storybookjs / storybook

Storybook is the industry standard workshop for building, documenting, and testing UI components in isolation
https://storybook.js.org
MIT License
84.08k stars 9.25k forks source link

[Bug]: Update express to address vulnerability reported by Snyk CVE-2024-45590 #29206

Open ahayes91 opened 2 days ago

ahayes91 commented 2 days ago

Describe the bug

Hey folks! We're seeing high vulnerabilities reported by Snyk related to the version of express being used here, could we safely update it to the latest 4.21.0 minor version (or maybe even the next major version)?

https://www.cve.org/CVERecord?id=CVE-2024-45590 describes the vulnerability, and it looks like express internally updated the body-parser dependency already in https://github.com/expressjs/express/pull/5926

Thank you!

Reproduction link

https://www.cve.org/CVERecord?id=CVE-2024-45590

Reproduction steps

N/A

System

Storybook Environment Info:

  System:
    OS: macOS 14.6.1
    CPU: (16) x64 Intel(R) Core(TM) i9-9880H CPU @ 2.30GHz
    Shell: 5.9 - /bin/zsh
  Binaries:
    Node: 18.19.1 - ~/Library/Caches/fnm_multishells/1473_1727252379074/bin/node
    Yarn: 1.22.22 - ~/Library/Caches/fnm_multishells/1473_1727252379074/bin/yarn
    npm: 10.2.4 - ~/Library/Caches/fnm_multishells/1473_1727252379074/bin/npm <----- active
    pnpm: 9.1.0 - ~/Library/Caches/fnm_multishells/1473_1727252379074/bin/pnpm
  Browsers:
    Chrome: 129.0.6668.60
    Safari: 17.6
  npmPackages:
    @storybook/blocks: 8.3.2 => 8.3.2 
    @storybook/react: 8.3.2 => 8.3.2 
    eslint-plugin-storybook: 0.8.0 => 0.8.0

Additional context

No response

dkingyello949 commented 2 days ago

I would also appreciate an update on this 👍

ahayes91 commented 1 day ago

https://github.com/storybookjs/storybook/pull/29079 should sort this actually!