The @storybook/addon-actions package provides a powerful way to display data received by event handler arguments in Storybook, aiding in UI component development and testing. Comparing versions 6.1.1 and 6.1.2, the core functionality remains consistent, but there are important context updates valuable to developers.
Both versions share the same dependencies including uuid, lodash, core-js, polished, ts-dedent, prop-types, fast-deep-equal, react-inspector and a suite of internal Storybook packages such as @storybook/api, @storybook/addons, @storybook/theming, @storybook/client-api, @storybook/components, and @storybook/core-events. This indicates a stable feature set around capturing and displaying action data. Notably, the peerDependencies specify compatibility with React versions 16.8.0 and 17.0.0, ensuring broad support for common React projects.
The critical difference lies in the updated internal Storybook package dependencies, bumped from version 6.1.1 to 6.1.2. This likely incorporates bug fixes, performance improvements, or minor feature enhancements within Storybook's core components that directly impact the addon's behavior. Specifically, @storybook/api, @storybook/addons, @storybook/theming, @storybook/client-api, @storybook/components, and @storybook/core-events were updated in version 6.1.2. For developers, upgrading from 6.1.1 to 6.1.2 means leveraging the latest improvements within the Storybook ecosystem, leading potentially to a more robust and reliable development experience without major breaking changes. The release date difference signifies a quick succession, implying that the update likely contains essential fixes. Always check Storybook's official release notes for detailed information on the underlying changes.
All the vulnerabilities related to the version 6.1.2 of the package
Cross site scripting in markdown-to-jsx
Versions of the package markdown-to-jsx before 7.4.0 are vulnerable to Cross-site Scripting (XSS) via the src property due to improper input sanitization. An attacker can execute arbitrary code by injecting a malicious iframe element in the markdown.