chore(deps-dev): bump storybook from 10.2.19 to 10.4.2#654
chore(deps-dev): bump storybook from 10.2.19 to 10.4.2#654dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [storybook](https://github.com/storybookjs/storybook/tree/HEAD/code/core) from 10.2.19 to 10.4.2. - [Release notes](https://github.com/storybookjs/storybook/releases) - [Changelog](https://github.com/storybookjs/storybook/blob/next/CHANGELOG.md) - [Commits](https://github.com/storybookjs/storybook/commits/v10.4.2/code/core) --- updated-dependencies: - dependency-name: storybook dependency-version: 10.4.2 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
![semgrep-code-launchdarkly[bot]](https://avatars.githubusercontent.com/u/8039656?s=60&v=4){kind=small}
| @@ -3420,8 +3111,8 @@ packages: | |||
| engines: {node: '>=18'} | |||
| hasBin: true | |||
|
|
|||
| esbuild@0.27.4: | |||
| resolution: {integrity: sha512-Rq4vbHnYkK5fws5NF7MYTU68FPRE1ajX7heQ/8QXXWqNgqqJ/GkmmyxIzUnf2Sr/bakf8l54716CcMGHYhMrrQ==} | |||
| esbuild@0.27.7: | |||
There was a problem hiding this comment.
High severity vulnerability may affect your project—review required:
Line 3114 lists a dependency (esbuild) with a known High severity vulnerability.
ℹ️ Why this matters
Affected versions of esbuild are vulnerable to Download of Code Without Integrity Check / Untrusted Search Path. esbuild's Deno distribution module (lib/deno/mod.ts) contains an import.meta.main CLI entrypoint that calls install() directly when the module is run as a script (deno run https://deno.land/x/esbuild@vX/mod.js). This download path has no SHA-256 integrity verification: if NPM_CONFIG_REGISTRY resolves to an attacker-controlled registry, the fetched binary is executed immediately, yielding arbitrary code execution without any API call in user code.
References: GHSA
To resolve this comment:
Check if you invoke the esbuild Deno module directly as a CLI tool (e.g. deno run https://deno.land/x/esbuild@vX/mod.js) and the NPM_CONFIG_REGISTRY environment variable resolves the binary download to an untrusted registry.
- If you're affected, upgrade this dependency to at least version 0.28.1 at pnpm-lock.yaml.
- If you're not affected, comment
/fp we don't use this [condition]
💬 Ignore this finding
To ignore this, reply with:
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
You can view more details on this finding in the Semgrep AppSec Platform here.
Bumps storybook from 10.2.19 to 10.4.2.
Release notes
Sourced from storybook's releases.
... (truncated)
Changelog
Sourced from storybook's changelog.
... (truncated)
Commits
298dea2Bump version from "10.4.1" to "10.4.2" [skip ci]40c81c8Merge pull request #33534 from storybookjs/copilot/fix-pnpm-command-resolutio...bfb942bMerge pull request #34901 from storybookjs/shilman/fix-csf-export-as-string-l...fad8dd2Merge pull request #34791 from tobiasdiez/type-fest-upgradecc19ae1Bump version from "10.4.0" to "10.4.1" [skip ci]f8c16d1Bump version from "10.4.0-beta.0" to "10.4.0" [skip ci]e02da0bBump version from "10.4.0-alpha.19" to "10.4.0-beta.0" [skip ci]6fe5959Merge branch 'next' into next-releasef9810c7Merge pull request #34769 from storybookjs/jeppe/handle-minimum-release-agedb9d52bformatDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)