chore: update dependencies 2026-08-25

[claude]

Summary

• @rsbuild/core: 2.1.5 → 2.1.13 (peerDependencies, devDependencies)
• @rspack/core: 2.1.3 → 2.1.10 (peerDependencies, dependencies, devDependencies)
• @swc/core: 1.15.43 → 1.16.1 (peerDependencies, devDependencies)
• @tanstack/react-query: 5.101.2 → 5.102.2 (peerDependencies, dependencies, devDependencies)
• browserslist: 4.28.5 → 4.28.8 (peerDependencies, devDependencies)
• i18next: 26.3.6 → 26.4.0 (peerDependencies, dependencies, devDependencies)
• launchdarkly-js-client-sdk: 3.9.3 → 3.9.5 (peerDependencies, dependencies, devDependencies)
• react: 19.2.7 → 19.2.8 (peerDependencies, dependencies, devDependencies)
• react-dom: 19.2.7 → 19.2.8 (peerDependencies, dependencies, devDependencies)
• react-error-boundary: 6.1.2 → 6.1.3 (peerDependencies, dependencies)
• react-i18next: 17.0.9 → 17.0.12 (peerDependencies, dependencies, devDependencies)
• react-router: 8.2.0 → 8.3.0 (peerDependencies, dependencies, devDependencies)
• storybook: 10.4.6 → 10.5.10 (peerDependencies, dependencies, devDependencies)
• webpack: 5.108.4 → 5.109.2 (peerDependencies, devDependencies)
• webpack-dev-server: 5.2.4 → 6.0.0 (peerDependencies, devDependencies) (range narrowed — may break consumers)
• @formatjs/intl-localematcher: 0.8.11 → 0.8.13 (dependencies)
• @module-federation/enhanced: 2.7.0 → 2.9.0 (dependencies)
• @module-federation/rsbuild-plugin: 2.7.0 → 2.9.0 (dependencies)
• @opentelemetry/auto-instrumentations-node: 0.78.0 → 0.79.0 (dependencies)
• @opentelemetry/exporter-trace-otlp-http: 0.220.0 → 0.221.0 (dependencies)
• @opentelemetry/instrumentation-express: 0.68.0 → 0.69.0 (dependencies)
• @opentelemetry/instrumentation-http: 0.220.0 → 0.221.0 (dependencies)
• @opentelemetry/sdk-node: 0.220.0 → 0.221.0 (dependencies)
• @storybook/addon-a11y: 10.4.6 → 10.5.10 (dependencies)
• @types/react: 19.2.17 → 19.2.18 (dependencies, devDependencies)
• @types/react-dom: 19.2.3 → 19.2.5 (dependencies, devDependencies)
• @workleap-telemetry/core: 2.0.2 → 2.0.3 (dependencies)
• html-webpack-plugin: 5.6.7 → 5.6.8 (dependencies)
• msw-storybook-addon: 2.0.7 → 3.0.0 (dependencies)
• storybook-react-rsbuild: 3.3.4 → 3.4.2 (dependencies, devDependencies)
• uuid: 14.0.1 → 14.0.2 (dependencies)
• @changesets/changelog-github: 0.7.0 → 1.0.0 (devDependencies)
• @changesets/cli: 2.31.0 → 3.0.1 (devDependencies)
• @tanstack/react-query-devtools: 5.101.2 → 5.102.2 (devDependencies)
• @types/node: 26.1.1 → 26.2.0 (devDependencies)
• @types/semver: 7.7.1 → 7.8.0 (devDependencies)
• @typescript-eslint/parser: 8.63.0 → 8.67.0 (devDependencies)
• @vitejs/plugin-react: 6.0.3 → 6.1.0 (devDependencies)
• agent-browser: 0.31.1 → 0.34.0 (devDependencies)
• happy-dom: 20.10.6 → 20.11.6 (devDependencies)
• netlify-cli: 26.2.0 → 27.1.2 (devDependencies)
• pkg-pr-new: 0.0.75 → 0.0.88 (devDependencies)
• stylelint: 17.14.0 → 17.14.1 (devDependencies)
• syncpack: 15.3.2 → 15.3.3 (devDependencies)
• tsx: 4.23.0 → 4.23.12 (devDependencies)
• turbo: 2.10.4 → 2.10.11 (devDependencies)
• vitest: 4.1.10 → 4.1.11 (devDependencies)
• webpack-cli: 7.2.1 → 7.2.2 (devDependencies)

Breaking changes migrated

msw-storybook-addon 2.0.7 → 3.0.0 removed the initialize and mswLoader named exports from the package root. The official codemod (msw-storybook-migrate) was run on the storybook sample:

• .storybook/preview.tsx now imports mswLoader from msw-storybook-addon/csf3 (the supported entry point for CSF 3 projects) and calls it with a setup function that replaces the old initialize({ onUnhandledRequest: "bypass" }) call.
• The four story files that declared parameters.msw.handlers now register handlers through beforeEach({ msw }).
• .storybook/main.ts registers msw-storybook-addon with a plain specifier instead of the local getAbsolutePath helper, because v3 no longer exposes ./package.json in its exports field and require.resolve therefore fails.

Not updated

typescript 6.0.3 → 7.0.2 was reverted: @typescript-eslint/typescript-estree@8.54.0 crashes on load under TypeScript 7, which breaks every eslint invocation, and typescript-eslint is intentionally pinned by this repo's update exclusion list. Tracked in #674.

Validation checklist

• Step 2a: Linting
• Step 2b: Tests
• Step 2c: Endpoints sample app
• Step 2d: Storybook sample app

[pkg-pr-new]

Open in StackBlitz

@squide/core

pnpm add https://pkg.pr.new/@squide/core@675

@squide/env-vars

pnpm add https://pkg.pr.new/@squide/env-vars@675

@squide/fakes

pnpm add https://pkg.pr.new/@squide/fakes@675

@squide/firefly

pnpm add https://pkg.pr.new/@squide/firefly@675

@squide/firefly-module-federation

pnpm add https://pkg.pr.new/@squide/firefly-module-federation@675

@squide/firefly-rsbuild-configs

pnpm add https://pkg.pr.new/@squide/firefly-rsbuild-configs@675

@squide/firefly-storybook

pnpm add https://pkg.pr.new/@squide/firefly-storybook@675

@squide/firefly-webpack-configs

pnpm add https://pkg.pr.new/@squide/firefly-webpack-configs@675

@squide/i18next

pnpm add https://pkg.pr.new/@squide/i18next@675

@squide/launch-darkly

pnpm add https://pkg.pr.new/@squide/launch-darkly@675

@squide/msw

pnpm add https://pkg.pr.new/@squide/msw@675

@squide/react-router

pnpm add https://pkg.pr.new/@squide/react-router@675

commit: f363373

[claude]

High — dependency compatibility (/pnpm, /workleap-web-configs)

Narrowing this peer to ^6.0.0 puts it in direct conflict with this package's own runtime dependency. @workleap/webpack-configs@1.6.15 (line 47) declares:

# pnpm-lock.yaml:7246-7257
'@workleap/webpack-configs@1.6.15':
  peerDependencies:
    webpack-dev-server: ^5.2.4   # <-- not ^6

and its transitive @pmmmwh/react-refresh-webpack-plugin@0.6.2 declares webpack-dev-server: ^4.8.0 || 5.x (pnpm-lock.yaml:5933). Both are optional: true, so pnpm silently resolved them against webpack-dev-server@6.0.0 instead of failing — the lockfile now pins @workleap/webpack-configs@1.6.15(...)(webpack-dev-server@6.0.0(...)) (pnpm-lock.yaml:18257, 18275).

Failure scenario: every consumer of @squide/firefly-webpack-configs is now forced onto webpack-dev-server 6 while the package that actually produces the devServer object — defineDevConfig from @workleap/webpack-configs — is written for v5. webpack-dev-server validates its options schema strictly and throws on unknown/renamed keys, so a v5-shaped devServer object can fail at webpack serve startup, and the react-refresh HMR overlay integration is outside its supported dev-server range.

This is not covered by the PR's validation checklist. Steps 2c/2d only exercise samples/endpoints and samples/storybook, both of which use rsbuild (samples/endpoints/host/package.json:11 → rsbuild dev; and pnpm serve-endpoints is turbo run serve-build, a static http-server). The only webpack serve consumer in the repo is samples/basic-webpack (samples/basic-webpack/host/package.json:10), which is never started in a browser. packages/firefly-webpack-configs/tests/defineConfig.test.ts only asserts on the config object shape, so it cannot catch this either.

Fix — keep the range additive so no consumer is broken and the bump stays non-breaking:

Suggested change

	"webpack-dev-server": "^6.0.0"
	"webpack-dev-server": "^5.2.4 || ^6.0.0"

Then downgrade the @squide/firefly-webpack-configs bump in .changeset/update-deps-20260825-144153.md from major to minor and drop the "must upgrade" note. Alternatively, hold webpack-dev-server at 5.x until @workleap/webpack-configs ships a release that declares v6 support.

If you do intend to require v6 only, the changeset should also state that webpack-dev-server@6.0.0 sets engines: {node: '>= 22.15.0'} (pnpm-lock.yaml:12723) — that raises the Node floor for consumers, which the current changeset text doesn't mention.

[claude]

Medium — stale public documentation

The msw-storybook-addon v3 migration was applied to the sample but not to the published docs, which still teach the v2 API that this PR's own description says was removed from the package root.

docs/integrations/setup-storybook.md tells consumers to install the addon unpinned (line 15: pnpm add msw msw-storybook-addon → resolves to 3.0.0) and then use the removed root exports:

• docs/integrations/setup-storybook.md:23 — import { initialize as initializeMsw, mswLoader } from "msw-storybook-addon";
• docs/integrations/setup-storybook.md:27 — initializeMsw({ onUnhandledRequest: "bypass" })
• docs/integrations/setup-storybook.md:41 — loaders: [mswLoader] (passing the loader directly rather than calling it with a setup function)
• docs/integrations/setup-storybook.md:198-199 — parameters: { msw: { handlers: [...] } }, the pattern the codemod replaced with beforeEach({ msw })

The same parameters.msw.handlers pattern is still documented in:

• docs/reference/storybook/withFireflyDecorator.md:46-47
• docs/reference/storybook/FireflyDecorator.md:48-49
• docs/reference/storybook/withFeatureFlagsOverrideDecorator.md:46-47
• agent-skills/workleap-squide/references/integrations.md:549-550
• agent-skills/workleap-squide/references/components.md:237-238, 260-261

Failure scenario: a consumer following docs/integrations/setup-storybook.md installs msw-storybook-addon@3.0.0 and copies the documented preview.tsx. The import of initialize/mswLoader from the package root fails to resolve, so Storybook never boots. Even if they get past that, stories written with parameters.msw.handlers register no handlers under v3, so every request falls through and the stories render error/loading states instead of mocked data.

Fix: update those docs to mirror the migrated sample — mswLoader from msw-storybook-addon/csf3 called with the setupWorker factory (this file, lines 16-24), "msw-storybook-addon" registered in .storybook/main.ts addons (samples/storybook/.storybook/main.ts:12, including the getAbsolutePath caveat), and beforeEach({ msw }) { msw.use(...) } in place of parameters.msw.handlers (see samples/storybook/host/src/HomePage.stories.tsx).

Also worth cleaning up while you're here: samples/storybook/parameters.d.ts:3,8 still augments Parameters with msw?: MswParameters["msw"], but no story in the sample reads parameters.msw anymore.

[claude]

Superseded by a newer dependency update run.