Vulnerabilities reported on storybook ^7.6.7 #27530

sumiyaushiro · 2024-06-04T07:39:01Z

sumiyaushiro
Jun 4, 2024

Summary

When running npm run audit, it throws the following message. The message persists even I tried to upgrade storybook to 8. Could you help us fix them? Thank you!

We are using Next.js 14 and the dev dependencies are:

  "devDependencies": {
    "@faker-js/faker": "^8.4.1",
    "@storybook/addon-essentials": "^7.6.7",
    "@storybook/addon-interactions": "^7.6.7",
    "@storybook/addon-links": "^7.6.7",
    "@storybook/blocks": "^7.6.7",
    "@storybook/nextjs": "^7.6.7",
    "@storybook/react": "^7.6.7",
    "@storybook/test": "^8.0.9",
    "@storybook/test-runner": "^0.17.0",
    "@testing-library/jest-dom": "^6.2.0",
    "@testing-library/react": "^14.1.2",
    "@types/jest": "^29.5.11",
    "@types/node": "^20",
    "@types/react": "^18",
    "@types/react-dom": "^18",
    "autoprefixer": "^10.0.1",
    "eslint": "^8.57.0",
    "eslint-config-next": "14.0.4",
    "eslint-plugin-jsx-a11y": "^6.8.0",
    "eslint-plugin-react": "^7.34.1",
    "eslint-plugin-security": "^2.1.1",
    "eslint-plugin-storybook": "^0.6.15",
    "jest": "^29.7.0",
    "jest-environment-jsdom": "^29.7.0",
    "postcss": "^8",
    "prettier-plugin-tailwindcss": "^0.5.14",
    "storybook": "^7.6.7",
    "tailwindcss": "^3.3.0",
    "ts-node": "^10.9.2",
    "typescript": "^5"
  }

❯  npm audit                  
# npm audit report

ip  *
Severity: high
ip SSRF improper categorization in isPublic - https://github.com/advisories/GHSA-2p57-rm9w-gvfp
fix available via `npm audit fix --force`
Will install storybook@6.5.16, which is a breaking change
node_modules/ip
  @storybook/core-server  *
  Depends on vulnerable versions of ip
  node_modules/@storybook/core-server
    @storybook/cli  <=0.0.0-pr-27522-sha-b32386a1 || >=6.5.17-alpha.0
    Depends on vulnerable versions of @storybook/core-server
    node_modules/@storybook/cli
      storybook  <=0.0.0-pr-27522-sha-b32386a1 || >=6.5.17-alpha.0
      Depends on vulnerable versions of @storybook/cli
      node_modules/storybook

4 high severity vulnerabilities

To address all issues (including breaking changes), run:
  npm audit fix --force