Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

upgrade tp 7.0 proper #48

Merged
merged 1 commit into from
Mar 31, 2023
Merged

upgrade tp 7.0 proper #48

merged 1 commit into from
Mar 31, 2023

Conversation

winkerVSbecks
Copy link
Collaborator

No description provided.

@socket-security
Copy link

New dependency changes detected. Learn more about Socket for GitHub ↗︎

🚨 Potential security issues found in this pull request. To accept the risk, merge this PR and you will not be notified again.

Bot Commands

To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of package-name@version specifiers. e.g. @SocketSecurity ignore foo@1.0.0 bar@* or ignore all packages with @SocketSecurity ignore-all

  • @SocketSecurity ignore esbuild@0.17.14
  • @SocketSecurity ignore esbuild@0.16.17
  • @SocketSecurity ignore commander@2.20.3
  • @SocketSecurity ignore cross-spawn@7.0.3
  • @SocketSecurity ignore envinfo@7.8.1
  • @SocketSecurity ignore execa@5.1.1
  • @SocketSecurity ignore gitlog@4.0.4
  • @SocketSecurity ignore jake@10.8.5
  • @SocketSecurity ignore jscodeshift@0.14.0
  • @SocketSecurity ignore mz@2.7.0
  • @SocketSecurity ignore requireg@0.2.2
  • @SocketSecurity ignore shelljs@0.8.5
  • @SocketSecurity ignore tree-kill@1.2.2
  • @SocketSecurity ignore ts-node@10.9.1
  • @SocketSecurity ignore typescript@4.9.5
  • @SocketSecurity ignore update-browserslist-db@1.0.10
  • @SocketSecurity ignore vite@4.1.4
  • @SocketSecurity ignore zx@1.15.2
  • @SocketSecurity ignore ejs@3.1.8
  • @SocketSecurity ignore handlebars@4.7.7
  • @SocketSecurity ignore is-callable@1.2.7
  • @SocketSecurity ignore js-yaml@3.14.1
  • @SocketSecurity ignore load-tsconfig@0.2.3
  • @SocketSecurity ignore lodash@4.17.21
  • @SocketSecurity ignore object-inspect@1.12.3
  • @SocketSecurity ignore prettier@2.8.4
  • @SocketSecurity ignore pretty-format@27.5.1
  • @SocketSecurity ignore telejson@7.0.4
  • @SocketSecurity ignore tsup@6.6.3
  • @SocketSecurity ignore uglify-js@3.17.4
  • @SocketSecurity ignore await-to-js@3.0.0
  • @SocketSecurity ignore bottleneck@2.19.5
  • @SocketSecurity ignore get-intrinsic@1.2.0
📜 Install scripts

Install scripts are run when the package is installed. The majority of malware in npm is hidden in install scripts.

Packages should not be running non-essential scripts during install and there are often solutions to problems people solve with install scripts that can be run at publish time instead.

Package Script field Source
esbuild@0.17.14 (upgraded) postinstall package.json via @storybook/addon-essentials@7.0.0, @storybook/addon-interactions@7.0.0, @storybook/react@7.0.0, @storybook/react-vite@7.0.0, storybook@7.0.0, tsup@6.6.3
⚠️ Shell access

This module accesses the system shell. Accessing the system shell increases the risk of executing arbitrary code.

Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced.

Package Module Location Source
commander@2.20.3 (upgraded) child_process index.js package.json via @storybook/react-vite@7.0.0
cross-spawn@7.0.3 (added) child_process index.js package.json via @storybook/react-vite@7.0.0, auto@10.43.0, storybook@7.0.0, tsup@6.6.3
envinfo@7.8.1 (added) child_process dist/envinfo.js package.json via storybook@7.0.0
esbuild@0.16.17 (upgraded) child_process install.js package.json via @storybook/react-vite@7.0.0, @vitejs/plugin-react@3.1.0, vite@4.1.4
esbuild@0.16.17 (upgraded) child_process lib/main.js package.json via @storybook/react-vite@7.0.0, @vitejs/plugin-react@3.1.0, vite@4.1.4
esbuild@0.17.14 (upgraded) child_process install.js package.json via @storybook/addon-essentials@7.0.0, @storybook/addon-interactions@7.0.0, @storybook/react@7.0.0, @storybook/react-vite@7.0.0, storybook@7.0.0, tsup@6.6.3
esbuild@0.17.14 (upgraded) child_process lib/main.js package.json via @storybook/addon-essentials@7.0.0, @storybook/addon-interactions@7.0.0, @storybook/react@7.0.0, @storybook/react-vite@7.0.0, storybook@7.0.0, tsup@6.6.3
execa@5.1.1 (added) child_process index.js package.json via auto@10.43.0, storybook@7.0.0, tsup@6.6.3
gitlog@4.0.4 (added) child_process dist/gitlog.cjs.development.js package.json via auto@10.43.0
gitlog@4.0.4 (added) child_process dist/gitlog.cjs.production.min.js package.json via auto@10.43.0
gitlog@4.0.4 (added) child_process dist/gitlog.esm.js package.json via auto@10.43.0
jake@10.8.5 (added) child_process jake-v10.8.5/jakefile.js package.json via storybook@7.0.0
jake@10.8.5 (added) child_process jake-v10.8.5/lib/package_task.js package.json via storybook@7.0.0
jake@10.8.5 (added) child_process jake-v10.8.5/lib/publish_task.js package.json via storybook@7.0.0
jake@10.8.5 (added) child_process jake-v10.8.5/lib/utils/index.js package.json via storybook@7.0.0
jake@10.8.5 (added) child_process jake-v10.8.5/test/integration/concurrent.js package.json via storybook@7.0.0
jake@10.8.5 (added) child_process jake-v10.8.5/test/integration/file_task.js package.json via storybook@7.0.0
jake@10.8.5 (added) child_process jake-v10.8.5/test/integration/file.js package.json via storybook@7.0.0
jake@10.8.5 (added) child_process jake-v10.8.5/test/integration/helpers.js package.json via storybook@7.0.0
jake@10.8.5 (added) child_process jake-v10.8.5/test/integration/jakelib/rule.jake.js package.json via storybook@7.0.0
jake@10.8.5 (added) child_process jake-v10.8.5/test/integration/publish_task.js package.json via storybook@7.0.0
jake@10.8.5 (added) child_process jake-v10.8.5/test/integration/rule.js package.json via storybook@7.0.0
jake@10.8.5 (added) child_process jake-v10.8.5/test/integration/selfdep.js package.json via storybook@7.0.0
jake@10.8.5 (added) child_process jake-v10.8.5/test/integration/task_base.js package.json via storybook@7.0.0
jake@10.8.5 (added) child_process jake-v10.8.5/test/integration/task_base.js package.json via storybook@7.0.0
jscodeshift@0.14.0 (added) child_process dist/Runner.js package.json via storybook@7.0.0
jscodeshift@0.14.0 (added) child_process src/Runner.js package.json via storybook@7.0.0
mz@2.7.0 (added) child_process child_process.js package.json via tsup@6.6.3
requireg@0.2.2 (added) child_process lib/resolvers.js package.json via auto@10.43.0
shelljs@0.8.5 (added) child_process src/exec-child.js package.json via storybook@7.0.0
shelljs@0.8.5 (added) child_process src/exec.js package.json via storybook@7.0.0
tree-kill@1.2.2 (added) child_process index.js package.json via concurrently@6.5.1, tsup@6.6.3
ts-node@10.9.1 (added) child_process dist/child/spawn-child.js package.json via auto@10.43.0, tsup@6.6.3
typescript@4.9.5 (added) child_process lib/tsserver.js package.json via @storybook/react-vite@7.0.0, auto@10.43.0, tsup@6.6.3
typescript@4.9.5 (added) child_process lib/tsserver.js package.json via @storybook/react-vite@7.0.0, auto@10.43.0, tsup@6.6.3
typescript@4.9.5 (added) child_process lib/typingsInstaller.js package.json via @storybook/react-vite@7.0.0, auto@10.43.0, tsup@6.6.3
update-browserslist-db@1.0.10 (added) child_process check-npm-version.js package.json via @storybook/addon-essentials@7.0.0, @storybook/react@7.0.0, @storybook/react-vite@7.0.0, @vitejs/plugin-react@3.1.0, storybook@7.0.0
update-browserslist-db@1.0.10 (added) child_process index.js package.json via @storybook/addon-essentials@7.0.0, @storybook/react@7.0.0, @storybook/react-vite@7.0.0, @vitejs/plugin-react@3.1.0, storybook@7.0.0
vite@4.1.4 (added) child_process dist/node/cli.js package.json via @storybook/react-vite@7.0.0, @vitejs/plugin-react@3.1.0
vite@4.1.4 (added) child_process dist/node/index.js package.json via @storybook/react-vite@7.0.0, @vitejs/plugin-react@3.1.0
zx@1.15.2 (added) child_process index.mjs package.json
⚠️ Uses eval

Package uses eval() which is a dangerous function. This prevents the code from running in certain environments and increases the risk that the code may contain exploits or malicious behavior.

Avoid packages that use eval, since this could potentially execute any code.

Package Eval Type Location Source
ejs@3.1.8 (added) Function ejs-v3.1.8/ejs.js package.json via storybook@7.0.0
ejs@3.1.8 (added) Function ejs-v3.1.8/ejs.js package.json via storybook@7.0.0
ejs@3.1.8 (added) Function ejs-v3.1.8/ejs.min.js package.json via storybook@7.0.0
ejs@3.1.8 (added) Function ejs-v3.1.8/ejs.min.js package.json via storybook@7.0.0
ejs@3.1.8 (added) Function ejs-v3.1.8/lib/ejs.js package.json via storybook@7.0.0
ejs@3.1.8 (added) Function ejs-v3.1.8/lib/ejs.js package.json via storybook@7.0.0
envinfo@7.8.1 (added) Function dist/envinfo.js package.json via storybook@7.0.0
envinfo@7.8.1 (added) Function dist/envinfo.js package.json via storybook@7.0.0
handlebars@4.7.7 (added) Function dist/cjs/handlebars/compiler/javascript-compiler.js package.json via @storybook/addon-essentials@7.0.0, @storybook/addon-interactions@7.0.0, @storybook/react@7.0.0, @storybook/react-vite@7.0.0, storybook@7.0.0
handlebars@4.7.7 (added) Function dist/cjs/handlebars/compiler/javascript-compiler.js package.json via @storybook/addon-essentials@7.0.0, @storybook/addon-interactions@7.0.0, @storybook/react@7.0.0, @storybook/react-vite@7.0.0, storybook@7.0.0
handlebars@4.7.7 (added) Function dist/handlebars.amd.js package.json via @storybook/addon-essentials@7.0.0, @storybook/addon-interactions@7.0.0, @storybook/react@7.0.0, @storybook/react-vite@7.0.0, storybook@7.0.0
handlebars@4.7.7 (added) Function dist/handlebars.amd.js package.json via @storybook/addon-essentials@7.0.0, @storybook/addon-interactions@7.0.0, @storybook/react@7.0.0, @storybook/react-vite@7.0.0, storybook@7.0.0
handlebars@4.7.7 (added) Function dist/handlebars.amd.min.js package.json via @storybook/addon-essentials@7.0.0, @storybook/addon-interactions@7.0.0, @storybook/react@7.0.0, @storybook/react-vite@7.0.0, storybook@7.0.0
handlebars@4.7.7 (added) Function dist/handlebars.amd.min.js package.json via @storybook/addon-essentials@7.0.0, @storybook/addon-interactions@7.0.0, @storybook/react@7.0.0, @storybook/react-vite@7.0.0, storybook@7.0.0
is-callable@1.2.7 (added) Function test/index.js package.json via @storybook/addon-essentials@7.0.0, @storybook/react-vite@7.0.0, @storybook/testing-library@0.0.14-next.1, storybook@7.0.0
is-callable@1.2.7 (added) Function test/index.js package.json via @storybook/addon-essentials@7.0.0, @storybook/react-vite@7.0.0, @storybook/testing-library@0.0.14-next.1, storybook@7.0.0
js-yaml@3.14.1 (added) Function dist/js-yaml.js package.json via @storybook/addon-essentials@7.0.0
js-yaml@3.14.1 (added) Function dist/js-yaml.js package.json via @storybook/addon-essentials@7.0.0
js-yaml@3.14.1 (added) Function lib/js-yaml/type/js/function.js package.json via @storybook/addon-essentials@7.0.0
js-yaml@3.14.1 (added) Function lib/js-yaml/type/js/function.js package.json via @storybook/addon-essentials@7.0.0
load-tsconfig@0.2.3 (added) Function dist/index.cjs package.json via tsup@6.6.3
load-tsconfig@0.2.3 (added) Function dist/index.js package.json via tsup@6.6.3
lodash@4.17.21 (added) Function _root.js package.json via @storybook/addon-essentials@7.0.0, @storybook/addon-interactions@7.0.0, @storybook/addon-links@7.0.0, @storybook/preview-api@7.0.0-rc.1, @storybook/react@7.0.0, @storybook/react-vite@7.0.0, @storybook/testing-library@0.0.14-next.1, concurrently@6.5.1, storybook@7.0.0
lodash@4.17.21 (added) Function template.js package.json via @storybook/addon-essentials@7.0.0, @storybook/addon-interactions@7.0.0, @storybook/addon-links@7.0.0, @storybook/preview-api@7.0.0-rc.1, @storybook/react@7.0.0, @storybook/react-vite@7.0.0, @storybook/testing-library@0.0.14-next.1, concurrently@6.5.1, storybook@7.0.0
object-inspect@1.12.3 (added) Function test/bigint.js package.json via @storybook/addon-essentials@7.0.0, @storybook/addon-interactions@7.0.0, @storybook/addon-links@7.0.0, @storybook/preview-api@7.0.0-rc.1, @storybook/react@7.0.0, @storybook/react-vite@7.0.0, @storybook/testing-library@0.0.14-next.1, storybook@7.0.0
object-inspect@1.12.3 (added) Function test/bigint.js package.json via @storybook/addon-essentials@7.0.0, @storybook/addon-interactions@7.0.0, @storybook/addon-links@7.0.0, @storybook/preview-api@7.0.0-rc.1, @storybook/react@7.0.0, @storybook/react-vite@7.0.0, @storybook/testing-library@0.0.14-next.1, storybook@7.0.0
object-inspect@1.12.3 (added) Function test/bigint.js package.json via @storybook/addon-essentials@7.0.0, @storybook/addon-interactions@7.0.0, @storybook/addon-links@7.0.0, @storybook/preview-api@7.0.0-rc.1, @storybook/react@7.0.0, @storybook/react-vite@7.0.0, @storybook/testing-library@0.0.14-next.1, storybook@7.0.0
prettier@2.8.4 (added) Function cli.js package.json via storybook@7.0.0
pretty-format@27.5.1 (added) Function build/plugins/AsymmetricMatcher.js package.json via @storybook/testing-library@0.0.14-next.1
pretty-format@27.5.1 (added) Function build/plugins/ReactTestComponent.js package.json via @storybook/testing-library@0.0.14-next.1
telejson@7.0.4 (added) Function dist/index.js package.json via @storybook/addon-essentials@7.0.0, @storybook/addon-interactions@7.0.0, @storybook/addon-links@7.0.0, @storybook/preview-api@7.0.0-rc.1, @storybook/react@7.0.0, @storybook/react-vite@7.0.0, @storybook/testing-library@0.0.14-next.1, storybook@7.0.0
telejson@7.0.4 (added) Function dist/index.js package.json via @storybook/addon-essentials@7.0.0, @storybook/addon-interactions@7.0.0, @storybook/addon-links@7.0.0, @storybook/preview-api@7.0.0-rc.1, @storybook/react@7.0.0, @storybook/react-vite@7.0.0, @storybook/testing-library@0.0.14-next.1, storybook@7.0.0
telejson@7.0.4 (added) Function dist/index.js package.json via @storybook/addon-essentials@7.0.0, @storybook/addon-interactions@7.0.0, @storybook/addon-links@7.0.0, @storybook/preview-api@7.0.0-rc.1, @storybook/react@7.0.0, @storybook/react-vite@7.0.0, @storybook/testing-library@0.0.14-next.1, storybook@7.0.0
telejson@7.0.4 (added) Function dist/index.mjs package.json via @storybook/addon-essentials@7.0.0, @storybook/addon-interactions@7.0.0, @storybook/addon-links@7.0.0, @storybook/preview-api@7.0.0-rc.1, @storybook/react@7.0.0, @storybook/react-vite@7.0.0, @storybook/testing-library@0.0.14-next.1, storybook@7.0.0
telejson@7.0.4 (added) Function dist/index.mjs package.json via @storybook/addon-essentials@7.0.0, @storybook/addon-interactions@7.0.0, @storybook/addon-links@7.0.0, @storybook/preview-api@7.0.0-rc.1, @storybook/react@7.0.0, @storybook/react-vite@7.0.0, @storybook/testing-library@0.0.14-next.1, storybook@7.0.0
telejson@7.0.4 (added) Function dist/index.mjs package.json via @storybook/addon-essentials@7.0.0, @storybook/addon-interactions@7.0.0, @storybook/addon-links@7.0.0, @storybook/preview-api@7.0.0-rc.1, @storybook/react@7.0.0, @storybook/react-vite@7.0.0, @storybook/testing-library@0.0.14-next.1, storybook@7.0.0
tsup@6.6.3 (added) Function dist/chunk-OSC67C6M.js package.json
tsup@6.6.3 (added) Function dist/rollup.js package.json
uglify-js@3.17.4 (added) Function tools/node.js package.json via @storybook/addon-essentials@7.0.0, @storybook/addon-interactions@7.0.0, @storybook/react@7.0.0, @storybook/react-vite@7.0.0, storybook@7.0.0
vite@4.1.4 (added) Function dist/node-cjs/publicUtils.cjs package.json via @storybook/react-vite@7.0.0, @vitejs/plugin-react@3.1.0
vite@4.1.4 (added) Function dist/node/chunks/dep-f597f42f.js package.json via @storybook/react-vite@7.0.0, @vitejs/plugin-react@3.1.0
await-to-js@3.0.0 (added) eval dist/docs/assets/js/main.js package.json via auto@10.43.0
await-to-js@3.0.0 (added) eval dist/docs/assets/js/main.js package.json via auto@10.43.0
bottleneck@2.19.5 (added) eval lib/RedisConnection.js package.json via auto@10.43.0
get-intrinsic@1.2.0 (added) eval index.js package.json via @storybook/addon-essentials@7.0.0, @storybook/addon-interactions@7.0.0, @storybook/addon-links@7.0.0, @storybook/preview-api@7.0.0-rc.1, @storybook/react@7.0.0, @storybook/react-vite@7.0.0, @storybook/testing-library@0.0.14-next.1, storybook@7.0.0
telejson@7.0.4 (added) eval dist/index.js package.json via @storybook/addon-essentials@7.0.0, @storybook/addon-interactions@7.0.0, @storybook/addon-links@7.0.0, @storybook/preview-api@7.0.0-rc.1, @storybook/react@7.0.0, @storybook/react-vite@7.0.0, @storybook/testing-library@0.0.14-next.1, storybook@7.0.0
telejson@7.0.4 (added) eval dist/index.js package.json via @storybook/addon-essentials@7.0.0, @storybook/addon-interactions@7.0.0, @storybook/addon-links@7.0.0, @storybook/preview-api@7.0.0-rc.1, @storybook/react@7.0.0, @storybook/react-vite@7.0.0, @storybook/testing-library@0.0.14-next.1, storybook@7.0.0
telejson@7.0.4 (added) eval dist/index.js package.json via @storybook/addon-essentials@7.0.0, @storybook/addon-interactions@7.0.0, @storybook/addon-links@7.0.0, @storybook/preview-api@7.0.0-rc.1, @storybook/react@7.0.0, @storybook/react-vite@7.0.0, @storybook/testing-library@0.0.14-next.1, storybook@7.0.0
telejson@7.0.4 (added) eval dist/index.mjs package.json via @storybook/addon-essentials@7.0.0, @storybook/addon-interactions@7.0.0, [@storybook/addon-links@7.0.0](https://socket.dev/npm/package/@stor

@winkerVSbecks winkerVSbecks merged commit 8dfac5a into main Mar 31, 2023
@winkerVSbecks winkerVSbecks deleted the upgrade branch March 31, 2023 15:34
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@winkerVSbecks