront-next) - Add showCancelSuccess/showCancelError helpers for API integration - Badge shows × Cancelled on success, stays unchanged on error - Move feedback alert above Order Details heading - Move badge to far right of heading row - Only allow cancel when shippingStatus is not_shipped (no empty fallback) * Fix prettier formatting for CI lint - Inline short prop lists in test file - Inline ternary expressions in order-detail.jsx * Add cancel order i18n messages to translation files Extract and compile new message IDs for cancel order modal, feedback alerts, and badge into en-US, en-GB, and en-XA. * Fix a11y and UX issues from code review - Replace hard-coded × glyph with CloseIcon + aria-hidden - Reset selectedReason via useEffect on isOpen (covers all close paths) - Use Chakra Alert with role="alert" for screen reader announcement - Only disable cancel button on success, not error (allow retry) - Clear feedback when modal reopens after error * Fix a11y and UX issues from code review - Replace hard-coded × glyph with CloseIcon + aria-hidden in badge - Reset selectedReason via useEffect on isOpen (covers all close paths) - Use role="alert" with aria-live="assertive" for screen reader announcement - Delay feedback 300ms so screen readers finish modal close before alert - Only disable cancel button on success, not error (allow retry) - Clear feedback when modal reopens after error - Add proper label element for reason select - Add tests for reason reset and label association * Fix CI lint: inline props for prettier, suppress unused-var for showCancelError
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
20 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Types of Changes
Changes
How to Test-Drive This PR
Checklists
General
Accessibility Compliance
You must check off all items in one of the follow two lists:
or...
Localization