
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
@storybook/html
Advanced tools
@storybook/html is a tool for developing UI components in isolation for HTML-based projects. It allows developers to build, test, and showcase their components in a structured and interactive environment.
Component Development
This feature allows developers to create and display different states of a component. The code sample demonstrates how to create stories for a Button component with different content.
import { storiesOf } from '@storybook/html';
storiesOf('Button', module)
.add('with text', () => '<button>Hello Button</button>')
.add('with emoji', () => '<button>😀 😎 👍 💯</button>');
Interactive Addons
This feature allows the use of addons to make stories interactive. The code sample shows how to use the Knobs addon to dynamically change the text of a Button component.
import { storiesOf } from '@storybook/html';
import { withKnobs, text } from '@storybook/addon-knobs';
storiesOf('Button', module)
.addDecorator(withKnobs)
.add('with dynamic text', () => {
const label = text('Label', 'Hello Button');
return `<button>${label}</button>`;
});
Documentation
This feature allows developers to add documentation to their stories. The code sample demonstrates how to use the storybook-readme addon to include markdown documentation for a Button component.
import { storiesOf } from '@storybook/html';
import { withDocs } from 'storybook-readme';
import ButtonReadme from './Button.md';
storiesOf('Button', module)
.addDecorator(withDocs(ButtonReadme))
.add('default', () => '<button>Hello Button</button>');
@storybook/react is similar to @storybook/html but is specifically designed for React components. It provides a similar environment for developing, testing, and showcasing React components.
@storybook/vue is designed for Vue.js components. It offers the same functionalities as @storybook/html but tailored for the Vue.js framework, allowing developers to work with Vue components in isolation.
@storybook/angular is tailored for Angular components. It provides a similar set of features as @storybook/html but is optimized for the Angular framework, enabling developers to build and test Angular components in isolation.
9.1.0
Storybook 9.1 is packed with new features and improvements to enhance accessibility, streamline testing, and make your development workflow even smoother!
🚀 Improved upgrade command with monorepo support for seamless upgrades
🅰 Angular fixes for Tailwind 4, cache busting, and zoneless compatibility
🧪 sb.mock
API and Automocking: one-line module mocking to simplify your testing workflow
🧪 Favicon shows test run status for quick visual feedback
⚛️ Easier configuration for React Native projects
🔥 Auto-abort play functions on HMR to avoid unwanted side effects
🏗️ Improved CSF factories API for type safe story definitions
♿️ A11y improvements across Storybook’s UI — addon panel, toolbar, sidebar, mobile & more
💯 Dozens more fixes and improvements based on community feedback!
extend
API, portable stories - #30601, thanks @kasperpeulen!react-element-to-jsx-string
- #31170, thanks @7rulnik!project.json
for getAbsolutePath - #31510, thanks @ndelangen!FAQs
Storybook HTML renderer
The npm package @storybook/html receives a total of 184,046 weekly downloads. As such, @storybook/html popularity was classified as popular.
We found that @storybook/html demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 12 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.