Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Release 1.0.0 #39

Merged
merged 63 commits into from
Apr 3, 2023
Merged

Release 1.0.0 #39

merged 63 commits into from
Apr 3, 2023

Conversation

shilman
Copy link
Member

@shilman shilman commented Apr 3, 2023

Issue: N/A

What Changed

New release for SB 7.0

Version

Published prerelease version: v1.0.0-next.8

Changelog

💥 Breaking Change

  • Add JSX transpilation to compiler-generated code #30 (@ndelangen)

🚀 Enhancement

🐛 Bug Fix

⚠️ Pushed to next

Authors: 10

tmeasday and others added 30 commits July 14, 2022 15:57
+ added 'child' type guard.
+ added readable comments.
+ renamed 'ele' to 'canvasContainer' (sematic purpose).
Was almost impossible to debug where the loader errors were coming from when upgrading storybook with mdx2, until I monkey patched it with this change.
chore: Moved @babel/types to dependencies
shilman and others added 28 commits November 30, 2022 00:48
…ptions

Add MDX compiler option overrides
…e JSX runtime.

default jsxRuntime = 'automatic'
…ite4-support-missing-v2

Add JSX transpilation to compiler-generated code
Replace `'mdx'` tag with `'stories-mdx'`
Add debug output to `loader.js`
Throw descriptive error when of prop is detected
@socket-security
Copy link

New dependency changes detected. Learn more about Socket for GitHub ↗︎


🚨 Potential security issues found in this pull request. To accept the risk, merge this PR and you will not be notified again.

Bot Commands

To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of package-name@version specifiers. e.g. @SocketSecurity ignore foo@1.0.0 bar@* or ignore all packages with @SocketSecurity ignore-all

  • @SocketSecurity ignore esbuild@0.17.14
  • @SocketSecurity ignore semver@7.3.8
  • @SocketSecurity ignore @aw-web-design/x-default-browser@1.4.88
  • @SocketSecurity ignore babel-plugin-istanbul@6.1.1
  • @SocketSecurity ignore commander@2.20.3
  • @SocketSecurity ignore cross-spawn@7.0.3
  • @SocketSecurity ignore envinfo@7.8.1
  • @SocketSecurity ignore execa@4.1.0
  • @SocketSecurity ignore execa@5.1.1
  • @SocketSecurity ignore gitlog@4.0.4
  • @SocketSecurity ignore husky@7.0.4
  • @SocketSecurity ignore jake@10.8.5
  • @SocketSecurity ignore jest-haste-map@27.0.6
  • @SocketSecurity ignore jest-haste-map@29.5.0
  • @SocketSecurity ignore jest-worker@27.0.6
  • @SocketSecurity ignore jest-worker@27.5.1
  • @SocketSecurity ignore jest-worker@29.5.0
  • @SocketSecurity ignore jscodeshift@0.14.0
  • @SocketSecurity ignore jsdom@16.6.0
  • @SocketSecurity ignore requireg@0.2.2
  • @SocketSecurity ignore rollup@2.79.1
  • @SocketSecurity ignore shelljs@0.8.5
  • @SocketSecurity ignore tree-kill@1.2.2
  • @SocketSecurity ignore update-browserslist-db@1.0.10
  • @SocketSecurity ignore webpack@5.74.0
  • @SocketSecurity ignore @sinclair/typebox@0.25.24
  • @SocketSecurity ignore @storybook/components@7.0.0
  • @SocketSecurity ignore @storybook/router@6.5.13
  • @SocketSecurity ignore @storybook/router@7.0.0
  • @SocketSecurity ignore @testing-library/react@12.1.3
  • @SocketSecurity ignore ajv@6.12.6
  • @SocketSecurity ignore ajv@8.11.0
  • @SocketSecurity ignore core-js@3.13.1
  • @SocketSecurity ignore depd@2.0.0
  • @SocketSecurity ignore ejs@3.1.8
  • @SocketSecurity ignore expect@27.0.6
  • @SocketSecurity ignore handlebars@4.7.7
  • @SocketSecurity ignore is-callable@1.2.7
  • @SocketSecurity ignore is-generator-function@1.0.10
  • @SocketSecurity ignore jest-circus@27.0.6
  • @SocketSecurity ignore jest-jasmine2@27.0.6
  • @SocketSecurity ignore jest-message-util@27.0.6
  • @SocketSecurity ignore jest-snapshot@27.0.6
  • @SocketSecurity ignore js-yaml@3.14.1
  • @SocketSecurity ignore lodash@4.17.21
  • @SocketSecurity ignore object-inspect@1.12.0
  • @SocketSecurity ignore prettier@2.3.1
  • @SocketSecurity ignore pretty-format@27.5.1
  • @SocketSecurity ignore telejson@6.0.8
  • @SocketSecurity ignore telejson@7.0.4
📜 Install scripts

Install scripts are run when the package is installed. The majority of malware in npm is hidden in install scripts.

Packages should not be running non-essential scripts during install and there are often solutions to problems people solve with install scripts that can be run at publish time instead.

Package Script field Source
esbuild@0.17.14 (added) postinstall package.json via @storybook/addon-essentials@7.0.0, @storybook/addon-interactions@7.0.0, @storybook/react@7.0.0, @storybook/react-webpack5@7.0.0, storybook@7.0.0, tsup@6.3.0
😵‍💫 Bin script confusion

This package has multiple bin scripts with the same name. This can cause non-deterministic behavior when installing or could be a sign of a supply chain attack

Consider removing one of the conflicting packages. Packages should only export bin scripts with their name

Package Bin script Source
semver@7.3.8 (added) semver package.json via @storybook/addon-actions@7.0.0, @storybook/addon-essentials@7.0.0, @storybook/addon-interactions@7.0.0, @storybook/addon-links@7.0.0, @storybook/react-webpack5@7.0.0, storybook@7.0.0
⚠️ Shell access

This module accesses the system shell. Accessing the system shell increases the risk of executing arbitrary code.

Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced.

Package Module Location Source
@aw-web-design/x-default-browser@1.4.88 (added) child_process src/detect-linux.js package.json via storybook@7.0.0
@aw-web-design/x-default-browser@1.4.88 (added) child_process src/detect-windows.js package.json via storybook@7.0.0
@aw-web-design/x-default-browser@1.4.88 (added) child_process src/detect-windows10.js package.json via storybook@7.0.0
babel-plugin-istanbul@6.1.1 (upgraded) child_process lib/index.js package.json via @storybook/addon-essentials@7.0.0, babel-jest@27.0.6, jest@27.0.6, ts-jest@27.0.4
commander@2.20.3 (upgraded) child_process index.js package.json via @storybook/react-webpack5@7.0.0, babel-loader@8.2.2
cross-spawn@7.0.3 (upgraded) child_process index.js package.json via @storybook/react-webpack5@7.0.0, auto@10.29.2, jest@27.0.6, lint-staged@12.3.4, storybook@7.0.0, ts-jest@27.0.4, tsup@6.3.0
envinfo@7.8.1 (added) child_process dist/envinfo.js package.json via storybook@7.0.0
esbuild@0.17.14 (added) child_process install.js package.json via @storybook/addon-essentials@7.0.0, @storybook/addon-interactions@7.0.0, @storybook/react@7.0.0, @storybook/react-webpack5@7.0.0, storybook@7.0.0, tsup@6.3.0
esbuild@0.17.14 (added) child_process lib/main.js package.json via @storybook/addon-essentials@7.0.0, @storybook/addon-interactions@7.0.0, @storybook/react@7.0.0, @storybook/react-webpack5@7.0.0, storybook@7.0.0, tsup@6.3.0
execa@4.1.0 (upgraded) child_process index.js package.json via auto@10.29.2
execa@5.1.1 (upgraded) child_process index.js package.json via jest@27.0.6, lint-staged@12.3.4, storybook@7.0.0, ts-jest@27.0.4, tsup@6.3.0
gitlog@4.0.4 (added) child_process dist/gitlog.cjs.development.js package.json via auto@10.29.2
gitlog@4.0.4 (added) child_process dist/gitlog.cjs.production.min.js package.json via auto@10.29.2
gitlog@4.0.4 (added) child_process dist/gitlog.esm.js package.json via auto@10.29.2
husky@7.0.4 (added) child_process lib/index.js package.json
jake@10.8.5 (added) child_process jake-v10.8.5/jakefile.js package.json via storybook@7.0.0
jake@10.8.5 (added) child_process jake-v10.8.5/lib/package_task.js package.json via storybook@7.0.0
jake@10.8.5 (added) child_process jake-v10.8.5/lib/publish_task.js package.json via storybook@7.0.0
jake@10.8.5 (added) child_process jake-v10.8.5/lib/utils/index.js package.json via storybook@7.0.0
jake@10.8.5 (added) child_process jake-v10.8.5/test/integration/concurrent.js package.json via storybook@7.0.0
jake@10.8.5 (added) child_process jake-v10.8.5/test/integration/file_task.js package.json via storybook@7.0.0
jake@10.8.5 (added) child_process jake-v10.8.5/test/integration/file.js package.json via storybook@7.0.0
jake@10.8.5 (added) child_process jake-v10.8.5/test/integration/helpers.js package.json via storybook@7.0.0
jake@10.8.5 (added) child_process jake-v10.8.5/test/integration/jakelib/rule.jake.js package.json via storybook@7.0.0
jake@10.8.5 (added) child_process jake-v10.8.5/test/integration/publish_task.js package.json via storybook@7.0.0
jake@10.8.5 (added) child_process jake-v10.8.5/test/integration/rule.js package.json via storybook@7.0.0
jake@10.8.5 (added) child_process jake-v10.8.5/test/integration/selfdep.js package.json via storybook@7.0.0
jake@10.8.5 (added) child_process jake-v10.8.5/test/integration/task_base.js package.json via storybook@7.0.0
jake@10.8.5 (added) child_process jake-v10.8.5/test/integration/task_base.js package.json via storybook@7.0.0
jest-haste-map@27.0.6 (upgraded) child_process build/crawlers/node.js package.json via babel-jest@27.0.6, jest@27.0.6, ts-jest@27.0.4
jest-haste-map@27.0.6 (upgraded) child_process build/index.js package.json via babel-jest@27.0.6, jest@27.0.6, ts-jest@27.0.4
jest-haste-map@29.5.0 (upgraded) child_process build/crawlers/node.js package.json via @storybook/addon-essentials@7.0.0
jest-haste-map@29.5.0 (upgraded) child_process build/lib/isWatchmanInstalled.js package.json via @storybook/addon-essentials@7.0.0
jest-worker@27.0.6 (upgraded) child_process build/workers/ChildProcessWorker.js package.json via babel-jest@27.0.6, jest@27.0.6, ts-jest@27.0.4
jest-worker@27.5.1 (upgraded) child_process build/workers/ChildProcessWorker.js package.json via @storybook/react-webpack5@7.0.0, babel-loader@8.2.2
jest-worker@29.5.0 (upgraded) child_process build/workers/ChildProcessWorker.js package.json via @storybook/addon-essentials@7.0.0
jscodeshift@0.14.0 (added) child_process dist/Runner.js package.json via storybook@7.0.0
jscodeshift@0.14.0 (added) child_process src/Runner.js package.json via storybook@7.0.0
jsdom@16.6.0 (added) child_process lib/jsdom/living/xhr/XMLHttpRequest-impl.js package.json via jest@27.0.6, jest-environment-jsdom@27.0.6, ts-jest@27.0.4
requireg@0.2.2 (added) child_process lib/resolvers.js package.json via auto@10.29.2
rollup@2.79.1 (added) child_process dist/shared/watch-cli.js package.json via tsup@6.3.0
shelljs@0.8.5 (added) child_process src/exec-child.js package.json via storybook@7.0.0
shelljs@0.8.5 (added) child_process src/exec.js package.json via storybook@7.0.0
tree-kill@1.2.2 (added) child_process index.js package.json via concurrently@7.0.0, tsup@6.3.0
update-browserslist-db@1.0.10 (added) child_process check-npm-version.js package.json via @storybook/addon-essentials@7.0.0, storybook@7.0.0
update-browserslist-db@1.0.10 (added) child_process index.js package.json via @storybook/addon-essentials@7.0.0, storybook@7.0.0
webpack@5.74.0 (upgraded) child_process bin/webpack.js package.json via @storybook/react-webpack5@7.0.0, babel-loader@8.2.2
⚠️ Uses eval

Package uses eval() which is a dangerous function. This prevents the code from running in certain environments and increases the risk that the code may contain exploits or malicious behavior.

Avoid packages that use eval, since this could potentially execute any code.

Package Eval Type Location Source
@sinclair/typebox@0.25.24 (added) Function compiler/compiler.js package.json via @storybook/addon-essentials@7.0.0
@sinclair/typebox@0.25.24 (added) Function errors/errors.js package.json via @storybook/addon-essentials@7.0.0
@sinclair/typebox@0.25.24 (added) Function value/cast.js package.json via @storybook/addon-essentials@7.0.0
@sinclair/typebox@0.25.24 (added) Function value/check.js package.json via @storybook/addon-essentials@7.0.0
@sinclair/typebox@0.25.24 (added) Function value/create.js package.json via @storybook/addon-essentials@7.0.0
@storybook/components@7.0.0 (upgraded) Function dist/formatter-UT3ZCDIS.mjs package.json via @storybook/addon-actions@7.0.0, @storybook/addon-essentials@7.0.0, @storybook/addon-interactions@7.0.0, @storybook/react-webpack5@7.0.0
@storybook/components@7.0.0 (upgraded) Function dist/formatter-UT3ZCDIS.mjs package.json via @storybook/addon-actions@7.0.0, @storybook/addon-essentials@7.0.0, @storybook/addon-interactions@7.0.0, @storybook/react-webpack5@7.0.0
@storybook/router@6.5.13 (upgraded) Function dist/cjs/index.js package.json via @storybook/testing-library@0.0.14-next.0
@storybook/router@6.5.13 (upgraded) Function dist/esm/index.js package.json via @storybook/testing-library@0.0.14-next.0
@storybook/router@6.5.13 (upgraded) Function dist/modern/index.js package.json via @storybook/testing-library@0.0.14-next.0
@storybook/router@7.0.0 (upgraded) Function dist/chunk-NQZQ3SVL.mjs package.json via @storybook/addon-actions@7.0.0, @storybook/addon-essentials@7.0.0, @storybook/addon-interactions@7.0.0, @storybook/addon-links@7.0.0, @storybook/react-webpack5@7.0.0
@storybook/router@7.0.0 (upgraded) Function dist/index.js package.json via @storybook/addon-actions@7.0.0, @storybook/addon-essentials@7.0.0, @storybook/addon-interactions@7.0.0, @storybook/addon-links@7.0.0, @storybook/react-webpack5@7.0.0
@storybook/router@7.0.0 (upgraded) Function dist/utils.js package.json via @storybook/addon-actions@7.0.0, @storybook/addon-essentials@7.0.0, @storybook/addon-interactions@7.0.0, @storybook/addon-links@7.0.0, @storybook/react-webpack5@7.0.0
@testing-library/react@12.1.3 (added) Function dist/@testing-library/react.pure.umd.js package.json
@testing-library/react@12.1.3 (added) Function dist/@testing-library/react.pure.umd.js package.json
@testing-library/react@12.1.3 (added) Function dist/@testing-library/react.pure.umd.js package.json
@testing-library/react@12.1.3 (added) Function dist/@testing-library/react.pure.umd.min.js package.json
@testing-library/react@12.1.3 (added) Function dist/@testing-library/react.pure.umd.min.js package.json
@testing-library/react@12.1.3 (added) Function dist/@testing-library/react.pure.umd.min.js package.json
@testing-library/react@12.1.3 (added) Function dist/@testing-library/react.umd.js package.json
@testing-library/react@12.1.3 (added) Function dist/@testing-library/react.umd.js package.json
@testing-library/react@12.1.3 (added) Function dist/@testing-library/react.umd.js package.json
@testing-library/react@12.1.3 (added) Function dist/@testing-library/react.umd.min.js package.json
@testing-library/react@12.1.3 (added) Function dist/@testing-library/react.umd.min.js package.json
@testing-library/react@12.1.3 (added) Function dist/@testing-library/react.umd.min.js package.json
ajv@6.12.6 (added) Function dist/ajv.bundle.js package.json via @storybook/react-webpack5@7.0.0, babel-loader@8.2.2
ajv@6.12.6 (added) Function lib/compile/index.js package.json via @storybook/react-webpack5@7.0.0, babel-loader@8.2.2
ajv@8.11.0 (added) Function dist/compile/index.js package.json via @storybook/react-webpack5@7.0.0
ajv@8.11.0 (added) Function dist/compile/jtd/parse.js package.json via @storybook/react-webpack5@7.0.0
ajv@8.11.0 (added) Function dist/compile/jtd/serialize.js package.json via @storybook/react-webpack5@7.0.0
core-js@3.13.1 (added) Function internals/async-iterator-prototype.js package.json via @storybook/addon-actions@7.0.0, @storybook/addon-essentials@7.0.0, @storybook/addon-interactions@7.0.0, @storybook/addon-links@7.0.0, @storybook/react@7.0.0, @storybook/react-webpack5@7.0.0, @storybook/testing-library@0.0.14-next.0, storybook@7.0.0
core-js@3.13.1 (added) Function internals/function-bind.js package.json via @storybook/addon-actions@7.0.0, @storybook/addon-essentials@7.0.0, @storybook/addon-interactions@7.0.0, @storybook/addon-links@7.0.0, @storybook/react@7.0.0, @storybook/react-webpack5@7.0.0, @storybook/testing-library@0.0.14-next.0, storybook@7.0.0
core-js@3.13.1 (added) Function internals/task.js package.json via @storybook/addon-actions@7.0.0, @storybook/addon-essentials@7.0.0, @storybook/addon-interactions@7.0.0, @storybook/addon-links@7.0.0, @storybook/react@7.0.0, @storybook/react-webpack5@7.0.0, @storybook/testing-library@0.0.14-next.0, storybook@7.0.0
core-js@3.13.1 (added) Function modules/web.timers.js package.json via @storybook/addon-actions@7.0.0, @storybook/addon-essentials@7.0.0, @storybook/addon-interactions@7.0.0, @storybook/addon-links@7.0.0, @storybook/react@7.0.0, @storybook/react-webpack5@7.0.0, @storybook/testing-library@0.0.14-next.0, storybook@7.0.0
depd@2.0.0 (upgraded) Function index.js package.json via @storybook/react-webpack5@7.0.0, storybook@7.0.0
ejs@3.1.8 (added) Function ejs-v3.1.8/ejs.js package.json via storybook@7.0.0
ejs@3.1.8 (added) Function ejs-v3.1.8/ejs.js package.json via storybook@7.0.0
ejs@3.1.8 (added) Function ejs-v3.1.8/ejs.min.js package.json via storybook@7.0.0
ejs@3.1.8 (added) Function ejs-v3.1.8/ejs.min.js package.json via storybook@7.0.0
ejs@3.1.8 (added) Function ejs-v3.1.8/lib/ejs.js package.json via storybook@7.0.0
ejs@3.1.8 (added) Function ejs-v3.1.8/lib/ejs.js package.json via storybook@7.0.0
envinfo@7.8.1 (added) Function dist/envinfo.js package.json via storybook@7.0.0
envinfo@7.8.1 (added) Function dist/envinfo.js package.json via storybook@7.0.0
expect@27.0.6 (added) Function build/asymmetricMatchers.js package.json via jest@27.0.6, ts-jest@27.0.4
expect@27.0.6 (added) Function build/index.js package.json via jest@27.0.6, ts-jest@27.0.4
expect@27.0.6 (added) Function build/index.js package.json via jest@27.0.6, ts-jest@27.0.4
expect@27.0.6 (added) Function build/index.js package.json via jest@27.0.6, ts-jest@27.0.4
expect@27.0.6 (added) Function build/jestMatchersObject.js package.json via jest@27.0.6, ts-jest@27.0.4
expect@27.0.6 (added) Function build/utils.js package.json via jest@27.0.6, ts-jest@27.0.4
handlebars@4.7.7 (added) Function dist/cjs/handlebars/compiler/javascript-compiler.js package.json via @storybook/addon-essentials@7.0.0, @storybook/addon-interactions@7.0.0, @storybook/react@7.0.0, @storybook/react-webpack5@7.0.0, storybook@7.0.0
handlebars@4.7.7 (added) Function dist/cjs/handlebars/compiler/javascript-compiler.js package.json via @storybook/addon-essentials@7.0.0, @storybook/addon-interactions@7.0.0, @storybook/react@7.0.0, @storybook/react-webpack5@7.0.0, storybook@7.0.0
handlebars@4.7.7 (added) Function dist/handlebars.amd.js package.json via @storybook/addon-essentials@7.0.0, @storybook/addon-interactions@7.0.0, @storybook/react@7.0.0, @storybook/react-webpack5@7.0.0, storybook@7.0.0
handlebars@4.7.7 (added) Function [dist/handlebars.amd.js](https://socket.dev/npm/package/handlebars/files/4.7.7/dist/handlebar

@shilman shilman merged commit 7a3b0d3 into main Apr 3, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

10 participants