@storybook/addon-actions is a crucial tool for Storybook developers, enabling the logging and display of actions triggered within stories, facilitating interactive component testing and development. Comparing versions 6.1.7 and 6.1.8, the core functionality remains consistent, focusing on tracking user interactions within Storybook. Both versions share identical dependencies including essential packages like uuid, lodash, polished, ts-dedent, and peer dependencies on react and react-dom ensuring compatibility with React 16.8.0 or 17.0.0.
While the dependency list appears the same, a subtle but important distinction lies in the versions of internal Storybook packages. Version 6.1.8 updates its internal dependencies, point to version 6.1.8 (@storybook/api, @storybook/addons, @storybook/theming, @storybook/client-api, @storybook/components, @storybook/core-events). In contrast, Version 6.1.7 uses version 6.1.7. This signals a synchronization effort within the Storybook ecosystem, aligning the action addon with the latest features and bug fixes available in other core Storybook modules. For developers, upgrading to 6.1.8 ensures they benefit from the most recent improvements across the Storybook platform, potentially addressing subtle compatibility issues or performance enhancements present in the earlier 6.1.7 version. The consistent fileCount and unpackedSize suggest that the code footprint remains largely unchanged, emphasizing that the update primarily involves internal dependency alignment rather than significant feature additions or modifications. Also, version 6.1.8 was released one day after version 6.1.7, confirming that the update mainly aimed to fix issues or ensure compatibility.
All the vulnerabilities related to the version 6.1.8 of the package
Cross site scripting in markdown-to-jsx
Versions of the package markdown-to-jsx before 7.4.0 are vulnerable to Cross-site Scripting (XSS) via the src property due to improper input sanitization. An attacker can execute arbitrary code by injecting a malicious iframe element in the markdown.