[dependabot]

Storybook's Chromatic addon advances from 5.3.1 to 5.5.1, including channel hardening and UI/API updates while retaining the existing Chromatic CLI 18.6.0.

The originally proposed addon 5.6.0 requires a newer CLI. Its resolved CLI 18.13.3 interpolates historical symlink-target contents into shell-enabled Git commands during TurboSnap baseline comparison, so that coupled upgrade remains deferred until upstream handles these arguments as data. This source finding is not a claim of an exploit in River UI or a published advisory.

The final lockfile changes only the addon artifact and its root version constraint. CLI 18.6.0 retains the exact base identity and satisfies addon 5.5.1's dependency range. Remove the temporary Babel runtime override as well: both testing-library consumers accept the already selected patched runtime 7.29.7, and lifecycle-disabled regeneration without the override leaves the entire lockfile byte-for-byte unchanged. Typography's parser override and Storybook's version alignment remain necessary.

Clean installation and frontend regression coverage validate the retained graph; production and Storybook builds succeed. The excluded addon 5.6.0 / CLI 18.13.3 upgrade remains outstanding pending an upstream shell-safe Git implementation.

[bgentry]

🤖 Codex review: Approved for the retained addon 5.5.1 upgrade and override cleanup after current-head security and compatibility review. Addon 5.6.0 / CLI 18.13.3 remains deferred.

Upgrade

• @chromatic-com/storybook: 5.3.1 → 5.5.1.
• chromatic: retained at the base's exact 18.6.0 artifact.
• Reviewed head: d2e95d313e2bc9e62e4ed1c672fd45e604d47d61; base: 997a128a1fcf4f1961d8bce0a6b403a9a821d036.

Security Review
Compared actual published old/new addon artifacts, canonical upstream source, manager/preview/preset bundles, registry integrity, publisher/provenance metadata, and advisory results. The 5.5.1 tarball matches lockfile and registry SHA-512 DOtUEBIJHmqsOWg+Hi1t5m5FTNlyzL0NpZUwQob+ex30nDvL4p+MrYctmvEqH/QT72mf9mLXbz3Uj8aoWD2OYA== and source gitHead 74818545c641ad36e0aae7829436509680f71678. Provenance subject matches its computed artifact digest and the expected upstream release workflow. Source and bundled changes contain expected UI/rate-limit work and channel hardening, including token redaction, linked-project validation/freezing, filtered Git fields, and relay removal. No new lifecycle hooks, binaries/native payloads, alternate sources or unexplained credential/network/process behavior. Exact OSV checks report no matching advisories; this is routine hardening, not a claimed CVE fix.

The final regenerated inventory changes only the root addon constraint and addon artifact. No package is added or removed, no same-version integrity changes, and the CLI lock object is byte-identical to the base. Reused the exact artifact evidence after amendments; no new dependency identity appears. Base integration adds only the already reviewed/merged #733 action and #734 River module updates.

Repairs and Deferred Upgrade

• 2b02347 reduces the addon target to 5.5.1, whose chromatic: ^18.0.1 range accepts CLI 18.6.0. No resolver bypass or new override is used.
• The original 5.6.0 target requires CLI ^18.12.1 and resolves to 18.13.3. Its new historical-symlink resolver feeds committed symlink-target text into shell-enabled git ls-tree / git show commands during TurboSnap baseline comparison. Verified in actual source and the published CLI bundle. This is a credible new command-input concern; no exploit in River UI is claimed. Defer addon 5.6.0 / CLI 18.13.3 until upstream passes Git arguments as data without shell interpretation, then reassess exact fixed artifacts before upgrading.
• 2d21b2f removes the temporary Babel runtime override. Both testing-library consumers accept the already locked patched runtime 7.29.7; lifecycle-disabled regeneration leaves the entire lockfile byte-identical. Typography's patched parser override and Storybook's intentional version alignment remain.
• d2e95d3 integrates current master with append-only history.

Compatibility Verification

• Metadata-only installation with scripts disabled is idempotent; clean npm ci, npm run lint, npm run test:once (37 files / 278 tests), npm run build, and npm run build-storybook -- --disable-telemetry pass on Node 24.19.0.
• Repeated clean installation and lint after Babel override removal pass; the tested source and installed artifact identities remain unchanged. No tracked output drift.
• Every required check on this final head passes, including Node 24.21.0 frontend checks, the complete Go/PostgreSQL matrix, Go lint, pinned sqlc generation verification, release builds, CodeQL, public/Pro image builds on both architectures and both manifest jobs. Release-only registry prefetch correctly skips on a PR. No rule or credential changes/bypass are used.

Residual Risk
The excluded 5.6.0/18.13.3 work remains outstanding. Retaining CLI 18.6.0 does not fix its pre-existing filename-handling risks. Generated/minified bundles were statically inspected rather than independently rebuilt; provenance signatures were not independently cryptographically reverified. The baseline AWS action's unused-path upstream advisories remain as documented in #733. No blocking issue is identified in the retained diff.