# What changed in @storybook/addon-onboarding

> 3 changes in @storybook/addon-onboarding 8 to 10 from its official release notes, upgrade guides and advisories: 2 security. Each one cited. Sources checked 2026-10-27. HTML: https://unstale.sh/npm/@storybook/addon-onboarding/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## @storybook/addon-onboarding 10

### Security

- Storybook dev server vulnerable to code injection from the local network (8.6.19, 9.1.21, 10.6.2) — [security advisory](https://github.com/advisories/GHSA-PX85-F4Q5-JH77)
- Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites (8.6.19, 9.1.21, 10.6.2) — [security advisory](https://github.com/advisories/GHSA-F2PH-CMG5-WXC8)

## @storybook/addon-onboarding 8

### Behavior and default changes

- Non-React projects no longer require React when using Storybook. (8.0.0) — [release notes](https://github.com/storybookjs/storybook/blob/HEAD/CHANGELOG.md)