storybook
10.6.5 · 27 Oct 2026MIT22.3M / weekRepositoryHomepagenpmAtom feed
Upgrading storybook from 10.4.3 to 10.6.2
17 releases in betweenevery note read
Before you upgrade
Tick each one off as you go- deprecated10.6.0
Security
Fixes 2 advisories affecting 10.4.3
- Storybook: Missing origin validation in Storybook preview allows code injection from malicious websitescritical · GHSA-f2ph-cmg5-wxc8
- Storybook dev server vulnerable to code injection from the local networkhigh · GHSA-px85-f4q5-jh77
- 10.6.2
Security: Patch GHSA-f2ph-cmg5-wxc8 and GHSA-px85-f4q5-jh77
- 10.5.10
Dependencies: Bump Vitest to 4.1.6 (CVE-2026-47428)
- 10.5.5
Core: Upgrade
wsto fix security advisories
Release by release
- new
Preact: Support Preact 11
- fixed
CLI: Fix hidden output of CLI commands on Yarn 1
- new
- new
Addon Vitest: Support Vitest 5 browser tests
- new
TanStack: Support both interpolatePath signatures
- fixed
Addon A11y: Fix vision simulator color filters in Firefox
- fixed
CLI: Fix vitest ERESOLVE on fresh Next.js apps.
- fixed
Core: Fix build crash when ref reachability check fails mid-request
- fixed
Core: Restore the change-detection CTA in the sidebar
- new
- new
Angular: Add an in-process docgen analyzer, replacing Compodoc under the flag
- new
CLI: Add
storybook skillscommand - new
CLI: Allow esbuild builds for Storybook-owned pnpm dlx
- new
Core: Add additionnal field for component API in manifest
- new
10.5.10nothing new or fixed in the note
- fixed
Addon-Pseudo-States: Fix pseudo-states rewriting for nested functional selectors
- fixed
Preview: Fix crash when initialising UrlStore on a docs path
- fixed
Webpack: Prevent long preview output filenames
- fixed
- fixed
React: Fix RDT tsconfig selection for Vite project references
- fixed
10.5.7nothing new or fixed in the note
- new
ESLint Plugin: Add plugin meta and document oxlint usage
- new
211 other lines we could not sort, mostly version bumps
- 10.6.2
Angular-Vite: Require @analogjs/vite-plugin-angular 2.7.3 or later
- 10.6.2
Typescript: Explicitly type enhanceArgTypes
- 10.6.1
Telemetry: One tools-command record per invocation with CLI toolset and tool names
- 10.6.0
💻 CLI bindings for agent tools/skills
- 10.6.0
🅰️ Angular-Vite MCP/skills support and improved docgen/snippets (experimental)
- 10.6.0
🟢 Vue MCP/skills support and improved docgen/snippets (experimental)
- 10.6.0
🧩 Tanstack / NextJS-Vite framework bugfixes
- 10.6.0
⚡ Improved performance and reduced bundle size
- 10.6.0
Addon Vitest: Pin storybook/test in optimizeDeps so its CJS-only deps are prebundled
- 10.6.0
Addon Vitest: Report test runs with failures as failed tool outcomes
22 internal lines (docs, tests, tooling) left out.