[renovate]

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
storybook (source)	10.5.10 → 10.6.2

---

Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites

CVE-2026-114125 / GHSA-f2ph-cmg5-wxc8

More information

Details

Summary: A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild.

Who is impacted?

You are impacted if you run a Storybook dev server in the affected versions.

You are not impacted if:

• You run a dev server that you never open in a web browser (e.g. headless automation, MCP clients)
• You run or visit a built version of Storybook

Recent versions of Chrome and Firefox may ask for permission before a website can connect to a localhost service. This reduces the risk, but does not remove it. Do not grant this permission to websites you don’t trust.

Recommended actions

Upgrade Storybook

Storybook has released patched versions of all affected major Storybook versions that fix all the vulnerabilities necessary for the worst-case scenario above to occur.

Upgrade to a patched version listed below before running storybook dev again. If you cannot upgrade immediately, do not run an affected Storybook dev server until you can apply the fix.

• 11.0.0-alpha.6
• 10.6.2
• 9.1.21
• 8.6.19

Review potentially breaking changes

Due to the exceptional nature of the reported vulnerabilities, the Storybook team has decided to change the default behavior of Storybook, including versions 8 and 9, for several network-related features that are not essential to most Storybook users' workflow. If your team relies on the affected features, we've added feature flags that can disable specific security updates to support your existing workflows.

Please carefully read the introduced flags and the consequences of using them.

Iframe embedding over the network is disabled by default

Storybook no longer allows the manager or preview to be embedded as an iframe on a website with a different host name. Built versions of Storybook are unaffected and can be freely embedded.

If you rely on embedding a Storybook dev server through a separate web app, run that separate app on localhost. You may also use the security.insecureRemoteIframeEmbed feature flag to re-enable iframe embedding from any origin.

The preview iframe rejects messages sent by an unknown host

Both the Storybook preview and manager now restrict the origin of iframes and parent windows that they can send messages to and receive messages from using the postMessage API.

By default, Storybook in dev mode only accepts communication with its own origin and other localhost services. Built Storybooks continue to accept communication from unknown origins.

A Storybook addon or integration could hypothetically rely on postMessage to update a live story's args. If you do that, reach out to the Storybook team to explore safer alternatives.

Storybook composition also relies on postMessage, so a composed Storybook on a different origin now fails to load unless it has been built. The security.insecureIframeMessaging feature flag disables this protection, but we recommend you build composed Storybooks instead.

The highlight event signature has changed

Storybook’s own accessibility addon uses the highlight event to inject highlights into the preview, which a user can click. Clicking the highlight opens a menu with a link to a documentation page.

The API for that event was too permissive and could be used to trigger arbitrary events, including events processed by the user’s dev server. We reworked the API to prevent abuse. Besides the accessibility addon, Chromatic's Visual Tests addon uses this API to link to documentation from highlighted ignored elements. Update the Visual Tests addon to version 5.5.1 or later to keep that link working. Because no other addons use this API as far as we know, we have not added a feature flag to restore the old API.

Disclosure timeline

On September 30th, the Storybook team received a responsible disclosure showing how a malicious website can embed a Storybook dev server's preview iframe and send events to the dev server on the developer's machine.

They combined this information with findings from an ongoing security audit to come up with a worst-case-scenario exploitation of the disclosed vulnerability, and the ones we independently discovered. They then worked to address all layers necessary for this worst-case scenario to happen. We have not received evidence of exploitation in real Storybook projects. The attack outlined in this advisory relies on correctly exploiting a sequence of many vulnerabilities, some of which were never disclosed to the Storybook team.

Worst-case attack scenario

An attacker-controlled website can interact with the preview of a running Storybook dev server. With user interaction, it may cause the dev server to make unauthorized changes to story files. If a malicious file is subsequently executed by a local runtime, the attack could lead to arbitrary code execution with the developer’s permissions.

Severity

• CVSS Score: 9.4 / 10 (Critical)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

References

• https://github.com/storybookjs/storybook/security/advisories/GHSA-f2ph-cmg5-wxc8
• https://github.com/storybookjs/storybook/pull/36726
• https://github.com/storybookjs/storybook/commit/243c06bf8f1e2f09446c44868ea100261e1374da
• https://github.com/storybookjs/storybook/commit/3be03ec6f11f4616471cebc3fc65c13e1bf8c178
• https://github.com/storybookjs/storybook/commit/a9ef9345d73224c73e0b81dc2701ec5b465ea9bb
• https://github.com/storybookjs/storybook/commit/d9b09e332510a88689c71ecc081bbbc2d072476e
• https://github.com/storybookjs/storybook/commit/df3fed468c9b4830605f00068c4bc6b7e1e215ed
• https://github.com/storybookjs/storybook/releases/tag/v10.6.2
• https://github.com/storybookjs/storybook/releases/tag/v11.0.0-alpha.6
• https://github.com/storybookjs/storybook/releases/tag/v8.6.19
• https://github.com/storybookjs/storybook/releases/tag/v9.1.21
• https://github.com/advisories/GHSA-f2ph-cmg5-wxc8

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Storybook dev server vulnerable to code injection from the local network

CVE-2026-114126 / GHSA-px85-f4q5-jh77

More information

Details

Summary: The Storybook dev server exposes its WebSocket authentication token to any client that can load its HTML pages. Any host on a LAN can open a Storybook app by IP address, and therefore obtain the token. The WebSocket can be used to inject code into story files or to create new files. Under the right circumstances, an attacker can execute code on the machine of a developer connected on the same LAN.

Who is impacted?

You are impacted if you run a Storybook dev server whilst connected on an untrusted local network, or to a WiFi access point posing as a trusted network. The impact of this advisory is more important if you have the Vitest addon installed and are using an old version of Vitest.

You are not impacted if:

• You run a dev server in an environment that other devices on your network cannot reach (e.g. a container that does not publish the Storybook port, or publishes it only on 127.0.0.1)
• You run a dev server whilst connected to a trusted local network
• You serve a built version of Storybook on your machine

Recommended actions

Upgrade Storybook

Storybook has released patched versions of all affected major Storybook versions that fix all the vulnerabilities necessary for the worst-case scenario above to occur.

Upgrade to a patched version listed below before running storybook dev again. If you cannot upgrade immediately, do not run an affected Storybook dev server until you can apply the fix.

• 11.0.0-alpha.6
• 10.6.2
• 9.1.21
• 8.6.19

Review potentially breaking changes

Due to the exceptional nature of the reported vulnerabilities, the Storybook team has decided to change the default behavior of Storybook, including versions 8 and 9, for several network-related features that are not essential to most Storybook users' workflow. If your team relies on the affected features, this document explains how to fall back to the previous behavior.

Storybook now only listens on 127.0.0.1 by default

By default, the Storybook dev server no longer binds to all network interfaces on your machine. It only binds to the loopback address 127.0.0.1. You can still open it at http://localhost:6006. This prevents other devices on the same network from seeing your Storybook server.

To share a Storybook with others, consider publishing it to Chromatic (free). To share it on a LAN without exposing the dev server, build a static Storybook with storybook build and serve the output folder with any static file server.

To share a live Storybook running in dev mode, you can use the --host CLI option to bind to the LAN IP you want to share Storybook on, e.g. storybook dev --host 192.168.0.110. Host and origin validation stays enabled with this option. If you use --host 0.0.0.0 instead, also set core.allowedHosts to the hostnames you will use. Without it, host and origin validation is disabled, and Storybook shows a warning and asks you to confirm before it starts.

Consider using a firewall to restrict incoming packets to known colleague IPs, and avoid using --host on an untrusted WiFi network.

The Vitest addon now disables browser.api.allowWrite and browser.api.allowExec

Storybook no longer allows code running in Vitest Browser mode to write to the developer’s machine or execute other processes. In the unlikely scenario that you rely on this capability in your tests, you can manually re-enable these APIs in your Vitest config.

The saveStoryRequest event validates input more strictly

Storybook strengthened input validation in saveStoryRequest, so addons and the Storybook UI can now only write serialized args and story titles. It is no longer possible to exploit input validation weaknesses to e.g. write play functions with a custom addon.

If you develop an addon that writes or edits files on users’ behalf, reach out to the Storybook team to get advice on security best practice.

Disclosure timeline

On August 19th, the Storybook team received a responsible disclosure showing that the WebSocket token can be stolen by an attacker sharing a LAN with a Storybook dev server.

The disclosure identified several actions an attacker can do. An attacker can bypass input validation to write a payload in a story file.

They can then trigger a test run via the WebSocket. If the Vitest addon is installed, the payload can exploit a Vitest API to write other files, with more exploit logic to the user’s filesystem.

Depending on the exploit content, where the file is written, and what software the developer uses, that exploit could then be executed.

Severity

• CVSS Score: 8.7 / 10 (High)
• Vector String: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/storybookjs/storybook/security/advisories/GHSA-px85-f4q5-jh77
• https://nvd.nist.gov/vuln/detail/CVE-2026-114126
• https://github.com/storybookjs/storybook/pull/36726
• https://github.com/storybookjs/storybook/commit/243c06bf8f1e2f09446c44868ea100261e1374da
• https://github.com/storybookjs/storybook/commit/3be03ec6f11f4616471cebc3fc65c13e1bf8c178
• https://github.com/storybookjs/storybook/commit/5540f03b209cc56c66f56a9c7cb4b2ee5b883ce5
• https://github.com/storybookjs/storybook/commit/a9ef9345d73224c73e0b81dc2701ec5b465ea9bb
• https://github.com/storybookjs/storybook/commit/d9b09e332510a88689c71ecc081bbbc2d072476e
• https://github.com/storybookjs/storybook/commit/df3fed468c9b4830605f00068c4bc6b7e1e215ed
• https://github.com/storybookjs/storybook/releases/tag/v10.6.2
• https://github.com/storybookjs/storybook/releases/tag/v11.0.0-alpha.6
• https://github.com/storybookjs/storybook/releases/tag/v8.6.19
• https://github.com/storybookjs/storybook/releases/tag/v9.1.21
• https://github.com/advisories/GHSA-px85-f4q5-jh77

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

storybookjs/storybook (storybook)

v10.6.2

Compare Source

• Angular-Vite: Require @​analogjs/vite-plugin-angular 2.7.3 or later - #​36525, thanks @​valentinpalkovic!
• CLI: Fix hidden output of CLI commands on Yarn 1 - #​36419, thanks @​kasperpeulen!
• Preact: Support Preact 11 - #​36526, thanks @​ghengeveld!
• Security: Patch GHSA-f2ph-cmg5-wxc8 and GHSA-px85-f4q5-jh77 - #​36726, thanks @​Sidnioulz!
• Typescript: Explicitly type enhanceArgTypes - #​35664, thanks @​mrginglymus!

v10.6.1

Compare Source

• Addon A11y: Fix vision simulator color filters in Firefox - #​36153, thanks @​ghengeveld!
• Addon Vitest: Support Vitest 5 browser tests - #​36270, thanks @​valentinpalkovic!
• CLI: Fix vitest ERESOLVE on fresh Next.js apps. - #​36310, thanks @​obvious-autobuild!
• Core: Fix build crash when ref reachability check fails mid-request - #​36181, thanks @​shilman!
• Core: Restore the change-detection CTA in the sidebar - #​36214, thanks @​ghengeveld!
• TanStack: Support both interpolatePath signatures - #​36333, thanks @​BaconMan1168!
• Telemetry: One tools-command record per invocation with CLI toolset and tool names - #​36210, thanks @​kasperpeulen!

v10.6.0

Compare Source

New skills architecture for agentic workflows

Storybook 10.6 contains hundreds of fixes and improvements:

• 💻 CLI bindings for agent tools/skills
• 🅰️ Angular-Vite MCP/skills support and improved docgen/snippets (experimental)
• 🟢 Vue MCP/skills support and improved docgen/snippets (experimental)
• 🧩 Tanstack / NextJS-Vite framework bugfixes
• ⚡ Improved performance and reduced bundle size

List of all updates

• Addon MCP: Stop silently dropping composed refs from MCP composition - #​36077, thanks @​kasperpeulen!
• Addon Vitest: Pin storybook/test in optimizeDeps so its CJS-only deps are prebundled - #​35572, thanks @​Nic-Polumeyv!
• Addon Vitest: Report test runs with failures as failed tool outcomes - #​36080, thanks @​kasperpeulen!
• Addon Vitest: Resolve story test globs against the project root - #​36103, thanks @​kasperpeulen!
• Addon-vitest: Filter Storybook instrumentation from reported stack traces - #​36120, thanks @​ghengeveld!
• Angular Vite: Resolve tsConfig against the workspace root - #​36026, thanks @​ndelangen!
• Angular-Vite: Run Compodoc on demand - #​35776, thanks @​valentinpalkovic!
• Angular: Add an in-process docgen analyzer, replacing Compodoc under the flag - #​35805, thanks @​valentinpalkovic!
• Angular: Bind only what the component accepts in story snippets, and report the rest - #​35943, thanks @​valentinpalkovic!
• Angular: Decide the migration's zone.js import from the dependency tree - #​36008, thanks @​valentinpalkovic!
• Angular: Declare story args the snippet markup binds by name - #​35895, thanks @​valentinpalkovic!
• Angular: Declare style preprocessors as optional peers and name the missing one - #​36098, thanks @​valentinpalkovic!
• Angular: Derive required inputs from Compodoc's own flag - #​35758, thanks @​valentinpalkovic!
• Angular: Extract Compodoc parsing into its own package - #​35749, thanks @​valentinpalkovic!
• Angular: Extract component JSDoc through TypeScript's APIs - #​35977, thanks @​huang-julien!
• Angular: Extract docgen on the server via Compodoc - #​35733, thanks @​valentinpalkovic!
• Angular: Fix component resolution, MCP output, and dev/build path aliasing - #​35952, thanks @​valentinpalkovic!
• Angular: Fix eight upgrade and migration bugs - #​35946, thanks @​valentinpalkovic!
• Angular: Fix ten docgen bugs found across 22 community repositories - #​35941, thanks @​valentinpalkovic!
• Angular: Generate story-docs snippets from the analyzer - #​35807, thanks @​valentinpalkovic!
• Angular: Give agents real input and output documentation - #​35896, thanks @​valentinpalkovic!
• Angular: Hide class internals from the props table by default - #​35887, thanks @​valentinpalkovic!
• Angular: Install the @storybook/angular-vite peers that nothing else brings in - #​36002, thanks @​valentinpalkovic!
• Angular: Keep the function control on constructor and generic signatures - #​35921, thanks @​valentinpalkovic!
• Angular: Make experimentalDocgenServer the default in angular-vite - #​35886, thanks @​valentinpalkovic!
• Angular: Migrate Analog projects to angular-vite instead of refusing them - #​35971, thanks @​valentinpalkovic!
• Angular: Print unevaluable story args instead of slicing the file - #​35888, thanks @​valentinpalkovic!
• Angular: Read the story shapes that supply their own markup - #​35797, thanks @​valentinpalkovic!
• Angular: Render self-closing tags in server-side docs snippets - #​35953, thanks @​valentinpalkovic!
• Angular: Render the required badge for required inputs in the props table - #​36065, thanks @​valentinpalkovic!
• Angular: Resolve @angular/core through the package manager, not the raw specifier - #​35999, thanks @​valentinpalkovic!
• Angular: Resolve builder styles the way the Angular builders do - #​35998, thanks @​valentinpalkovic!
• Angular: Resolve builder styles against the workspace root - #​35974, thanks @​valentinpalkovic!
• Angular: Skip the runtime source decorator when the docgen server produces snippets - #​35906, thanks @​valentinpalkovic!
• Angular: Stop marking a defaulted input as required in the props table - #​35899, thanks @​valentinpalkovic!
• Angular: Stop treating input/output alias collisions as two-way bindings - #​35777, thanks @​valentinpalkovic!
• Angular: hoist non-literal args onto the host component instead of inlining them - #​36003, thanks @​valentinpalkovic!
• Build: Fix repository.directory path in @​storybook/nextjs-vite package.json - #​35609, thanks @​LHMQ878!
• Build: Fix repository.directory path in create-storybook package.json - #​35596, thanks @​LHMQ878!
• Build: Stop nissuer from treating every repro URL as blocklisted - #​35827, thanks @​ndelangen!
• Builder-Webpack5: Use strict mtime equality for mock cache reuse - #​35681, thanks @​benwarbrooke-auror!
• CLI plugins: Delegate to storybook skills / storybook tools and align the evals - #​35957, thanks @​kasperpeulen!
• CLI: Add storybook skills command - #​35757, thanks @​ghengeveld!
• CLI: Align storybook skills with storybook tools shape - #​36121, thanks @​ghengeveld!
• CLI: Allow esbuild builds for Storybook-owned pnpm dlx - #​35742, thanks @​ndelangen!
• CLI: Attach to the most recent matching Storybook instance and add --port target selection - #​36076, thanks @​kasperpeulen!
• CLI: Categorize Execa failures for init telemetry - #​35720, thanks @​ndelangen!
• CLI: Detect Turbopack, Module Federation, and renderer versions - #​35949, thanks @​yannbf!
• CLI: Drop skills get/skills list, add skills --all - #​36127, thanks @​kasperpeulen!
• CLI: Enrich tools-command telemetry with attach dimensions - #​36032, thanks @​JReinhold!
• CLI: Fix stories changed hanging on attach - #​36093, thanks @​JReinhold!
• CLI: Keep storybook tools --json stdout parseable - #​36023, thanks @​kasperpeulen!
• CLI: Label the tools help Output block as the --json shape - #​36089, thanks @​kasperpeulen!
• CLI: Match Storybook instances across Windows drive-letter case - #​36108, thanks @​JReinhold!
• CLI: Offer the new 10.5 experimental feature flags during upgrade - #​35417, thanks @​valentinpalkovic!
• CLI: Point the init outro at storybook skills get setup and remove duplicate sandbox addon - #​36024, thanks @​kasperpeulen!
• CLI: Render the same toolset output as MCP - #​36029, thanks @​kasperpeulen!
• CLI: Serve the skills docs workflow whenever manifests are producible - #​36081, thanks @​kasperpeulen!
• CLI: Silence auto-mode fallback when no Storybook is running - #​36092, thanks @​JReinhold!
• Core: Add additionnal field for component API in manifest - #​35585, thanks @​huang-julien!
• Core: Add security token to instance registry record - #​35988, thanks @​JReinhold!
• Core: Add storybook/internal/tools SDK skeleton - #​35985, thanks @​JReinhold!
• Core: Allow token-only WebSocket upgrade without Origin - #​35980, thanks @​JReinhold!
• Core: Always show warning in story-docs if available - #​36079, thanks @​huang-julien!
• Core: Centralize import-statement generation in csf-tools - #​35845, thanks @​valentinpalkovic!
• Core: Define shared public toolsets (defineToolset) - #​35516, thanks @​ghengeveld!
• Core: Extract ComponentMetaManager to Core - #​35657, thanks @​huang-julien!
• Core: Fix Windows unit tests for instance-record ACLs - #​36060, thanks @​JReinhold!
• Core: Fix change detection missing working-tree edits until a commit - #​35744, thanks @​ghengeveld!
• Core: Fix module resolution for packages with conditional-only exports maps - #​36090, thanks @​kasperpeulen!
• Core: Fix resolve wrapped addon entries via package exports map - #​36011, thanks @​yzxcj797!
• Core: Include null union members as enum options in TS argTypes conversion - #​35599, thanks @​solp721!
• Core: Keep Tabs memo out of an esbuild joined var - #​36038, thanks @​ndelangen!
• Core: Make TypeScript's JSDoc semantics canonical for component docgen - #​35976, thanks @​huang-julien!
• Core: Move docgen JSDoc parser into csf-tools - #​35623, thanks @​huang-julien!
• Core: Move the component-meta invalidation state machine into core - #​35806, thanks @​valentinpalkovic!
• Core: Recover from a docgen worker death instead of going dark for the session - #​35964, thanks @​valentinpalkovic!
• Core: Remove experimental Playwright CT integration - #​35650, thanks @​ndelangen!
• Core: Resolve tsconfig paths from the defining config - #​35959, thanks @​ndelangen!
• Core: Restore the args a server-docgen preview cannot type - #​35907, thanks @​valentinpalkovic!
• Core: Scope in-flight open-service loads to their runtime - #​35897, thanks @​valentinpalkovic!
• Core: Share the CSF story-shape helpers snippet generators need - #​35803, thanks @​valentinpalkovic!
• Core: Share the program-backed half of a component-meta project - #​35820, thanks @​valentinpalkovic!
• Core: Skip builder preset in headless loading if non-existing - #​36078, thanks @​ndelangen!
• Core: Warn when multiple story files collapse onto one componentId - #​35931, thanks @​valentinpalkovic!
• Dependencies: Bump @​testing-library/user-event to 14.6.3 - #​35840, thanks @​ndelangen!
• Dependencies: Bump magic-string from 0.30.21 to 1.1.0 - #​35559, thanks @​wojtekmaj!
• Docgen server: Resolve arg spreads and identifier references in static snippets - #​35923, thanks @​valentinpalkovic!
• Docs: Surface the story-docs snippet warning in docs and the Code panel - #​35965, thanks @​valentinpalkovic!
• Harness: Gate the Angular component meta analyzer against Compodoc - #​35808, thanks @​valentinpalkovic!
• Icons: Add missing @​storybook/icons to the toolbar icon map - #​35595, thanks @​thejamesgore!
• Init: Detect TanStack packages in peerdependencies - #​34969, thanks @​huang-julien!
• Manager API: Add experimental_setFilters batch API - #​35413, thanks @​valentinpalkovic!
• Manager: Fix sidebar scroll on iOS Safari - #​35117, thanks @​ayerhs0904!
• Manager: Toggle the mobile navigation drawer with the sidebar keyboard shortcut - #​35263, thanks @​TheSeydiCharyyev!
• Manifest Debugger: Stable deep-link anchors for component cards - #​35470, thanks @​rachelslurs!
• Manifest debugger: Show the API description and snippet warnings - #​36000, thanks @​valentinpalkovic!
• Manifests: Add a warning field to story entries - #​35794, thanks @​valentinpalkovic!
• Mcp: Support JsDoc annotations in component documentation - #​35963, thanks @​huang-julien!
• NextJS: Normalize trailing slash in the next/link mock - #​35589, thanks @​sobol-sudo!
• Nextjs-Vite: Move vite-plugin-storybook-nextjs into the monorepo - #​35833, thanks @​ndelangen!
• Nextjs-Vite: Recover from Next.js 16.3 raw config cache - #​35882, thanks @​ndelangen!
• Nextjs-Vite: Support % in next/font/local declarations - #​35884, thanks @​ndelangen!
• Nextjs-Vite: Unwrap CJS loadJsConfig on Vite 7 - #​36075, thanks @​ndelangen!
• Nextjs: Replace archived image-size with probe-image-size - #​35881, thanks @​ndelangen!
• OSA: Review fixes for toolsets, skills, and MCP - #​35846, thanks @​JReinhold!
• Open Service: Add delegated mode for Open Service transports - #​35984, thanks @​JReinhold!
• Performance: Halve the tools CLI cold-boot time - #​35951, thanks @​kasperpeulen!
• React: Share a TypeScript DocumentRegistry across component-meta projects - #​35468, thanks @​connorshea!
• Review: Use correct role for footer - #​35434, thanks @​Sidnioulz!
• Search: Add docs headings to search results - #​33593, thanks @​kroeder!
• Search: Show docs stories as docs search result item instead of a story-group search result item - #​35495, thanks @​kroeder!
• Skills M2b: Rework the core toolsets into their intended shape - #​35726, thanks @​kasperpeulen!
• Skills M4: Run addon-mcp and @​storybook/mcp on the shared core toolsets - #​35858, thanks @​JReinhold!
• Skills M5a: CLI: Add the public storybook tools command derived at runtime from the OSA toolsets - #​35850, thanks @​JReinhold!
• TanStack: Carry lazy route bindings onto cloned routes - #​35500, thanks @​unpunnyfuns!
• TanStack: Keep Start's document shell out of stories - #​35504, thanks @​unpunnyfuns!
• TanStack: Select the story leaf by mount path and params - #​35498, thanks @​unpunnyfuns!
• Tanstack: Use dependency chain for deps optimization - #​36101, thanks @​huang-julien!
• Telemetry: Track StyleX as a styling package - #​36091, thanks @​valentinpalkovic!
• Tools: Accept a story ID in docs show-story as an alternative to componentId + storyName - #​36104, thanks @​kasperpeulen!
• Tools: Auto-spawn a project-local child host on fidelity failure - #​35981, thanks @​JReinhold!
• Tools: Default to attach mode, delete MCP proxy - #​35990, thanks @​JReinhold!
• Tools: Flush remote-command ack before the handler's fan-out starts - #​36100, thanks @​kasperpeulen!
• Tools: Implement attached mode in storybook/internal/tools - #​35983, thanks @​JReinhold!
• Tools: Record the dev server's storybook installation and attach through it - #​36117, thanks @​kasperpeulen!
• Tools: Spawn a child host for local mode when cwd differs - #​36052, thanks @​JReinhold!
• UI: Fix missing whitespace in search result breadcrumb - #​36067, thanks @​kroeder!
• Vue3 Vite: Enable Schema Extraction for Vue Component Meta - #​35565, thanks @​dmitriy-prokoshev!
• Vue3: Support TypeScript enum props in vue-component-meta docgen - #​35684, thanks @​valentinpalkovic!
• Vue: Add story-docs provider skeleton - #​35786, thanks @​huang-julien!
• Vue: Allow args to be explictly undefined in story-snippet generation - #​36048, thanks @​huang-julien!
• Vue: Decouple server side docgen from docgen options - #​35920, thanks @​huang-julien!
• Vue: Deprecate vue-docgen-api - [#​35927](https://redirect.github.com/storybookjs/story

[!IMPORTANT]
✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-06T13:28:29.783302Z	32d45d9	New commits
🔒 Security Review	✅ Completed 2026-11-06T13:29:42.759575Z	32d45d9	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 76b63a6f20

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Keep Storybook reachable from the screenshot container

The patched Storybook release now binds its dev server only to 127.0.0.1 by default, but ui/package.json:26 starts it without a host option while the documented local screenshot workflow connects from Docker to http://host.docker.internal:6006 (ui/docker-compose.yml:32). Following ui/CONTRIBUTING.md:77-90 will therefore leave the tester unable to connect; expose the dev server to the container and configure the corresponding allowed host while retaining the new validation.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Upgrade the a11y addon with Storybook core

This upgrades core to 10.6.4 while @storybook/addon-a11y remains locked at 10.5.10 (ui/yarn.lock:3552-3555). The security release changed highlight-menu clicks from the addon's arbitrary EVENTS.SELECT event to HIGHLIGHT_MENU_CLICK, and the matching a11y patch changes its listener accordingly (upstream patch); with the mixed versions, clicking an accessibility highlight's “Learn how to resolve this violation” item is no longer handled. Upgrade the a11y addon to the patched version alongside core.

Useful? React with 👍 / 👎.