build(deps): bump tar and storybook#272
Conversation
Removes [tar](https://github.com/isaacs/node-tar). It's no longer used after updating ancestor dependency [storybook](https://github.com/storybookjs/storybook/tree/HEAD/code/core). These dependencies need to be updated together. Removes `tar` Updates `storybook` from 7.6.24 to 10.4.0 - [Release notes](https://github.com/storybookjs/storybook/releases) - [Changelog](https://github.com/storybookjs/storybook/blob/next/CHANGELOG.md) - [Commits](https://github.com/storybookjs/storybook/commits/v10.4.0/code/core) --- updated-dependencies: - dependency-name: tar dependency-version: dependency-type: indirect - dependency-name: storybook dependency-version: 10.4.0 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
doistbot
left a comment
doistbot
left a comment
There was a problem hiding this comment.
Thank you for this PR updating the storybook dependency and removing tar. Keeping our tooling current is always appreciated for long-term maintainability. However, the update currently leaves other @storybook/* packages pinned to version 7.x which can cause major version conflicts, and the CI pipeline does not yet include a build step to verify that the upgraded Storybook setup functions correctly.
| "react-is": "17.0.2", | ||
| "react-test-renderer": "17.0.2", | ||
| "storybook": "7.6.24" | ||
| "storybook": "10.4.0" |
There was a problem hiding this comment.
[P1] This updates only the storybook CLI to 10.4.0 while the actual Storybook framework/addons in this package are still pinned to 7.6.24 (@storybook/react, @storybook/react-webpack5, @storybook/addon-*). Mixing major Storybook versions is unsupported and can break npm run storybook / build-storybook. Upgrade the rest of the @storybook/* packages in the same change, or keep storybook on the 7.x line.
| "react-is": "17.0.2", | ||
| "react-test-renderer": "17.0.2", | ||
| "storybook": "7.6.24" | ||
| "storybook": "10.4.0" |
There was a problem hiding this comment.
[P2] This major Storybook upgrade is not exercised by the package’s current CI path: react-ci only runs integrity-check, and that script does not include build-storybook or any Storybook smoke test. Add build-storybook (or an equivalent Storybook startup/build check) to CI so the highest-risk path introduced by this dependency bump is actually covered.
1 participant
Removes tar. It's no longer used after updating ancestor dependency storybook. These dependencies need to be updated together.
Removes
tarUpdates
storybookfrom 7.6.24 to 10.4.0Release notes
Sourced from storybook's releases.
... (truncated)
Changelog
Sourced from storybook's changelog.
... (truncated)
Commits
f8c16d1Bump version from "10.4.0-beta.0" to "10.4.0" [skip ci]e02da0bBump version from "10.4.0-alpha.19" to "10.4.0-beta.0" [skip ci]6fe5959Merge branch 'next' into next-releasef9810c7Merge pull request #34769 from storybookjs/jeppe/handle-minimum-release-agedb9d52bformatbdc688ffix documentation stringeed7d2asimplify error handling429fb3eBump version from "10.4.0-alpha.18" to "10.4.0-alpha.19" [skip ci]79a8667format3ebdd02undo the "run" prefix on ghost stories and self healing payloadDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.