Skip to content

Upgrading @storybook/addon-links 9 to 10

Breaking9.1.21 → 10.6.5Breaking14Security9Platform2Deprecated4New164Changed279Fixed451Other54

Fetching 214 releases from GitHub…212 / 214
BreakingUpgrade verdict

14 breaking changes and 2 platform requirement changes and 9 security fixes.

  • Drops skills get and skills list subcommands and adds skills --all.
  • Defaults to attach mode and deletes the MCP proxy.
  • Removes the extensive prompt option.
  • Renames experimentalComponentsManifest to componentsManifest and defaults it to true.
Top 5 of 29 that need code or config changes
Breaking14
Drops skills get and skills list subcommands and adds skills --all.
skills getskills listskills --all
Defaults to attach mode and deletes the MCP proxy.
MCP proxy
Removes the extensive prompt option.
Renames experimentalComponentsManifest to componentsManifest and defaults it to true.
experimentalComponentsManifestcomponentsManifest
Removes the return type of getAbsolutePath in the CLI.
getAbsolutePath
Removes the REACT_PROJECT projectType from the CLI.
REACT_PROJECT
Renames the Listbox component to ActionList and uses it in TagsFilterPanel.
ListboxActionListTagsFilterPanel
Removes CJS bundles and only ships ESM.
Removes the experimental Playwright CT integration.
Removes the Outlet mock from TanStack support.
Outlet
Moves Next.js image configuration from FrameworkOptions to parameters.
FrameworkOptions
Refactors from componentManifestGenerator to an extensible manifests preset property.
componentManifestGeneratormanifests
Storybook 10 is ESM-only, simplifying distribution and reducing install size by 29% while unminifying dist code for easier debugging.
Removes undocumented x-only tags.
Security9
Patches GHSA-f2ph-cmg5-wxc8 and GHSA-px85-f4q5-jh77.
Adds a security token to the instance registry record.
Allows token-only WebSocket upgrade without an Origin header.
Bumps Vitest to 4.1.6 to address CVE-2026-47428.
Vitest
Upgrades the ws dependency to fix security advisories.
ws
Ensures serialize-javascript is at the latest version.
serialize-javascript
Adds host/origin validation to requests and websocket connections in Core.
Sanitizes inputs for save from controls in Core.
Requires a token for websocket connections in Core.
Platform2
Angular-Vite drops the @angular/platform-browser-dynamic peer dependency.
@angular/platform-browser-dynamic
Angular-Vite widens the TypeScript peer dependency range to support TypeScript 6.
typescript
Deprecated4
Deprecates vue-docgen-api.
vue-docgen-api
Deprecates ExternalDocs.
ExternalDocs
Warns when the legacy defaultViewport parameter is used.
defaultViewport
Marks pnp support as deprecated.
pnp

Generated by DepDelta from published .d.ts files. Not mixed with prose notes.

  • removed: const default: () => storybook_internal_csf.PreviewAddon<storybook_internal_csf.AddonTypes>
  • added: function default(): import('storybook/internal/csf').PreviewAddon<import('storybook/internal/csf').AddonTypes>