[cooper (czxtm)]

Summary

Replaces #696 and #697. Dependabot opened one PR per package and changed only package.json. bun.lock and bun.nix still pinned 10.4.2, so bun install --frozen-lockfile rejected both. @storybook/addon-vitest 10.6.2 also peer-requires storybook ^10.6.2, so neither could land on its own.

 apps/native/package.json            (devDependencies)
-  "@storybook/addon-a11y": "10.4.2"         +  "@storybook/addon-a11y": "10.6.2"
-  "@storybook/addon-docs": "10.4.2"         +  "@storybook/addon-docs": "10.6.2"
-  "@storybook/addon-onboarding": "10.4.2"   +  "@storybook/addon-onboarding": "10.6.2"
-  "@storybook/addon-vitest": "10.4.2"       +  "@storybook/addon-vitest": "10.6.2"
-  "@storybook/react-vite": "10.4.2"         +  "@storybook/react-vite": "10.6.2"
-  "storybook": "10.4.2"                     +  "storybook": "10.6.2"
 bun.lock   regenerated with bun 1.3.14 (the packageManager version)
 bun.nix    regenerated with bun2nix 2.0.8

This resolves the two open high-severity Dependabot alerts for GHSA-px85-f4q5-jh77 on storybook and @storybook/addon-vitest, which 10.6.2 patches (its release notes also list GHSA-f2ph-cmg5-wxc8).

#no-linear

Test Plan

• bun install --frozen-lockfile passes with bun 1.3.14, and bun.nix matches a fresh bun2nix run on the new bun.lock
• vitest run --project=unit in apps/native: 59 files, 398 tests pass (Node 22, as in CI)
• storybook build succeeds on 10.6.2
• Storybook Snapshot Tests in CI. If 10.6 changes rendering, accept the new baselines from the Storybook preview comment.

Docs

• No docs update needed

Merge Danger

Door: two-way. Dev-only dependency bump; a revert restores 10.4.2.

Blast Radius: Storybook. It affects the Storybook dev server, the storybook vitest project and snapshot baselines; nothing here ships in the app bundle.

build will fail at notarization until the Apple Developer agreement is renewed, as on every PR right now.

🤖 Generated with Claude Code

---

Summary by cubic

Bumps all Storybook dev dependencies in apps/native from 10.4.2 to 10.6.2, regenerating bun.lock and bun.nix so bun install --frozen-lockfile checks out. The two earlier Dependabot PRs (#696, #697) each changed only package.json, leaving the lockfiles pinned to 10.4.2; @storybook/addon-vitest 10.6.2 also peer-requires storybook ^10.6.2, so the packages have to move together.

Resolves the two open high-severity Dependabot alerts for GHSA-px85-f4q5-jh77. The branch was merged with main, so the lockfiles now resolve the Storybook 10.6.2 packages alongside the vitest 3.2.6 tree. This affects only Storybook tooling and snapshot baselines; nothing ships in the app bundle.

^{Written for commit f8a0f5e. Summary will update on new commits.}

[cubic-dev-ai]

No issues found across 3 files

_{View guided diff | Turn on auto-fix | Re-trigger cubic}

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The grouped Storybook upgrade appears safe to merge.

Summary

Upgrades the six direct Storybook packages from 10.4.2 to 10.6.2 together.

• The native app’s Storybook tools move to version 10.6.2.

Known condition: czxtm explicitly allows snapshot baselines to change if Storybook 10.6 changes rendering, with baseline review left to CI.

_{Reviews (1) · Last reviewed commit: "build(deps): bump Storybook to 10.6.2 as..." · Reviewed by Greptile}

[github-actions]

📋 PR Overview

Lines changed	282 (+228 / -54)
Files	0 added, 3 modified, 0 deleted
Draft / WIP	no
Has Test Plan	yes
Linear issue	no
No Test Plan Needed	no
New UI components	no
New Storybook stories	no
New Rust modules	no
New TS source files	no
New tests	no
package.json touched	yes
Cargo.toml touched	no
Infra / CI touched	no

🔬 Coverage

Report	Lines	Statements	Functions	Branches
apps/native/coverage/coverage-summary.json	35.0%	34.4%	29.8%	29.6%

Generated by 🚫 dangerJS against f8a0f5e

[darkmatter]

🎨 Storybook preview

Open Storybook preview

Updated for f8a0f5e

---

⚠️ Detected UI changes (5)

These stories' HTML snapshots changed. I've added screenshots + links to the changed stories below. Review them carefully then accept the changes to regenerate baselines and include them in this PR:

Flows/Evolve › Playground

Flows/Evolve › 1. Begin (idle)

Flows/Evolve › 2. Evolving (progress)

Flows/Evolve › Evolving With Error Event

Flows/Evolve › 3. Review (changes generated)

---

Accept UI changes

• Click here to accept these changes

Alternatively, you can run bun run test:update-snapshots locally to re-generate the baselines and then push the changes to this PR.

What does this do?

The screenshots above show UI changes detected by the Storybook
snapshot tests run on this PR. Each image is the rendered output of
a Storybook story from the code in this PR branch; the snapshot
test compared it against the committed baseline in
__snapshots__/ and flagged the difference.

Checking the box tells the darkmatter[bot] to regenerate the
baselines from this PR's current code and commit them directly to
this branch. The new baselines become the source of truth for
future runs — only accept after confirming the visual changes are
intentional.

Comparison baseline: the committed __snapshots__/ files on this
PR branch (carried forward from develop). Accept updates them in
place on this branch.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud