package.json

@@ -64,9 +64,9 @@
     "@rolldown/plugin-babel": "^0.2.3",
     "@sentry/react": "^8.0.0",
     "@sentry/vite-plugin": "^3.0.0",
-    "@storybook/addon-docs": "^10.3.6",
-    "@storybook/addon-vitest": "^10.3.6",
-    "@storybook/react-vite": "^10.3.6",
+    "@storybook/addon-docs": "^10.6.3",
+    "@storybook/addon-vitest": "^10.6.3",
+    "@storybook/react-vite": "^10.6.3",
     "@testing-library/dom": "^10.1.0",
     "@testing-library/jest-dom": "^6.6.3",
     "@testing-library/react": "^16.0.0",
@@ -86,9 +86,9 @@
     "@vector-im/compound-design-tokens": "^11.0.0",
     "@vector-im/compound-web": "^10.0.0",
     "@vitejs/plugin-react": "^6.0.2",
-    "@vitest/browser-playwright": "^4.1.5",
+    "@vitest/browser-playwright": "^4.1.12",
     "@vitest/coverage-v8": "^4.0.18",
-    "@vitest/ui": "4.1.11",
+    "@vitest/ui": "^4.1.12",
     "babel-plugin-react-compiler": "^1.0.0",
     "classnames": "^2.3.1",
     "copy-to-clipboard": "^3.3.3",
@@ -123,18 +123,18 @@
     "react-use-measure": "^2.1.1",
     "rxjs": "^7.8.1",
     "sass": "^1.42.1",
-    "storybook": "^10.3.6",
+    "storybook": "^10.6.3",
     "typescript": "^5.8.3",
     "unique-names-generator": "^4.6.0",
     "uuid": "^14.0.0",
     "vaul": "^1.0.0",
-    "vite": "^8.0.0",
+    "vite": "^8.3.5",
     "vite-plugin-html": "^3.2.2",
     "vite-plugin-node-polyfills": "^0.28.0",
     "vite-plugin-node-stdlib-browser": "^0.2.1",
     "vite-plugin-svgr": "^4.0.0",
     "vite-plugin-wasm": "^3.6.0",
-    "vitest": "^4.1.5",
+    "vitest": "^4.1.12",
     "vitest-axe": "^1.0.0-pre.3"
   },
   "packageManager": "pnpm@11.21.0+sha512.521705bce689924eac72f5a3587122f362689ef6571e55ba80076fd637c11132ecffada26fad4ea79c485bfddbfd3d5a2a5b05805a77e893de71ec8a6cca3bb1"

pnpm-workspace.yaml

@@ -28,24 +28,38 @@ overrides:
   # - https://github.com/advisories/GHSA-7r86-cg39-jmmj
   # - https://github.com/advisories/GHSA-23c5-xmqv-rm74
   "minimatch": "^10.2.3"
+  # Security fixes for transitive build/test tooling (none of these ship in the
+  # embedded call bundle; checked against the npm advisory database 2026-10-25).
+  "tinypool": "^2.1.2"
+  "@vitest/mocker": "^4.1.12"
+  "brace-expansion@>=4": "^5.0.12"
+  "browserslist": "^4.28.7"
+  "smol-toml": "^1.8.1"
+  "source-map-js": "^1.2.2"
+  "postcss-selector-parser@>=7": "^7.1.6"
+  "baseline-browser-mapping": "^2.11.0"
+  "fflate@<0.5": "^0.4.9"
+  "fflate@>=0.8": "^0.8.3"
+  "pbkdf2": "^3.1.7"
+  "zod@>=4": "^4.6.6"
   # Security fix: https://github.com/element-hq/element-call/security/dependabot/109
   "glob": "^10.5.0"
   # Security fixes:
   # - https://github.com/element-hq/element-call/security/dependabot/110
   # - https://github.com/element-hq/element-call/security/dependabot/122
   # - https://github.com/element-hq/element-call/security/dependabot/179
-  "qs": "^6.15.2"
+  "qs": "^6.16.0"
   # Security fixes:
   # - https://github.com/element-hq/element-call/security/dependabot/106
   # - https://github.com/element-hq/element-call/security/dependabot/203
-  "js-yaml": "^4.2.0"
+  "js-yaml": "^4.3.2"
   # Storybook declares support for 0.27.0 only but empirically works fine with 0.28.0.
   "esbuild": "^0.28.0"
   # Security fixes:
   # - https://github.com/nodejs/undici/releases/tag/v6.24.0
   # - https://github.com/element-hq/element-call/security/dependabot/201
   # - https://github.com/element-hq/element-call/security/dependabot/199
-  "undici": "^6.27.0"
+  "undici": "^6.29.1"
   # Security fix: https://github.com/advisories/GHSA-rf6f-7fwh-wjgh
   "flatted": "^3.4.2"
   # Security fix: https://github.com/element-hq/element-call/security/dependabot/184
@@ -59,4 +73,4 @@ overrides:
   # - https://github.com/element-hq/element-call/security/dependabot/196
   # - https://github.com/element-hq/element-call/security/dependabot/195
   # - https://github.com/element-hq/element-call/security/dependabot/193
-  "dompurify": "^3.4.11"
+  "dompurify": "^3.4.17"