Skip to content

chore: bump the major group in /web with 5 updates#825

Closed
dependabot[bot] wants to merge 2 commits intomainfrom
dependabot/npm_and_yarn/web/major-ca902fdc5e
Closed

chore: bump the major group in /web with 5 updates#825
dependabot[bot] wants to merge 2 commits intomainfrom
dependabot/npm_and_yarn/web/major-ca902fdc5e

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot bot commented on behalf of github Mar 25, 2026

Bumps the major group in /web with 5 updates:

Package From To
@storybook/addon-a11y 8.6.18 10.3.3
@storybook/react 8.6.18 10.3.3
@storybook/react-vite 8.6.18 10.3.3
storybook 8.6.18 10.3.3
typescript 5.9.3 6.0.2

Updates @storybook/addon-a11y from 8.6.18 to 10.3.3

Release notes

Sourced from @​storybook/addon-a11y's releases.

v10.3.3

10.3.3

v10.3.2

10.3.2

v10.3.1

10.3.1

v10.3.0

10.3.0

> Improved developer experience, AI-assisting tools, and broader ecosystem support

Storybook 10.3 contains hundreds of fixes and improvements including:

  • 🤖 Storybook MCP: Agentic component dev, docs, and test (Preview release for React)
  • ⚡ Vite 8 support
  • ▲ Next.js 16.2 support
  • 📝 ESLint 10 support
  • 〰️ Addon Pseudo-States: Tailwind v4 support
  • 🔧 Addon-Vitest: Simplified configuration - no more setup files required
  • ♿ Numerous accessibility improvements across the UI

... (truncated)

Changelog

Sourced from @​storybook/addon-a11y's changelog.

10.3.3

10.3.2

10.3.1

10.3.0

> Improved developer experience, AI-assisting tools, and broader ecosystem support

Storybook 10.3 contains hundreds of fixes and improvements including:

  • 🤖 Storybook MCP: Agentic component dev, docs, and test (Preview release for React)
  • ⚡ Vite 8 support
  • ▲ Next.js 16.2 support
  • 📝 ESLint 10 support
  • 〰️ Addon Pseudo-States: Tailwind v4 support
  • 🔧 Addon-Vitest: Simplified configuration - no more setup files required
  • ♿ Numerous accessibility improvements across the UI

... (truncated)

Commits
  • b0acfb4 Bump version from "10.3.2" to "10.3.3" [skip ci]
  • 308656f Bump version from "10.3.1" to "10.3.2" [skip ci]
  • 24c2c2c Bump version from "10.3.0" to "10.3.1" [skip ci]
  • 06cb6a6 Bump version from "10.3.0-beta.3" to "10.3.0" [skip ci]
  • 94b9430 Bump version from "10.3.0-beta.2" to "10.3.0-beta.3" [skip ci]
  • af5b7de Bump version from "10.3.0-beta.1" to "10.3.0-beta.2" [skip ci]
  • a571619 Bump version from "10.3.0-beta.0" to "10.3.0-beta.1" [skip ci]
  • 546aece Bump version from "10.3.0-alpha.17" to "10.3.0-beta.0" [skip ci]
  • ceda0b4 Bump version from "10.3.0-alpha.16" to "10.3.0-alpha.17" [skip ci]
  • 1ed871c Bump version from "10.3.0-alpha.15" to "10.3.0-alpha.16" [skip ci]
  • Additional commits viewable in compare view

Updates @storybook/react from 8.6.18 to 10.3.3

Release notes

Sourced from @​storybook/react's releases.

v10.3.3

10.3.3

v10.3.2

10.3.2

v10.3.1

10.3.1

v10.3.0

10.3.0

> Improved developer experience, AI-assisting tools, and broader ecosystem support

Storybook 10.3 contains hundreds of fixes and improvements including:

  • 🤖 Storybook MCP: Agentic component dev, docs, and test (Preview release for React)
  • ⚡ Vite 8 support
  • ▲ Next.js 16.2 support
  • 📝 ESLint 10 support
  • 〰️ Addon Pseudo-States: Tailwind v4 support
  • 🔧 Addon-Vitest: Simplified configuration - no more setup files required
  • ♿ Numerous accessibility improvements across the UI

... (truncated)

Changelog

Sourced from @​storybook/react's changelog.

10.3.3

10.3.2

10.3.1

10.3.0

> Improved developer experience, AI-assisting tools, and broader ecosystem support

Storybook 10.3 contains hundreds of fixes and improvements including:

  • 🤖 Storybook MCP: Agentic component dev, docs, and test (Preview release for React)
  • ⚡ Vite 8 support
  • ▲ Next.js 16.2 support
  • 📝 ESLint 10 support
  • 〰️ Addon Pseudo-States: Tailwind v4 support
  • 🔧 Addon-Vitest: Simplified configuration - no more setup files required
  • ♿ Numerous accessibility improvements across the UI

... (truncated)

Commits
  • b0acfb4 Bump version from "10.3.2" to "10.3.3" [skip ci]
  • 308656f Bump version from "10.3.1" to "10.3.2" [skip ci]
  • 24c2c2c Bump version from "10.3.0" to "10.3.1" [skip ci]
  • 06cb6a6 Bump version from "10.3.0-beta.3" to "10.3.0" [skip ci]
  • df32a33 Merge branch 'next-release' into next
  • 94b9430 Bump version from "10.3.0-beta.2" to "10.3.0-beta.3" [skip ci]
  • fefa2f5 Merge pull request #34172 from storybookjs/kasper/vitest-root-migration
  • af5b7de Bump version from "10.3.0-beta.1" to "10.3.0-beta.2" [skip ci]
  • 8b2044a Remove reactDocgenTypescript test (covered elsewhere)
  • 8b78c8b Merge branch 'next' into kasper/vitest-root-migration
  • Additional commits viewable in compare view

Updates @storybook/react-vite from 8.6.18 to 10.3.3

Release notes

Sourced from @​storybook/react-vite's releases.

v10.3.3

10.3.3

v10.3.2

10.3.2

v10.3.1

10.3.1

v10.3.0

10.3.0

> Improved developer experience, AI-assisting tools, and broader ecosystem support

Storybook 10.3 contains hundreds of fixes and improvements including:

  • 🤖 Storybook MCP: Agentic component dev, docs, and test (Preview release for React)
  • ⚡ Vite 8 support
  • ▲ Next.js 16.2 support
  • 📝 ESLint 10 support
  • 〰️ Addon Pseudo-States: Tailwind v4 support
  • 🔧 Addon-Vitest: Simplified configuration - no more setup files required
  • ♿ Numerous accessibility improvements across the UI

... (truncated)

Changelog

Sourced from @​storybook/react-vite's changelog.

10.3.3

10.3.2

10.3.1

10.3.0

> Improved developer experience, AI-assisting tools, and broader ecosystem support

Storybook 10.3 contains hundreds of fixes and improvements including:

  • 🤖 Storybook MCP: Agentic component dev, docs, and test (Preview release for React)
  • ⚡ Vite 8 support
  • ▲ Next.js 16.2 support
  • 📝 ESLint 10 support
  • 〰️ Addon Pseudo-States: Tailwind v4 support
  • 🔧 Addon-Vitest: Simplified configuration - no more setup files required
  • ♿ Numerous accessibility improvements across the UI

... (truncated)

Commits
  • b0acfb4 Bump version from "10.3.2" to "10.3.3" [skip ci]
  • 308656f Bump version from "10.3.1" to "10.3.2" [skip ci]
  • 24c2c2c Bump version from "10.3.0" to "10.3.1" [skip ci]
  • 06cb6a6 Bump version from "10.3.0-beta.3" to "10.3.0" [skip ci]
  • 94b9430 Bump version from "10.3.0-beta.2" to "10.3.0-beta.3" [skip ci]
  • af5b7de Bump version from "10.3.0-beta.1" to "10.3.0-beta.2" [skip ci]
  • a571619 Bump version from "10.3.0-beta.0" to "10.3.0-beta.1" [skip ci]
  • 546aece Bump version from "10.3.0-alpha.17" to "10.3.0-beta.0" [skip ci]
  • ceda0b4 Bump version from "10.3.0-alpha.16" to "10.3.0-alpha.17" [skip ci]
  • 1ed871c Bump version from "10.3.0-alpha.15" to "10.3.0-alpha.16" [skip ci]
  • Additional commits viewable in compare view

Updates storybook from 8.6.18 to 10.3.3

Release notes

Sourced from storybook's releases.

v10.3.3

10.3.3

v10.3.2

10.3.2

v10.3.1

10.3.1

v10.3.0

10.3.0

> Improved developer experience, AI-assisting tools, and broader ecosystem support

Storybook 10.3 contains hundreds of fixes and improvements including:

  • 🤖 Storybook MCP: Agentic component dev, docs, and test (Preview release for React)
  • ⚡ Vite 8 support
  • ▲ Next.js 16.2 support
  • 📝 ESLint 10 support
  • 〰️ Addon Pseudo-States: Tailwind v4 support
  • 🔧 Addon-Vitest: Simplified configuration - no more setup files required
  • ♿ Numerous accessibility improvements across the UI

... (truncated)

Changelog

Sourced from storybook's changelog.

10.3.3

10.3.2

10.3.1

10.3.0

> Improved developer experience, AI-assisting tools, and broader ecosystem support

Storybook 10.3 contains hundreds of fixes and improvements including:

  • 🤖 Storybook MCP: Agentic component dev, docs, and test (Preview release for React)
  • ⚡ Vite 8 support
  • ▲ Next.js 16.2 support
  • 📝 ESLint 10 support
  • 〰️ Addon Pseudo-States: Tailwind v4 support
  • 🔧 Addon-Vitest: Simplified configuration - no more setup files required
  • ♿ Numerous accessibility improvements across the UI

... (truncated)

Commits
  • b0acfb4 Bump version from "10.3.2" to "10.3.3" [skip ci]
  • 6a398c5 Merge pull request #34193 from storybookjs/valentin/streamline-config-validat...
  • 308656f Bump version from "10.3.1" to "10.3.2" [skip ci]
  • 24c2c2c Bump version from "10.3.0" to "10.3.1" [skip ci]
  • e9b881a Merge pull request #34153 from storybookjs/fix-persistent-story-viewport
  • 06cb6a6 Bump version from "10.3.0-beta.3" to "10.3.0" [skip ci]
  • 94b9430 Bump version from "10.3.0-beta.2" to "10.3.0-beta.3" [skip ci]
  • 96340a8 Merge branch 'next' into sidnioulz/103-qa-zoom-shift
  • 2d48af8 remove shiftStep and make it fixed 10x multiplier
  • fda8f06 Merge branch 'next' into sidnioulz/10-3-opportunistic-link-isbutton-bugfix
  • Additional commits viewable in compare view

Updates typescript from 5.9.3 to 6.0.2

Release notes

Sourced from typescript's releases.

TypeScript 6.0

For release notes, check out the release announcement blog post.

Downloads are available on:

TypeScript 6.0 Beta

For release notes, check out the release announcement.

Downloads are available on:

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot dependabot bot added dependencies Pull requests that update a dependency file scope:web Vue 3 dashboard type:chore Maintenance, cleanup, dependency updates labels Mar 25, 2026
@dependabot dependabot bot requested a review from Aureliolo as a code owner March 25, 2026 06:13
@socket-security
Copy link
Copy Markdown

socket-security bot commented Mar 25, 2026

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Updatednpm/​@​storybook/​react-vite@​8.6.18 ⏵ 10.3.399 +110073 +7100 +1100
Updatednpm/​@​storybook/​react@​8.6.18 ⏵ 10.3.3100 +710077 +4100100
Updatednpm/​@​storybook/​addon-a11y@​8.6.18 ⏵ 10.3.3100 +110078 +2100100
Addednpm/​fast-check@​4.6.010010010085100
Addednpm/​framer-motion@​12.38.09710010099100

View full report

@dependabot dependabot bot force-pushed the dependabot/npm_and_yarn/web/major-ca902fdc5e branch from 6a13fa9 to 0780a8f Compare March 26, 2026 13:24
@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Mar 26, 2026

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA 30f8f0a.
Ensure that dependencies are being submitted on PR branches. Re-running this action after a short time may resolve the issue. See the documentation for more information and troubleshooting advice.

OpenSSF Scorecard

Scorecard details
PackageVersionScoreDetails
npm/@joshwooding/vite-plugin-react-docgen-typescript 0.6.4 UnknownUnknown
npm/@storybook/addon-a11y 10.3.3 🟢 7.2
Details
CheckScoreReason
Binary-Artifacts🟢 10no binaries found in the repo
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
CI-Tests🟢 1011 out of 11 merged PRs checked by a CI test -- score normalized to 10
CII-Best-Practices⚠️ 0no badge detected
Code-Review🟢 79 out of last 12 changesets reviewed before merge -- score normalized to 7
Contributors🟢 1042 different organizations found -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Dependency-Update-Tool🟢 10update tool detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Maintained🟢 1030 commit(s) out of 30 and 11 issue activity out of 30 found in the last 90 days -- score normalized to 10
Packaging⚠️ -1no published package detected
Pinned-Dependencies🟢 7dependency not pinned by hash detected -- score normalized to 7
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Security-Policy🟢 10security policy file detected
Signed-Releases⚠️ -1no releases found
Token-Permissions⚠️ 0non read-only tokens detected in GitHub workflows
Vulnerabilities🟢 10no vulnerabilities detected
npm/@storybook/builder-vite 10.3.3 🟢 7.2
Details
CheckScoreReason
Binary-Artifacts🟢 10no binaries found in the repo
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
CI-Tests🟢 1011 out of 11 merged PRs checked by a CI test -- score normalized to 10
CII-Best-Practices⚠️ 0no badge detected
Code-Review🟢 79 out of last 12 changesets reviewed before merge -- score normalized to 7
Contributors🟢 1042 different organizations found -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Dependency-Update-Tool🟢 10update tool detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Maintained🟢 1030 commit(s) out of 30 and 11 issue activity out of 30 found in the last 90 days -- score normalized to 10
Packaging⚠️ -1no published package detected
Pinned-Dependencies🟢 7dependency not pinned by hash detected -- score normalized to 7
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Security-Policy🟢 10security policy file detected
Signed-Releases⚠️ -1no releases found
Token-Permissions⚠️ 0non read-only tokens detected in GitHub workflows
Vulnerabilities🟢 10no vulnerabilities detected
npm/@storybook/csf-plugin 10.3.3 🟢 7.2
Details
CheckScoreReason
Binary-Artifacts🟢 10no binaries found in the repo
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
CI-Tests🟢 1011 out of 11 merged PRs checked by a CI test -- score normalized to 10
CII-Best-Practices⚠️ 0no badge detected
Code-Review🟢 79 out of last 12 changesets reviewed before merge -- score normalized to 7
Contributors🟢 1042 different organizations found -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Dependency-Update-Tool🟢 10update tool detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Maintained🟢 1030 commit(s) out of 30 and 11 issue activity out of 30 found in the last 90 days -- score normalized to 10
Packaging⚠️ -1no published package detected
Pinned-Dependencies🟢 7dependency not pinned by hash detected -- score normalized to 7
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Security-Policy🟢 10security policy file detected
Signed-Releases⚠️ -1no releases found
Token-Permissions⚠️ 0non read-only tokens detected in GitHub workflows
Vulnerabilities🟢 10no vulnerabilities detected
npm/@storybook/icons 2.0.1 UnknownUnknown
npm/@storybook/react 10.3.3 🟢 7.2
Details
CheckScoreReason
Binary-Artifacts🟢 10no binaries found in the repo
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
CI-Tests🟢 1011 out of 11 merged PRs checked by a CI test -- score normalized to 10
CII-Best-Practices⚠️ 0no badge detected
Code-Review🟢 79 out of last 12 changesets reviewed before merge -- score normalized to 7
Contributors🟢 1042 different organizations found -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Dependency-Update-Tool🟢 10update tool detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Maintained🟢 1030 commit(s) out of 30 and 11 issue activity out of 30 found in the last 90 days -- score normalized to 10
Packaging⚠️ -1no published package detected
Pinned-Dependencies🟢 7dependency not pinned by hash detected -- score normalized to 7
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Security-Policy🟢 10security policy file detected
Signed-Releases⚠️ -1no releases found
Token-Permissions⚠️ 0non read-only tokens detected in GitHub workflows
Vulnerabilities🟢 10no vulnerabilities detected
npm/@storybook/react-dom-shim 10.3.3 🟢 7.2
Details
CheckScoreReason
Binary-Artifacts🟢 10no binaries found in the repo
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
CI-Tests🟢 1011 out of 11 merged PRs checked by a CI test -- score normalized to 10
CII-Best-Practices⚠️ 0no badge detected
Code-Review🟢 79 out of last 12 changesets reviewed before merge -- score normalized to 7
Contributors🟢 1042 different organizations found -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Dependency-Update-Tool🟢 10update tool detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Maintained🟢 1030 commit(s) out of 30 and 11 issue activity out of 30 found in the last 90 days -- score normalized to 10
Packaging⚠️ -1no published package detected
Pinned-Dependencies🟢 7dependency not pinned by hash detected -- score normalized to 7
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Security-Policy🟢 10security policy file detected
Signed-Releases⚠️ -1no releases found
Token-Permissions⚠️ 0non read-only tokens detected in GitHub workflows
Vulnerabilities🟢 10no vulnerabilities detected
npm/@storybook/react-vite 10.3.3 🟢 7.2
Details
CheckScoreReason
Binary-Artifacts🟢 10no binaries found in the repo
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
CI-Tests🟢 1011 out of 11 merged PRs checked by a CI test -- score normalized to 10
CII-Best-Practices⚠️ 0no badge detected
Code-Review🟢 79 out of last 12 changesets reviewed before merge -- score normalized to 7
Contributors🟢 1042 different organizations found -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Dependency-Update-Tool🟢 10update tool detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Maintained🟢 1030 commit(s) out of 30 and 11 issue activity out of 30 found in the last 90 days -- score normalized to 10
Packaging⚠️ -1no published package detected
Pinned-Dependencies🟢 7dependency not pinned by hash detected -- score normalized to 7
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Security-Policy🟢 10security policy file detected
Signed-Releases⚠️ -1no releases found
Token-Permissions⚠️ 0non read-only tokens detected in GitHub workflows
Vulnerabilities🟢 10no vulnerabilities detected
npm/@vitest/expect 3.2.4 UnknownUnknown
npm/@vitest/pretty-format 3.2.4 UnknownUnknown
npm/@vitest/spy 3.2.4 UnknownUnknown
npm/@vitest/utils 3.2.4 UnknownUnknown
npm/empathic 2.0.0 UnknownUnknown
npm/glob 13.0.6 🟢 5.5
Details
CheckScoreReason
Packaging⚠️ -1packaging workflow not detected
Code-Review⚠️ 0Found 0/30 approved changesets -- score normalized to 0
Maintained🟢 1026 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10
SAST⚠️ 0no SAST tool detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Fuzzing⚠️ 0project is not fuzzed
License🟢 9license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Security-Policy🟢 10security policy file detected
npm/open 10.2.0 🟢 3.7
Details
CheckScoreReason
Code-Review⚠️ 2Found 8/30 approved changesets -- score normalized to 2
Packaging⚠️ -1packaging workflow not detected
Security-Policy🟢 10security policy file detected
Binary-Artifacts🟢 10no binaries found in the repo
Maintained⚠️ 00 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/path-scurry 2.0.2 🟢 4.9
Details
CheckScoreReason
Code-Review⚠️ 0Found 0/30 approved changesets -- score normalized to 0
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 10no binaries found in the repo
Maintained🟢 45 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 4
Packaging⚠️ -1packaging workflow not detected
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 9license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Security-Policy🟢 10security policy file detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/react-docgen 8.0.3 🟢 6.9
Details
CheckScoreReason
Code-Review⚠️ 0Found 1/29 approved changesets -- score normalized to 0
Maintained🟢 1030 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Packaging⚠️ -1packaging workflow not detected
Security-Policy🟢 10security policy file detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST🟢 10SAST tool is run on all commits
npm/storybook 10.3.3 🟢 7.2
Details
CheckScoreReason
Binary-Artifacts🟢 10no binaries found in the repo
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
CI-Tests🟢 1011 out of 11 merged PRs checked by a CI test -- score normalized to 10
CII-Best-Practices⚠️ 0no badge detected
Code-Review🟢 79 out of last 12 changesets reviewed before merge -- score normalized to 7
Contributors🟢 1042 different organizations found -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Dependency-Update-Tool🟢 10update tool detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Maintained🟢 1030 commit(s) out of 30 and 11 issue activity out of 30 found in the last 90 days -- score normalized to 10
Packaging⚠️ -1no published package detected
Pinned-Dependencies🟢 7dependency not pinned by hash detected -- score normalized to 7
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Security-Policy🟢 10security policy file detected
Signed-Releases⚠️ -1no releases found
Token-Permissions⚠️ 0non read-only tokens detected in GitHub workflows
Vulnerabilities🟢 10no vulnerabilities detected
npm/tinyrainbow 2.0.0 UnknownUnknown
npm/tinyspy 4.0.4 UnknownUnknown
npm/typescript 6.0.2 🟢 8.5
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Maintained🟢 1030 commit(s) and 12 issue activity found in the last 90 days -- score normalized to 10
Dependency-Update-Tool🟢 10update tool detected
Packaging⚠️ -1packaging workflow not detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions🟢 9detected GitHub workflow tokens with excessive permissions
Security-Policy🟢 10security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Vulnerabilities🟢 91 existing vulnerabilities detected
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
Binary-Artifacts🟢 10no binaries found in the repo
Branch-Protection⚠️ -1internal error: error during GetBranch(release-5.9): error during branchesHandler.query: internal error: githubv4.Query: Resource not accessible by integration
License🟢 10license file detected
SAST🟢 10SAST tool is run on all commits
Pinned-Dependencies🟢 6dependency not pinned by hash detected -- score normalized to 6
Fuzzing🟢 10project is fuzzed
CI-Tests🟢 1030 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors🟢 10project has 35 contributing companies or organizations
npm/unplugin 2.3.11 UnknownUnknown
npm/wsl-utils 0.1.0 UnknownUnknown

Scanned Files

  • web/package-lock.json

Bumps the major group in /web with 5 updates:

| Package | From | To |
| --- | --- | --- |
| [@storybook/addon-a11y](https://github.com/storybookjs/storybook/tree/HEAD/code/addons/a11y) | `8.6.18` | `10.3.3` |
| [@storybook/react](https://github.com/storybookjs/storybook/tree/HEAD/code/renderers/react) | `8.6.18` | `10.3.3` |
| [@storybook/react-vite](https://github.com/storybookjs/storybook/tree/HEAD/code/frameworks/react-vite) | `8.6.18` | `10.3.3` |
| [storybook](https://github.com/storybookjs/storybook/tree/HEAD/code/core) | `8.6.18` | `10.3.3` |
| [typescript](https://github.com/microsoft/TypeScript) | `5.9.3` | `6.0.2` |


Updates `@storybook/addon-a11y` from 8.6.18 to 10.3.3
- [Release notes](https://github.com/storybookjs/storybook/releases)
- [Changelog](https://github.com/storybookjs/storybook/blob/next/CHANGELOG.md)
- [Commits](https://github.com/storybookjs/storybook/commits/v10.3.3/code/addons/a11y)

Updates `@storybook/react` from 8.6.18 to 10.3.3
- [Release notes](https://github.com/storybookjs/storybook/releases)
- [Changelog](https://github.com/storybookjs/storybook/blob/next/CHANGELOG.md)
- [Commits](https://github.com/storybookjs/storybook/commits/v10.3.3/code/renderers/react)

Updates `@storybook/react-vite` from 8.6.18 to 10.3.3
- [Release notes](https://github.com/storybookjs/storybook/releases)
- [Changelog](https://github.com/storybookjs/storybook/blob/next/CHANGELOG.md)
- [Commits](https://github.com/storybookjs/storybook/commits/v10.3.3/code/frameworks/react-vite)

Updates `storybook` from 8.6.18 to 10.3.3
- [Release notes](https://github.com/storybookjs/storybook/releases)
- [Changelog](https://github.com/storybookjs/storybook/blob/next/CHANGELOG.md)
- [Commits](https://github.com/storybookjs/storybook/commits/v10.3.3/code/core)

Updates `typescript` from 5.9.3 to 6.0.2
- [Release notes](https://github.com/microsoft/TypeScript/releases)
- [Commits](microsoft/TypeScript@v5.9.3...v6.0.2)

---
updated-dependencies:
- dependency-name: "@storybook/addon-a11y"
  dependency-version: 10.3.3
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: major
- dependency-name: "@storybook/react"
  dependency-version: 10.3.3
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: major
- dependency-name: "@storybook/react-vite"
  dependency-version: 10.3.3
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: major
- dependency-name: storybook
  dependency-version: 10.3.3
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: major
- dependency-name: typescript
  dependency-version: 6.0.2
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot force-pushed the dependabot/npm_and_yarn/web/major-ca902fdc5e branch from 0780a8f to 624e003 Compare March 26, 2026 13:34
Aureliolo added a commit that referenced this pull request Mar 26, 2026
Migrate web dashboard to Storybook 10.3.3 (from 8.6.18) and TypeScript
6.0 (from 5.9). Adopts native Storybook 10 APIs and fixes TS 6
deprecations while the codebase is still small (11 stories, skeleton
stage).

Storybook 10 migration:
- Remove dead packages: addon-essentials, addon-interactions,
  @storybook/test (absorbed into core storybook in v9, removed in v10)
- Add @storybook/addon-docs (separated from essentials in v9)
- Migrate to defineMain/definePreview (native type-safe config APIs)
- Update backgrounds API to options + initialGlobals pattern
- Enable a11y.test: 'error' globally (WCAG enforcement on all stories)

TypeScript 6 migration:
- Remove deprecated baseUrl from tsconfig.json and tsconfig.app.json
- Remove explicit esModuleInterop from tsconfig.node.json (always true)
- Merge DOM.Iterable into DOM (consolidated in TS 6)
- Upgrade target/lib to ES2025 (unlocks Set methods, Promise.try, etc.)

Documentation:
- Add post-training reference section to CLAUDE.md for TS 6 and SB 10
- Add Storybook tooling section to brand-and-ux.md design spec

Closes #825

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@Aureliolo
Copy link
Copy Markdown
Owner

Superseded by a manual migration branch (chore/storybook10-typescript6) that also migrates to Storybook 10 native APIs (defineMain/definePreview), fixes TypeScript 6 deprecations, upgrades to ES2025, and adds documentation.

@Aureliolo Aureliolo closed this Mar 26, 2026
@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot bot commented on behalf of github Mar 26, 2026

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot dependabot bot deleted the dependabot/npm_and_yarn/web/major-ca902fdc5e branch March 26, 2026 16:04
Aureliolo added a commit that referenced this pull request Mar 26, 2026
Migrate web dashboard to Storybook 10.3.3 (from 8.6.18) and TypeScript
6.0 (from 5.9). Adopts native Storybook 10 APIs and fixes TS 6
deprecations while the codebase is still small (11 stories, skeleton
stage).

Storybook 10 migration:
- Remove dead packages: addon-essentials, addon-interactions,
  @storybook/test (absorbed into core storybook in v9, removed in v10)
- Add @storybook/addon-docs (separated from essentials in v9)
- Migrate to defineMain/definePreview (native type-safe config APIs)
- Update backgrounds API to options + initialGlobals pattern
- Enable a11y.test: 'error' globally (WCAG enforcement on all stories)

TypeScript 6 migration:
- Remove deprecated baseUrl from tsconfig.json and tsconfig.app.json
- Remove explicit esModuleInterop from tsconfig.node.json (always true)
- Merge DOM.Iterable into DOM (consolidated in TS 6)
- Upgrade target/lib to ES2025 (unlocks Set methods, Promise.try, etc.)

Documentation:
- Add post-training reference section to CLAUDE.md for TS 6 and SB 10
- Add Storybook tooling section to brand-and-ux.md design spec

Closes #825

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Aureliolo added a commit that referenced this pull request Mar 26, 2026
## Summary

- Upgrade Storybook 8.6.18 to 10.3.3 -- adopt native
`defineMain`/`definePreview` APIs, remove dead packages
(addon-essentials, addon-interactions, @storybook/test), add addon-docs,
migrate backgrounds API, enable global a11y enforcement (`a11y.test:
'error'`)
- Upgrade TypeScript 5.9 to 6.0 -- remove deprecated `baseUrl`, remove
explicit `esModuleInterop`, merge `DOM.Iterable` into `DOM`, upgrade
target/lib to ES2025
- Add post-training reference section to CLAUDE.md documenting TS 6 and
Storybook 10 conventions (both released after Claude's training cutoff)
- Add Storybook 10 tooling section to `docs/design/brand-and-ux.md`

Supersedes #825 (Dependabot partial bump that caused version mismatch CI
failures).

## Test plan

- [x] `npm --prefix web run type-check` -- clean (no baseUrl deprecation
errors)
- [x] `npm --prefix web run build` -- Vite production build succeeds
- [x] `npm --prefix web run storybook:build` -- Storybook build succeeds
(no version mismatch)
- [x] `npm --prefix web run lint` -- ESLint clean
- [x] `npm --prefix web run test` -- 330/330 tests pass
- [ ] CI: Dashboard Type Check, Dashboard Build, Dashboard Storybook
Build, Build Web should all pass
- [ ] CI: Build Sandbox may still fail (pre-existing Grype CVE,
unrelated)

Closes #825

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file scope:web Vue 3 dashboard type:chore Maintenance, cleanup, dependency updates

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant