[pull] main from KelvinTegelaar:main

.github/workflows/cipp_dev_build.yml

@@ -54,7 +54,7 @@ jobs:
 
       # Upload to Azure Blob Storage
       - name: Azure Blob Upload
-        uses: LanceMcCarthy/Action-AzureBlobUpload@v3.11.0
+        uses: LanceMcCarthy/Action-AzureBlobUpload@v3.12.0
         with:
           connection_string: ${{ secrets.AZURE_CONNECTION_STRING }}
           container_name: cipp

.github/workflows/cipp_frontend_build.yml

@@ -54,7 +54,7 @@ jobs:
 
       # Upload to Azure Blob Storage
       - name: Azure Blob Upload
-        uses: LanceMcCarthy/Action-AzureBlobUpload@v3.11.0
+        uses: LanceMcCarthy/Action-AzureBlobUpload@v3.12.0
         with:
           connection_string: ${{ secrets.AZURE_CONNECTION_STRING }}
           container_name: cipp

package.json

@@ -1,6 +1,6 @@
 {
   "name": "cipp",
-  "version": "10.5.2",
+  "version": "10.5.3",
   "author": "CIPP Contributors",
   "homepage": "https://cipp.app/",
   "bugs": {
@@ -16,7 +16,7 @@
   },
   "scripts": {
     "dev": "next -H 127.0.0.1",
-    "build": "next build --webpack && rm -rf package.json yarn.lock",
+    "build": "node scripts/skip-export-build-traces.mjs && next build --webpack && rm -rf package.json yarn.lock",
     "start": "next start",
     "export": "next export",
     "lint": "npx eslint .",
@@ -40,10 +40,10 @@
     "@nivo/core": "^0.99.0",
     "@nivo/sankey": "^0.99.0",
     "@react-pdf/renderer": "^4.5.1",
-    "@reduxjs/toolkit": "^2.11.2",
+    "@reduxjs/toolkit": "^2.12.0",
     "@tanstack/query-sync-storage-persister": "^5.90.25",
     "@tanstack/react-query": "^5.100.10",
-    "@tanstack/react-query-devtools": "^5.96.2",
+    "@tanstack/react-query-devtools": "^5.100.10",
     "@tanstack/react-query-persist-client": "^5.96.2",
     "@tanstack/react-table": "^8.19.2",
     "@tiptap/core": "^3.22.3",
@@ -53,11 +53,11 @@
     "@tiptap/react": "^3.20.5",
     "@tiptap/starter-kit": "^3.20.5",
     "@vvo/tzdb": "^6.198.0",
-    "apexcharts": "5.10.4",
+    "apexcharts": "5.14.0",
     "axios": "1.16.1",
     "date-fns": "4.1.0",
     "diff": "^8.0.3",
-    "dompurify": "^3.4.3",
+    "dompurify": "^3.4.9",
     "driver.js": "^1.4.0",
     "eml-parse-js": "^1.2.0-beta.0",
     "export-to-csv": "^1.3.0",
@@ -72,7 +72,7 @@
     "lodash.isequal": "4.5.0",
     "material-react-table": "^3.0.1",
     "monaco-editor": "^0.55.1",
-    "mui-tiptap": "^1.30.0",
+    "mui-tiptap": "^1.31.0",
     "next": "^16.2.2",
     "nprogress": "0.2.0",
     "numeral": "2.0.6",
@@ -116,4 +116,4 @@
     "eslint-config-prettier": "^10.1.8",
     "prettier": "^3.8.1"
   }
-}
+}

public/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "10.5.2"
+  "version": "10.5.3"
 }

scripts/skip-export-build-traces.mjs

@@ -0,0 +1,41 @@
+// Workaround for a Next.js 16 build-time waste on `output: 'export'` builds.
+//
+// Next traces server-side file dependencies with @vercel/nft ("Collecting build traces") on every
+// webpack build. For a static export there is NO server runtime, so that trace is never used — yet it
+// costs roughly HALF the build wall-clock (measured ~256s; the single biggest serial phase, and on a
+// 2-core CI runner it stacks on top of static generation). Next 14 let you skip it with
+// `outputFileTracing: false`; Next 15+ removed that option and ships no replacement.
+//
+// This idempotently patches the installed Next build to gate the NFT step on `config.output !== 'export'`
+// — exactly what the old flag did. It's safe: the trace result is never consumed for an export build
+// (only `output: 'standalone'` reads it), and Next already does `await buildTracesPromise` where an
+// unset (undefined) promise is a no-op. Run it immediately before `next build`. Re-running is harmless.
+// Remove once Next skips build traces for `output: 'export'` upstream (track: vercel/next.js).
+import { readFileSync, writeFileSync } from "node:fs";
+import { createRequire } from "node:module";
+
+const require = createRequire(import.meta.url);
+
+let target;
+try {
+  target = require.resolve("next/dist/build/index.js");
+} catch {
+  console.warn("[skip-export-traces] next/dist/build/index.js not resolvable — skipping (build still works)");
+  process.exit(0);
+}
+
+const NEEDLE = "!isGenerateMode && !buildTracesPromise) {";
+const PATCHED = "!isGenerateMode && !buildTracesPromise && config.output !== 'export') {";
+
+let src = readFileSync(target, "utf8");
+if (src.includes(PATCHED)) {
+  console.log("[skip-export-traces] already patched — Next will skip build traces for output: export");
+} else if (src.includes(NEEDLE)) {
+  writeFileSync(target, src.replace(NEEDLE, PATCHED));
+  console.log("[skip-export-traces] patched: Next will skip @vercel/nft build traces for output: export");
+} else {
+  console.warn(
+    "[skip-export-traces] WARNING: patch site not found — Next internals changed for this version. " +
+      "Build proceeds unpatched (just slower). Re-verify the gate in next/dist/build/index.js."
+  );
+}

src/components/CippCards/CippStandardsDialog.jsx

@@ -36,7 +36,7 @@ import {
   ExpandMore as ExpandMoreIcon,
 } from '@mui/icons-material'
 import { SvgIcon } from '@mui/material'
-import standards from '../../data/standards.json'
+import { getStandards } from '../../utils/standards-data'
 
 const getCategoryIcon = (category) => {
   switch (category) {
@@ -136,7 +136,7 @@ export const CippStandardsDialog = ({ open, onClose, standardsData, currentTenan
   let totalStandardsCount = 0
 
   Object.entries(combinedStandards).forEach(([standardKey, standardConfig]) => {
-    const standardInfo = standards.find((s) => s.name === `standards.${standardKey}`)
+    const standardInfo = getStandards().find((s) => s.name === `standards.${standardKey}`)
     if (standardInfo) {
       const category = standardInfo.cat
       if (!standardsByCategory[category]) {

src/components/CippComponents/CippAutocomplete.jsx

@@ -146,7 +146,10 @@ export const CippAutoComplete = React.forwardRef((props, ref) => {
   const currentTenant = api?.tenantFilter ? api.tenantFilter : useSettings().currentTenant
   useEffect(() => {
     if (actionGetRequest.isSuccess && !actionGetRequest.isFetching) {
-      const lastPage = actionGetRequest.data?.pages[actionGetRequest.data.pages.length - 1]
+      // Guard against a non-paginated cache shape (e.g. when a queryKey is accidentally shared
+      // with a useQuery/ApiGetCall consumer that stores a plain array instead of { pages }).
+      const pages = actionGetRequest.data?.pages
+      const lastPage = Array.isArray(pages) ? pages[pages.length - 1] : undefined
       const nextLinkExists = lastPage?.Metadata?.nextLink
       if (nextLinkExists) {
         actionGetRequest.fetchNextPage()

src/components/CippComponents/CippCodeBlock.jsx

@@ -1,11 +1,20 @@
 import { useState } from "react";
-import { atomDark } from "react-syntax-highlighter/dist/cjs/styles/prism";
-import { Prism as SyntaxHighlighter } from "react-syntax-highlighter";
+import dynamic from "next/dynamic";
 import { CippCopyToClipBoard } from "./CippCopyToClipboard";
 import { styled } from "@mui/system"; // Correct import from @mui/system
-import { Editor } from "@monaco-editor/react";
 import { useSettings } from "../../hooks/use-settings";
 
+// Heavy, client-only editors loaded on demand so monaco-editor (~5MB) and react-syntax-highlighter
+// stay out of the common bundle — they only download when a code block actually renders.
+const Editor = dynamic(() => import("@monaco-editor/react").then((m) => m.Editor), {
+  ssr: false,
+  loading: () => null,
+});
+const CippPrismHighlighter = dynamic(() => import("./CippPrismHighlighter"), {
+  ssr: false,
+  loading: () => null,
+});
+
 const CodeContainer = styled("div")`
   position: relative;
   display: block;
@@ -68,16 +77,14 @@ export const CippCodeBlock = (props) => {
         />
       )}
       {type === "syntax" && (
-        <SyntaxHighlighter
+        <CippPrismHighlighter
           lineProps={{ style: { wordBreak: "break-all", whiteSpace: "pre-wrap" } }}
           language={language}
-          style={atomDark}
           showLineNumbers={showLineNumbers}
           startingLineNumber={startingLineNumber}
           wrapLongLines={wrapLongLines}
-        >
-          {code}
-        </SyntaxHighlighter>
+          code={code}
+        />
       )}
     </CodeContainer>
   );

src/components/CippComponents/CippDeployCompliancePolicyDrawer.jsx

@@ -67,10 +67,13 @@ const MODE_CONFIG = {
   "Tooltip": "Confidential data, do not share externally",
   "Comment": "Internal-only confidential classification",
   "ContentType": "File, Email",
+  "ApplyContentMarkingHeaderEnabled": true,
+  "ApplyContentMarkingHeaderText": "Confidential - Internal Use Only",
+  "ApplyContentMarkingHeaderFontColor": "#FF0000",
   "EncryptionEnabled": true,
-  "EncryptionProtectionType": "Template",
-  "ContentMarkingHeaderEnabled": true,
-  "ContentMarkingHeaderText": "Confidential - Internal Use Only",
+  "EncryptionProtectionType": "UserDefined",
+  "EncryptionPromptUser": true,
+  "EncryptionDoNotForward": true,
   "PolicyParams": {
     "Name": "Confidential Label Policy",
     "ExchangeLocation": "All",

src/components/CippComponents/CippFormComponent.jsx

@@ -20,20 +20,20 @@ import { Controller, useFormState } from "react-hook-form";
 import { DateTimePicker } from "@mui/x-date-pickers"; // Make sure to install @mui/x-date-pickers
 import CSVReader from "../CSVReader";
 import get from "lodash/get";
-import {
-  MenuButtonBold,
-  MenuButtonItalic,
-  MenuControlsContainer,
-  MenuDivider,
-  MenuSelectHeading,
-  RichTextEditor,
-} from "mui-tiptap";
-import StarterKit from "@tiptap/starter-kit";
+import dynamic from "next/dynamic";
 import { CippDataTable } from "../CippTable/CippDataTable";
 import React from "react";
 import { CloudUpload } from "@mui/icons-material";
 import { Stack } from "@mui/system";
 
+// The tiptap / prosemirror / mui-tiptap editor tree is large and only used by `richText` fields.
+// Load it on demand via next/dynamic so it is code-split into an async chunk instead of being
+// pulled into the shared bundle that every page using CippFormComponent loads. See CippRichTextField.jsx.
+const CippRichTextField = dynamic(() => import("./CippRichTextField"), {
+  ssr: false,
+  loading: () => null,
+});
+
 // Helper function to convert bracket notation to dot notation
 // Improved to correctly handle nested bracket notations
 const convertBracketsToDots = (name) => {
@@ -485,72 +485,14 @@ export const CippFormComponent = (props) => {
     }
 
     case "richText": {
-      const editorInstanceRef = React.useRef(null);
-      const lastSetValue = React.useRef(null);
-
       return (
-        <>
-          <div>
-            <Controller
-              name={convertedName}
-              control={formControl.control}
-              rules={validators}
-              render={({ field }) => {
-                const { value, onChange, ref } = field;
-
-                // Update content when value changes externally
-                React.useEffect(() => {
-                  if (
-                    editorInstanceRef.current &&
-                    typeof value === "string" &&
-                    value !== lastSetValue.current
-                  ) {
-                    editorInstanceRef.current.commands.setContent(value || "", false);
-                    lastSetValue.current = value;
-                  }
-                }, [value]);
-
-                return (
-                  <>
-                    <Typography variant="subtitle2">{label}</Typography>
-                    <RichTextEditor
-                      {...other}
-                      immediatelyRender={false}
-                      ref={ref}
-                      extensions={[StarterKit]}
-                      content=""
-                      onCreate={({ editor }) => {
-                        editorInstanceRef.current = editor;
-                        // Set initial content when editor is created
-                        if (typeof value === "string") {
-                          editor.commands.setContent(value || "", false);
-                          lastSetValue.current = value;
-                        }
-                      }}
-                      onUpdate={({ editor }) => {
-                        const newValue = editor.getHTML();
-                        lastSetValue.current = newValue;
-                        onChange(newValue);
-                      }}
-                      label={label}
-                      renderControls={() => (
-                        <MenuControlsContainer>
-                          <MenuSelectHeading />
-                          <MenuDivider />
-                          <MenuButtonBold />
-                          <MenuButtonItalic />
-                        </MenuControlsContainer>
-                      )}
-                    />
-                  </>
-                );
-              }}
-            />
-          </div>
-          <Typography variant="subtitle3" color="error">
-            {get(errors, convertedName, {}).message}
-          </Typography>
-        </>
+        <CippRichTextField
+          convertedName={convertedName}
+          formControl={formControl}
+          validators={validators}
+          label={label}
+          {...other}
+        />
       );
     }
     case "CSVReader":

src/components/CippComponents/CippFormLicenseSelector.jsx

@@ -32,6 +32,7 @@ export const CippFormLicenseSelector = ({
         data: {
           Endpoint: 'subscribedSkus',
           $count: true,
+          IncludeExcluded: true,
         },
         showRefresh,
       }}