fix(deps): update npm non-major dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@biomejs/biome (source)	2.4.9 → 2.4.10
@navikt/aksel-icons (source)	^8.8.0 → ^8.9.0
@react-router/dev (source)	^7.13.2 → ^7.14.0
@react-router/express (source)	^7.13.2 → ^7.14.0
@react-router/node (source)	^7.13.2 → ^7.14.0
@storybook/addon-a11y (source)	^10.3.3 → ^10.3.4
@storybook/addon-docs (source)	^10.3.3 → ^10.3.4
@storybook/addon-themes (source)	^10.3.3 → ^10.3.4
@storybook/addon-vitest (source)	^10.3.3 → ^10.3.4
@storybook/react-vite (source)	^10.3.3 → ^10.3.4
@types/node (source)	^24.12.0 → ^24.12.2
chromatic (source)	^16.0.0 → ^16.1.0
cssnano	^7.1.3 → ^7.1.4
express-rate-limit	^8.3.1 → ^8.3.2
invokers-polyfill	^1.0.1 → ^1.0.2
isbot (source)	^5.1.36 → ^5.1.37
playwright (source)	^1.58.2 → ^1.59.1
react-i18next	^17.0.0 → ^17.0.2
react-router (source)	^7.13.2 → ^7.14.0
rollup (source)	^4.60.0 → ^4.60.1
storybook (source)	^10.3.3 → ^10.3.4
storybook-addon-pseudo-states (source)	^10.3.3 → ^10.3.4

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

biomejs/biome (@​biomejs/biome)

v2.4.10

Compare Source

Patch Changes

• #​8838 f3a6a6b Thanks @​baeseokjae! - Added new lint nursery rule noImpliedEval.

  The rule detects implied eval() usage through functions like setTimeout, setInterval, and setImmediate when called with string arguments.

  // Invalid
  setTimeout("alert('Hello');", 100);
  
  // Valid
  setTimeout(() => alert("Hello"), 100);

• #​9320 93c3b6c Thanks @​taberoajorge! - Fixed #​7664: noUnusedVariables no longer reports false positives for TypeScript namespace declarations that participate in declaration merging with an exported or used value declaration (const, function, or class) of the same name. The reverse direction is also handled: a value declaration merged with an exported namespace is no longer flagged.

• #​9630 1dd4a56 Thanks @​raashish1601! - Fixed #​9629: noNegationElse now keeps ternary branch comments attached to the correct branch when applying its fixer.

• #​9216 04243b0 Thanks @​FrederickStempfle! - Fixed #​9061: noProcessEnv now also detects process.env when process is imported from the "process" or "node:process" modules.

  Previously, only the global process object was flagged:

  import process from "node:process";
  // This was not flagged, but now it is:
  console.log(process.env.NODE_ENV);

• #​9692 61b7ec5 Thanks @​mkosei! - Fixed Svelte #each destructuring parsing and formatting for nested patterns such as [key, { a, b }].

• #​9627 06a0f35 Thanks @​ematipico! - Fixed #​191: Improved the performance of how the Biome Language Server pulls code actions and diagnostics.

  Before, code actions were pulled and computed all at once in one request. This approach couldn't work in big files, and caused Biome to stale and have CPU usage spikes up to 100%.

  Now, code actions are pulled and computed lazily, and Biome won't choke anymore in big files.

• #​9643 5bfee36 Thanks @​dyc3! - Fixed #​9347: useVueValidVBind no longer reports valid object bindings like v-bind="props".

• #​9627 06a0f35 Thanks @​ematipico! - Fixed assist diagnostics being invisible when using --diagnostic-level=error. Enforced assist violations (e.g. useSortedKeys) were filtered out before being promoted to errors, causing biome check to incorrectly return success.

• #​9695 9856a87 Thanks @​dyc3! - Added the new nursery rule noUnsafePlusOperands, which reports + and += operations that use object-like, symbol, unknown, or never operands, or that mix number with bigint.

• #​9627 06a0f35 Thanks @​ematipico! - Fixed duplicate parse errors in check and ci output. When a file had syntax errors, the same parse error was printed twice and the error count was inflated.

• #​9627 06a0f35 Thanks @​ematipico! - Improved the performance of the commands lint and check when they are called with --write.

• #​9627 06a0f35 Thanks @​ematipico! - Fixed --diagnostic-level not fully filtering diagnostics. Setting --diagnostic-level=error now correctly excludes warnings and infos from both the output and the summary counts.

• #​9623 13b3261 Thanks @​ematipico! - Fixed #​9258: --skip no longer causes suppressions/unused warnings for suppression comments targeting skipped rules or domains.

• #​9631 599dd04 Thanks @​raashish1601! - Fixed #​9625: experimentalEmbeddedSnippetsEnabled no longer crashes when a file mixes formatable CSS-in-JS templates with tagged templates that the embedded formatter can't currently delegate, such as a styled-components interpolation returning `css```.

navikt/aksel (@​navikt/aksel-icons)

v8.9.0

Compare Source

remix-run/react-router (@​react-router/dev)

v7.14.0

Compare Source

Minor Changes

• Add support for Vite 8 (#​14876)

Patch Changes

• support for prerendering multiple server bundles with v8_viteEnvironmentApi (#​14921)

• rsc framework mode prerender / spa mode support (#​14907)

• UNSTABLE RSC FRAMEWORK MODE BREAKING CHANGE - Existing route module exports remain unchanged from stable v7 non-RSC mode, but new exports are added for RSC mode. If you want to use RSC features, you will need to update your route modules to export the new annotations. (#​14901)

  If you are using RSC framework mode currently, you will need to update your route modules to the new conventions. The following route module components have their own mutually exclusive server component counterparts:

  Server Component Export	Client Component
  ServerComponent	default
  ServerErrorBoundary	ErrorBoundary
  ServerLayout	Layout
  ServerHydrateFallback	HydrateFallback

  If you were previously exporting a ServerComponent, your ErrorBoundary, Layout, and HydrateFallback were also server components. If you want to keep those as server components, you can rename them and prefix them with Server. If you were previously importing the implementations of those components from a client module, you can simply inline them.

  Example:

  Before

  import { ErrorBoundary as ClientErrorBoundary } from "./client";
  
  export function ServerComponent() {
    // ...
  }
  
  export function ErrorBoundary() {
    return <ClientErrorBoundary />;
  }
  
  export function Layout() {
    // ...
  }
  
  export function HydrateFallback() {
    // ...
  }

  After

  export function ServerComponent() {
    // ...
  }
  
  export function ErrorBoundary() {
    // previous implementation of ClientErrorBoundary, this is now a client component
  }
  
  export function ServerLayout() {
    // rename previous Layout export to ServerLayout to make it a server component
  }
  
  export function ServerHydrateFallback() {
    // rename previous HydrateFallback export to ServerHydrateFallback to make it a server component
  }

• update the reveal command to support rsc for entry.client, entry.rsc, entry.ssr (#​14904)

• Updated dependencies:

  • react-router@7.14.0
  • @react-router/node@7.14.0
  • @react-router/serve@7.14.0

remix-run/react-router (@​react-router/express)

v7.14.0

Compare Source

Patch Changes

• Updated dependencies:
  • react-router@7.14.0
  • @react-router/node@7.14.0

remix-run/react-router (@​react-router/node)

v7.14.0

Compare Source

Patch Changes

• Updated dependencies:
  • react-router@7.14.0

storybookjs/storybook (@​storybook/addon-a11y)

v10.3.4

Compare Source

• Addon-a11y: Clear status transition timer on unmount to prevent test flake - #​34203, thanks @​mixelburg!
• Bug: Skip re-processing already transformed config files for CSF factories - #​34273, thanks @​huang-julien!
• Builder-Vite: Use djb2 hash to prevent variable name collisions in builder-vite - #​34274, thanks @​chida09!
• CLI: Prompt for init crash reports - #​34316, thanks @​JReinhold!
• CSF4: Fix duplicate preview loading issue in Vitest - #​34361, thanks @​valentinpalkovic!
• Core: Fix WebSocket connection for StackBlitz/WebContainers - #​34281, thanks @​ghengeveld!
• React-Docgen: Try .tsx fallback when resolving .js ESM imports in docgen resolvers - #​34393, thanks @​mixelburg!
• React-Vite: Upgrade @​joshwooding/vite-plugin-react-docgen-typescript to 0.7.0 - #​34335, thanks @​beeswhacks!

chromaui/chromatic-cli (chromatic)

v16.1.0

Compare Source

🚀 Enhancement

• Best effort alternative to tree-kill that swallows errors #​1261 (@​jmhobbs @​justin-thurman)

🐛 Bug Fix

• Merge pull request #​1265 from chromaui/CAP-4242-unit-tests #​1265 (@​justin-thurman)
• Create workflow for action-canary release #​1255 (@​jmhobbs)
• Upgrade eslint version #​1253 (@​jmhobbs)

Authors: 2

• John Hobbs (@​jmhobbs)
• Justin Thurman (@​justin-thurman)

---

cssnano/cssnano (cssnano)

v7.1.4: v7.1.4

Compare Source

Bug Fixes

Update color conversion library to @​colordx/core to fix rounding errors in color conversions #​1755

express-rate-limit/express-rate-limit (express-rate-limit)

v8.3.2

Compare Source

You can view the changelog here.

keithamus/invokers-polyfill (invokers-polyfill)

v1.0.2

Compare Source

What's Changed

• Handle composed click events properly by @​jpzwarte in #​79

New Contributors

• @​jpzwarte made their first contribution in #​79

Full Changelog: keithamus/invokers-polyfill@v1.0.1...v1.0.2

omrilotan/isbot (isbot)

v5.1.37

Compare Source

• Better checking for non empty strings in the interface functions
• [Internal] Build with tsup

microsoft/playwright (playwright)

v1.59.1

Compare Source

v1.59.0

Compare Source

i18next/react-i18next (react-i18next)

v17.0.2

Compare Source

• fix(types): values prop on <Trans /> now only requires interpolation variables for the specific i18nKey, not all variables in the namespace 1913

remix-run/react-router (react-router)

v7.14.0

Compare Source

Patch Changes

• UNSTABLE RSC FRAMEWORK MODE BREAKING CHANGE - Existing route module exports remain unchanged from stable v7 non-RSC mode, but new exports are added for RSC mode. If you want to use RSC features, you will need to update your route modules to export the new annotations. (#​14901)

  If you are using RSC framework mode currently, you will need to update your route modules to the new conventions. The following route module components have their own mutually exclusive server component counterparts:

  Server Component Export	Client Component
  ServerComponent	default
  ServerErrorBoundary	ErrorBoundary
  ServerLayout	Layout
  ServerHydrateFallback	HydrateFallback

  If you were previously exporting a ServerComponent, your ErrorBoundary, Layout, and HydrateFallback were also server components. If you want to keep those as server components, you can rename them and prefix them with Server. If you were previously importing the implementations of those components from a client module, you can simply inline them.

  Example:

  Before

  import { ErrorBoundary as ClientErrorBoundary } from "./client";
  
  export function ServerComponent() {
    // ...
  }
  
  export function ErrorBoundary() {
    return <ClientErrorBoundary />;
  }
  
  export function Layout() {
    // ...
  }
  
  export function HydrateFallback() {
    // ...
  }

  After

  export function ServerComponent() {
    // ...
  }
  
  export function ErrorBoundary() {
    // previous implementation of ClientErrorBoundary, this is now a client component
  }
  
  export function ServerLayout() {
    // rename previous Layout export to ServerLayout to make it a server component
  }
  
  export function ServerHydrateFallback() {
    // rename previous HydrateFallback export to ServerHydrateFallback to make it a server component
  }

• rsc Link prefetch (#​14902)

• Remove recursion from turbo-stream v2 allowing for encoding / decoding of massive payloads. (#​14838)

• encodeViaTurboStream leaked memory via unremoved AbortSignal listener (#​14900)

rollup/rollup (rollup)

v4.60.1

Compare Source

2026-03-30

Bug Fixes

• Resolve a situation where side effect imports could be dropped due to a caching issue (#​6286)

Pull Requests

• #​6286: fix: skip dropping side-effects on namespaceReexportsByName cache hit (#​6274) (@​littlegrayss, @​TrickyPi)
• #​6317: chore(deps): pin dependencies (@​renovate[bot], @​lukastaegert)
• #​6318: chore(deps): update msys2/setup-msys2 digest to cafece8 (@​renovate[bot], @​lukastaegert)
• #​6319: chore(deps): update minor/patch updates (@​renovate[bot], @​lukastaegert)
• #​6320: chore(deps): pin dependency typescript to v5 (@​renovate[bot], @​lukastaegert)
• #​6321: chore(deps): update openharmony-rs/setup-ohos-sdk action to v1 (@​renovate[bot], @​lukastaegert)
• #​6322: fix(deps): update swc monorepo (major) (@​renovate[bot], @​lukastaegert)
• #​6323: chore(deps): lock file maintenance (@​renovate[bot])
• #​6324: chore(deps): lock file maintenance (@​renovate[bot], @​lukastaegert)

---

Configuration

📅 Schedule: Branch creation - "before 07:00 on Thursday" in timezone Europe/Oslo, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[changeset-bot]

🦋 Changeset detected

Latest commit: ec14880

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 5 packages

Name	Type
@digdir/designsystemet	Patch
@digdir/designsystemet-css	Patch
@digdir/designsystemet-react	Patch
@digdir/designsystemet-web	Patch
@digdir/designsystemet-types	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[github-actions]

Preview deployments for this pull request:

storybook - 7. Apr 2026 - 07:31

themebuilder - 7. Apr 2026 - 07:31

www - 7. Apr 2026 - 07:38

[Barsnes]

Looks good to me