Packages

@storybook/react

10.6.5 · 27 Oct 2026MIT31.7M / weekRepositoryHomepagenpmAtom feed

Upgrading @storybook/react From 8.2.3 to 8.6.19

52 releases in betweenevery note read

Reading releases, release notes and advisories…

Other targets from 8.2.3Latest10.6.5
  1. 8.2.3yours
  2. 32 releases
  3. 8.6.0security
  4. 18 releases
  5. 8.6.19target
1
change to make
0
advisories fixed
79
new
130
fixes

Before you upgrade

Tick each one off as you go
  • deprecated8.5.0

Security

  • 🚨 Key security fixes for Vite and ESbuild

    8.6.0

Release by release

  1. 8.6.19

    12 Oct 20261 new · 1 fix
    • new

      Core: Add host validation warning and origin validation for MCP

    • fixed

      Highlight: Prevent menu items from emitting arbitrary channel events

  2. 8.6.18

    6 Mar 20261 new
    • new

      Add request validation

  3. 8.6.16 – 8.6.172 releases, nothing new or fixed in the notes

  4. 8.6.15

    17 Dec 20251 fix
    • fixed

      Core: Fix .env-file parsing, thanks @jreinhold!

  5. 8.6.14

    16 May 20251 new · 2 fixes
    • new

      CLI: Add skip onboarding, recommended/minimal config

    • fixed

      Core: Fix using dates in expect statements

    • fixed

      React Native Web: Fix expo router by setting JSX to automatic

  6. 8.6.13

    16 May 20251 fix
    • fixed

      Controls: Fix boxShadow on empty controls

  7. 8.6.12

    2 Apr 20252 fixes
    • fixed

      Core: Fix telemetry error on Storybook UI

    • fixed

      Ember: Fix ember-template-compiler import for ember 6+

  8. 8.6.11

    28 Mar 20251 fix
    • fixed

      Angular: Fix zone.js support for Angular libraries

224 other lines we could not sort, mostly version bumps

  • Channels: Restrict preview postMessage to known manager origins

    8.6.19

  • Core: Separate manager and preview roles on the dev server channel

    8.6.19

  • Core: Block iframe embedding of the dev server from non-localhost origins

    8.6.19

  • Core: Reject component search queries outside the project

    8.6.19

  • Core: Validate component export name when creating a story

    8.6.19

  • Core: Contain save story path to the project root

    8.6.19

  • Core: Validate save story name and arg keys as identifiers

    8.6.19

  • Addon Vitest: Disable browser file writes and command execution

    8.6.19

  • Harden websocket connection

    8.6.17

  • No-op release. No changes.

    8.6.16

12 internal lines (docs, tests, tooling) left out.