Upgrading @storybook/addon-links 9 to 10
Breaking9.1.21 → 10.6.5Breaking14Security9Platform2Deprecated4New164Changed279Fixed451Other54
Fetching 214 releases from GitHub…212 / 214
BreakingUpgrade verdict
14 breaking changes and 2 platform requirement changes and 9 security fixes.
In plain terms
- Drops skills get and skills list subcommands and adds skills --all.
- Defaults to attach mode and deletes the MCP proxy.
- Removes the extensive prompt option.
- Renames experimentalComponentsManifest to componentsManifest and defaults it to true.
Must act Top 5 of 29 that need code or config changes
What you must change
Breaking14
Drops skills get and skills list subcommands and adds skills --all.
skills getskills listskills --allDefaults to attach mode and deletes the MCP proxy.
MCP proxyRemoves the extensive prompt option.
Renames experimentalComponentsManifest to componentsManifest and defaults it to true.
experimentalComponentsManifestcomponentsManifestRemoves the return type of
getAbsolutePath in the CLI.getAbsolutePathRemoves the REACT_PROJECT projectType from the CLI.
REACT_PROJECTRenames the Listbox component to ActionList and uses it in TagsFilterPanel.
ListboxActionListTagsFilterPanelRemoves CJS bundles and only ships ESM.
Removes the experimental Playwright CT integration.
Removes the Outlet mock from TanStack support.
OutletMoves Next.js image configuration from FrameworkOptions to parameters.
FrameworkOptionsRefactors from componentManifestGenerator to an extensible manifests preset property.
componentManifestGeneratormanifestsStorybook 10 is ESM-only, simplifying distribution and reducing install size by 29% while unminifying dist code for easier debugging.
Removes undocumented x-only tags.
Security9
Patches GHSA-f2ph-cmg5-wxc8 and GHSA-px85-f4q5-jh77.
Adds a security token to the instance registry record.
Allows token-only WebSocket upgrade without an Origin header.
Bumps Vitest to 4.1.6 to address CVE-2026-47428.
VitestUpgrades the ws dependency to fix security advisories.
wsEnsures serialize-javascript is at the latest version.
serialize-javascriptAdds host/origin validation to requests and websocket connections in Core.
Sanitizes inputs for save from controls in Core.
Requires a token for websocket connections in Core.
Platform2
Angular-Vite drops the @angular/platform-browser-dynamic peer dependency.
@angular/platform-browser-dynamicAngular-Vite widens the TypeScript peer dependency range to support TypeScript 6.
typescriptDeprecations to plan for
Deprecated4
Deprecates vue-docgen-api.
vue-docgen-apiDeprecates ExternalDocs.
ExternalDocsWarns when the legacy defaultViewport parameter is used.
defaultViewportMarks pnp support as deprecated.
pnpAPI changes
Generated by DepDelta from published .d.ts files. Not mixed with prose notes.
- removed:
const default: () => storybook_internal_csf.PreviewAddon<storybook_internal_csf.AddonTypes> - added:
function default(): import('storybook/internal/csf').PreviewAddon<import('storybook/internal/csf').AddonTypes>