[dependabot]

Bumps the npm_and_yarn group with 1 update in the /apps/dashboard directory: storybook.
Bumps the npm_and_yarn group with 1 update in the /apps/nebula directory: storybook.
Bumps the npm_and_yarn group with 1 update in the /apps/wagmi-demo directory: vite.
Bumps the npm_and_yarn group with 2 updates in the /packages/thirdweb directory: storybook and vite.
Bumps the npm_and_yarn group with 1 update in the /packages/ui directory: storybook.

Updates storybook from 9.1.20 to 9.1.21

Release notes

Sourced from storybook's releases.

v9.1.21

9.1.21

• Highlight: Prevent menu items from emitting arbitrary channel events
• Channels: Restrict preview postMessage to known manager origins
• Core: Separate manager and preview roles on the dev server channel
• Core: Block iframe embedding of the dev server from non-localhost origins
• Core: Reject component search queries outside the project
• Core: Validate component export name when creating a story
• Core: Add host validation warning and origin validation for MCP
• Core: Contain save story path to the project root
• Core: Validate save story name and arg keys as identifiers
• Addon Vitest: Disable browser file writes and command execution

Changelog

Sourced from storybook's changelog.

9.1.21

• Highlight: Prevent menu items from emitting arbitrary channel events
• Channels: Restrict preview postMessage to known manager origins
• Core: Separate manager and preview roles on the dev server channel
• Core: Block iframe embedding of the dev server from non-localhost origins
• Core: Reject component search queries outside the project
• Core: Validate component export name when creating a story
• Core: Add host validation warning and origin validation for MCP
• Core: Contain save story path to the project root
• Core: Validate save story name and arg keys as identifiers
• Addon Vitest: Disable browser file writes and command execution

Commits

• 9abaf68 Bump version from "9.1.20" to "9.1.21" [skip ci]
• dc03253 Core: Escape the component file name in generated story imports
• 0cd2fc4 Core: Check the origin of channel messages from registered preview iframes
• 81d4a04 Patch v9
• See full diff in compare view

Updates storybook from 9.1.20 to 9.1.21

Release notes

Sourced from storybook's releases.

v9.1.21

9.1.21

• Highlight: Prevent menu items from emitting arbitrary channel events
• Channels: Restrict preview postMessage to known manager origins
• Core: Separate manager and preview roles on the dev server channel
• Core: Block iframe embedding of the dev server from non-localhost origins
• Core: Reject component search queries outside the project
• Core: Validate component export name when creating a story
• Core: Add host validation warning and origin validation for MCP
• Core: Contain save story path to the project root
• Core: Validate save story name and arg keys as identifiers
• Addon Vitest: Disable browser file writes and command execution

Changelog

Sourced from storybook's changelog.

9.1.21

• Highlight: Prevent menu items from emitting arbitrary channel events
• Channels: Restrict preview postMessage to known manager origins
• Core: Separate manager and preview roles on the dev server channel
• Core: Block iframe embedding of the dev server from non-localhost origins
• Core: Reject component search queries outside the project
• Core: Validate component export name when creating a story
• Core: Add host validation warning and origin validation for MCP
• Core: Contain save story path to the project root
• Core: Validate save story name and arg keys as identifiers
• Addon Vitest: Disable browser file writes and command execution

Commits

• 9abaf68 Bump version from "9.1.20" to "9.1.21" [skip ci]
• dc03253 Core: Escape the component file name in generated story imports
• 0cd2fc4 Core: Check the origin of channel messages from registered preview iframes
• 81d4a04 Patch v9
• See full diff in compare view

Updates vite from 7.3.6 to 7.3.7

Release notes

Sourced from vite's releases.

v7.3.7

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

7.3.7 (2026-10-06)

Bug Fixes

• deps: update launch-editor to v2.14.2 (#23654) (a0a3339)
• html: filename passed to transformIndexHtml should not include queries (#23653) (8d479f9)
• server: store ids to safeModulePaths rather than URLs (#23656) (f0d76c7)

Commits

• 284f6b5 release: v7.3.7
• f0d76c7 fix(server): store ids to safeModulePaths rather than URLs (#23656)
• a0a3339 fix(deps): update launch-editor to v2.14.2 (#23654)
• 8d479f9 fix(html): filename passed to transformIndexHtml should not include queries (...
• See full diff in compare view

Updates storybook from 9.1.20 to 9.1.21

Release notes

Sourced from storybook's releases.

v9.1.21

9.1.21

• Highlight: Prevent menu items from emitting arbitrary channel events
• Channels: Restrict preview postMessage to known manager origins
• Core: Separate manager and preview roles on the dev server channel
• Core: Block iframe embedding of the dev server from non-localhost origins
• Core: Reject component search queries outside the project
• Core: Validate component export name when creating a story
• Core: Add host validation warning and origin validation for MCP
• Core: Contain save story path to the project root
• Core: Validate save story name and arg keys as identifiers
• Addon Vitest: Disable browser file writes and command execution

Changelog

Sourced from storybook's changelog.

9.1.21

• Highlight: Prevent menu items from emitting arbitrary channel events
• Channels: Restrict preview postMessage to known manager origins
• Core: Separate manager and preview roles on the dev server channel
• Core: Block iframe embedding of the dev server from non-localhost origins
• Core: Reject component search queries outside the project
• Core: Validate component export name when creating a story
• Core: Add host validation warning and origin validation for MCP
• Core: Contain save story path to the project root
• Core: Validate save story name and arg keys as identifiers
• Addon Vitest: Disable browser file writes and command execution

Commits

• 9abaf68 Bump version from "9.1.20" to "9.1.21" [skip ci]
• dc03253 Core: Escape the component file name in generated story imports
• 0cd2fc4 Core: Check the origin of channel messages from registered preview iframes
• 81d4a04 Patch v9
• See full diff in compare view

Updates vite from 7.3.6 to 7.3.7

Release notes

Sourced from vite's releases.

v7.3.7

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

7.3.7 (2026-10-06)

Bug Fixes

• deps: update launch-editor to v2.14.2 (#23654) (a0a3339)
• html: filename passed to transformIndexHtml should not include queries (#23653) (8d479f9)
• server: store ids to safeModulePaths rather than URLs (#23656) (f0d76c7)

Commits

• 284f6b5 release: v7.3.7
• f0d76c7 fix(server): store ids to safeModulePaths rather than URLs (#23656)
• a0a3339 fix(deps): update launch-editor to v2.14.2 (#23654)
• 8d479f9 fix(html): filename passed to transformIndexHtml should not include queries (...
• See full diff in compare view

Updates storybook from 9.1.20 to 9.1.21

Release notes

Sourced from storybook's releases.

v9.1.21

9.1.21

• Highlight: Prevent menu items from emitting arbitrary channel events
• Channels: Restrict preview postMessage to known manager origins
• Core: Separate manager and preview roles on the dev server channel
• Core: Block iframe embedding of the dev server from non-localhost origins
• Core: Reject component search queries outside the project
• Core: Validate component export name when creating a story
• Core: Add host validation warning and origin validation for MCP
• Core: Contain save story path to the project root
• Core: Validate save story name and arg keys as identifiers
• Addon Vitest: Disable browser file writes and command execution

Changelog

Sourced from storybook's changelog.

9.1.21

• Highlight: Prevent menu items from emitting arbitrary channel events
• Channels: Restrict preview postMessage to known manager origins
• Core: Separate manager and preview roles on the dev server channel
• Core: Block iframe embedding of the dev server from non-localhost origins
• Core: Reject component search queries outside the project
• Core: Validate component export name when creating a story
• Core: Add host validation warning and origin validation for MCP
• Core: Contain save story path to the project root
• Core: Validate save story name and arg keys as identifiers
• Addon Vitest: Disable browser file writes and command execution

Commits

• 9abaf68 Bump version from "9.1.20" to "9.1.21" [skip ci]
• dc03253 Core: Escape the component file name in generated story imports
• 0cd2fc4 Core: Check the origin of channel messages from registered preview iframes
• 81d4a04 Patch v9
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[changeset-bot]

⚠️ No Changeset found

Latest commit: dca1269

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs-v2	Error		Oct 21, 2026 6:45pm UTC
nebula	Error		Oct 21, 2026 6:45pm UTC
thirdweb_playground	Error		Oct 21, 2026 6:45pm UTC
thirdweb-www	Error		Oct 21, 2026 6:45pm UTC
wallet-ui	Error		Oct 21, 2026 6:45pm UTC

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 67b9980b-0056-4fcf-bd4d-953cba375486

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[dependabot]

Looks like these dependencies are no longer updatable, so this is no longer needed.