Skip to content

[Snyk] Security upgrade @storybook/addon-links from 6.5.16 to 7.0.1#37

Open
decause-gov wants to merge 1 commit intomainfrom
snyk-fix-55454d40732066f473bf595d6e68d1e3
Open

[Snyk] Security upgrade @storybook/addon-links from 6.5.16 to 7.0.1#37
decause-gov wants to merge 1 commit intomainfrom
snyk-fix-55454d40732066f473bf595d6e68d1e3

Conversation

@decause-gov
Copy link
Copy Markdown
Contributor

snyk-top-banner

Snyk has created this PR to fix 2 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

  • app/package.json
  • app/package-lock.json

Vulnerabilities that will be fixed with an upgrade:

Issue Score
high severity Arbitrary Code Injection
SNYK-JS-LODASH-15869625
  183  
medium severity Prototype Pollution
SNYK-JS-LODASH-15869619
  88  

Breaking Change Risk

Merge Risk: High

Notice: This assessment is enhanced by AI.


Important

  • Check the changes in this PR to ensure they won't cause issues with your project.
  • Max score is 1000. Note that the real score may have changed since the PR was raised.
  • This PR was automatically created by Snyk using the credentials of a real user.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic


Learn how to fix vulnerabilities with free interactive lessons:

🦉 Prototype Pollution
🦉 Arbitrary Code Injection

@decause-gov
Copy link
Copy Markdown
Contributor Author

Merge Risk: High

This is a major version upgrade from Storybook v6 to v7, which introduces significant breaking changes across the entire Storybook ecosystem. While there are no specific API changes cited for @storybook/addon-links itself, the upgrade requires a comprehensive migration of your Storybook configuration and environment.

Key Breaking Changes in Storybook 7.0:

  • Mandatory Configuration Changes: The start-storybook and build-storybook binaries have been replaced by a new storybook CLI. Your package.json scripts must be updated (e.g., storybook dev). Additionally, the framework field is now mandatory in your .storybook/main.js configuration file.
  • Environment Requirements: Storybook 7 requires Node.js 16 or higher and has dropped support for Internet Explorer 11.
  • Deprecated APIs: The storiesOf API is deprecated. While a compatibility flag exists, migration to the modern Component Story Format (CSF) is strongly recommended.
  • MDX2 Upgrade: Storybook 7 has upgraded from MDX1 to MDX2, which includes breaking changes. An automigration script is available to assist with this transition.

Recommendation:
This is a high-impact upgrade that requires developer action. Do not merge this change without running the official Storybook migration script, which automates many of the required changes.

Run the following command in your project root:
npx storybook@latest upgrade

After running the script, thoroughly test your Storybook to ensure all stories and documentation pages render correctly.

Source: Storybook 7.0 Migration Guide

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants