fix(dashboard): Import vendored shadcn CSS from design-tokens

[michaelbromley]

packages/dashboard/src/app/styles.css imported shadcn/tailwind.css, but shadcn was never a declared dependency of @vendure/dashboard. It reached the dashboard only transitively:

@vendure/dashboard → @vendure-io/design-tokens ^2.0.0-beta.7 → shadcn ^3.8.5

@vendure-io/design-tokens@2.0.0-beta.8, published today at 12:01 UTC, removed shadcn from its dependencies. Since ^2.0.0-beta.7 resolves forward across prereleases (>=2.0.0-beta.7 <3.0.0-0), every fresh install from that point lost the package and the stylesheet failed to build.

@vendure-io/design-tokens@2.0.0-beta.9 vendors the same CSS and exposes it as ./css/shadcn, so this imports it from there and raises the minimum accordingly. That also makes line 4 consistent with line 1, which already imports @vendure-io/design-tokens/css/fonts.

The import stays in its current position, after tw-animate-css, because the vendored file relies on that ordering for its accordion keyframes to win the cascade.

Symptom

The test (ubuntu-latest, 22.x) job of the Publish & Install workflow fails. The reported error is a Playwright timeout waiting for the login form, but the cause appears four seconds earlier in the log:

[vite] Internal server error: Can't resolve 'shadcn/tailwind.css'
       in '/home/runner/install/test-app/node_modules/@vendure/dashboard/src/app'
  Plugin: @tailwindcss/vite:generate:serve

The stylesheet fails to build, the dashboard renders nothing, and there is no input for Playwright to fill.

This only shows up in the freshly scaffolded test app, which installs without a lockfile. Inside the monorepo, bun.lock pinned design-tokens at beta.7, which still carried shadcn, so local builds and the in-repo dashboard tests kept passing.

master is unaffected: it depends on @vendure-io/design-tokens: ^1.1.2, which excludes the 2.0.0 prerelease line, and its stylesheet has no shadcn import.

Lockfile

bun.lock has to move to beta.9 as well. Without it the monorepo would install beta.7, which has no ./css/shadcn export, and the new import would fail in-repo.

The rest of the lockfile churn follows from the same change: with shadcn gone from the hoisted design-tokens, postcss-selector-parser@7.1.1 takes the top-level slot and seven nested duplicates collapse.

Verification

• require.resolve('@vendure-io/design-tokens/css/shadcn') from packages/dashboard/src/app resolves to the vendored file; shadcn/tailwind.css no longer resolves, confirming the lockfile bump was required rather than incidental.
• A full vite build of the dashboard succeeds.
• The built CSS contains the vendored file's accordion-down keyframes and its no-scrollbar utility, so the stylesheet is being applied rather than silently skipped.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
vendure-storybook	Ready	Preview	Jul 31, 2026 1:42pm

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: a956fcd4-aa86-436d-a414-b0d8b65b1b74

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Dashboard Preview: https://admin-dashboard-dso5dp9os-vendure.vercel.app

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud