fix(deps): update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@storybook/addon-onboarding (source)	^10.1.2 -> ^10.1.4
@storybook/react-vite (source)	^10.1.2 -> ^10.1.4
@types/chrome (source)	^0.1.31 -> ^0.1.32
@types/express (source)	^5.0.5 -> ^5.0.6
@typescript-eslint/eslint-plugin (source)	^8.48.0 -> ^8.48.1
@typescript-eslint/parser (source)	^8.48.0 -> ^8.48.1
esbuild	^0.27.0 -> ^0.27.1
express (source)	^5.1.0 -> ^5.2.1
prettier (source)	3.7.3 -> 3.7.4
react (source)	^19.2.0 -> ^19.2.1
react-dom (source)	^19.2.0 -> ^19.2.1
react-is (source)	^19.2.0 -> ^19.2.1
react-router-dom (source)	^7.9.6 -> ^7.10.0
storybook (source)	^10.1.2 -> ^10.1.4
ts-jest (source)	^29.4.5 -> ^29.4.6
typescript-eslint (source)	^8.48.0 -> ^8.48.1

---

Release Notes

storybookjs/storybook (@​storybook/addon-onboarding)

v10.1.4

Compare Source

10.1.4

• Core: Enhance getPrettier function to provide prettier interface - #​33260, thanks @​valentinpalkovic!
• NextJS: Alias image to use fileURLToPath for better resolution - #​33256, thanks @​ndelangen!
• Telemetry: Cache Storybook metadata by main config content hash - #​33247, thanks @​valentinpalkovic!

v10.1.3

Compare Source

10.1.3

• Angular: Honor --loglevel and --logfile in dev/build - #​33212, thanks @​valentinpalkovic!
• Core: Minor UI fixes - #​33218, thanks @​ghengeveld!
• Telemetry: Add playwright-prompt - #​33229, thanks @​valentinpalkovic!

storybookjs/storybook (@​storybook/react-vite)

v10.1.4

Compare Source

• Core: Enhance getPrettier function to provide prettier interface - #​33260, thanks @​valentinpalkovic!
• NextJS: Alias image to use fileURLToPath for better resolution - #​33256, thanks @​ndelangen!
• Telemetry: Cache Storybook metadata by main config content hash - #​33247, thanks @​valentinpalkovic!

v10.1.3

Compare Source

• Angular: Honor --loglevel and --logfile in dev/build - #​33212, thanks @​valentinpalkovic!
• Core: Minor UI fixes - #​33218, thanks @​ghengeveld!
• Telemetry: Add playwright-prompt - #​33229, thanks @​valentinpalkovic!

typescript-eslint/typescript-eslint (@​typescript-eslint/eslint-plugin)

v8.48.1

Compare Source

🩹 Fixes

• eslint-plugin: [restrict-template-expressions] check base types in allow list (#​11764, #​11759)
• eslint-plugin: honor ignored base types on generic classes (#​11767)
• eslint-plugin: [consistent-type-exports] check value flag before resolving alias (#​11769)

❤️ Thank You

• Josh Goldberg
• OleksandraKordonets
• SangheeSon @​Higangssh
• tao

You can read about our versioning strategy and releases on our website.

typescript-eslint/typescript-eslint (@​typescript-eslint/parser)

v8.48.1

Compare Source

This was a version bump only for parser to align it with other projects, there were no code changes.

You can read about our versioning strategy and releases on our website.

evanw/esbuild (esbuild)

v0.27.1

Compare Source

• Fix bundler bug with var nested inside if (#​4348)

  This release fixes a bug with the bundler that happens when importing an ES module using require (which causes it to be wrapped) and there's a top-level var inside an if statement without being wrapped in a { ... } block (and a few other conditions). The bundling transform needed to hoist these var declarations outside of the lazy ES module wrapper for correctness. See the issue for details.

• Fix minifier bug with for inside try inside label (#​4351)

  This fixes an old regression from version v0.21.4. Some code was introduced to move the label inside the try statement to address a problem with transforming labeled for await loops to avoid the await (the transformation involves converting the for await loop into a for loop and wrapping it in a try statement). However, it introduces problems for cross-compiled JVM code that uses all three of these features heavily. This release restricts this transform to only apply to for loops that esbuild itself generates internally as part of the for await transform. Here is an example of some affected code:

  // Original code
  d: {
    e: {
      try {
        while (1) { break d }
      } catch { break e; }
    }
  }
  
  // Old output (with --minify)
  a:try{e:for(;;)break a}catch{break e}
  
  // New output (with --minify)
  a:e:try{for(;;)break a}catch{break e}

• Inline IIFEs containing a single expression (#​4354)

  Previously inlining of IIFEs (immediately-invoked function expressions) only worked if the body contained a single return statement. Now it should also work if the body contains a single expression statement instead:

  // Original code
  const foo = () => {
    const cb = () => {
      console.log(x())
    }
    return cb()
  }
  
  // Old output (with --minify)
  const foo=()=>(()=>{console.log(x())})();
  
  // New output (with --minify)
  const foo=()=>{console.log(x())};

• The minifier now strips empty finally clauses (#​4353)

  This improvement means that finally clauses containing dead code can potentially cause the associated try statement to be removed from the output entirely in minified builds:

  // Original code
  function foo(callback) {
    if (DEBUG) stack.push(callback.name);
    try {
      callback();
    } finally {
      if (DEBUG) stack.pop();
    }
  }
  
  // Old output (with --minify --define:DEBUG=false)
  function foo(a){try{a()}finally{}}
  
  // New output (with --minify --define:DEBUG=false)
  function foo(a){a()}

• Allow tree-shaking of the Symbol constructor

  With this release, calling Symbol is now considered to be side-effect free when the argument is known to be a primitive value. This means esbuild can now tree-shake module-level symbol variables:

  // Original code
  const a = Symbol('foo')
  const b = Symbol(bar)
  
  // Old output (with --tree-shaking=true)
  const a = Symbol("foo");
  const b = Symbol(bar);
  
  // New output (with --tree-shaking=true)
  const b = Symbol(bar);

expressjs/express (express)

v5.2.1

Compare Source

=======================

• Revert security fix for CVE-2024-51999 (GHSA-pj86-cfqh-vqx6)

v5.2.0

Compare Source

========================

• Security fix for CVE-2024-51999 (GHSA-pj86-cfqh-vqx6)
• deps: body-parser@^2.2.1
• A deprecation warning was added when using res.redirect with undefined arguments, Express now emits a warning to help detect calls that pass undefined as the status or URL and make them easier to fix.

prettier/prettier (prettier)

v3.7.4

Compare Source

diff

LWC: Avoid quote around interpolations (#​18383 by @​kovsu)

<!-- Input -->
<div foo={bar}>   </div>

<!-- Prettier 3.7.3 (--embedded-language-formatting off) -->
<div foo="{bar}"></div>

<!-- Prettier 3.7.4 (--embedded-language-formatting off) -->
<div foo={bar}></div>

TypeScript: Fix comment inside union type gets duplicated (#​18393 by @​fisker)

// Input
type Foo = (/** comment */ a | b) | c;

// Prettier 3.7.3
type Foo = /** comment */ (/** comment */ a | b) | c;

// Prettier 3.7.4
type Foo = /** comment */ (a | b) | c;

TypeScript: Fix unstable comment print in union type comments (#​18395 by @​fisker)

// Input
type X = (A | B) & (
  // comment
  A | B
);

// Prettier 3.7.3 (first format)
type X = (A | B) &
  (// comment
  A | B);

// Prettier 3.7.3 (second format)
type X = (
  | A
  | B // comment
) &
  (A | B);

// Prettier 3.7.4
type X = (A | B) &
  // comment
  (A | B);

facebook/react (react)

v19.2.1: 19.2.1 (December 3rd, 2025)

Compare Source

React Server Components

• Bring React Server Component fixes to Server Actions (@​sebmarkbage #​35277)

facebook/react (react-is)

v19.2.1

Compare Source

remix-run/react-router (react-router-dom)

v7.10.0

Compare Source

Patch Changes

• Updated dependencies:
  • react-router@7.10.0

kulshekhar/ts-jest (ts-jest)

v29.4.6

Compare Source

Bug Fixes

• log hybrid module as warning instead of failing tests (#​5144) (528d37c), closes #​5130

typescript-eslint/typescript-eslint (typescript-eslint)

v8.48.1

Compare Source

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

You can read about our versioning strategy and releases on our website.

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 688acce

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR