[antosubash]

Two smaller fixes from the scaffolded-app feedback: bare border utilities now use the theme's border colour, and smpy package-update updates every framework pin, not only [project] dependencies.

Closes #714
Closes #715

What changed

• Behaviour change: theme border colour by default (ui: globals.css never applies --color-border, so bare border utilities draw currentColor #714). @simple-module-py/ui's globals.css base layer now sets border-color: var(--color-border) on *, ::before, ::after, ::backdrop, ::file-selector-button, the same selector list as Tailwind's preflight. A bare border / border-b used to draw in currentColor, which already affected TableRow, PaginationBar and the sharing table. Any explicit border-* class still wins; use border-current for the old look.
• smpy package-update covers dependency groups and extras (cli: smpy package-update skips dependency-groups and the client app's @simple-module-py/* pins #715). Every string entry in [dependency-groups] and [project.optional-dependencies] is rewritten too, including a workspace root that has only a dev group. {include-group = …} entries are left alone, and root [tool.uv.sources] are honoured in members.
• …and the client app's @simple-module-py/* pins. Root and client_app/package.json (dependencies, dev, optional and peer) move in lockstep to the selected simple_module_core version, keeping ^/~/exact style and never downgrading.
  • If that version isn't on npm, or the registry fails or times out, the pin is skipped with a warning.
  • If the run leaves the Python core pin alone (an upper bound, a local source), every npm pin stays too, so npm never runs ahead of Python.
  • workspace/file/git/alias references are reported, not silently skipped.
  • All changes are planned before anything is written; --dry-run writes nothing; JSON indentation and newline style are preserved. The summary says to run uv sync and/or npm install where needed.
• package_update.py is split into package_update_deps.py (TOML) and package_update_npm.py (npm) to stay under the 300-line cap. Docs and the shipped simple-module-cli skill are updated.

Verification

• make lint ✓ · make test-js ✓ · make test-py ✓ (6500 passed, 41 skipped)
• New tests: dependency groups, extras, include-group, workspace sources (test_cli_package_update_groups.py); npm sections and locations, pin styles, skips, held-back core, registry timeout and bad JSON, hyphenated core name (test_cli_package_update_npm.py); compiled-stylesheet border colours, including explicit-class precedence (ui-border-color.test.ts).
• Code review: two passes. Review found and fixed the held-back-core case, registry error handling, the extra selectors and a stale shipped skill; rejected findings are recorded with reasons.
• No browser QA: the CSS change is covered by a test that compiles the real stylesheet and checks computed border colours. I didn't eyeball the screens.

https://claude.ai/code/session_01M9neheZZEe3sVpDi2S3zT4

[cloudflare-workers-and-pages]

Deploying simple-module-python with    Cloudflare Pages

Latest commit:	e536cbf
Status:	✅  Deploy successful!
Preview URL:	https://1bee06eb.simple-module-python.pages.dev
Branch Preview URL:	https://feat-b29-ui-border-pkg-updat.simple-module-python.pages.dev

View logs

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	✅ Completed 2026-10-30T22:17:26.458856Z	e536cbf	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.