[Dario Valdespino (darvld)]

fix(deps): update October 2026 security dependencies

Repository: elide-dev/components
Branch: fix/october-2026-dependency-security
Target: main
Commit: 7bfb62f

Summary

• Upgrade Bun from 1.4.2 to 1.4.4 in packageManager and all five affected CI workflows.
• Raise Storybook and addon requirements from ^10.6.1 to ^10.6.2; the existing refreshed lockfile resolves these packages to 10.6.3.
• Upgrade Vitest, browser integrations, and V8 coverage from 5.0.3 to 5.0.5 across Storybook, brand, and UI workspaces.
• Override Undici 6 to 6.29.1 and Undici 8 to 8.12.2, preserving major-version separation.
• Include the existing Bun lockfile v3 refresh and corresponding dependency placement changes.

Verification

Fresh submission verification passed: bun install --frozen-lockfile at the runtime workspace root made no dependency changes, followed by a successful bun run --cwd third_party/components build-storybook using Storybook 10.6.3. The tokens/brand/UI build tasks reused their Turbo cache; the Storybook build executed. This is build verification, not a full component test-suite claim.

Target evidence and scope

Target: main. The branch starts from 0d9493c (chore: dep updates (#11)).

Only the ten tracked dependency, lockfile, and CI files are included.

Runtime integration

Consumed by https://github.com/elide-dev/runtime/pull/2659. This branch was published first so the runtime's components gitlink is fetchable.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!