Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

WIP: [PSL-1380] Security vulnerabilities fixed by upgrading Storybook to v7 #18

Closed
wants to merge 3 commits into from

Conversation

vbartonicek
Copy link
Contributor

Before:

What I did:

  1. Did automatic upgrade to Storybook 7.0.0-beta.13 by running npx storybook@next upgrade --prerelease
  2. Rewrote custom story sort as described in https://github.com/storybookjs/storybook/blob/next/MIGRATION.md#v7-style-story-sort
  3. Installed Webpack as dev dependency by running npm install --save-dev webpack to tackle following issue - Storybook build fails with "Cannot find module 'webpack/lib/util/makeSerializable.js" after upgrading storybook packages to 6.3.0 storybookjs/storybook#15336
  4. Deleted node-modules & package-lock.json and ran npm install to get rid of glob-parent <5.1.2 vulnerability which couldn't be fixed by npm audit fix

Resources:
Storybook 7.0 beta - https://storybook.js.org/blog/7-0-beta/
Storybook 7 migration guide - https://chromatic-ui.notion.site/Storybook-7-migration-guide-dbf41fa347304eb2a5e9c69b34503937

@linear
Copy link

linear bot commented Dec 21, 2022

PSL-1380 Update NPM dependencies and fix vulnerabilities

I just cloned the repo and running npm install reported 22 vulnerabilities.

Business Outcome:

As an Engineer I want to make sure our dependencies are up-to-date so that our repo's security&stability is increased.

Definition of done:

  • Update NPM dependencies to latest version
  • Fix all vulnerabilities

Additional Notes:

Some packages are deprecated and need a major update, e.g.

  • fsevents@1 => 2
  • chokidar@2.1.8 => 3

Screenshot

Screen Shot 2022-11-15 at 9.37.05 AM.png

@vbartonicek vbartonicek deleted the psl-1380-update-npm-dependencies-and-fix branch December 21, 2022 05:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

1 participant