storybook
10.6.5 · 27 Oct 2026MIT22.3M / weekRepositoryHomepagenpmAtom feed
Upgrading storybook from 8.0.5 to 10.6.5
185 releases in betweennotes for 174
Counted from 174 of 185 release notes. Advisories are counted from the advisory database, in full.
Start here
Before you upgrade
Tick each one off as you go- breaking10.4.0
- breaking10.0.0
- breaking10.0.0
- breaking9.0.8
- breaking9.0.0
- breaking9.0.0
- breaking9.0.0
- breaking9.0.0
- breaking9.0.0
- breaking9.0.0
Security
Fixes 3 advisories affecting 8.0.5
- Storybook manager bundle may expose environment variables during buildhigh · GHSA-8452-54wp-rmv6
- Storybook: Missing origin validation in Storybook preview allows code injection from malicious websitescritical · GHSA-f2ph-cmg5-wxc8
- Storybook dev server vulnerable to code injection from the local networkhigh · GHSA-px85-f4q5-jh77
- 10.6.2
Security: Patch GHSA-f2ph-cmg5-wxc8 and GHSA-px85-f4q5-jh77
- 10.5.10
Dependencies: Bump Vitest to 4.1.6 (CVE-2026-47428)
- 10.5.5
Core: Upgrade
wsto fix security advisories - 8.6.0
🚨 Key security fixes for Vite and ESbuild
- 8.1.0
Webpack: Bump webpack-dev-middleware to patch high security issue
Release by release
10.6.4 – 10.6.52 releases, nothing new or fixed in the notes
- new
Addon Vitest: Support Vitest 5
- fixed
Next.js: Fix app-router mock crash on Next.js 16.4
- new
- new
Preact: Support Preact 11
- fixed
CLI: Fix hidden output of CLI commands on Yarn 1
- new
- new
Addon Vitest: Support Vitest 5 browser tests
- new
TanStack: Support both interpolatePath signatures
- fixed
Addon A11y: Fix vision simulator color filters in Firefox
- fixed
CLI: Fix vitest ERESOLVE on fresh Next.js apps.
- fixed
Core: Fix build crash when ref reachability check fails mid-request
- fixed
Core: Restore the change-detection CTA in the sidebar
- new
- new
Angular: Add an in-process docgen analyzer, replacing Compodoc under the flag
- new
CLI: Add
storybook skillscommand - new
CLI: Allow esbuild builds for Storybook-owned pnpm dlx
- new
Core: Add additionnal field for component API in manifest
- new
10.5.10nothing new or fixed in the note
- fixed
Addon-Pseudo-States: Fix pseudo-states rewriting for nested functional selectors
- fixed
Preview: Fix crash when initialising UrlStore on a docs path
- fixed
Webpack: Prevent long preview output filenames
- fixed
- fixed
React: Fix RDT tsconfig selection for Vite project references
- fixed
959 other lines we could not sort, mostly version bumps
- 10.6.5
Typescript: Exclude all dunderscore prefixed folders from production compilation
- 10.6.4
Core: Skip TypeScript loader hook registration under Jest
- 10.6.3
Nextjs-Vite: Provide parentRenderTree.bfcacheId in app router mock
- 10.6.3
TypeScript: Explicitly type returntype of ArgsStore#get
- 10.6.2
Angular-Vite: Require @analogjs/vite-plugin-angular 2.7.3 or later
- 10.6.2
Typescript: Explicitly type enhanceArgTypes
- 10.6.1
Telemetry: One tools-command record per invocation with CLI toolset and tool names
- 10.6.0
💻 CLI bindings for agent tools/skills
- 10.6.0
🅰️ Angular-Vite MCP/skills support and improved docgen/snippets (experimental)
- 10.6.0
🟢 Vue MCP/skills support and improved docgen/snippets (experimental)
100 internal lines (docs, tests, tooling) left out.