demio-ui 5.4.3 → 5.4.4

package/README.md

@@ -19,7 +19,6 @@ As a small team, we need to build and maintain our UI library quickly and with a
 
 - add CSS variables to variables.css from [Figma](<https://www.figma.com/file/cIDRvlVWwtmu3wCrFZ27IY/Demio-Design-Kit-(New)?node-id=5162%3A8032&mode=dev>)
 - create a new components ( one MR for one component implementation)
-
   - `<Icon />` - SVG icon component
     - all SVG styles (including color and size) should be managed by CSS
 
@@ -36,6 +35,49 @@ To get started with the `Demio React UI Components Library`, follow these steps:
 2. Install dependencies: `npm install`
 3. Run Storybook: `npm run storybook` and open [http://localhost:6006](http://localhost:6006) in your browser if it doesn't open automatically.
 
+## Updating npm dependencies
+
+This library uses [`.npmrc`](.npmrc) supply-chain settings:
+
+- `allow-git=none` — registry-only dependencies
+- `min-release-age=14` — block package versions newer than 14 days when resolving installs (**npm 11+**)
+
+GitLab CI runs `npm ci` on **Node 24 LTS** and upgrades to **npm 11** before install (base images may still ship npm 10, which ignores `.npmrc` supply-chain settings). Commit `package-lock.json` with every dependency change.
+
+### Clean install
+
+```bash
+npm ci
+npm run prepare
+```
+
+The `prepare` script runs the library build required for local consumers and hooks.
+
+### Update one package
+
+1. Pick a version at least 14 days old on npm (unless hotfixing).
+2. `npm install <package>@<version>`
+3. `npm run lint:lockfile && npm run test && npm run lint-all`
+4. Commit `package.json` and `package-lock.json`.
+
+### Update within ranges
+
+```bash
+npm update <package>
+```
+
+### Security hotfix (before cooldown)
+
+```bash
+npm install <package>@<version> --min-release-age=0
+```
+
+Document the reason in the merge request.
+
+### Publishing note
+
+Run the full quality gate (`npm run lint-all`, tests, build) before release; do not publish with an uncommitted lockfile.
+
 ## Tools
 
 - [TypeScript](https://www.typescriptlang.org/) - strongly typed programming language that builds on JavaScript
@@ -212,7 +254,6 @@ npm run analyze-all
 ### 🎯 **Why Two Different Measurements?**
 
 1. **Visualizer (500KB CJS / 420KB ESM)**:
-
    - Shows only JavaScript code size
    - Helps optimize code and dependencies
    - Focuses on runtime performance
@@ -227,18 +268,15 @@ Both measurements are correct and serve different optimization purposes!
 ### 🚀 **Optimization Recommendations**
 
 1. **JavaScript Bundle**:
-
    - ✅ Already well-optimized
    - Consider tree-shaking for unused components
    - Monitor for large dependency additions
 
 2. **CSS Bundle**:
-
    - ✅ Good size for comprehensive styling
    - Monitor for duplicate styles
 
 3. **Assets (SVG files)**:
-
    - Optimize SVG files using SVGO
    - Monitor total assets size