storybook
10.6.5 · 27 Oct 2026MIT22.3M / weekRepositoryHomepagenpmAtom feed
Upgrading storybook from 10.2.15 to 10.2.16
1 release in betweenevery note read
Security
2 advisories still affect 10.2.16
- Storybook: Missing origin validation in Storybook preview allows code injection from malicious websitescritical · GHSA-f2ph-cmg5-wxc8
- Storybook dev server vulnerable to code injection from the local networkhigh · GHSA-px85-f4q5-jh77
Upgrading to 10.6.2 clears them.
Release by release
- new
Core: Add host/origin validation to requests and websocket connections
- new
Core: Add vike metadata frameworks
- fixed
CSF-Factories: Fix ConfigFile parser false warning on
definePreview({...}).type<T>()export default - fixed
Core: Resolve builder preset path correctly in pnpm strict mode
- new
1 other line we could not sort, mostly version bumps
- 10.2.16
Core: Update default allowed hosts in host validation middleware