@storybook/angular

Highlight: Prevent menu items from emitting arbitrary channel events

Channels: Restrict preview postMessage to known manager origins

Core: Separate manager and preview roles on the dev server channel

Core: Block iframe embedding of the dev server from non-localhost origins

Core: Reject component search queries outside the project

Core: Validate component export name when creating a story

Core: Add host validation warning and origin validation for MCP

Core: Contain save story path to the project root

Core: Validate save story name and arg keys as identifiers

Addon Vitest: Disable browser file writes and command execution