storybookjs · github-actions · Jun 7, 2026 · Jun 9, 2026 · Jun 9, 2026 · Jun 9, 2026
diff --git a/.github/actions/setup-node-and-install/action.yml b/.github/actions/setup-node-and-install/action.yml
@@ -11,7 +11,7 @@ runs:
   using: 'composite'
   steps:
     - name: Setup Node.js
-      uses: actions/setup-node@v4
+      uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
       with:
         node-version-file: '.nvmrc'
 
@@ -23,7 +23,7 @@ runs:
     # runner-internal token that bypasses `permissions:`, so splitting is the only
     # reliable way to prevent pull_request_target runs from poisoning the shared cache.
     - name: Restore cached dependencies
-      uses: actions/cache/restore@v4
+      uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
       with:
         path: |
           ~/.yarn/berry/cache
@@ -45,7 +45,7 @@ runs:
 
     - name: Save cached dependencies
       if: github.event_name != 'pull_request_target'
-      uses: actions/cache/save@v4
+      uses: actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
       with:
         path: |
           ~/.yarn/berry/cache

diff --git a/.github/workflows/generate-sandboxes.yml b/.github/workflows/generate-sandboxes.yml
@@ -76,7 +76,7 @@ jobs:
           ref: ${{ matrix.branch }}
           persist-credentials: false
 
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e #6.4.0
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version-file: '.nvmrc'
 

diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
@@ -6,14 +6,14 @@ on:
   pull_request:
     branches: ['**']
 
-permissions: {}
+permissions:
+  contents: read
+  security-events: write # Required for upload-sarif (used by zizmor-action) to upload SARIF files.
 
 jobs:
   zizmor:
     name: zizmor latest via PyPI
     runs-on: ubuntu-latest
-    permissions:
-      security-events: write # Required for upload-sarif (used by zizmor-action) to upload SARIF files.
     steps:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -27,8 +27,6 @@ jobs:
 
       - name: Run zizmor 🌈
         run: uvx zizmor --format=sarif . > results.sarif
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Upload SARIF file
         uses: github/codeql-action/upload-sarif@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0

diff --git a/AGENTS.md b/AGENTS.md
@@ -258,7 +258,7 @@ Do **not** use `/tmp` paths or replace `node:fs/promises` with a full async fact
 
 After changing files:
 
-1. Format with `yarn fmt:write` (run from the repo root)
+1. **Always** format with `yarn fmt:write`, run from the `code/` directory (`cd code && yarn fmt:write`), once you are done editing. The repo uses `oxfmt`, so hand-written formatting will frequently be wrong — do not skip this step.
 2. Lint with `yarn --cwd code lint:js:cmd <file-relative-to-code-folder> --fix` or `cd code && yarn lint:js:cmd <file-relative-to-code-folder>`
 3. Run relevant tests before submitting a PR
 

diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,3 +1,15 @@
+## 10.4.4
+
+- Preview: Stop mixed CSF3+4 stories getting core annotations injected twice - [#35094](https://github.com/storybookjs/storybook/pull/35094), thanks @JReinhold!
+- Telemetry: Add timeout to event-log POST to prevent build hang - [#35085](https://github.com/storybookjs/storybook/pull/35085), thanks @badams!
+
+## 10.4.3
+
+- Addon Docs: Fix Primary and Controls blocks not rendering in custom MDX pages - [#34496](https://github.com/storybookjs/storybook/pull/34496), thanks @NYCU-Chung!
+- Core: Respect !dev tag on MDX docs in sidebar - [#35031](https://github.com/storybookjs/storybook/pull/35031), thanks @JReinhold!
+- React: Add support for resolving subcomponents attached as properties of a parent component - [#34967](https://github.com/storybookjs/storybook/pull/34967), thanks @yatishgoel!
+- UI: Prevent docs page scroll reset on HMR re-render - [#35021](https://github.com/storybookjs/storybook/pull/35021), thanks @LongTangGithub!
+
 ## 10.4.2
 
 - Bug: Fix Windows command resolution for non-Node package managers - [#33534](https://github.com/storybookjs/storybook/pull/33534), thanks @copilot-swe-agent!

diff --git a/CHANGELOG.prerelease.md b/CHANGELOG.prerelease.md
@@ -1,3 +1,14 @@
+## 10.5.0-alpha.7
+
+- CLI: Add `storybook ai <tool>` MCP passthrough behind `STORYBOOK_FEATURE_AI_CLI` - [#35125](https://github.com/storybookjs/storybook/pull/35125), thanks @kasperpeulen!
+- CLI: Add telemetry for the `storybook ai <command>` passthrough - [#35138](https://github.com/storybookjs/storybook/pull/35138), thanks @kasperpeulen!
+- CLI: Bundle the `ai` command in core so it never downloads `@storybook/cli` - [#35147](https://github.com/storybookjs/storybook/pull/35147), thanks @kasperpeulen!
+- Docgen: Register service runtime, payload argTypes - [#35108](https://github.com/storybookjs/storybook/pull/35108), thanks @JReinhold!
+- Docs: Route ArgTypes and Controls through docgen service when flag enabled - [#35109](https://github.com/storybookjs/storybook/pull/35109), thanks @JReinhold!
+- Open Service: Mark module-graph engine commands as internal - [#35144](https://github.com/storybookjs/storybook/pull/35144), thanks @JReinhold!
+- Telemetry: Preserve state machine when the module loads more than once - [#35140](https://github.com/storybookjs/storybook/pull/35140), thanks @kasperpeulen!
+- Viewport: Warn when legacy `defaultViewport` parameter is used - [#35087](https://github.com/storybookjs/storybook/pull/35087), thanks @yatishgoel!
+
 ## 10.5.0-alpha.6
 
 - Controls: Guard normalizeOptions against array labels and prototype chain lookups - [#34664](https://github.com/storybookjs/storybook/pull/34664), thanks @creazyfrog!

diff --git a/code/.storybook/main.ts b/code/.storybook/main.ts
@@ -156,7 +156,9 @@ const config = defineMain({
   features: {
     developmentModeForBuild: true,
     experimentalTestSyntax: true,
-    experimentalDocgenServer: true,
+    // Disabled for now: the docgen service does not yet work in production builds. Keeping it off
+    // ensures this branch exercises the normal (non-experimental) docgen path without regressions.
+    experimentalDocgenServer: false,
     experimentalReactComponentMeta: true,
     changeDetection: true,
   },

diff --git a/code/addons/docs/src/blocks/blocks/ArgTypes.mdx b/code/addons/docs/src/blocks/blocks/ArgTypes.mdx
@@ -0,0 +1,73 @@
+import { Meta } from '@storybook/addon-docs/blocks';
+
+import * as ArgTypesStories from './ArgTypes.stories.tsx';
+import * as ExampleStories from '../examples/ArgTypesParameters.stories';
+import * as SubcomponentsExampleStories from '../examples/ArgTypesWithSubcomponentsParameters.stories';
+
+import { ArgTypes } from './ArgTypes';
+
+<Meta of={ArgTypesStories} />
+
+# ArgTypes block (MDX)
+
+Each section below uses the `ArgTypes` block the same way as the matching story in `ArgTypes.stories.tsx`.
+
+## OfComponent
+
+<ArgTypes of={ExampleStories.default.component} />
+
+## OfMeta
+
+<ArgTypes of={ExampleStories.default} />
+
+## OfStory
+
+<ArgTypes of={ExampleStories.NoParameters} />
+
+## IncludeProp
+
+<ArgTypes of={ExampleStories.NoParameters} include={['a']} />
+
+## IncludeParameter
+
+<ArgTypes of={ExampleStories.Include} />
+
+## ExcludeProp
+
+<ArgTypes of={ExampleStories.NoParameters} exclude={['a']} />
+
+## ExcludeParameter
+
+<ArgTypes of={ExampleStories.Exclude} />
+
+## SortProp
+
+<ArgTypes of={ExampleStories.NoParameters} sort="alpha" />
+
+## SortParameter
+
+<ArgTypes of={ExampleStories.Sort} />
+
+## Categories
+
+<ArgTypes of={ExampleStories.Categories} />
+
+## SubcomponentsOfMeta
+
+<ArgTypes of={SubcomponentsExampleStories.default} />
+
+## SubcomponentsOfStory
+
+<ArgTypes of={SubcomponentsExampleStories.NoParameters} />
+
+## SubcomponentsIncludeProp
+
+<ArgTypes of={SubcomponentsExampleStories.NoParameters} include={['a', 'f']} />
+
+## SubcomponentsExcludeProp
+
+<ArgTypes of={SubcomponentsExampleStories.NoParameters} exclude={['a', 'c', 'f', 'g']} />
+
+## SubcomponentsSortProp
+
+<ArgTypes of={SubcomponentsExampleStories.NoParameters} sort="alpha" />
diff --git a/code/addons/docs/src/blocks/blocks/ArgTypes.stories.tsx b/code/addons/docs/src/blocks/blocks/ArgTypes.stories.tsx
@@ -1,16 +1,13 @@
-import React from 'react';
-
+/** Custom docs page: {@link ./ArgTypes.mdx} (attached via `<Meta of={...} />`). */
 import type { PlayFunctionContext } from 'storybook/internal/csf';
 
 import type { Meta, StoryObj } from '@storybook/react-vite';
 
-import { within } from 'storybook/test';
-
 import * as ExampleStories from '../examples/ArgTypesParameters.stories';
 import * as SubcomponentsExampleStories from '../examples/ArgTypesWithSubcomponentsParameters.stories';
 import { ArgTypes } from './ArgTypes';
 
-const meta: Meta<typeof ArgTypes> = {
+const meta = {
   title: 'Blocks/ArgTypes',
   component: ArgTypes,
   parameters: {
@@ -21,7 +18,8 @@ const meta: Meta<typeof ArgTypes> = {
     ],
     docsStyles: true,
   },
-};
+} satisfies Meta<typeof ArgTypes>;
+
 export default meta;
 
 type Story = StoryObj<typeof meta>;
@@ -108,7 +106,7 @@ export const Categories: Story = {
 };
 
 const findSubcomponentTabs = async (
-  canvas: ReturnType<typeof within>,
+  canvas: Parameters<NonNullable<Story['play']>>[0]['canvas'],
   step: PlayFunctionContext['step']
 ) => {
   let subcomponentATab: HTMLElement | null = null;
@@ -124,26 +122,26 @@ export const SubcomponentsOfMeta: Story = {
   args: {
     of: SubcomponentsExampleStories.default,
   },
-  play: async ({ canvasElement, step }) => {
-    const canvas = within(canvasElement);
+  play: async ({ canvas, step }) => {
     await findSubcomponentTabs(canvas, step);
   },
 };
 
 export const SubcomponentsOfStory: Story = {
-  ...SubcomponentsOfMeta,
   args: {
     of: SubcomponentsExampleStories.NoParameters,
   },
+  play: async ({ canvas, step }) => {
+    await findSubcomponentTabs(canvas, step);
+  },
 };
 
 export const SubcomponentsIncludeProp: Story = {
   args: {
     of: SubcomponentsExampleStories.NoParameters,
     include: ['a', 'f'],
   },
-  play: async ({ canvasElement, step }) => {
-    const canvas = within(canvasElement);
+  play: async ({ canvas, step }) => {
     const { subcomponentBTab } = await findSubcomponentTabs(canvas, step);
     if (subcomponentBTab) {
       await (subcomponentBTab as HTMLElement & { click: () => Promise<void> }).click();