Storybook

Component states you open directly, outside the app

Storybook is a frontend workshop for building UI components, and whole pages, away from the application that uses them. Each state of a component is a story that sets the props and context it needs to render: an empty login form and the same form filled in are two separate stories in the Storybook sidebar.

Docs and tests written once, as stories

• The main repository supports React, Angular, Vue 3, Svelte, Preact, Web Components, HTML and Ember. React Native, Qwik, SolidJS, Android, iOS and Flutter go through separate projects.
• Autodocs builds a component's documentation page as soon as one of its stories carries the autodocs tag, pulling in its args, argTypes and parameters.
• Interaction tests live inside the story. Its play function clicks, types or submits a form, then asserts on the result with Testing Library queries.
• The accessibility addon runs on Deque's axe-core, which Deque says catches up to 57% of WCAG issues. It adds a violations panel and a toolbar button that simulates vision impairments.
• A production build is a static web app that any web server can host, so designers and product managers can check the UI without a dev environment.
• An MCP addon, still in preview, gives an AI agent access to component docs, story generation and tests. The docs part only works with React frameworks, angular-vite and vue3-vite.

Storybook 10 requirements and the security patch policy

Storybook 10 needs Node.js 20.19+ or 22.12+. Its packages are ESM-only, and .storybook/main.js|ts has to be valid ESM too. The UI expects at least Chrome 131, Firefox 136 or Safari 18.3; for older browsers, the docs point to a pre-9.0 release or "preview-only" mode.

Component tests through Vitest require a Vite-based Storybook framework. The Vitest addon wants Vitest 3.0 or later and runs stories in Playwright's Chromium, in browser mode. Next.js projects get it only through @storybook/nextjs-vite, on Next.js 14.1 or later. Projects still on Webpack use the test-runner instead.

Storybook's cross-browser visual testing runs on Chromatic, a cloud service from the Storybook team. The addon uploads stories to Chromatic to snapshot and diff them, so a Chromatic account is required. The free plan covers 5,000 billed snapshots a month, on Chrome only. Safari, Firefox and Edge start with the Starter plan at $179 a month.

Roughly one major release a year, and only serious security fixes for the two before it. Version 10.6.4 shipped on October 26, 2026, and 11.0.0 is in alpha (alpha.8 on October 23). Within the current major, only the latest minor gets patches, and 7.x gets none at all. Yet the migration guide suggests staying on 8.x if the version 10 requirements are a blocker, a branch that now receives only high and critical security fixes.

Two dev server vulnerabilities were patched on October 12, 2026. The critical one (CVE-2026-114125) lets a malicious website change files in the project while a dev server is running and open in a browser; built Storybooks are not affected. The high-severity one (CVE-2026-114126) exposes the server's WebSocket token to any machine on the local network. Versions 10.6.2, 9.1.21 and 8.6.19 fix both. An earlier flaw, CVE-2025-68429 from December 2025, could, under specific conditions, bundle variables from a .env file into a published build.