Update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence	Type	Update
@next/bundle-analyzer (source)	16.2.2 → 16.2.4					dependencies	patch
@storybook/addon-themes (source)	10.3.4 → 10.3.5					devDependencies	patch
@storybook/nextjs (source)	10.3.4 → 10.3.5					devDependencies	patch
@storybook/react (source)	10.3.4 → 10.3.5					devDependencies	patch
@types/node (source)	25.5.2 → 25.6.0					devDependencies	minor
next (source)	16.2.2 → 16.2.4					dependencies	patch
node (source)	24.14.1 → 24.15.0						minor
oxfmt (source)	^0.43.0 → ^0.46.0					devDependencies	minor
oxlint (source)	1.58.0 → 1.61.0					devDependencies	minor
postcss (source)	8.5.8 → 8.5.10					devDependencies	patch
react (source)	19.2.4 → 19.2.5					dependencies	patch
react-dom (source)	19.2.4 → 19.2.5					dependencies	patch
storybook (source)	10.3.4 → 10.3.5					devDependencies	patch
stylelint (source)	17.6.0 → 17.9.0					devDependencies	minor
typescript (source)	6.0.2 → 6.0.3					devDependencies	patch

---

Release Notes

vercel/next.js (@​next/bundle-analyzer)

v16.2.4

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• chore: Bump reqwest to 0.13.2 (Fixes Google Fonts with Turbopack for Windows on ARM64) (#​92713)
• Turbopack: fix filesystem watcher config not applying follow_symlinks(false) (#​92631)
• Scope Safari ?ts= cache-buster to CSS/font assets only (Pages Router) (#​92580)
• Compiler: Support boolean and number primtives in next.config defines (#​92731)
• turbo-tasks: Fix recomputation loop by allowing cell cleanup on error during recomputation (#​92725)
• Turbopack: shorter error for ChunkGroupInfo::get_index_of (#​92814)
• Turbopack: shorter error message for ModuleBatchesGraph::get_entry_index (#​92828)
• Adding more system info to the 'initialize project' trace (#​92427)

Credits

Huge thanks to @​Badbird5907, @​lukesandberg, @​andrewimm, @​sokra, and @​mischnic for helping!

v16.2.3

Compare Source

[!NOTE]
This release is backporting security and bug fixes. For more information about the fixed security vulnerability, please see https://vercel.com/changelog/summary-of-cve-2026-23869. The release does not include all pending features/changes on canary.

Core Changes

• Ensure app-page reports stale ISR revalidation errors via onRequestError (#​92282)
• Fix [Bug]: manifest.ts breaks HMR in Next.js 16.2 (#​91981 through #​92273)
• Deduplicate output assets and detect content conflicts on emit (#​92292)
• Fix styled-jsx race condition: styles lost due to concurrent rendering (#​92459)
• turbo-tasks-backend: stability fixes for task cancellation and error handling (#​92254)

Credits

Huge thanks to @​icyJoseph, @​sokra, @​wbinnssmith, @​eps1lon and @​ztanner for helping!

storybookjs/storybook (@​storybook/addon-themes)

v10.3.5

Compare Source

• Core: Disable component manifest by default - #​34408, thanks @​yannbf!

[!NOTE]
Version >=0.5.0 of @storybook/addon-mcp enables component manifests again. If you're upgrading Storybook from version >= 10.3.0 to >= 10.3.5 and are using the MCP addon, you should also upgrade @storybook/addon-mcp to keep the docs toolset in the MCP server.

vercel/next.js (next)

v16.2.4

Compare Source

v16.2.3

Compare Source

nodejs/node (node)

v24.15.0

Compare Source

oxc-project/oxc (oxfmt)

v0.46.0

Compare Source

v0.45.0

Compare Source

🐛 Bug Fixes

• 50c389b oxfmt: Support .editorconfig quote_type (#​20989) (leaysgur)

v0.44.0

Compare Source

🐛 Bug Fixes

• dd2df87 npm: Export package.json for oxlint and oxfmt (#​20784) (kazuya kawaguchi)
• 4216380 oxfmt: Support .editorconfig tab_width fallback (#​20988) (leaysgur)

oxc-project/oxc (oxlint)

v1.61.0

Compare Source

🚀 Features

• 38d8090 linter/jest: Implemented jest version settings in config file. (#​21522) (Said Atrahouch)

v1.60.0

Compare Source

📚 Documentation

• cfd8a4f linter: Don't rely on old eslint doc for available globals (#​21334) (Nicolas Le Cam)

v1.59.0

Compare Source

postcss/postcss (postcss)

v8.5.10

Compare Source

• Fixed XSS via unescaped </style> in non-bundler cases (by @​TharVid).

v8.5.9

Compare Source

• Speed up source map encoding paring in case of the error.

facebook/react (react)

v19.2.5: 19.2.5 (April 8th, 2026)

Compare Source

React Server Components

• Add more cycle protections (#​36236 by @​eps1lon and @​unstubbable)

stylelint/stylelint (stylelint)

v17.9.0

Compare Source

It adds 3 new features. Adding the referenceFiles property to your configuration object makes the no-unknown-animations, no-unknown-custom-media and no-unknown-custom-properties rules more useful.

• Added: experimental referenceFiles to configuration object (#​9179) (@​jeddy3).
• Added: experimental abortSignal option to Node.js API for cancellation support (#​9213) (@​adalinesimonian).
• Added: maxWarnings to configuration object (#​9181) (@​mrginglymus).

v17.8.0

Compare Source

It adds 3 new rules and 1 configuration property.

• Added: languageOptions.directionality configuration property (#​8687) (@​sw1tch3roo).
• Added: property-layout-mappings rule (#​8687) (@​sw1tch3roo).
• Added: relative-selector-nesting-notation rule (#​8730) (@​sw1tch3roo).
• Added: selector-no-deprecated rule (#​8694) (@​immitsu).

v17.7.0

Compare Source

It fixes 4 bugs, including clearer problem messages by removing filler words and leading with the problem. We've also released 1.0.0 of create-stylelint to help with first-time Stylelint setup.

• Fixed: clarity of problem messages (#​9199) (@​jeddy3).
• Fixed: --print-config CLI flag to hide internal properties (#​9194) (@​ybiquitous).
• Fixed: function-url-quotes false positives when URLs have modifiers (#​8702) (@​immitsu).
• Fixed: selector-no-qualifying-type false positives for :has() (#​9182) (@​romainmenke).

microsoft/TypeScript (typescript)

v6.0.3

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 5am on sunday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.