Packages

@storybook/react

10.6.5 · 27 Oct 2026MIT31.7M / weekRepositoryHomepagenpmAtom feed

Upgrading @storybook/react From 9.0.4 to 9.1.21

35 releases in betweenevery note read

Reading releases, release notes and advisories…

Other targets from 9.0.4Latest10.6.5
  1. 9.0.4yours
  2. 2 releases
  3. 9.0.8breaking
  4. 31 releases
  5. 9.1.21target
1
change to make
0
advisories fixed
25
new
46
fixes

Before you upgrade

Tick each one off as you go
  • breaking9.0.8

Release by release

  1. 9.1.21

    12 Oct 20261 new · 1 fix
    • new

      Core: Add host validation warning and origin validation for MCP

    • fixed

      Highlight: Prevent menu items from emitting arbitrary channel events

  2. 9.1.20

    5 Mar 20261 new
    • new

      Add request validation

  3. 9.1.18 – 9.1.192 releases, nothing new or fixed in the notes

  4. 9.1.17

    17 Dec 20251 fix
    • fixed

      Core: Fix .env-file parsing, thanks @jreinhold!

  5. 9.1.16

    28 Oct 20251 new · 2 fixes
    • new

      Core: Add `experimental_devServer` preset

    • fixed

      CLI: Fix Nextjs project creation in empty directories

    • fixed

      Telemetry: Fix preview-first-load event

  6. 9.1.15

    24 Oct 20251 new
    • new

      Core: Add `preview-first-load` telemetry

  7. 9.1.14

    24 Oct 20252 new · 1 fix
    • new

      NextJS: Add NextJS 16 support - #32791, thanks @yannbf and @ndelangen!

    • new

      Addon-Vitest: Support Vitest 4 - #32819, thanks @yannbf and @ndelangen!

    • fixed

      CSF: Fix `play-fn` tag for methods

  8. 9.1.13

    17 Oct 20251 fix
    • fixed

      Nextjs: Fix config access for Vite

75 other lines we could not sort, mostly version bumps

  • Channels: Restrict preview postMessage to known manager origins

    9.1.21

  • Core: Separate manager and preview roles on the dev server channel

    9.1.21

  • Core: Block iframe embedding of the dev server from non-localhost origins

    9.1.21

  • Core: Reject component search queries outside the project

    9.1.21

  • Core: Validate component export name when creating a story

    9.1.21

  • Core: Contain save story path to the project root

    9.1.21

  • Core: Validate save story name and arg keys as identifiers

    9.1.21

  • Addon Vitest: Disable browser file writes and command execution

    9.1.21

  • Harden websocket connection

    9.1.19

  • No-op release. No changes.

    9.1.18

13 internal lines (docs, tests, tooling) left out.