search

storybookjs / addon-kit

Everything you need to build a Storybook addon
https://storybook.js.org/docs/react/addons/writing-addons
MIT License
142 stars 35 forks source link

upgrade tp 7.0 proper #48

Closed winkerVSbecks closed 1 year ago

socket-security[bot] commented 1 year ago

New dependency changes detected. Learn more about Socket for GitHub ↗︎

🚨 Potential security issues found in this pull request. To accept the risk, merge this PR and you will not be notified again.

Bot Commands

To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of package-name@version specifiers. e.g. @SocketSecurity ignore foo@1.0.0 bar@* or ignore all packages with @SocketSecurity ignore-all

  • @SocketSecurity ignore esbuild@0.17.14
  • @SocketSecurity ignore esbuild@0.16.17
  • @SocketSecurity ignore commander@2.20.3
  • @SocketSecurity ignore cross-spawn@7.0.3
  • @SocketSecurity ignore envinfo@7.8.1
  • @SocketSecurity ignore execa@5.1.1
  • @SocketSecurity ignore gitlog@4.0.4
  • @SocketSecurity ignore jake@10.8.5
  • @SocketSecurity ignore jscodeshift@0.14.0
  • @SocketSecurity ignore mz@2.7.0
  • @SocketSecurity ignore requireg@0.2.2
  • @SocketSecurity ignore shelljs@0.8.5
  • @SocketSecurity ignore tree-kill@1.2.2
  • @SocketSecurity ignore ts-node@10.9.1
  • @SocketSecurity ignore typescript@4.9.5
  • @SocketSecurity ignore update-browserslist-db@1.0.10
  • @SocketSecurity ignore vite@4.1.4
  • @SocketSecurity ignore zx@1.15.2
  • @SocketSecurity ignore ejs@3.1.8
  • @SocketSecurity ignore handlebars@4.7.7
  • @SocketSecurity ignore is-callable@1.2.7
  • @SocketSecurity ignore js-yaml@3.14.1
  • @SocketSecurity ignore load-tsconfig@0.2.3
  • @SocketSecurity ignore lodash@4.17.21
  • @SocketSecurity ignore object-inspect@1.12.3
  • @SocketSecurity ignore prettier@2.8.4
  • @SocketSecurity ignore pretty-format@27.5.1
  • @SocketSecurity ignore telejson@7.0.4
  • @SocketSecurity ignore tsup@6.6.3
  • @SocketSecurity ignore uglify-js@3.17.4
  • @SocketSecurity ignore await-to-js@3.0.0
  • @SocketSecurity ignore bottleneck@2.19.5
  • @SocketSecurity ignore get-intrinsic@1.2.0
📜 Install scripts

Install scripts are run when the package is installed. The majority of malware in npm is hidden in install scripts.

Packages should not be running non-essential scripts during install and there are often solutions to problems people solve with install scripts that can be run at publish time instead.

Package Script field Source
esbuild@0.17.14 (upgraded) postinstall package.json via @storybook/addon-essentials@7.0.0, @storybook/addon-interactions@7.0.0, @storybook/react@7.0.0, @storybook/react-vite@7.0.0, storybook@7.0.0, tsup@6.6.3
⚠️ Shell access

This module accesses the system shell. Accessing the system shell increases the risk of executing arbitrary code.

Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced.

Package Module Location Source
commander@2.20.3 (upgraded) child_process index.js package.json via @storybook/react-vite@7.0.0
cross-spawn@7.0.3 (added) child_process index.js package.json via @storybook/react-vite@7.0.0, auto@10.43.0, storybook@7.0.0, tsup@6.6.3
envinfo@7.8.1 (added) child_process dist/envinfo.js package.json via storybook@7.0.0
esbuild@0.16.17 (upgraded) child_process install.js package.json via @storybook/react-vite@7.0.0, @vitejs/plugin-react@3.1.0, vite@4.1.4
esbuild@0.16.17 (upgraded) child_process lib/main.js package.json via @storybook/react-vite@7.0.0, @vitejs/plugin-react@3.1.0, vite@4.1.4
esbuild@0.17.14 (upgraded) child_process install.js package.json via @storybook/addon-essentials@7.0.0, @storybook/addon-interactions@7.0.0, @storybook/react@7.0.0, @storybook/react-vite@7.0.0, storybook@7.0.0, tsup@6.6.3
esbuild@0.17.14 (upgraded) child_process lib/main.js package.json via @storybook/addon-essentials@7.0.0, @storybook/addon-interactions@7.0.0, @storybook/react@7.0.0, @storybook/react-vite@7.0.0, storybook@7.0.0, tsup@6.6.3
execa@5.1.1 (added) child_process index.js package.json via auto@10.43.0, storybook@7.0.0, tsup@6.6.3
gitlog@4.0.4 (added) child_process dist/gitlog.cjs.development.js package.json via auto@10.43.0
gitlog@4.0.4 (added) child_process dist/gitlog.cjs.production.min.js package.json via auto@10.43.0
gitlog@4.0.4 (added) child_process dist/gitlog.esm.js package.json via auto@10.43.0
jake@10.8.5 (added) child_process jake-v10.8.5/jakefile.js package.json via storybook@7.0.0
jake@10.8.5 (added) child_process jake-v10.8.5/lib/package_task.js package.json via storybook@7.0.0
jake@10.8.5 (added) child_process jake-v10.8.5/lib/publish_task.js package.json via storybook@7.0.0
jake@10.8.5 (added) child_process jake-v10.8.5/lib/utils/index.js package.json via storybook@7.0.0
jake@10.8.5 (added) child_process jake-v10.8.5/test/integration/concurrent.js package.json via storybook@7.0.0
jake@10.8.5 (added) child_process jake-v10.8.5/test/integration/file_task.js package.json via storybook@7.0.0
jake@10.8.5 (added) child_process jake-v10.8.5/test/integration/file.js package.json via storybook@7.0.0
jake@10.8.5 (added) child_process jake-v10.8.5/test/integration/helpers.js package.json via storybook@7.0.0
jake@10.8.5 (added) child_process jake-v10.8.5/test/integration/jakelib/rule.jake.js package.json via storybook@7.0.0
jake@10.8.5 (added) child_process jake-v10.8.5/test/integration/publish_task.js package.json via storybook@7.0.0
jake@10.8.5 (added) child_process jake-v10.8.5/test/integration/rule.js package.json via storybook@7.0.0
jake@10.8.5 (added) child_process jake-v10.8.5/test/integration/selfdep.js package.json via storybook@7.0.0
jake@10.8.5 (added) child_process jake-v10.8.5/test/integration/task_base.js package.json via storybook@7.0.0
jake@10.8.5 (added) child_process jake-v10.8.5/test/integration/task_base.js package.json via storybook@7.0.0
jscodeshift@0.14.0 (added) child_process dist/Runner.js package.json via storybook@7.0.0
jscodeshift@0.14.0 (added) child_process src/Runner.js package.json via storybook@7.0.0
mz@2.7.0 (added) child_process child_process.js package.json via tsup@6.6.3
requireg@0.2.2 (added) child_process lib/resolvers.js package.json via auto@10.43.0
shelljs@0.8.5 (added) child_process src/exec-child.js package.json via storybook@7.0.0
shelljs@0.8.5 (added) child_process src/exec.js package.json via storybook@7.0.0
tree-kill@1.2.2 (added) child_process index.js package.json via concurrently@6.5.1, tsup@6.6.3
ts-node@10.9.1 (added) child_process dist/child/spawn-child.js package.json via auto@10.43.0, tsup@6.6.3
typescript@4.9.5 (added) child_process lib/tsserver.js package.json via @storybook/react-vite@7.0.0, auto@10.43.0, tsup@6.6.3
typescript@4.9.5 (added) child_process lib/tsserver.js package.json via @storybook/react-vite@7.0.0, auto@10.43.0, tsup@6.6.3
typescript@4.9.5 (added) child_process lib/typingsInstaller.js package.json via @storybook/react-vite@7.0.0, auto@10.43.0, tsup@6.6.3
update-browserslist-db@1.0.10 (added) child_process check-npm-version.js package.json via @storybook/addon-essentials@7.0.0, @storybook/react@7.0.0, @storybook/react-vite@7.0.0, @vitejs/plugin-react@3.1.0, storybook@7.0.0
update-browserslist-db@1.0.10 (added) child_process index.js package.json via @storybook/addon-essentials@7.0.0, @storybook/react@7.0.0, @storybook/react-vite@7.0.0, @vitejs/plugin-react@3.1.0, storybook@7.0.0
vite@4.1.4 (added) child_process dist/node/cli.js package.json via @storybook/react-vite@7.0.0, @vitejs/plugin-react@3.1.0
vite@4.1.4 (added) child_process dist/node/index.js package.json via @storybook/react-vite@7.0.0, @vitejs/plugin-react@3.1.0
zx@1.15.2 (added) child_process index.mjs package.json
⚠️ Uses eval

Package uses eval() which is a dangerous function. This prevents the code from running in certain environments and increases the risk that the code may contain exploits or malicious behavior.

Avoid packages that use eval, since this could potentially execute any code.

Package Eval Type Location Source
ejs@3.1.8 (added) Function ejs-v3.1.8/ejs.js package.json via storybook@7.0.0
ejs@3.1.8 (added) Function ejs-v3.1.8/ejs.js package.json via storybook@7.0.0
ejs@3.1.8 (added) Function ejs-v3.1.8/ejs.min.js package.json via storybook@7.0.0
ejs@3.1.8 (added) Function ejs-v3.1.8/ejs.min.js package.json via storybook@7.0.0
ejs@3.1.8 (added) Function ejs-v3.1.8/lib/ejs.js package.json via storybook@7.0.0
ejs@3.1.8 (added) Function ejs-v3.1.8/lib/ejs.js package.json via storybook@7.0.0
envinfo@7.8.1 (added) Function dist/envinfo.js package.json via storybook@7.0.0
envinfo@7.8.1 (added) Function dist/envinfo.js package.json via storybook@7.0.0
handlebars@4.7.7 (added) Function dist/cjs/handlebars/compiler/javascript-compiler.js package.json via @storybook/addon-essentials@7.0.0, @storybook/addon-interactions@7.0.0, @storybook/react@7.0.0, @storybook/react-vite@7.0.0, storybook@7.0.0
handlebars@4.7.7 (added) Function dist/cjs/handlebars/compiler/javascript-compiler.js package.json via @storybook/addon-essentials@7.0.0, @storybook/addon-interactions@7.0.0, @storybook/react@7.0.0, @storybook/react-vite@7.0.0, storybook@7.0.0
handlebars@4.7.7 (added) Function dist/handlebars.amd.js package.json via @storybook/addon-essentials@7.0.0, @storybook/addon-interactions@7.0.0, @storybook/react@7.0.0, @storybook/react-vite@7.0.0, storybook@7.0.0
handlebars@4.7.7 (added) Function dist/handlebars.amd.js package.json via @storybook/addon-essentials@7.0.0, @storybook/addon-interactions@7.0.0, @storybook/react@7.0.0, @storybook/react-vite@7.0.0, storybook@7.0.0
handlebars@4.7.7 (added) Function dist/handlebars.amd.min.js package.json via @storybook/addon-essentials@7.0.0, @storybook/addon-interactions@7.0.0, @storybook/react@7.0.0, @storybook/react-vite@7.0.0, storybook@7.0.0
handlebars@4.7.7 (added) Function dist/handlebars.amd.min.js package.json via @storybook/addon-essentials@7.0.0, @storybook/addon-interactions@7.0.0, @storybook/react@7.0.0, @storybook/react-vite@7.0.0, storybook@7.0.0
is-callable@1.2.7 (added) Function test/index.js package.json via @storybook/addon-essentials@7.0.0, @storybook/react-vite@7.0.0, @storybook/testing-library@0.0.14-next.1, storybook@7.0.0
is-callable@1.2.7 (added) Function test/index.js package.json via @storybook/addon-essentials@7.0.0, @storybook/react-vite@7.0.0, @storybook/testing-library@0.0.14-next.1, storybook@7.0.0
js-yaml@3.14.1 (added) Function dist/js-yaml.js package.json via @storybook/addon-essentials@7.0.0
js-yaml@3.14.1 (added) Function dist/js-yaml.js package.json via @storybook/addon-essentials@7.0.0
js-yaml@3.14.1 (added) Function lib/js-yaml/type/js/function.js package.json via @storybook/addon-essentials@7.0.0
js-yaml@3.14.1 (added) Function lib/js-yaml/type/js/function.js package.json via @storybook/addon-essentials@7.0.0
load-tsconfig@0.2.3 (added) Function dist/index.cjs package.json via tsup@6.6.3
load-tsconfig@0.2.3 (added) Function dist/index.js package.json via tsup@6.6.3
lodash@4.17.21 (added) Function _root.js package.json via @storybook/addon-essentials@7.0.0, @storybook/addon-interactions@7.0.0, @storybook/addon-links@7.0.0, @storybook/preview-api@7.0.0-rc.1, @storybook/react@7.0.0, @storybook/react-vite@7.0.0, @storybook/testing-library@0.0.14-next.1, concurrently@6.5.1, storybook@7.0.0
lodash@4.17.21 (added) Function template.js package.json via @storybook/addon-essentials@7.0.0, @storybook/addon-interactions@7.0.0, @storybook/addon-links@7.0.0, @storybook/preview-api@7.0.0-rc.1, @storybook/react@7.0.0, @storybook/react-vite@7.0.0, @storybook/testing-library@0.0.14-next.1, concurrently@6.5.1, storybook@7.0.0
object-inspect@1.12.3 (added) Function test/bigint.js package.json via @storybook/addon-essentials@7.0.0, @storybook/addon-interactions@7.0.0, @storybook/addon-links@7.0.0, @storybook/preview-api@7.0.0-rc.1, @storybook/react@7.0.0, @storybook/react-vite@7.0.0, @storybook/testing-library@0.0.14-next.1, storybook@7.0.0
object-inspect@1.12.3 (added) Function test/bigint.js package.json via @storybook/addon-essentials@7.0.0, @storybook/addon-interactions@7.0.0, @storybook/addon-links@7.0.0, @storybook/preview-api@7.0.0-rc.1, @storybook/react@7.0.0, @storybook/react-vite@7.0.0, @storybook/testing-library@0.0.14-next.1, storybook@7.0.0
object-inspect@1.12.3 (added) Function test/bigint.js package.json via @storybook/addon-essentials@7.0.0, @storybook/addon-interactions@7.0.0, @storybook/addon-links@7.0.0, @storybook/preview-api@7.0.0-rc.1, @storybook/react@7.0.0, @storybook/react-vite@7.0.0, @storybook/testing-library@0.0.14-next.1, storybook@7.0.0
prettier@2.8.4 (added) Function cli.js package.json via storybook@7.0.0
pretty-format@27.5.1 (added) Function build/plugins/AsymmetricMatcher.js package.json via @storybook/testing-library@0.0.14-next.1
pretty-format@27.5.1 (added) Function build/plugins/ReactTestComponent.js package.json via @storybook/testing-library@0.0.14-next.1
telejson@7.0.4 (added) Function dist/index.js package.json via @storybook/addon-essentials@7.0.0, @storybook/addon-interactions@7.0.0, @storybook/addon-links@7.0.0, @storybook/preview-api@7.0.0-rc.1, @storybook/react@7.0.0, @storybook/react-vite@7.0.0, @storybook/testing-library@0.0.14-next.1, storybook@7.0.0
telejson@7.0.4 (added) Function dist/index.js package.json via @storybook/addon-essentials@7.0.0, @storybook/addon-interactions@7.0.0, @storybook/addon-links@7.0.0, @storybook/preview-api@7.0.0-rc.1, @storybook/react@7.0.0, @storybook/react-vite@7.0.0, @storybook/testing-library@0.0.14-next.1, storybook@7.0.0
telejson@7.0.4 (added) Function dist/index.js package.json via @storybook/addon-essentials@7.0.0, @storybook/addon-interactions@7.0.0, @storybook/addon-links@7.0.0, @storybook/preview-api@7.0.0-rc.1, @storybook/react@7.0.0, @storybook/react-vite@7.0.0, @storybook/testing-library@0.0.14-next.1, storybook@7.0.0
telejson@7.0.4 (added) Function dist/index.mjs package.json via @storybook/addon-essentials@7.0.0, @storybook/addon-interactions@7.0.0, @storybook/addon-links@7.0.0, @storybook/preview-api@7.0.0-rc.1, @storybook/react@7.0.0, @storybook/react-vite@7.0.0, @storybook/testing-library@0.0.14-next.1, storybook@7.0.0
telejson@7.0.4 (added) Function dist/index.mjs package.json via @storybook/addon-essentials@7.0.0, @storybook/addon-interactions@7.0.0, @storybook/addon-links@7.0.0, @storybook/preview-api@7.0.0-rc.1, @storybook/react@7.0.0, @storybook/react-vite@7.0.0, @storybook/testing-library@0.0.14-next.1, storybook@7.0.0
telejson@7.0.4 (added) Function dist/index.mjs package.json via @storybook/addon-essentials@7.0.0, @storybook/addon-interactions@7.0.0, @storybook/addon-links@7.0.0, @storybook/preview-api@7.0.0-rc.1, @storybook/react@7.0.0, @storybook/react-vite@7.0.0, @storybook/testing-library@0.0.14-next.1, storybook@7.0.0
tsup@6.6.3 (added) Function dist/chunk-OSC67C6M.js package.json
tsup@6.6.3 (added) Function dist/rollup.js package.json
uglify-js@3.17.4 (added) Function tools/node.js package.json via @storybook/addon-essentials@7.0.0, @storybook/addon-interactions@7.0.0, @storybook/react@7.0.0, @storybook/react-vite@7.0.0, storybook@7.0.0
vite@4.1.4 (added) Function dist/node-cjs/publicUtils.cjs package.json via @storybook/react-vite@7.0.0, @vitejs/plugin-react@3.1.0
vite@4.1.4 (added) Function dist/node/chunks/dep-f597f42f.js package.json via @storybook/react-vite@7.0.0, @vitejs/plugin-react@3.1.0
await-to-js@3.0.0 (added) eval dist/docs/assets/js/main.js package.json via auto@10.43.0
await-to-js@3.0.0 (added) eval dist/docs/assets/js/main.js package.json via auto@10.43.0
bottleneck@2.19.5 (added) eval lib/RedisConnection.js package.json via auto@10.43.0
get-intrinsic@1.2.0 (added) eval index.js package.json via @storybook/addon-essentials@7.0.0, @storybook/addon-interactions@7.0.0, @storybook/addon-links@7.0.0, @storybook/preview-api@7.0.0-rc.1, @storybook/react@7.0.0, @storybook/react-vite@7.0.0, @storybook/testing-library@0.0.14-next.1, storybook@7.0.0
telejson@7.0.4 (added) eval dist/index.js package.json via @storybook/addon-essentials@7.0.0, @storybook/addon-interactions@7.0.0, @storybook/addon-links@7.0.0, @storybook/preview-api@7.0.0-rc.1, @storybook/react@7.0.0, @storybook/react-vite@7.0.0, @storybook/testing-library@0.0.14-next.1, storybook@7.0.0
telejson@7.0.4 (added) eval dist/index.js package.json via @storybook/addon-essentials@7.0.0, @storybook/addon-interactions@7.0.0, @storybook/addon-links@7.0.0, @storybook/preview-api@7.0.0-rc.1, @storybook/react@7.0.0, @storybook/react-vite@7.0.0, @storybook/testing-library@0.0.14-next.1, storybook@7.0.0
telejson@7.0.4 (added) eval dist/index.js package.json via @storybook/addon-essentials@7.0.0, @storybook/addon-interactions@7.0.0, @storybook/addon-links@7.0.0, @storybook/preview-api@7.0.0-rc.1, @storybook/react@7.0.0, @storybook/react-vite@7.0.0, @storybook/testing-library@0.0.14-next.1, storybook@7.0.0
telejson@7.0.4 (added) eval dist/index.mjs package.json via @storybook/addon-essentials@7.0.0, @storybook/addon-interactions@7.0.0, [@storybook/addon-links@7.0.0](https://socket.dev/npm/package/@stor