storybook
10.6.5 · 27 Oct 2026MIT22.3M / weekRepositoryHomepagenpmAtom feed
Upgrading storybook from 8.3.4 to 8.6.19
40 releases in betweennotes for 35
Counted from 35 of 40 release notes. Advisories are counted from the advisory database, in full.
Before you upgrade
Tick each one off as you go- deprecated8.5.0
Security
Fixes 4 advisories affecting 8.3.4
- Storybook manager bundle may expose environment variables during buildhigh · GHSA-8452-54wp-rmv6
- Storybook: Missing origin validation in Storybook preview allows code injection from malicious websitescritical · GHSA-f2ph-cmg5-wxc8
- Storybook Dev Server is Vulnerable to WebSocket Hijackinghigh · GHSA-mjf5-7g4m-gx5w
- Storybook dev server vulnerable to code injection from the local networkhigh · GHSA-px85-f4q5-jh77
- 8.6.0
🚨 Key security fixes for Vite and ESbuild
Release by release
8.6.16 – 8.6.194 releases, no release note
- fixed
Core: Fix .env-file parsing, thanks @jreinhold!
- fixed
- new
CLI: Add skip onboarding, recommended/minimal config
- fixed
Core: Fix using dates in expect statements
- fixed
React Native Web: Fix expo router by setting JSX to automatic
- new
- fixed
Controls: Fix boxShadow on empty controls
- fixed
- fixed
Core: Fix telemetry error on Storybook UI
- fixed
Ember: Fix
ember-template-compilerimport for ember 6+
- fixed
- fixed
Angular: Fix zone.js support for Angular libraries
- fixed
- fixed
Addon-docs: Fix non-string handling in Stories block
- fixed
Nextjs: Fix styled-jsx optimize vite warnings
- fixed
React: Fix actImplementation is not a function
- fixed
- fixed
Next: Fix react aliases in next vite plugin
- fixed
166 other lines we could not sort, mostly version bumps
- 8.6.13
React Native Web: Update
react-native-web - 8.6.12
CLI: Only install Visual Test Addon if test feature is selected
- 8.6.12
Svelte: Exclude
node_modulesfrom docgen - 8.6.8
Angular: Export all files in Angular package.json
- 8.6.8
Svelte: Adjust Svelte typings to include Svelte 5 function components
- 8.6.8
Telemetry: Make sure that telemetry doesn't fail on init
- 8.6.8
Vite: Update HMR filter to target specific story file types
- 8.6.6
Angular: Make sure that polyfills are loaded before the storybook is loaded
- 8.6.5
Addon A11y: Promote @storybook/global to full dependency
- 8.6.5
Core: Replace 'min' instead of 'm' in printDuration
8 internal lines (docs, tests, tooling) left out.