Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Upgrade to SB7.0 #38

Merged
merged 2 commits into from
Mar 31, 2023
Merged

Upgrade to SB7.0 #38

merged 2 commits into from
Mar 31, 2023

Conversation

shilman
Copy link
Member

@shilman shilman commented Mar 31, 2023 •
edited by github-actions bot
Loading

Issue: N/A

What Changed

Update version dependency to point include 7.0 support. Will publish a major release as a follow-on step next week.

📦 Published PR as canary version: 0.0.5-canary.38.8dab49f.0

✨ Test out this PR locally via:

npm install @storybook/mdx2-csf@0.0.5-canary.38.8dab49f.0
# or 
yarn add @storybook/mdx2-csf@0.0.5-canary.38.8dab49f.0

Version

Published prerelease version: v1.0.0-next.7

Changelog

💥 Breaking Change

  • Add JSX transpilation to compiler-generated code #30 (@ndelangen)

🚀 Enhancement

🐛 Bug Fix

⚠️ Pushed to next

Authors: 10

@socket-security
Copy link

New dependency changes detected. Learn more about Socket for GitHub ↗︎

🚨 Potential security issues found in this pull request. To accept the risk, merge this PR and you will not be notified again.

Bot Commands

To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of package-name@version specifiers. e.g. @SocketSecurity ignore foo@1.0.0 bar@* or ignore all packages with @SocketSecurity ignore-all

  • @SocketSecurity ignore esbuild@0.17.14
  • @SocketSecurity ignore babel-plugin-istanbul@6.1.1
  • @SocketSecurity ignore commander@2.20.3
  • @SocketSecurity ignore cross-spawn@7.0.3
  • @SocketSecurity ignore envinfo@7.8.1
  • @SocketSecurity ignore execa@4.1.0
  • @SocketSecurity ignore execa@5.1.1
  • @SocketSecurity ignore gitlog@4.0.4
  • @SocketSecurity ignore husky@7.0.4
  • @SocketSecurity ignore jake@10.8.5
  • @SocketSecurity ignore jest-haste-map@27.0.6
  • @SocketSecurity ignore jest-worker@27.0.6
  • @SocketSecurity ignore jest-worker@27.5.1
  • @SocketSecurity ignore jscodeshift@0.14.0
  • @SocketSecurity ignore jsdom@16.6.0
  • @SocketSecurity ignore requireg@0.2.2
  • @SocketSecurity ignore rollup@2.79.1
  • @SocketSecurity ignore shelljs@0.8.5
  • @SocketSecurity ignore tree-kill@1.2.2
  • @SocketSecurity ignore update-browserslist-db@1.0.10
  • @SocketSecurity ignore webpack@5.74.0
  • @SocketSecurity ignore @storybook/router@6.5.13
  • @SocketSecurity ignore @testing-library/react@12.1.3
  • @SocketSecurity ignore ajv@6.12.6
  • @SocketSecurity ignore ejs@3.1.8
  • @SocketSecurity ignore expect@27.0.6
  • @SocketSecurity ignore handlebars@4.7.7
  • @SocketSecurity ignore jest-circus@27.0.6
  • @SocketSecurity ignore jest-jasmine2@27.0.6
  • @SocketSecurity ignore jest-message-util@27.0.6
  • @SocketSecurity ignore jest-snapshot@27.0.6
  • @SocketSecurity ignore js-yaml@3.14.1
  • @SocketSecurity ignore lodash@4.17.21
  • @SocketSecurity ignore object-inspect@1.12.0
  • @SocketSecurity ignore prettier@2.3.1
  • @SocketSecurity ignore pretty-format@27.5.1
  • @SocketSecurity ignore telejson@6.0.8
  • @SocketSecurity ignore terser@5.10.0
  • @SocketSecurity ignore terser@5.15.1
  • @SocketSecurity ignore tsup@6.3.0
  • @SocketSecurity ignore uglify-js@3.14.5
  • @SocketSecurity ignore uvu@0.5.3
  • @SocketSecurity ignore await-to-js@3.0.0
  • @SocketSecurity ignore bottleneck@2.19.5
  • @SocketSecurity ignore loader-runner@4.2.0
📜 Install scripts

Install scripts are run when the package is installed. The majority of malware in npm is hidden in install scripts.

Packages should not be running non-essential scripts during install and there are often solutions to problems people solve with install scripts that can be run at publish time instead.

Package Script field Source
esbuild@0.17.14 (upgraded) postinstall package.json via @storybook/addon-essentials@7.0.0, @storybook/addon-interactions@7.0.0, @storybook/react@7.0.0, @storybook/react-webpack5@7.0.0, storybook@7.0.0, tsup@6.3.0
⚠️ Shell access

This module accesses the system shell. Accessing the system shell increases the risk of executing arbitrary code.

Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced.

Package Module Location Source
babel-plugin-istanbul@6.1.1 (upgraded) child_process lib/index.js package.json via @storybook/addon-essentials@7.0.0, babel-jest@27.0.6, jest@27.0.6, ts-jest@27.0.4
commander@2.20.3 (upgraded) child_process index.js package.json via @storybook/react-webpack5@7.0.0, babel-loader@8.2.2
cross-spawn@7.0.3 (added) child_process index.js package.json via @storybook/react-webpack5@7.0.0, auto@10.29.2, jest@27.0.6, lint-staged@12.3.4, storybook@7.0.0, ts-jest@27.0.4, tsup@6.3.0
envinfo@7.8.1 (added) child_process dist/envinfo.js package.json via storybook@7.0.0
esbuild@0.17.14 (upgraded) child_process install.js package.json via @storybook/addon-essentials@7.0.0, @storybook/addon-interactions@7.0.0, @storybook/react@7.0.0, @storybook/react-webpack5@7.0.0, storybook@7.0.0, tsup@6.3.0
esbuild@0.17.14 (upgraded) child_process lib/main.js package.json via @storybook/addon-essentials@7.0.0, @storybook/addon-interactions@7.0.0, @storybook/react@7.0.0, @storybook/react-webpack5@7.0.0, storybook@7.0.0, tsup@6.3.0
execa@4.1.0 (added) child_process index.js package.json via auto@10.29.2
execa@5.1.1 (added) child_process index.js package.json via jest@27.0.6, lint-staged@12.3.4, storybook@7.0.0, ts-jest@27.0.4, tsup@6.3.0
gitlog@4.0.4 (added) child_process dist/gitlog.cjs.development.js package.json via auto@10.29.2
gitlog@4.0.4 (added) child_process dist/gitlog.cjs.production.min.js package.json via auto@10.29.2
gitlog@4.0.4 (added) child_process dist/gitlog.esm.js package.json via auto@10.29.2
husky@7.0.4 (added) child_process lib/index.js package.json
jake@10.8.5 (added) child_process jake-v10.8.5/jakefile.js package.json via storybook@7.0.0
jake@10.8.5 (added) child_process jake-v10.8.5/lib/package_task.js package.json via storybook@7.0.0
jake@10.8.5 (added) child_process jake-v10.8.5/lib/publish_task.js package.json via storybook@7.0.0
jake@10.8.5 (added) child_process jake-v10.8.5/lib/utils/index.js package.json via storybook@7.0.0
jake@10.8.5 (added) child_process jake-v10.8.5/test/integration/concurrent.js package.json via storybook@7.0.0
jake@10.8.5 (added) child_process jake-v10.8.5/test/integration/file_task.js package.json via storybook@7.0.0
jake@10.8.5 (added) child_process jake-v10.8.5/test/integration/file.js package.json via storybook@7.0.0
jake@10.8.5 (added) child_process jake-v10.8.5/test/integration/helpers.js package.json via storybook@7.0.0
jake@10.8.5 (added) child_process jake-v10.8.5/test/integration/jakelib/rule.jake.js package.json via storybook@7.0.0
jake@10.8.5 (added) child_process jake-v10.8.5/test/integration/publish_task.js package.json via storybook@7.0.0
jake@10.8.5 (added) child_process jake-v10.8.5/test/integration/rule.js package.json via storybook@7.0.0
jake@10.8.5 (added) child_process jake-v10.8.5/test/integration/selfdep.js package.json via storybook@7.0.0
jake@10.8.5 (added) child_process jake-v10.8.5/test/integration/task_base.js package.json via storybook@7.0.0
jake@10.8.5 (added) child_process jake-v10.8.5/test/integration/task_base.js package.json via storybook@7.0.0
jest-haste-map@27.0.6 (upgraded) child_process build/crawlers/node.js package.json via babel-jest@27.0.6, jest@27.0.6, ts-jest@27.0.4
jest-haste-map@27.0.6 (upgraded) child_process build/index.js package.json via babel-jest@27.0.6, jest@27.0.6, ts-jest@27.0.4
jest-worker@27.0.6 (upgraded) child_process build/workers/ChildProcessWorker.js package.json via babel-jest@27.0.6, jest@27.0.6, ts-jest@27.0.4
jest-worker@27.5.1 (upgraded) child_process build/workers/ChildProcessWorker.js package.json via @storybook/react-webpack5@7.0.0, babel-loader@8.2.2
jscodeshift@0.14.0 (upgraded) child_process dist/Runner.js package.json via storybook@7.0.0
jscodeshift@0.14.0 (upgraded) child_process src/Runner.js package.json via storybook@7.0.0
jsdom@16.6.0 (added) child_process lib/jsdom/living/xhr/XMLHttpRequest-impl.js package.json via jest@27.0.6, jest-environment-jsdom@27.0.6, ts-jest@27.0.4
requireg@0.2.2 (added) child_process lib/resolvers.js package.json via auto@10.29.2
rollup@2.79.1 (added) child_process dist/shared/watch-cli.js package.json via tsup@6.3.0
shelljs@0.8.5 (added) child_process src/exec-child.js package.json via storybook@7.0.0
shelljs@0.8.5 (added) child_process src/exec.js package.json via storybook@7.0.0
tree-kill@1.2.2 (added) child_process index.js package.json via concurrently@7.0.0, tsup@6.3.0
update-browserslist-db@1.0.10 (added) child_process check-npm-version.js package.json via @storybook/addon-essentials@7.0.0, storybook@7.0.0
update-browserslist-db@1.0.10 (added) child_process index.js package.json via @storybook/addon-essentials@7.0.0, storybook@7.0.0
webpack@5.74.0 (added) child_process bin/webpack.js package.json via @storybook/react-webpack5@7.0.0, babel-loader@8.2.2
⚠️ Uses eval

Package uses eval() which is a dangerous function. This prevents the code from running in certain environments and increases the risk that the code may contain exploits or malicious behavior.

Avoid packages that use eval, since this could potentially execute any code.

Package Eval Type Location Source
@storybook/router@6.5.13 (upgraded) Function dist/cjs/index.js package.json via @storybook/testing-library@0.0.14-next.0
@storybook/router@6.5.13 (upgraded) Function dist/esm/index.js package.json via @storybook/testing-library@0.0.14-next.0
@storybook/router@6.5.13 (upgraded) Function dist/modern/index.js package.json via @storybook/testing-library@0.0.14-next.0
@testing-library/react@12.1.3 (added) Function dist/@testing-library/react.pure.umd.js package.json
@testing-library/react@12.1.3 (added) Function dist/@testing-library/react.pure.umd.js package.json
@testing-library/react@12.1.3 (added) Function dist/@testing-library/react.pure.umd.js package.json
@testing-library/react@12.1.3 (added) Function dist/@testing-library/react.pure.umd.min.js package.json
@testing-library/react@12.1.3 (added) Function dist/@testing-library/react.pure.umd.min.js package.json
@testing-library/react@12.1.3 (added) Function dist/@testing-library/react.pure.umd.min.js package.json
@testing-library/react@12.1.3 (added) Function dist/@testing-library/react.umd.js package.json
@testing-library/react@12.1.3 (added) Function dist/@testing-library/react.umd.js package.json
@testing-library/react@12.1.3 (added) Function dist/@testing-library/react.umd.js package.json
@testing-library/react@12.1.3 (added) Function dist/@testing-library/react.umd.min.js package.json
@testing-library/react@12.1.3 (added) Function dist/@testing-library/react.umd.min.js package.json
@testing-library/react@12.1.3 (added) Function dist/@testing-library/react.umd.min.js package.json
ajv@6.12.6 (upgraded) Function dist/ajv.bundle.js package.json via @storybook/react-webpack5@7.0.0, babel-loader@8.2.2
ajv@6.12.6 (upgraded) Function lib/compile/index.js package.json via @storybook/react-webpack5@7.0.0, babel-loader@8.2.2
ejs@3.1.8 (added) Function ejs-v3.1.8/ejs.js package.json via storybook@7.0.0
ejs@3.1.8 (added) Function ejs-v3.1.8/ejs.js package.json via storybook@7.0.0
ejs@3.1.8 (added) Function ejs-v3.1.8/ejs.min.js package.json via storybook@7.0.0
ejs@3.1.8 (added) Function ejs-v3.1.8/ejs.min.js package.json via storybook@7.0.0
ejs@3.1.8 (added) Function ejs-v3.1.8/lib/ejs.js package.json via storybook@7.0.0
ejs@3.1.8 (added) Function ejs-v3.1.8/lib/ejs.js package.json via storybook@7.0.0
envinfo@7.8.1 (added) Function dist/envinfo.js package.json via storybook@7.0.0
envinfo@7.8.1 (added) Function dist/envinfo.js package.json via storybook@7.0.0
expect@27.0.6 (added) Function build/asymmetricMatchers.js package.json via jest@27.0.6, ts-jest@27.0.4
expect@27.0.6 (added) Function build/index.js package.json via jest@27.0.6, ts-jest@27.0.4
expect@27.0.6 (added) Function build/index.js package.json via jest@27.0.6, ts-jest@27.0.4
expect@27.0.6 (added) Function build/index.js package.json via jest@27.0.6, ts-jest@27.0.4
expect@27.0.6 (added) Function build/jestMatchersObject.js package.json via jest@27.0.6, ts-jest@27.0.4
expect@27.0.6 (added) Function build/utils.js package.json via jest@27.0.6, ts-jest@27.0.4
handlebars@4.7.7 (added) Function dist/cjs/handlebars/compiler/javascript-compiler.js package.json via @storybook/addon-essentials@7.0.0, @storybook/addon-interactions@7.0.0, @storybook/react@7.0.0, @storybook/react-webpack5@7.0.0, storybook@7.0.0
handlebars@4.7.7 (added) Function dist/cjs/handlebars/compiler/javascript-compiler.js package.json via @storybook/addon-essentials@7.0.0, @storybook/addon-interactions@7.0.0, @storybook/react@7.0.0, @storybook/react-webpack5@7.0.0, storybook@7.0.0
handlebars@4.7.7 (added) Function dist/handlebars.amd.js package.json via @storybook/addon-essentials@7.0.0, @storybook/addon-interactions@7.0.0, @storybook/react@7.0.0, @storybook/react-webpack5@7.0.0, storybook@7.0.0
handlebars@4.7.7 (added) Function dist/handlebars.amd.js package.json via @storybook/addon-essentials@7.0.0, @storybook/addon-interactions@7.0.0, @storybook/react@7.0.0, @storybook/react-webpack5@7.0.0, storybook@7.0.0
handlebars@4.7.7 (added) Function dist/handlebars.amd.min.js package.json via @storybook/addon-essentials@7.0.0, @storybook/addon-interactions@7.0.0, @storybook/react@7.0.0, @storybook/react-webpack5@7.0.0, storybook@7.0.0
handlebars@4.7.7 (added) Function dist/handlebars.amd.min.js package.json via @storybook/addon-essentials@7.0.0, @storybook/addon-interactions@7.0.0, @storybook/react@7.0.0, @storybook/react-webpack5@7.0.0, storybook@7.0.0
jest-circus@27.0.6 (added) Function build/eventHandler.js package.json via jest@27.0.6, ts-jest@27.0.4
jest-circus@27.0.6 (added) Function build/eventHandler.js package.json via jest@27.0.6, ts-jest@27.0.4
jest-circus@27.0.6 (added) Function build/eventHandler.js package.json via jest@27.0.6, ts-jest@27.0.4
jest-circus@27.0.6 (added) Function build/types.js package.json via jest@27.0.6, ts-jest@27.0.4
jest-circus@27.0.6 (added) Function build/utils.js package.json via jest@27.0.6, ts-jest@27.0.4
jest-circus@27.0.6 (added) Function build/utils.js package.json via jest@27.0.6, ts-jest@27.0.4
jest-circus@27.0.6 (added) Function build/utils.js package.json via jest@27.0.6, ts-jest@27.0.4
jest-circus@27.0.6 (added) Function build/utils.js package.json via jest@27.0.6, ts-jest@27.0.4
jest-circus@27.0.6 (added) Function build/utils.js package.json via jest@27.0.6, ts-jest@27.0.4
jest-jasmine2@27.0.6 (added) Function build/jasmineAsyncInstall.js package.json via jest@27.0.6, ts-jest@27.0.4
jest-jasmine2@27.0.6 (added) Function build/jasmineAsyncInstall.js package.json via jest@27.0.6, ts-jest@27.0.4
jest-jasmine2@27.0.6 (added) Function build/jasmineAsyncInstall.js package.json via jest@27.0.6, ts-jest@27.0.4
jest-message-util@27.0.6 (added) Function build/index.js package.json via jest@27.0.6, jest-environment-jsdom@27.0.6, ts-jest@27.0.4
jest-message-util@27.0.6 (added) Function build/index.js package.json via jest@27.0.6, jest-environment-jsdom@27.0.6, ts-jest@27.0.4
jest-message-util@27.0.6 (added) Function build/index.js package.json via jest@27.0.6, jest-environment-jsdom@27.0.6, ts-jest@27.0.4
jest-snapshot@27.0.6 (added) Function build/index.js package.json via jest@27.0.6, ts-jest@27.0.4
jest-snapshot@27.0.6 (added) Function build/index.js package.json via jest@27.0.6, ts-jest@27.0.4
jest-snapshot@27.0.6 (added) Function build/index.js package.json via jest@27.0.6, ts-jest@27.0.4
jest-snapshot@27.0.6 (added) Function build/InlineSnapshots.js package.json via jest@27.0.6, ts-jest@27.0.4
jest-snapshot@27.0.6 (added) Function build/InlineSnapshots.js package.json via jest@27.0.6, ts-jest@27.0.4
jest-snapshot@27.0.6 (added) Function build/InlineSnapshots.js package.json via jest@27.0.6, ts-jest@27.0.4
jest-snapshot@27.0.6 (added) Function build/InlineSnapshots.js package.json via jest@27.0.6, ts-jest@27.0.4
jest-snapshot@27.0.6 (added) Function build/InlineSnapshots.js package.json via jest@27.0.6, ts-jest@27.0.4
jest-snapshot@27.0.6 (added) Function build/State.js package.json via jest@27.0.6, ts-jest@27.0.4
jest-snapshot@27.0.6 (added) Function build/State.js package.json via jest@27.0.6, ts-jest@27.0.4
jest-snapshot@27.0.6 (added) Function build/State.js package.json via jest@27.0.6, ts-jest@27.0.4
jest-snapshot@27.0.6 (added) Function build/utils.js package.json via jest@27.0.6, ts-jest@27.0.4
jest-snapshot@27.0.6 (added) Function build/utils.js package.json via jest@27.0.6, ts-jest@27.0.4
jest-snapshot@27.0.6 (added) Function build/utils.js package.json via jest@27.0.6, ts-jest@27.0.4
jest-snapshot@27.0.6 (added) Function build/utils.js package.json via jest@27.0.6, ts-jest@27.0.4
jest-snapshot@27.0.6 (added) Function build/utils.js [package.json](https://github.com/storybo

@shilman shilman added the patch Increment the patch version when merged label Mar 31, 2023
@shilman shilman changed the title Upgrade to v7 Upgrade to SB7.0 Mar 31, 2023
@shilman shilman merged commit f241141 into next Mar 31, 2023
@github-actions github-actions bot mentioned this pull request Apr 3, 2023
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
patch Increment the patch version when merged
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@shilman