[gdevenyi]

What

Bump dev, docs and Storybook tooling that has Dependabot security alerts. No source changes.

Package	From	To	Via
storybook, @storybook/*	10.6.1	10.6.4	catalog
sharp	0.34.5	0.35.5	outreach, astro 5 (optional dep)
vite (6.x)	6.4.3	6.4.5	astro 5
svgo	4.0.1	4.1.0	astro 5
devalue	5.8.1	5.9.4	astro 5
smol-toml	1.6.1	1.9.0	@astrojs/markdown-remark
markdown-it	14.3.2	14.3.3	typedoc
postcss-selector-parser (6.x)	6.0.10, 6.1.2	6.1.5	@tailwindcss/typography, postcss-nested
browserslist / baseline-browser-mapping	4.28.2 / 2.10.33	4.29.5 / 2.11.33	babel

New overrides in root package.json:

• sharp: ^0.35.5. astro 5 lists sharp@^0.34.0 as an optional dependency and imports its own copy for the image service, so bumping outreach alone leaves a vulnerable copy in use. astro build of outreach passes with sharp 0.35.5 (images are optimized).
• @tailwindcss/typography>postcss-selector-parser: ^6.1.5. typography 0.5.20 (latest) pins 6.0.10 exactly.

Not in this PR

The astro alerts themselves (fix only in astro 7) are dismissed as tolerable risk: outreach is output: 'static' and built from repo-owned content.

Verification

• pnpm --filter @opendatacapture/outreach build: passes.
• pnpm lint and pnpm test:coverage (100%) pass.
• pnpm test:e2e: 346 passed, 2 failed. record-file-deletion.spec.ts also fails on main locally because my .env has STORAGE_ENABLED=false. It is an environment exception. subject-detail.spec.ts:53 (graph tab) timed out in the full run and 1 of 4 isolated runs (the Measures button stayed disabled). main passed 4/4 isolated. This PR changes no web runtime code, so I think it is flaky timing, but CI must confirm.
• Exception: no new unit or e2e test. Version bumps only, no code change.

Co-Authored-By: Claude Opus 5.5 noreply@anthropic.com

[Copilot]

🔵 Needs a closer look

Intermittent graph-tab e2e failures on this branch, absent in isolated main runs, require clean-environment CI validation to distinguish a dependency regression from timing flakiness.

No open issues 🎉

1 file not reviewed

• pnpm-lock.yaml: Generated file

What changed in this PR

Updates Open Data Capture’s development, documentation, and Storybook dependencies to address security advisories without changing application source code.

Changes:

• Updates Storybook packages to locked version 10.6.4.
• Upgrades Sharp to 0.35.5, including Astro’s optional dependency through a root override.
• Refreshes affected transitive tooling dependencies and overrides Tailwind Typography’s selector parser.

File	Description
pnpm-workspace.yaml	Raises shared Storybook version ranges to ^10.6.3.
pnpm-lock.yaml	Locks updated tooling versions and their dependency trees.
package.json	Adds Sharp and selector-parser overrides.
apps/​outreach/​package.json	Raises outreach’s direct Sharp dependency to ^0.35.5.

_{Review effort: Balanced}