build(deps): bump Storybook to 10.6.2 as one group

CZ
1d ago
+228-54

Summary

Replaces #696 and #697. Dependabot opened one PR per package and changed only package.json. bun.lock and bun.nix still pinned 10.4.2, so bun install --frozen-lockfile rejected both. @storybook/addon-vitest 10.6.2 also peer-requires storybook ^10.6.2, so neither could land on its own.

 apps/native/package.json            (devDependencies)
-  "@storybook/addon-a11y": "10.4.2"         +  "@storybook/addon-a11y": "10.6.2"
-  "@storybook/addon-docs": "10.4.2"         +  "@storybook/addon-docs": "10.6.2"
-  "@storybook/addon-onboarding": "10.4.2"   +  "@storybook/addon-onboarding": "10.6.2"
-  "@storybook/addon-vitest": "10.4.2"       +  "@storybook/addon-vitest": "10.6.2"
-  "@storybook/react-vite": "10.4.2"         +  "@storybook/react-vite": "10.6.2"
-  "storybook": "10.4.2"                     +  "storybook": "10.6.2"
 bun.lock   regenerated with bun 1.3.14 (the packageManager version)
 bun.nix    regenerated with bun2nix 2.0.8

This resolves the two open high-severity Dependabot alerts for GHSA-px85-f4q5-jh77 on storybook and @storybook/addon-vitest, which 10.6.2 patches (its release notes also list GHSA-f2ph-cmg5-wxc8).

#no-linear

Test Plan

  • bun install --frozen-lockfile passes with bun 1.3.14, and bun.nix matches a fresh bun2nix run on the new bun.lock
  • vitest run --project=unit in apps/native: 59 files, 398 tests pass (Node 22, as in CI)
  • storybook build succeeds on 10.6.2
  • Storybook Snapshot Tests in CI. If 10.6 changes rendering, accept the new baselines from the Storybook preview comment.

Docs

  • No docs update needed

Merge Danger

Door: two-way. Dev-only dependency bump; a revert restores 10.4.2.

Blast Radius: Storybook. It affects the Storybook dev server, the storybook vitest project and snapshot baselines; nothing here ships in the app bundle.

build will fail at notarization until the Apple Developer agreement is renewed, as on every PR right now.

🤖 Generated with Claude Code

Summary by cubic

Bumps all Storybook dev dependencies in apps/native from 10.4.2 to 10.6.2, regenerating bun.lock and bun.nix so bun install --frozen-lockfile checks out. The two earlier Dependabot PRs (#696, #697) each changed only package.json, leaving the lockfiles pinned to 10.4.2; @storybook/addon-vitest 10.6.2 also peer-requires storybook ^10.6.2, so the packages have to move together.

Resolves the two open high-severity Dependabot alerts for GHSA-px85-f4q5-jh77. The branch was merged with main, so the lockfiles now resolve the Storybook 10.6.2 packages alongside the vitest 3.2.6 tree. This affects only Storybook tooling and snapshot baselines; nothing ships in the app bundle.