Bump the storybook group across 1 directory with 7 updates - #673
Merged
Conversation
dependabot
Bot
added
dependencies
bgentry
approved these changes
Sep 1, 2026
bgentry
left a comment
bgentry
left a comment
Contributor
There was a problem hiding this comment.
🤖 Codex review: Approved after dependency security and compatibility review.
Upgrade
- Storybook group: 7 direct updates from
10.5.4to10.5.10, plus
@chromatic-com/storybook5.2.1→5.3.0 - Reviewed head:
ea80cf6157f1b0c3f7b2b7279367ed9377d1acf1
Security review
- Downloaded and compared 72 exact old/new npm artifacts covering all direct
packages, changed Storybook internals, Chromatic, emnapi, Oxc resolver and
its 19 platform bindings, andws. Every byte hash matches the lockfile's
canonical-registry SHA-512 integrity. - The lock changes 5 paths added, 6 removed, and 32 changed, with no lifecycle-
hook or bin changes, integrity rewrites, non-registry sources, or new
downloader. Direct packages and major transitives retain canonical sources,
publishers, registry signatures, and (exceptws) npm SLSA provenance. - Source changes match Storybook/Chromatic diagnostics, docgen, tsconfig,
resolver, and UI behavior. No new credential or secret access appeared.
This is routine maintenance rather than a known vulnerable-to-fixed update;
the base lock already contains fixedwsand Vitest versions.
Compatibility verification
npm ci— passednpm run lint— passednpm run test:once— passed (34 files, 233 tests)npm run build— passednpm run build-storybook— passed with Storybook 10.5.10- Tracked files remained unchanged. GitHub's JavaScript, Go, lint, release,
and public image checks are also green; the private image failure is the
queue-wide Dependabot AWS credential limitation.
Residual risk
- Low: Oxc's native/WASI payloads and large generated Storybook/Chromatic
bundles cannot be semantically source-diffed without reproducible builds.
Chromatic 18.5 can upload additional diagnostics/Storybook metadata when
TurboSnap is enabled; River does not currently enable that path and the
behavior can be disabled withuploadMetadata: false.
Bumps the storybook group with 7 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@chromatic-com/storybook](https://github.com/chromaui/addon-visual-tests) | `5.2.1` | `5.3.0` | | [@storybook/addon-docs](https://github.com/storybookjs/storybook/tree/HEAD/code/addons/docs) | `10.5.4` | `10.5.10` | | [@storybook/addon-links](https://github.com/storybookjs/storybook/tree/HEAD/code/addons/links) | `10.5.4` | `10.5.10` | | [@storybook/addon-onboarding](https://github.com/storybookjs/storybook/tree/HEAD/code/addons/onboarding) | `10.5.4` | `10.5.10` | | [@storybook/addon-themes](https://github.com/storybookjs/storybook/tree/HEAD/code/addons/themes) | `10.5.4` | `10.5.10` | | [@storybook/react-vite](https://github.com/storybookjs/storybook/tree/HEAD/code/frameworks/react-vite) | `10.5.4` | `10.5.10` | | [storybook](https://github.com/storybookjs/storybook/tree/HEAD/code/core) | `10.5.4` | `10.5.10` | Updates `@chromatic-com/storybook` from 5.2.1 to 5.3.0 - [Release notes](https://github.com/chromaui/addon-visual-tests/releases) - [Changelog](https://github.com/chromaui/addon-visual-tests/blob/v5.3.0/CHANGELOG.md) - [Commits](chromaui/addon-visual-tests@v5.2.1...v5.3.0) Updates `@storybook/addon-docs` from 10.5.4 to 10.5.10 - [Release notes](https://github.com/storybookjs/storybook/releases) - [Changelog](https://github.com/storybookjs/storybook/blob/next/CHANGELOG.md) - [Commits](https://github.com/storybookjs/storybook/commits/v10.5.10/code/addons/docs) Updates `@storybook/addon-links` from 10.5.4 to 10.5.10 - [Release notes](https://github.com/storybookjs/storybook/releases) - [Changelog](https://github.com/storybookjs/storybook/blob/next/CHANGELOG.md) - [Commits](https://github.com/storybookjs/storybook/commits/v10.5.10/code/addons/links) Updates `@storybook/addon-onboarding` from 10.5.4 to 10.5.10 - [Release notes](https://github.com/storybookjs/storybook/releases) - [Changelog](https://github.com/storybookjs/storybook/blob/next/CHANGELOG.md) - [Commits](https://github.com/storybookjs/storybook/commits/v10.5.10/code/addons/onboarding) Updates `@storybook/addon-themes` from 10.5.4 to 10.5.10 - [Release notes](https://github.com/storybookjs/storybook/releases) - [Changelog](https://github.com/storybookjs/storybook/blob/next/CHANGELOG.md) - [Commits](https://github.com/storybookjs/storybook/commits/v10.5.10/code/addons/themes) Updates `@storybook/react-vite` from 10.5.4 to 10.5.10 - [Release notes](https://github.com/storybookjs/storybook/releases) - [Changelog](https://github.com/storybookjs/storybook/blob/next/CHANGELOG.md) - [Commits](https://github.com/storybookjs/storybook/commits/v10.5.10/code/frameworks/react-vite) Updates `storybook` from 10.5.4 to 10.5.10 - [Release notes](https://github.com/storybookjs/storybook/releases) - [Changelog](https://github.com/storybookjs/storybook/blob/next/CHANGELOG.md) - [Commits](https://github.com/storybookjs/storybook/commits/v10.5.10/code/core) --- updated-dependencies: - dependency-name: "@chromatic-com/storybook" dependency-version: 5.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: storybook - dependency-name: "@storybook/addon-docs" dependency-version: 10.5.10 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: storybook - dependency-name: "@storybook/addon-links" dependency-version: 10.5.10 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: storybook - dependency-name: "@storybook/addon-onboarding" dependency-version: 10.5.10 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: storybook - dependency-name: "@storybook/addon-themes" dependency-version: 10.5.10 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: storybook - dependency-name: "@storybook/react-vite" dependency-version: 10.5.10 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: storybook - dependency-name: storybook dependency-version: 10.5.10 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: storybook ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
changed the title
dependabot
Bot
force-pushed
the
dependabot/npm_and_yarn/storybook-5666b0e6ab
branch
from
September 2, 2026 02:06
ea80cf6 to
b1a53a9
Compare
bgentry
approved these changes
Sep 2, 2026
bgentry
left a comment
bgentry
left a comment
Contributor
There was a problem hiding this comment.
Codex rebase delta review — approve
Revalidated exact rebased head b1a53a98e3dc932db9a18144d1e4dcb636cf7bf7 after the preceding dependency merges.
The PR still changes only package.json and package-lock.json and retains the same seven reviewed direct Storybook updates and exact registry artifact identities. The regenerated lock incorporates the already-reviewed merged development-dependency base plus the previously reviewed Storybook/Chromatic/Oxc transitive updates. Structural comparison found no lifecycle-script changes, non-registry resolutions, weak integrity, or unexpected executable surface.
All normal CI, JavaScript checks, release, and public amd64/arm64 image builds pass on this head. The only failures are the known private riverproui OIDC image builds; their manifest and prefetch jobs consequently skip. Security findings and residual native/generated-artifact risk are unchanged from the original review.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the storybook group with 7 updates in the / directory:
5.2.15.3.010.5.410.5.1010.5.410.5.1010.5.410.5.1010.5.410.5.1010.5.410.5.1010.5.410.5.10Updates
@chromatic-com/storybookfrom 5.2.1 to 5.3.0Release notes
Sourced from @chromatic-com/storybook's releases.
... (truncated)
Changelog
Sourced from @chromatic-com/storybook's changelog.
Commits
73d1ea7Bump version to: 5.3.0 [skip ci]ede1bf7Update CHANGELOG.md [skip ci]b918426Merge pull request #445 from chromaui/next737bc01Merge pull request #450 from chromaui/ghengeveld/pin-checkout-action-sha894b2eePin actions/checkout to a commit SHA in Chromatic workflow2414392Merge pull request #443 from chromaui/shilman/fix-share-actions09f0c93Lintingfc2fda1Include signedIn on openShare telemetry11c0a9aUse SHARE_TELEMETRY constant in SharePopup tests005a099Align SharePopup screen names with Authentication telemetryUpdates
@storybook/addon-docsfrom 10.5.4 to 10.5.10Release notes
Sourced from @storybook/addon-docs's releases.
... (truncated)
Changelog
Sourced from @storybook/addon-docs's changelog.
Commits
a2db752Bump version from "10.5.9" to "10.5.10" [skip ci]8f56104Bump version from "10.5.8" to "10.5.9" [skip ci]6ef7d1aBump version from "10.5.7" to "10.5.8" [skip ci]7c6fb3aBump version from "10.5.6" to "10.5.7" [skip ci]3126f0aBump version from "10.5.5" to "10.5.6" [skip ci]05a52b7Bump version from "10.5.4" to "10.5.5" [skip ci]Updates
@storybook/addon-linksfrom 10.5.4 to 10.5.10Release notes
Sourced from @storybook/addon-links's releases.
... (truncated)
Changelog
Sourced from @storybook/addon-links's changelog.
Commits
a2db752Bump version from "10.5.9" to "10.5.10" [skip ci]8f56104Bump version from "10.5.8" to "10.5.9" [skip ci]6ef7d1aBump version from "10.5.7" to "10.5.8" [skip ci]7c6fb3aBump version from "10.5.6" to "10.5.7" [skip ci]3126f0aBump version from "10.5.5" to "10.5.6" [skip ci]05a52b7Bump version from "10.5.4" to "10.5.5" [skip ci]Updates
@storybook/addon-onboardingfrom 10.5.4 to 10.5.10Release notes
Sourced from @storybook/addon-onboarding's releases.
... (truncated)
Changelog
Sourced from @storybook/addon-onboarding's changelog.
Commits
a2db752Bump version from "10.5.9" to "10.5.10" [skip ci]8f56104Bump version from "10.5.8" to "10.5.9" [skip ci]6ef7d1aBump version from "10.5.7" to "10.5.8" [skip ci]7c6fb3aBump version from "10.5.6" to "10.5.7" [skip ci]3126f0aBump version from "10.5.5" to "10.5.6" [skip ci]05a52b7Bump version from "10.5.4" to "10.5.5" [skip ci]Updates
@storybook/addon-themesfrom 10.5.4 to 10.5.10Release notes
Sourced from @storybook/addon-themes's releases.