Bump the storybook group with 6 updates - #644
Merged
Merged
Conversation
Bumps the storybook group with 6 updates: | Package | From | To | | --- | --- | --- | | [@storybook/addon-docs](https://github.com/storybookjs/storybook/tree/HEAD/code/addons/docs) | `10.4.6` | `10.5.4` | | [@storybook/addon-links](https://github.com/storybookjs/storybook/tree/HEAD/code/addons/links) | `10.4.6` | `10.5.4` | | [@storybook/addon-onboarding](https://github.com/storybookjs/storybook/tree/HEAD/code/addons/onboarding) | `10.4.6` | `10.5.4` | | [@storybook/addon-themes](https://github.com/storybookjs/storybook/tree/HEAD/code/addons/themes) | `10.4.6` | `10.5.4` | | [@storybook/react-vite](https://github.com/storybookjs/storybook/tree/HEAD/code/frameworks/react-vite) | `10.4.6` | `10.5.4` | | [storybook](https://github.com/storybookjs/storybook/tree/HEAD/code/core) | `10.4.6` | `10.5.4` | Updates `@storybook/addon-docs` from 10.4.6 to 10.5.4 - [Release notes](https://github.com/storybookjs/storybook/releases) - [Changelog](https://github.com/storybookjs/storybook/blob/next/CHANGELOG.md) - [Commits](https://github.com/storybookjs/storybook/commits/v10.5.4/code/addons/docs) Updates `@storybook/addon-links` from 10.4.6 to 10.5.4 - [Release notes](https://github.com/storybookjs/storybook/releases) - [Changelog](https://github.com/storybookjs/storybook/blob/next/CHANGELOG.md) - [Commits](https://github.com/storybookjs/storybook/commits/v10.5.4/code/addons/links) Updates `@storybook/addon-onboarding` from 10.4.6 to 10.5.4 - [Release notes](https://github.com/storybookjs/storybook/releases) - [Changelog](https://github.com/storybookjs/storybook/blob/next/CHANGELOG.md) - [Commits](https://github.com/storybookjs/storybook/commits/v10.5.4/code/addons/onboarding) Updates `@storybook/addon-themes` from 10.4.6 to 10.5.4 - [Release notes](https://github.com/storybookjs/storybook/releases) - [Changelog](https://github.com/storybookjs/storybook/blob/next/CHANGELOG.md) - [Commits](https://github.com/storybookjs/storybook/commits/v10.5.4/code/addons/themes) Updates `@storybook/react-vite` from 10.4.6 to 10.5.4 - [Release notes](https://github.com/storybookjs/storybook/releases) - [Changelog](https://github.com/storybookjs/storybook/blob/next/CHANGELOG.md) - [Commits](https://github.com/storybookjs/storybook/commits/v10.5.4/code/frameworks/react-vite) Updates `storybook` from 10.4.6 to 10.5.4 - [Release notes](https://github.com/storybookjs/storybook/releases) - [Changelog](https://github.com/storybookjs/storybook/blob/next/CHANGELOG.md) - [Commits](https://github.com/storybookjs/storybook/commits/v10.5.4/code/core) --- updated-dependencies: - dependency-name: "@storybook/addon-docs" dependency-version: 10.5.4 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: storybook - dependency-name: "@storybook/addon-links" dependency-version: 10.5.4 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: storybook - dependency-name: "@storybook/addon-onboarding" dependency-version: 10.5.4 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: storybook - dependency-name: "@storybook/addon-themes" dependency-version: 10.5.4 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: storybook - dependency-name: "@storybook/react-vite" dependency-version: 10.5.4 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: storybook - dependency-name: storybook dependency-version: 10.5.4 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: storybook ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
bgentry
approved these changes
Aug 1, 2026
bgentry
left a comment
bgentry
left a comment
Contributor
There was a problem hiding this comment.
🤖 Codex review: Approved after dependency security and compatibility review.
Upgrade
- Storybook group:
10.4.6→10.5.4(six direct packages) - Reviewed head:
8c27a911c04cdb50b3638d0b9008810b53e75d22
Security review
- Exact old/new tarballs for the six direct packages and changed Storybook transitives match the lockfile SHA-512 values; the new Storybook artifacts retain canonical repository, license, maintainer, registry-signature, and npm SLSA provenance metadata.
- The lockfile adds seven paths, removes ten, and changes sixteen. It introduces no install hooks, bin changes, native/WASM payloads, platform-gated packages, non-registry URLs, weak hashes, or same-version integrity rewrites.
@testing-library/domreplaces Chalk with existingpicocolors; newjsonc-parser@3.3.1is a pure-JavaScript Microsoft package with no consumer lifecycle hook.- Targeted source/artifact scans found no credential harvesting, downloader, unexpected service, obfuscated native payload, or advisory affecting the exact new versions.
Compatibility verification
npm ci— passed with zero audit vulnerabilities.npm audit signatures— 482 registry signatures and 181 attestations verified.npm run lint— passed.npm run test:once— 34 files and 229 tests passed.npm run build— passed.npm run build-storybook— passed on Storybook 10.5.4.- Required Go/JS CI and both public
riveruiarchitecture image builds passed. Theriverprouijob fails before build because Dependabot cannot assume the AWS OIDC role.
Residual risk
- Storybook core is a large generated artifact and was capability-scanned and selectively inspected rather than manually audited byte-for-byte. No blocking issue was identified.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the storybook group with 6 updates:
10.4.610.5.410.4.610.5.410.4.610.5.410.4.610.5.410.4.610.5.410.4.610.5.4Updates
@storybook/addon-docsfrom 10.4.6 to 10.5.4Release notes
Sourced from @storybook/addon-docs's releases.
... (truncated)
Changelog
Sourced from @storybook/addon-docs's changelog.
... (truncated)
Commits
3327dc4Bump version from "10.5.3" to "10.5.4" [skip ci]9ac2739Bump version from "10.5.2" to "10.5.3" [skip ci]b4b00f2Merge pull request #34971 from storybookjs/valentin/upgrade-typescript-6518f711Bump version from "10.5.1" to "10.5.2" [skip ci]c253a06Bump version from "10.5.0" to "10.5.1" [skip ci]9dafcd2Bump version from "10.5.0-beta.2" to "10.5.0" [skip ci]448db85Bump version from "10.5.0-beta.1" to "10.5.0-beta.2" [skip ci]a4ce979Bump version from "10.5.0-beta.0" to "10.5.0-beta.1" [skip ci]f0bf138Bump version from "10.5.0-alpha.11" to "10.5.0-beta.0" [skip ci]fac05a5Bump version from "10.5.0-alpha.10" to "10.5.0-alpha.11" [skip ci]Updates
@storybook/addon-linksfrom 10.4.6 to 10.5.4Release notes
Sourced from @storybook/addon-links's releases.
... (truncated)
Changelog
Sourced from @storybook/addon-links's changelog.
... (truncated)
Commits
3327dc4Bump version from "10.5.3" to "10.5.4" [skip ci]9ac2739Bump version from "10.5.2" to "10.5.3" [skip ci]b4b00f2Merge pull request #34971 from storybookjs/valentin/upgrade-typescript-6518f711Bump version from "10.5.1" to "10.5.2" [skip ci]c253a06Bump version from "10.5.0" to "10.5.1" [skip ci]9dafcd2Bump version from "10.5.0-beta.2" to "10.5.0" [skip ci]448db85Bump version from "10.5.0-beta.1" to "10.5.0-beta.2" [skip ci]a4ce979Bump version from "10.5.0-beta.0" to "10.5.0-beta.1" [skip ci]f0bf138Bump version from "10.5.0-alpha.11" to "10.5.0-beta.0" [skip ci]fac05a5Bump version from "10.5.0-alpha.10" to "10.5.0-alpha.11" [skip ci]Updates
@storybook/addon-onboardingfrom 10.4.6 to 10.5.4Release notes
Sourced from @storybook/addon-onboarding's releases.
... (truncated)
Changelog
Sourced from @storybook/addon-onboarding's changelog.
... (truncated)
Commits
3327dc4Bump version from "10.5.3" to "10.5.4" [skip ci]9ac2739Bump version from "10.5.2" to "10.5.3" [skip ci]b4b00f2Merge pull request #34971 from storybookjs/valentin/upgrade-typescript-6518f711Bump version from "10.5.1" to "10.5.2" [skip ci]c253a06Bump version from "10.5.0" to "10.5.1" [skip ci]9dafcd2Bump version from "10.5.0-beta.2" to "10.5.0" [skip ci]448db85Bump version from "10.5.0-beta.1" to "10.5.0-beta.2" [skip ci]a4ce979Bump version from "10.5.0-beta.0" to "10.5.0-beta.1" [skip ci]f0bf138Bump version from "10.5.0-alpha.11" to "10.5.0-beta.0" [skip ci]fac05a5Bump version from "10.5.0-alpha.10" to "10.5.0-alpha.11" [skip ci]Updates
@storybook/addon-themesfrom 10.4.6 to 10.5.4Release notes
Sourced from @storybook/addon-themes's releases.
... (truncated)
Changelog
Sourced from @storybook/addon-themes's changelog.
... (truncated)
Commits
3327dc4Bump version from "10.5.3" to "10.5.4" [skip ci]9ac2739Bump version from "10.5.2" to "10.5.3" [skip ci]b4b00f2Merge pull request #34971 from storybookjs/valentin/upgrade-typescript-6518f711Bump version from "10.5.1" to "10.5.2" [skip ci]c253a06Bump version from "10.5.0" to "10.5.1" [skip ci]9dafcd2Bump version from "10.5.0-beta.2" to "10.5.0" [skip ci]448db85Bump version from "10.5.0-beta.1" to "10.5.0-beta.2" [skip ci]a4ce979Bump version from "10.5.0-beta.0" to "10.5.0-beta.1" [skip ci]f0bf138Bump version from "10.5.0-alpha.11" to "10.5.0-beta.0" [skip ci]fac05a5Bump version from "10.5.0-alpha.10" to "10.5.0-alpha.11" [skip ci]Updates
@storybook/react-vitefrom 10.4.6 to 10.5.4Release notes
Sourced from @storybook/react-vite's releases.
... (truncated)
Changelog
Sourced from @storybook/react-vite's changelog.