Skip to content

chore(deps): bump storybook from 9.1.15 to 9.1.21 in /frontend - #1767

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/frontend/storybook-9.1.21
Open

dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/frontend/storybook-9.1.21

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 24, 2026 •

Copy link
Copy Markdown
Contributor

Bumps storybook from 9.1.15 to 9.1.21.

Release notes

Sourced from storybook's releases.

v9.1.21

9.1.21

  • Highlight: Prevent menu items from emitting arbitrary channel events
  • Channels: Restrict preview postMessage to known manager origins
  • Core: Separate manager and preview roles on the dev server channel
  • Core: Block iframe embedding of the dev server from non-localhost origins
  • Core: Reject component search queries outside the project
  • Core: Validate component export name when creating a story
  • Core: Add host validation warning and origin validation for MCP
  • Core: Contain save story path to the project root
  • Core: Validate save story name and arg keys as identifiers
  • Addon Vitest: Disable browser file writes and command execution
Changelog

Sourced from storybook's changelog.

9.1.21

  • Highlight: Prevent menu items from emitting arbitrary channel events
  • Channels: Restrict preview postMessage to known manager origins
  • Core: Separate manager and preview roles on the dev server channel
  • Core: Block iframe embedding of the dev server from non-localhost origins
  • Core: Reject component search queries outside the project
  • Core: Validate component export name when creating a story
  • Core: Add host validation warning and origin validation for MCP
  • Core: Contain save story path to the project root
  • Core: Validate save story name and arg keys as identifiers
  • Addon Vitest: Disable browser file writes and command execution

9.1.20

  • Add request validation

9.1.19

  • Harden websocket connection

9.1.18

  • No-op release. No changes.

9.1.16

Commits
  • 9abaf68 Bump version from "9.1.20" to "9.1.21" [skip ci]
  • dc03253 Core: Escape the component file name in generated story imports
  • 0cd2fc4 Core: Check the origin of channel messages from registered preview iframes
  • 81d4a04 Patch v9
  • f4eff48 Bump version from "9.1.19" to "9.1.20" [skip ci]
  • 046ce4d Formatting
  • 98e74eb Clarify hostname validation for HTTP requests and WebSocket connections
  • 5f27e88 Core: Backport origin/host validation and update related configurations
  • 20887f1 Bump version from "9.1.18" to "9.1.19" [skip ci]
  • 66b2d8e Fix test
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Oct 24, 2026
Bumps [storybook](https://github.com/storybookjs/storybook/tree/HEAD/code/core) from 9.1.15 to 9.1.21.
- [Release notes](https://github.com/storybookjs/storybook/releases)
- [Changelog](https://github.com/storybookjs/storybook/blob/v9.1.21/CHANGELOG.md)
- [Commits](https://github.com/storybookjs/storybook/commits/v9.1.21/code/core)

---
updated-dependencies:
- dependency-name: storybook
  dependency-version: 9.1.21
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/frontend/storybook-9.1.21 branch from 3d764fb to 7562fbc Compare October 27, 2026 20:21
@dependabot
dependabot Bot requested a review from a team October 27, 2026 20:21

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants