chore(deps): upgrade Storybook 10.4.6 → 10.5.10, drop hold-back pins - #1945
Merged
Conversation
The Storybook group was pinned exact at 10.4.6 (PR #1762) because 10.5.0 installed an accessor on HTMLElement.prototype.focus whose getter returned the raw native focus on a second read within the same tick. @zag-js/focus-visible's setupGlobalFocusEvents reads exactly that: let focus = win.HTMLElement.prototype.focus; // dist/index.mjs:73 The receiver there is HTMLElement.prototype, not an element, so invoking the native focus threw "Illegal invocation" and flaked a varying set of browser story files per run. (The old pin note credited react-aria; the actual caller is Chakra's zag focus-visible.) Fixed upstream in 10.5.8 via storybookjs/storybook#35528 — the getter now short-circuits when the receiver is the prototype: get() { if (this === HTMLElement.prototype) return currentFocus; ... } Verified by bisecting the published tarballs: the guard is absent in 10.5.0-10.5.7 and present from 10.5.8 onward. Changes: - catalogs.tooling: storybook, eslint-plugin-storybook, @storybook/addon-a11y, @storybook/addon-docs, @storybook/addon-vitest and @storybook/react-vite move from exact pins to ^10.5.10, restoring the pre-pin caret convention. - overrides: dropped the four transitive hold-backs (@storybook/react, @storybook/react-dom-shim, @storybook/builder-vite, @storybook/csf-plugin). They are no longer needed — the copies pulled by the @github-ui and @vueless addons resolve to 10.5.10 on their own. The lockfile now carries exactly one version of every Storybook package and shrinks by ~160 lines. The only 10.4 -> 10.5 migration note is the ExternalDocs deprecation, which this repo does not use. Verification: - pnpm test: 252 files, 3252 tests passed - pnpm test:storybook: 4 consecutive runs, 100 files / 1225 tests each - pnpm vitest run --project=storybook --retry=0: 2 runs green, confirming no flake was hidden behind the config's retry: 1 - pnpm test:storybook:dev: 100 files, 1225 tests passed - pnpm typecheck:strict, pnpm lint (0 errors), pnpm build, pnpm build:storybook: all pass - no minimumReleaseAgeExclude block appended; no Storybook peer issues No changeset: devDependency-only tooling change with no consumer-visible effect. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
|
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Contributor
Bundle Size ReportLast updated: 2026-08-25 08:21:33 UTC
Baseline source: comment-chain |
|
Tip All tests passed and all changes approved!🟢 UI Tests: 347 tests unchanged |
Removing the pins and overrides in the previous commit left 12 lines of comment describing them: 9 in `overrides` where the four @storybook/* entries had been, and 3 above the catalog entries pointing back at those. Both described a workaround the file no longer contains. `storybook: ^10.5.10` is an ordinary caret range like every other entry in the catalog and needs no explanation. The regression, the upstream fix and the reasoning stay in the previous commit message and in the PR. Comment-only: `pnpm install --frozen-lockfile` passes unchanged, so resolution is identical and the verification on the previous commit still holds. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
github-actions
Bot
added
the
bundle-sizes
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Storybook was pinned exact at
10.4.6since #1762. The regression that forced that pin is fixed upstream, so this moves the whole group to^10.5.10and removes the hold-back machinery.The blocker, and why it's gone
Storybook 10.5.0 installed an accessor on
HTMLElement.prototype.focuswhose getter returned the raw native focus on a second read within the same tick.@zag-js/focus-visible'ssetupGlobalFocusEventsreads exactly that:The receiver there is
HTMLElement.prototype, not an element, so invoking the nativefocusthrewIllegal invocation— flaking a varying set of browser story files per run.Fixed upstream in 10.5.8 via storybookjs/storybook#35528 — the getter now short-circuits when the receiver is the prototype:
Confirmed by bisecting the published tarballs: the guard is absent in 10.5.0–10.5.7 and present from 10.5.8 onward. Latest is
10.5.10(published 2026-08-20, so it clears the repo's 24hminimumReleaseAgegate).Changes
catalogs.tooling—storybook,eslint-plugin-storybook,@storybook/addon-a11y,@storybook/addon-docs,@storybook/addon-vitest,@storybook/react-vitemove from exact pins to^10.5.10, restoring the pre-pin caret convention.overrides— dropped all four transitive hold-backs (@storybook/react,@storybook/react-dom-shim,@storybook/builder-vite,@storybook/csf-plugin). They're genuinely unnecessary now: the copies pulled by the@github-ui/@vuelessaddons resolve to 10.5.10 on their own. The lockfile now carries exactly one version of every Storybook package and shrinks by ~160 net lines.storybook: ^10.5.10is an ordinary caret range like every other catalog entry and carries no explanation. The history lives in the commit messages and this PR. (See docs(claude): add an Implementation Comments rule #1946, which makes that a standing rule; the second commit here is the cleanup.)The only 10.4 → 10.5 migration note is the
ExternalDocsdeprecation, which this repo doesn't use.Verification
Since the original bug was flaky, a single green run isn't proof — so this was run repeatedly, including with retries disabled.
pnpm test(full suite)pnpm test:storybook×4pnpm vitest run --project=storybook --retry=0×2retry: 1pnpm test:storybook:devpnpm typecheck:strictpnpm lintreact-hookswarnings, unrelated)pnpm build/pnpm build:storybookminimumReleaseAgeExcludeappended?pnpm peers checkEight consecutive green browser-story runs, two with retries fully disabled. No
Illegal invocationanywhere.The second commit is comment-only;
pnpm install --frozen-lockfilepasses unchanged on it, so resolution is identical and the results above still hold.Notes for reviewers
docs/changeset-conventions.md: skip "tooling or CI changes that don't affect consumers").setProjectAnnotationsinfo notice in test output is pre-existing — it's in@storybook/addon-vitest@10.4.6too, not introduced here. Storybook has auto-applied preview annotations since 10.3, sopackages/nimbus/.storybook/vitest.setup.tscould drop that call as separate optional cleanup.@github-ui/storybook-addon-performance-panel(1.1.4 → 1.2.0) andchromatic(18.2.0 → 18.5.0) have newer releases but resolved at their existing versions. Deliberately left alone — outside this upgrade's scope; Renovate'sstorybookgroup will pick them up.docs/chromatic-ci.md.🤖 Generated with Claude Code