Skip to content

Core: Accept legacy addon namespaces in CSF factories - #35658

Merged
valentinpalkovic merged 8 commits into
storybookjs:nextfrom
wanxiankai:fix/csf-factories-addon-namespaces
Oct 7, 2026
Merged

valentinpalkovic merged 8 commits into
storybookjs:nextfrom
wanxiankai:fix/csf-factories-addon-namespaces

Conversation

@wanxiankai

@wanxiankai wanxiankai commented Jul 29, 2026 •

Copy link
Copy Markdown
Contributor

Closes #35571

What I did

  • Allow CSF factory addon arrays to accept legacy preview annotation namespace objects while preserving type inference from factory-based addons.
  • Add regression coverage for legacy namespace composition and mixed legacy/factory addon inference.

Checklist for Contributors

Testing

The changes in this PR are covered in the following automated tests:

  • stories
  • unit tests
  • integration tests
  • end-to-end tests

Manual testing

  1. In a React Storybook project using CSF factories, register a third-party addon whose /preview entry is imported as a namespace.
  2. Run npx storybook automigrate csf-factories.
  3. Run the project's TypeScript check and confirm the generated definePreview({ addons: [...] }) configuration no longer collapses decorators, render functions, and parameters to never.
  4. Start Storybook and confirm the third-party preview annotations are still composed at runtime.

Documentation

  • Add or update documentation reflecting your changes
  • If you are deprecating/removing a feature, make sure to update
    MIGRATION.MD

No documentation change is needed because this makes the public types accept an annotation shape that Storybook already supports at runtime.

Checklist for Maintainers

  • When this PR is ready for testing, make sure to add ci:normal, ci:merged or ci:daily GH label to it to run a specific set of sandboxes. The particular set of sandboxes can be found in code/lib/cli-storybook/src/sandbox-templates.ts
  • Declare whether manual QA will be needed for this PR during the next release, through qa:needed or qa:skip
  • Make sure this PR contains one of the required release labels.

AI assistance disclosure: Codex was used to implement and validate this change.

@wanxiankai
wanxiankai requested a review from a team July 29, 2026 15:30
@github-actions

github-actions Bot commented Jul 29, 2026 •

Copy link
Copy Markdown
Contributor
Fails
🚫

PR is not labeled with one of: ["qa:needed","qa:skip","qa:success"]

🚫 This PR needs an approving review from a Storybook Core or Developer Experience team member before it can be merged. No approvals found.

Generated by 🚫 dangerJS against 3e4d601

@coderabbitai

coderabbitai Bot commented Jul 29, 2026 •

Copy link
Copy Markdown
Contributor

Review in Change Stack →

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration
  • Configuration used: Organization UI
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: ae02f4a8-a340-448f-a9bd-a9a6bdcbe16e
📥 Commits

Reviewing files that changed from the base of the PR and between 7704947 and 7646988.

📒 Files selected for processing (9)
  • code/core/src/csf/csf-factories.ts
  • code/frameworks/angular-vite/src/client/preview.ts
  • code/frameworks/angular/src/client/preview.ts
  • code/frameworks/nextjs-vite/src/index.ts
  • code/frameworks/nextjs/src/index.ts
  • code/renderers/react/src/csf-factories.test.tsx
  • code/renderers/react/src/preview.tsx
  • code/renderers/vue3/src/preview.ts
  • code/renderers/web-components/src/preview.ts
💤 Files with no reviewable changes (1)
  • code/renderers/react/src/csf-factories.test.tsx

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 8 remain after this review.


Walkthrough

Preview factory and wrapper types now accept legacy annotation namespaces as addon entries. Type inference continues to derive renderer types from typed addons. Tests cover legacy parameter composition and addon type checks.

Changes

Typed preview addon entries

Layer / File(s) Summary
Addon entry types and inference
code/core/src/csf/csf-factories.ts
Adds PreviewAddonEntry for typed addons and legacy annotation namespaces. InferTypes extracts typed addons before deriving renderer types.
Preview wrapper typing
code/frameworks/angular*/src/client/preview.ts, code/frameworks/nextjs*/src/index.ts, code/frameworks/tanstack-react/src/index.ts, code/renderers/*/src/preview.*
Updates framework and renderer wrappers to accept PreviewAddonEntry arrays. React and Web Components cast configured addon lists to the inferred addon type.
Legacy addon composition coverage
code/core/src/csf/__testfixtures/*, code/core/src/csf/csf-factories.test.ts, code/renderers/react/src/csf-factories.test.tsx
Adds tests for legacy namespace entries, composed parameters, typed addon checks, and rejection of uncalled addon factories.

Priority: ➖ Normal

Severity of issue fixed: Medium

Merge Risk: ⚪ Minimal · up to 3e4d6

The change enables legacy namespace addons without a demonstrated new breakage. The reported omitted-addon inference behavior in core and Next.js predates this change; the PR appears ready for normal validation.

Security Architecture Review

Security architecture risk: 🔵 Low · up to 85347

The broader addon contract uses the existing preview composition path. No new security boundary or privilege was identified, though downstream coverage is incomplete.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

  • inferred — The demonstrated effect spans the shared preview type contract and its wrappers. The available dependency evidence does not establish additional downstream consumers or a cross-service exposure.

Trust Boundaries and Controls

  • inferred — Addon entries remain caller-supplied preview configuration composed by the existing factory. Type acceptance is not an authorization control, and no new attacker-controlled source or boundary bypass is evidenced in this path.
✨ Finishing Touches 💡 1
🛠️ Fix failing CI checks 💡
  • Commit to this branch
  • Create a new PR

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@valentinpalkovic valentinpalkovic added the sev:S3 Medium priority. Fix within months if possible. label Jul 31, 2026
@Sidnioulz
Sidnioulz removed the request for review from a team August 7, 2026 09:08
@github-actions github-actions Bot added the Stale label Aug 29, 2026
@valentinpalkovic valentinpalkovic added the ci:normal Run our default set of CI jobs (choose this for most PRs). label Sep 29, 2026
valentinpalkovic and others added 6 commits September 29, 2026 12:44
Guard on the inferred addon types instead of the entry list, so a list with
only legacy namespaces no longer resolves to never. Narrow PreviewAddonEntry
so an uncalled addon factory is rejected at the addons line again, and drop
the unused phantom member on PreviewAddon.
…olve

InferTypes now extracts the typed addons from the entries and infers their
types in one conditional. Unlike the per-entry union-to-intersection, this
resolves for an addons array cast to PreviewAddon<X>[] with a generic X, which
the Next.js and TanStack wrappers rely on. React and Web Components cast their
addons array the same way.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Previews must declare their addons, so the renderer and Angular wrappers take
`addons` as a required field again, and the `= []` generic defaults added for
omitted addons are dropped from core and the Next.js wrappers.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
@storybook-app-bot

storybook-app-bot Bot commented Oct 7, 2026 •

Copy link
Copy Markdown
Contributor

Package Benchmarks

Commit: 3e4d601, ran on 7 October 2026 at 15:09:40 UTC

The following packages have significant changes to their size or dependencies:

storybook

Before After Difference
Dependency count 73 73 0
Self size 21.71 MB 21.75 MB 🚨 +38 KB 🚨
Dependency size 31.24 MB 31.24 MB 0 B
Bundle Size Analyzer Link Link

@storybook/cli

Before After Difference
Dependency count 179 179 0
Self size 858 KB 859 KB 🚨 +192 B 🚨
Dependency size 87.15 MB 87.19 MB 🚨 +38 KB 🚨
Bundle Size Analyzer Link Link

@storybook/codemod

Before After Difference
Dependency count 172 172 0
Self size 44 KB 44 KB 0 B
Dependency size 85.64 MB 85.68 MB 🚨 +38 KB 🚨
Bundle Size Analyzer Link Link

create-storybook

Before After Difference
Dependency count 74 74 0
Self size 1.07 MB 1.07 MB 0 B
Dependency size 52.95 MB 52.99 MB 🚨 +38 KB 🚨
Bundle Size Analyzer node node

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
@valentinpalkovic
valentinpalkovic merged commit 7dc0370 into storybookjs:next Oct 7, 2026
135 of 138 checks passed
@github-actions github-actions Bot mentioned this pull request Oct 7, 2026
2 tasks done
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

agent-scan:automated bug ci:normal Run our default set of CI jobs (choose this for most PRs). core csf sev:S3 Medium priority. Fix within months if possible. Stale

Projects

Status: Done

Development

Successfully merging this pull request may close these issues.

CSF factories codemod injects incompatible addon namespaces into definePreview, collapsing all preview types to never

3 participants