storybook
10.6.5 · 27 Oct 2026MIT22.3M / weekRepositoryHomepagenpmAtom feed
8.6.19 is the newest release of 8.x.
In short
1 security10 new21 fixed23 changed
- security
🚨 Key security fixes for Vite and ESbuild
Security
4 advisories affect 8.6.0; 8.6.19 fixes them
- CriticalStorybook: Missing origin validation in Storybook preview allows code injection from malicious websitesGHSA-f2ph-cmg5-wxc8 · 21 Oct 2026Fixed in 8.6.19
- HighStorybook dev server vulnerable to code injection from the local networkGHSA-px85-f4q5-jh77 · 22 Oct 2026Fixed in 8.6.19
- HighStorybook Dev Server is Vulnerable to WebSocket HijackingGHSA-mjf5-7g4m-gx5w · 26 Feb 2026Fixed in 8.6.17
- HighStorybook manager bundle may expose environment variables during buildGHSA-8452-54wp-rmv6 · 18 Dec 2025Fixed in 8.6.15
Release note
The 8.6 release focuses on Storybook Test, which brings realtime component, accessibility, and visual UI tests to your favorite component workshop.
Here’s what’s new:
🎁 Storybook Test installer for out-of-the-box tests in new projects
🦾 Accessibility “todo” workflow to systematically fix a11y violations
🗜️ 80% smaller create-storybook package for much faster installs
🧪 Dozens of Test fixes based on user feedback
📕 Docs fixes for table of contents, code snippets, and more
- security
🚨 Key security fixes for Vite and ESbuild
💯 Hundreds more improvements
List of all updates
Addon A11y: Introduce parameters.a11y.test
Addon-A11y: Fix preset loading when loaded via getAbsolutePath
Addon-Docs: Change URL hash when TOC item is clicked, and fix TOC loading bugs
Addon-docs: Consider custom code snippet in story code panel and update styles
Addon-Test: Add telemetry data for Focused Tests
Addon-Test: Fix config and watch mode inconsistencies
Addon-Test: Fix console error in build mode
Addon-Test: Make sure that only one global portable story config is ever loaded
Angular: Fix accent character issue
Angular: Support experimental zoneless mode
Angular: Support v19.2 when @angular/animations is not installed
Builder-Vite: Fix resolve id warning
Builder-Vite: Fix runtime and iframe 404 on first load
Bun: Add support for text lock file
Cleanup: Remove unused constants in viewport addon
CLI: Don't initially select Documentation and Testing features
CLI: Fix peer dep issues for npm users during upgrade
CLI: Fix printing of selected features
CLI: Make telemetry data an object
CLI: Prompt users for RN vs RNW on init
CLI: Reimplement features prompt logic to handle
--yesand fix--featuresCLI: Remove Storybook dependencies before adding re-adding them
CLI: Use correct storybook internals import in automigration
Codemod: Always get real path of files
Codemod: Handle addon essentials differently in csf factories
Codemod: Migrate meta.args to meta.input.args in csf factories
Codemod: Use real path from symbolic links
Core: Add
UniversalStoreAPI to sync state/events between multiple environmentsCore: Add connection timeout notification
Core: Allow empty render functions in CSF factories
Core: Always place cache dir inside
node_modulesCore: Don't set process.env.NODE_ENV and process.env.DEV
Core: Fix addon essentials preview preset
Core: Fix extracting import path when it's not a core addon
Core: Fix invalid Websocket termination
Core: Fix statically serving single files and multiple dirs on the same endpoint
Core: Fix undeclared internal dependencies
Core: Improve type compatibility with React 19
Core: Move CSF to monorepo
Csf Tools: Allow ConfigFile to create more import syntaxes
CSF: Add support for CSF factories
Essentials: Fix
addon-essentialsnot working when used withgetAbsolutePathManager: Escape single quotes in dynamic import paths in wrapManagerEntries function
Manager: Fix escaping of single quotes in dynamic import paths
Manager: Fix panel reactivity
React: Fix incorrect import in preview.ts
Svelte: Fix conflicting variable names and support for
+page.sveltefilesTest addon: Only update
vitest.config.tswith workspaces, otherwise createvitest.workspace.ts