glob-parent Security Vulnerability #15174

zpeterson · 2021-06-08T18:37:33Z

Describe the bug

You are dependent on an insecure version of glob-parent.

To Reproduce

Run npm audit

System

Environment Info:

  System:
    OS: Linux 5.10 Ubuntu 20.04 LTS (Focal Fossa)
    CPU: (8) x64 Intel(R) Core(TM) i7-1065G7 CPU @ 1.30GHz
  Binaries:
    Node: 10.13.0 - ~/.nvm/versions/node/v10.13.0/bin/node
    npm: 6.4.1 - ~/.nvm/versions/node/v10.13.0/bin/npm
  npmPackages:
    @storybook/addon-a11y: 6.2.9 => 6.2.9 
    @storybook/addon-essentials: 6.2.9 => 6.2.9 
    @storybook/addon-links: 6.2.9 => 6.2.9 
    @storybook/addons: 6.2.9 => 6.2.9 
    @storybook/preset-scss: 1.0.3 => 1.0.3 
    @storybook/react: 6.2.9 => 6.2.9 
    @storybook/theming: 6.2.9 => 6.2.9

Additional context

┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Moderate      │ Regular expression denial of service                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ glob-parent                                                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=5.1.2                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ @storybook/addon-essentials [dev]                            │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ @storybook/addon-essentials > @storybook/addon-docs >        │
│               │ @storybook/builder-webpack4 > @storybook/core-common >       │
│               │ glob-base > glob-parent                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://nodesecurity.io/advisories/1751                      │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Moderate      │ Regular expression denial of service                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ glob-parent                                                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=5.1.2                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ @storybook/addon-essentials [dev]                            │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ @storybook/addon-essentials > @storybook/addon-docs >        │
│               │ @storybook/core > @storybook/core-server >                   │
│               │ @storybook/builder-webpack4 > @storybook/core-common >       │
│               │ glob-base > glob-parent                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://nodesecurity.io/advisories/1751                      │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Moderate      │ Regular expression denial of service                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ glob-parent                                                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=5.1.2                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ @storybook/react [dev]                                       │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ @storybook/react > @storybook/core > @storybook/core-server  │
│               │ > @storybook/builder-webpack4 > @storybook/core-common >     │
│               │ glob-base > glob-parent                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://nodesecurity.io/advisories/1751                      │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Moderate      │ Regular expression denial of service                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ glob-parent                                                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=5.1.2                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ @storybook/addon-essentials [dev]                            │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ @storybook/addon-essentials > @storybook/addon-docs >        │
│               │ @storybook/core > @storybook/core-server >                   │
│               │ @storybook/core-common > glob-base > glob-parent             │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://nodesecurity.io/advisories/1751                      │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Moderate      │ Regular expression denial of service                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ glob-parent                                                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=5.1.2                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ @storybook/react [dev]                                       │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ @storybook/react > @storybook/core > @storybook/core-server  │
│               │ > @storybook/core-common > glob-base > glob-parent           │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://nodesecurity.io/advisories/1751                      │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Moderate      │ Regular expression denial of service                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ glob-parent                                                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=5.1.2                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ @storybook/react [dev]                                       │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ @storybook/react > @storybook/core-common > glob-base >      │
│               │ glob-parent                                                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://nodesecurity.io/advisories/1751                      │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Moderate      │ Regular expression denial of service                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ glob-parent                                                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=5.1.2                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ @storybook/addon-essentials [dev]                            │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ @storybook/addon-essentials > @storybook/addon-docs >        │
│               │ @storybook/builder-webpack4 > @storybook/core-common >       │
│               │ webpack > watchpack > watchpack-chokidar2 > chokidar >       │
│               │ glob-parent                                                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://nodesecurity.io/advisories/1751                      │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Moderate      │ Regular expression denial of service                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ glob-parent                                                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=5.1.2                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ @storybook/addon-essentials [dev]                            │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ @storybook/addon-essentials > @storybook/addon-docs >        │
│               │ @storybook/core > @storybook/core-server >                   │
│               │ @storybook/builder-webpack4 > @storybook/core-common >       │
│               │ webpack > watchpack > watchpack-chokidar2 > chokidar >       │
│               │ glob-parent                                                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://nodesecurity.io/advisories/1751                      │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Moderate      │ Regular expression denial of service                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ glob-parent                                                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=5.1.2                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ @storybook/react [dev]                                       │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ @storybook/react > @storybook/core > @storybook/core-server  │
│               │ > @storybook/builder-webpack4 > @storybook/core-common >     │
│               │ webpack > watchpack > watchpack-chokidar2 > chokidar >       │
│               │ glob-parent                                                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://nodesecurity.io/advisories/1751                      │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Moderate      │ Regular expression denial of service                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ glob-parent                                                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=5.1.2                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ @storybook/addon-essentials [dev]                            │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ @storybook/addon-essentials > @storybook/addon-docs >        │
│               │ @storybook/core > @storybook/core-server >                   │
│               │ @storybook/core-common > webpack > watchpack >               │
│               │ watchpack-chokidar2 > chokidar > glob-parent                 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://nodesecurity.io/advisories/1751                      │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Moderate      │ Regular expression denial of service                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ glob-parent                                                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=5.1.2                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ @storybook/react [dev]                                       │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ @storybook/react > @storybook/core > @storybook/core-server  │
│               │ > @storybook/core-common > webpack > watchpack >             │
│               │ watchpack-chokidar2 > chokidar > glob-parent                 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://nodesecurity.io/advisories/1751                      │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Moderate      │ Regular expression denial of service                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ glob-parent                                                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=5.1.2                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ @storybook/react [dev]                                       │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ @storybook/react > @storybook/core-common > webpack >        │
│               │ watchpack > watchpack-chokidar2 > chokidar > glob-parent     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://nodesecurity.io/advisories/1751                      │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Moderate      │ Regular expression denial of service                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ glob-parent                                                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=5.1.2                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ @storybook/addon-essentials [dev]                            │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ @storybook/addon-essentials > @storybook/addon-docs >        │
│               │ @storybook/builder-webpack4 > webpack > watchpack >          │
│               │ watchpack-chokidar2 > chokidar > glob-parent                 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://nodesecurity.io/advisories/1751                      │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Moderate      │ Regular expression denial of service                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ glob-parent                                                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=5.1.2                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ @storybook/addon-essentials [dev]                            │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ @storybook/addon-essentials > @storybook/addon-docs >        │
│               │ @storybook/core > @storybook/core-server >                   │
│               │ @storybook/builder-webpack4 > webpack > watchpack >          │
│               │ watchpack-chokidar2 > chokidar > glob-parent                 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://nodesecurity.io/advisories/1751                      │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Moderate      │ Regular expression denial of service                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ glob-parent                                                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=5.1.2                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ @storybook/react [dev]                                       │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ @storybook/react > @storybook/core > @storybook/core-server  │
│               │ > @storybook/builder-webpack4 > webpack > watchpack >        │
│               │ watchpack-chokidar2 > chokidar > glob-parent                 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://nodesecurity.io/advisories/1751                      │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Moderate      │ Regular expression denial of service                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ glob-parent                                                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=5.1.2                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ @storybook/addon-essentials [dev]                            │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ @storybook/addon-essentials > @storybook/addon-docs >        │
│               │ @storybook/core > @storybook/core-server > webpack >         │
│               │ watchpack > watchpack-chokidar2 > chokidar > glob-parent     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://nodesecurity.io/advisories/1751                      │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Moderate      │ Regular expression denial of service                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ glob-parent                                                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=5.1.2                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ @storybook/react [dev]                                       │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ @storybook/react > @storybook/core > @storybook/core-server  │
│               │ > webpack > watchpack > watchpack-chokidar2 > chokidar >     │
│               │ glob-parent                                                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://nodesecurity.io/advisories/1751                      │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Moderate      │ Regular expression denial of service                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ glob-parent                                                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=5.1.2                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ @storybook/react [dev]                                       │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ @storybook/react > webpack > watchpack > watchpack-chokidar2 │
│               │ > chokidar > glob-parent                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://nodesecurity.io/advisories/1751                      │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Moderate      │ Regular expression denial of service                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ glob-parent                                                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=5.1.2                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ @storybook/addon-essentials [dev]                            │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ @storybook/addon-essentials > @storybook/addon-docs >        │
│               │ @storybook/core > @storybook/core-server > cpy > globby >    │
│               │ fast-glob > glob-parent                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://nodesecurity.io/advisories/1751                      │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Moderate      │ Regular expression denial of service                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ glob-parent                                                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=5.1.2                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ @storybook/react [dev]                                       │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ @storybook/react > @storybook/core > @storybook/core-server  │
│               │ > cpy > globby > fast-glob > glob-parent                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://nodesecurity.io/advisories/1751                      │
└───────────────┴──────────────────────────────────────────────────────────────┘

The text was updated successfully, but these errors were encountered:

s100 · 2021-06-14T17:23:30Z

glob-base has an issue open to upgrade from glob-parent@^2.0.0 (!!) to a patched version (@^5.1.2). However, that issue has been open since 15 May with no activity, and the glob-base repo itself has seen no activity since September 2015 and is clearly unmaintained.

Recommendation is for @storybook/core-common to stop using glob-base entirely.

shilman · 2021-07-23T17:16:37Z

Yowza!! I just released https://github.com/storybookjs/storybook/releases/tag/v6.4.0-alpha.20 containing PR #15399 that references this issue. Upgrade today to the @next NPM tag to try it out!

npx sb upgrade --prerelease

Closing this issue. Please re-open if you think there's still more to do.

cloakedninjas · 2021-08-19T08:39:45Z

This did fix a bunch of them, but a few remain, after running npx sb upgrade --prerelease (now on 6.4.0-alpha.30)

However - cpy needs updating: sindresorhus/cpy#87

┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Moderate      │ Regular expression denial of service                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ glob-parent                                                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=5.1.2                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ @storybook/addon-docs [dev]                                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ @storybook/addon-docs > @storybook/core >                    │
│               │ @storybook/core-server > cpy > globby > fast-glob >          │
│               │ glob-parent                                                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/1751                            │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Moderate      │ Regular expression denial of service                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ glob-parent                                                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=5.1.2                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ @storybook/addon-storyshots [dev]                            │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ @storybook/addon-storyshots > @storybook/core >              │
│               │ @storybook/core-server > cpy > globby > fast-glob >          │
│               │ glob-parent                                                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/1751                            │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Moderate      │ Regular expression denial of service                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ glob-parent                                                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=5.1.2                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ @storybook/angular [dev]                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ @storybook/angular > @storybook/core >                       │
│               │ @storybook/core-server > cpy > globby > fast-glob >          │
│               │ glob-parent                                                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/1751                            │
└───────────────┴──────────────────────────────────────────────────────────────┘

marcinincreo · 2021-08-25T08:15:11Z

@shilman please re-open this as it is still an issue.

Unfortunately we can't do them all. * storybook still has some deps. One they [removed in "next"][2]. Another is still there. Plus it has some webpack 4 deps it seemingly doesn't actually use. * `gulp` devs [actively refuse to update dependencies][3] when they believe they're not hitting the vulnerability, apparently as protest against `npm audit` which they consider "broken". [2]: storybookjs/storybook#15174 [3]: gulpjs/glob-stream#108

shilman · 2021-08-31T17:16:15Z

Huzzah!! I just released https://github.com/storybookjs/storybook/releases/tag/v6.4.0-alpha.33 containing PR #15953 that references this issue. Upgrade today to the @next NPM tag to try it out!

npx sb upgrade --prerelease

Closing this issue. Please re-open if you think there's still more to do.

cloakedninjas · 2021-09-01T06:43:13Z

Issues still present - v8.1.2 doesn't resolve the warnings from cpy, we will have to wait for their next release

Clean up JS dependencies, mainly those complained about by `pnpm audit`. * Remove unneeded pnpm.overrides. * `@automattic/calypso-build` no longer depends on `node-sass`. * Nothing we depend on depends on `terser-webpack-plugin` 2.3.1 anymore. And fix syntax for a few others. Looks like pnpm 6.10.2 broke the syntax we were using before. * Update browserslist. Add an override for `react-dev-utils` which unnecessarily depends on a specific version instead of allowing updates. * Update cheerio. New version fixes dep on vulnerable `css-what`. * Update tar. * Update postcss. Only the 7.0.35 deps needed updating for vulnerabilities, but may as well do the 8.2.15 too. * Update path-parse. * Add override for trim@0.0.1. `@storybook/csf-tools` depends on `@mdx-js/mdx`, which is [refusing to fix the old dep in its 1.x branch][1] and hasn't released 2.0 yet. * Upgrade copy-webpack-plugin. Depends on a vulnerable version of glob-parent. * Update glob-parent where we can. Unfortunately we can't do them all. * storybook still has some deps. One they [removed in "next"][2]. Another is still there. Plus it has some webpack 4 deps it seemingly doesn't actually use. * `gulp` devs [actively refuse to update dependencies][3] when they believe they're not hitting the vulnerability, apparently as protest against `npm audit` which they consider "broken". [1]: mdx-js/mdx#1553 [2]: storybookjs/storybook#15174 [3]: gulpjs/glob-stream#108

Clean up JS dependencies, mainly those complained about by `pnpm audit`. * Remove unneeded pnpm.overrides. * `@automattic/calypso-build` no longer depends on `node-sass`. * Nothing we depend on depends on `terser-webpack-plugin` 2.3.1 anymore. And fix syntax for a few others. Looks like pnpm 6.10.2 broke the syntax we were using before. * Update browserslist. Add an override for `react-dev-utils` which unnecessarily depends on a specific version instead of allowing updates. * Update cheerio. New version fixes dep on vulnerable `css-what`. * Update tar. * Update postcss. Only the 7.0.35 deps needed updating for vulnerabilities, but may as well do the 8.2.15 too. * Update path-parse. * Add override for trim@0.0.1. `@storybook/csf-tools` depends on `@mdx-js/mdx`, which is [refusing to fix the old dep in its 1.x branch][1] and hasn't released 2.0 yet. * Upgrade copy-webpack-plugin. Depends on a vulnerable version of glob-parent. * Update glob-parent where we can. Unfortunately we can't do them all. * storybook still has some deps. One they [removed in "next"][2]. Another is still there. Plus it has some webpack 4 deps it seemingly doesn't actually use. * `gulp` devs [actively refuse to update dependencies][3] when they believe they're not hitting the vulnerability, apparently as protest against `npm audit` which they consider "broken". [1]: mdx-js/mdx#1553 [2]: storybookjs/storybook#15174 [3]: gulpjs/glob-stream#108 Committed via a GitHub action: https://github.com/Automattic/jetpack/actions/runs/1190571780

andziaoo7 · 2021-12-20T08:57:48Z

After I've replaced addon-knobs with addon-controls this issue appeared.

I'm using:
"@storybook/angular": "6.4.9",
"@storybook/addon-controls": "6.4.9",


┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Moderate      │ Regular expression denial of service                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ glob-parent                                                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=5.1.2                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ @storybook/addon-controls                               │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ @storybook/addon-controls > @storybook/core-common > webpack  
                  > watchpack > watchpack-chokidar2 > chokidar > glob-parent                                                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://github.com/advisories/GHSA-ww39-953v-wcq6                              │
└───────────────┴──────────────────────────────────────────────────────────────┘

landsman · 2022-02-01T17:20:02Z

pls

Prompted by Dependabot false positive Security vulnerabilities of dev build tools RN Storybook v5.3 - Remove old /storybook config - Keep old /stories for now RN Storybook v6 - Setup in .storybook for now - Add minimal config w/o stories for now Jest setup mocks - Remove stale RN mocks - Add new RN Storybook mocks - Doc @storybook/addon-ondevice-notes/register parsing issue - Doc @storybook/addon-actions ES forEach proto parsing issue Metro - Config resolver for modern storybook build, vs polyfilled versions - Keep inlineRequires optimisation on, disable later if blocking App - Update gitignore with Storybook - Update app Storybook require to import with new path - Add react-native-slider and RNDateTimePicker pods - Add get-stories script to codegen storybook.requires.js - Update RNCAsyncStorage pod - Remove deprecated @react-native-community/async-storage later and update Reactotron config Relevant Dependabot Security alerts - Upgrading Storybook should clear some, resolve remaining after - browserslist: storybookjs/storybook#15173 - glob-parent : storybookjs/storybook#15174 - Vulnerabilities: storybookjs/storybook#16063 - immer: storybookjs/storybook#16093 - immer: storybookjs/storybook#16556 storybookjs/react-native#240 - Old v5.3 warnings no longer present, in this v6 no-stories but with addons upgrade so far

Prompted by Dependabot false positive Security vulnerabilities of dev build tools RN Storybook v5.3 - Remove old /storybook config - Keep old /stories for now RN Storybook v6 - Setup in .storybook for now - Add minimal config w/o stories for now Jest setup mocks - Remove stale RN mocks - Add new RN Storybook mocks - Doc @storybook/addon-ondevice-notes/register parsing issue - Doc @storybook/addon-actions ES forEach proto parsing issue Metro - Config resolver for modern storybook build, vs polyfilled versions - Keep inlineRequires optimisation on, disable later if blocking App - Update gitignore with Storybook - Update app Storybook require to import with new path - Add react-native-slider and RNDateTimePicker pods - Add get-stories script to codegen storybook.requires.js - Update RNCAsyncStorage pod - Remove deprecated @react-native-community/async-storage later and update Reactotron config Relevant Dependabot Security alerts - Upgrading Storybook should clear some, resolve remaining after - browserslist: storybookjs/storybook#15173 - glob-parent : storybookjs/storybook#15174 - Vulnerabilities: storybookjs/storybook#16063 - immer: storybookjs/storybook#16093 - immer: storybookjs/storybook#16556 storybookjs/react-native#240 - Old v5.3 warnings no longer present, in this v6 no-stories but with addons upgrade so far After figured @storybook/addon-ondevice-notes/register Jest parsing issue - Add generated storybook.requires.js to gitignore - Add prestart script to get-stories first Consider splitting/decoupling App/Storybook Jest parsing - env var with dynamic import - npm workspaces / lerna - multiple modules

dgarciasarai · 2022-02-14T12:43:05Z

After updating to @storybook/react 6.4.19:

iuriifaevskii · 2022-02-15T17:06:54Z

@dgarciasarai the same issue

can someone from the storybook team take a look

NicolasBelliard · 2022-02-24T17:18:29Z

Hello!
Do you have any news concerning a potential fix of this vulnerability?
Thank you!

shilman · 2022-02-24T17:29:45Z

If you look at the dependency tree, this is an issue with Webpack4.

The plan is to make Webpack4 optional starting in Storybook 7.0, which will come out later this year. At that point, this failing check should go away.

SimenB · 2022-03-08T10:06:56Z

@shilman cpy is not from webpack, but since its latest version is ESM only it might not be possibly for you to upgrade? Could replace it with some other copying lib, tho

bodograumann · 2022-04-12T15:29:21Z

I guess the issue is not that big, but I wish npm wouldn’t warn about “23 high severity vulnerabilities”, just because @storybook/addon-docs@6.4 is installed...

strmer15 · 2022-06-17T14:21:48Z

When I looked at this again yesterday, cpy was coming from @storybook/core-server, which uses cpy to move a favicon and the contents of a prebuiltDir to the output in certain circumstances - I've created #18497 to use fs-extra instead (which has a copy function and is already installed in the project).

shilman · 2022-06-29T11:40:07Z

Olé!! I just released https://github.com/storybookjs/storybook/releases/tag/v7.0.0-alpha.7 containing PR #18497 that references this issue. Upgrade today to the @future NPM tag to try it out!

npx sb upgrade --prerelease

Closing this issue. Please re-open if you think there's still more to do.

esharmony · 2022-08-10T08:43:20Z

Olé!! I just released https://github.com/storybookjs/storybook/releases/tag/v7.0.0-alpha.7 containing PR #18497 that references this issue. Upgrade today to the @future NPM tag to try it out!
npx sb upgrade --prerelease
Closing this issue. Please re-open if you think there's still more to do.

I just followed this, and now storybook no longer runs
/bin/sh: start-storybook: command not found

I have cleared the cache and deleted and reinstalled node_modules, has something changed?

esharmony · 2022-08-11T07:15:57Z

Olé!! I just released https://github.com/storybookjs/storybook/releases/tag/v7.0.0-alpha.7 containing PR #18497 that references this issue. Upgrade today to the @future NPM tag to try it out!
npx sb upgrade --prerelease
Closing this issue. Please re-open if you think there's still more to do.
I just followed this, and now storybook no longer runs /bin/sh: start-storybook: command not found

I have cleared the cache and deleted and reinstalled node_modules, has something changed?

OK - there are migration notes I need to read : )
https://github.com/storybookjs/storybook/blob/next/MIGRATION.md#start-storybook--build-storybook-binaries-removed

zpeterson added bug needs triage labels Jun 8, 2021

shilman added the security label Jun 13, 2021

lkuechler mentioned this issue Jun 28, 2021

remove glob-base dependency #15399

Merged

shilman closed this as completed Jul 23, 2021

anomiex mentioned this issue Aug 31, 2021

Update various JS dependencies Automattic/jetpack#20890

Merged

shilman mentioned this issue Aug 31, 2021

Bump cpy to 8.1.2 for security #15953

Merged

shilman reopened this Aug 31, 2021

shilman closed this as completed Aug 31, 2021

shilman reopened this Sep 1, 2021

shilman added dependencies and removed needs triage labels Sep 1, 2021

medied mentioned this issue Sep 1, 2021

Npm audit wikimedia/wikipedia-preview#147

Merged

cimbis mentioned this issue Sep 15, 2021

Security Vulnerabilities #16063

Closed

dhess mentioned this issue Jan 12, 2022

glob-parent security vulnerability hackworthltd/primer-app#228

Closed

jacob-israel-turner mentioned this issue Feb 16, 2022

Dependency globby security vulnerability sindresorhus/cpy#96

Closed

PetroSilenius mentioned this issue Feb 25, 2022

Upgrade to next.js 12.1, npm upgrade lyytioy/lyyti-design-system#25

Merged

This was referenced Apr 12, 2022

***URGENT - Potential security vulnerabilities*** #17648

Closed

NPM Audit reports vulnerabilities after installing storybook in nx workspace #17494

Closed

strmer15 mentioned this issue Jun 16, 2022

Core: Replace cpy with fs-extra copy/copyFile #18497

Merged

3 tasks

johnolek mentioned this issue Jun 27, 2022

Mailpoet 4222 update vulnerable dependencies mailpoet/mailpoet#4208

Merged

shilman closed this as completed Jun 29, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

glob-parent Security Vulnerability #15174

glob-parent Security Vulnerability #15174

zpeterson commented Jun 8, 2021

s100 commented Jun 14, 2021

shilman commented Jul 23, 2021

cloakedninjas commented Aug 19, 2021

marcinincreo commented Aug 25, 2021

shilman commented Aug 31, 2021

cloakedninjas commented Sep 1, 2021

andziaoo7 commented Dec 20, 2021 •

edited

landsman commented Feb 1, 2022

dgarciasarai commented Feb 14, 2022

iuriifaevskii commented Feb 15, 2022

NicolasBelliard commented Feb 24, 2022

shilman commented Feb 24, 2022

SimenB commented Mar 8, 2022 •

edited

bodograumann commented Apr 12, 2022

strmer15 commented Jun 17, 2022

shilman commented Jun 29, 2022

esharmony commented Aug 10, 2022

esharmony commented Aug 11, 2022 •

edited by yannbf

glob-parent Security Vulnerability #15174

glob-parent Security Vulnerability #15174

Comments

zpeterson commented Jun 8, 2021

s100 commented Jun 14, 2021

shilman commented Jul 23, 2021

cloakedninjas commented Aug 19, 2021

marcinincreo commented Aug 25, 2021

shilman commented Aug 31, 2021

cloakedninjas commented Sep 1, 2021

andziaoo7 commented Dec 20, 2021 • edited

landsman commented Feb 1, 2022

dgarciasarai commented Feb 14, 2022

iuriifaevskii commented Feb 15, 2022

NicolasBelliard commented Feb 24, 2022

shilman commented Feb 24, 2022

SimenB commented Mar 8, 2022 • edited

bodograumann commented Apr 12, 2022

strmer15 commented Jun 17, 2022

shilman commented Jun 29, 2022

esharmony commented Aug 10, 2022

esharmony commented Aug 11, 2022 • edited by yannbf

andziaoo7 commented Dec 20, 2021 •

edited

SimenB commented Mar 8, 2022 •

edited

esharmony commented Aug 11, 2022 •

edited by yannbf