← Home

@storybook/preview-api

npm Repository Homepage
67
Versions
MIT
License
No
Install Scripts
Missing
Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

ndelangenshilmantmeasdayghengeveldwinkervsbecksyannbfkylegachjreinholdkasperpeulenvalentinpalkovicdomyenstorybook-bot

Keywords

storybook

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
phantom-deps phantom-dep:@storybook/channel-postmessage AI (phantom-deps): Monorepo internal dependency; workspace-level management is standard for Storybook's structure. ai
source-diff obfuscated-file:dist/client-api.js AI (source-diff): Standard esbuild CJS bundle output for @storybook/preview-api; readable exports, no actual obfuscation. ai
source-diff obfuscated-file:dist/addons.js AI (source-diff): Standard esbuild CJS bundle output for @storybook/preview-api; readable exports, no actual obfuscation. ai
source-diff obfuscated-file:dist/core-client.js AI (source-diff): Standard esbuild CJS bundle output for @storybook/preview-api; readable exports, no actual obfuscation. ai
source-diff obfuscated-file:dist/index.js AI (source-diff): Standard esbuild CJS bundle output for @storybook/preview-api; readable exports, no actual obfuscation. ai
source-diff obfuscated-file:dist/preview-web.js AI (source-diff): Standard esbuild CJS bundle output for @storybook/preview-api; readable exports, no actual obfuscation. ai
source-diff obfuscated-file:dist/store.js AI (source-diff): Standard esbuild CJS bundle output for @storybook/preview-api; readable exports, no actual obfuscation. ai
source-diff source-size-tripled AI (source-diff): v7.x ships bundled dist files unlike v8.x baseline; size difference is expected across major versions. ai
source-diff large-new-source-files AI (source-diff): v7.x architecture bundles dist files that v8.x consolidated into @storybook/core; expected diff. ai
provenance publisher-changed AI (provenance): Storybook project transitioned to storybook-bot for automated publishing; bot has 12,996 approved versions across 44 packages. ai
maintainer-change maintainer-added AI (maintainer-change): storybook-bot is the official Storybook publishing bot; addition is a legitimate project-wide transition. ai
dependencies unvetted-dep:@types/qs AI (dependencies): @types/qs is a legitimate DefinitelyTyped package for the well-known 'qs' library; its use as a dependency in this bundled Storybook package is benign and stable across versions. ai
phantom-deps phantom-dep:@types/qs AI (phantom-deps): @types/qs is a TypeScript type definition used at compile time, not imported at runtime. Phantom dep finding is expected. ai
npm-metadata no-description AI (npm-metadata): Monorepo sub-package; empty description is standard practice for @storybook/* internal packages. ai
bogus-package bogus-package AI (bogus-package): README/description signals are false positives for @storybook monorepo sub-packages that don't need standalone docs. ai
provenance no-provenance AI (provenance): Storybook 7.x predates widespread provenance adoption; absence is not suspicious for this well-established package. ai

Versions (showing 67 of 167)

Hide prereleases
Version Deps Published
7.6.2 14 / 4
7.6.1 14 / 4
7.6.0 14 / 4
7.5.3 14 / 5
7.5.2 14 / 5
7.5.1 14 / 5
7.5.0 14 / 5
7.4.6 14 / 5
7.4.5 14 / 5
7.4.4 14 / 5
7.4.3 14 / 5
7.4.2 14 / 5
7.4.1 14 / 5
7.4.0 14 / 5
7.3.2 14 / 5
7.3.1 14 / 5
7.3.0 14 / 5
7.2.3 14 / 5
7.2.2 14 / 5
7.2.1 14 / 5
7.2.0 14 / 5
7.1.1 15 / 5
7.1.0 15 / 5
7.0.27 15 / 5
7.0.26 15 / 5
7.0.25 15 / 5
7.0.24 15 / 5
7.0.23 15 / 5
7.0.22 15 / 5
7.0.21 15 / 5
7.0.20 15 / 5
7.0.19 15 / 5
7.0.18 15 / 5
7.0.17 15 / 5
7.0.16 15 / 5
7.0.15 15 / 5
7.0.14 15 / 5
7.0.13 15 / 5
7.0.12 15 / 5
7.0.11 15 / 5
7.0.10 15 / 5
7.0.9 15 / 5
7.0.8 15 / 5
7.0.7 15 / 5
7.0.6 15 / 5
7.0.5 15 / 5
7.0.4 15 / 5
7.0.3 15 / 5
7.0.2 15 / 5
7.0.1 15 / 5
7.0.0 15 / 5
0.0.0-pr-34011-sha-c45b0f3f 14 / 4
0.0.0-pr-34011-sha-1f3f0b01 14 / 4
0.0.0-pr-34009-sha-c90626e7 0 / 0
0.0.0-pr-33859-sha-95913f7f 14 / 4
0.0.0-pr-33859-sha-3b5f3a7d 14 / 4
0.0.0-pr-33859-sha-2907ae70 14 / 4
0.0.0-pr-33859-sha-13cfcf7c 14 / 4
0.0.0-pr-33857-sha-9cf9d89d 0 / 0
0.0.0-pr-33846-sha-e0cc7193 14 / 4
0.0.0-pr-33846-sha-d3bab8e5 14 / 4
0.0.0-pr-33846-sha-a9ac2fb4 14 / 4
0.0.0-pr-33846-sha-6794f13b 14 / 4
0.0.0-pr-33843-sha-df25ab64 0 / 0
0.0.0-pr-33843-sha-b5b9b384 0 / 0
0.0.0-pr-33843-sha-99db7e4e 0 / 0
0.0.0-pr-33843-sha-6c2ca004 0 / 0

v7.6.2

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v7.6.1

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v7.6.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v7.5.3

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v7.5.2

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v7.5.1

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v7.5.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v7.4.6

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v7.4.5

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v7.4.4

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v7.4.3

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v7.4.2

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v7.4.1

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v7.4.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v7.3.2

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v7.3.1

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v7.3.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v7.2.3

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v7.2.2

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v7.2.1

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v7.2.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v7.1.1

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v7.1.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v7.0.27

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v7.0.26

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v7.0.25

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v7.0.24

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v7.0.23

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v7.0.22

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v7.0.21

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v7.0.20

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v7.0.19

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v7.0.18

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v7.0.17

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v7.0.16

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v7.0.15

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v7.0.14

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v7.0.13

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v7.0.12

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v7.0.11

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v7.0.10

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v7.0.9

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v7.0.8

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v7.0.7

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v7.0.6

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v7.0.5

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v7.0.4

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v7.0.3

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v7.0.2

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v7.0.1

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v7.0.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.