@storybook/addon-storyshots: NPM Audit warning - braces >= 2.3.1

[danielfigueiredo]

When running NPM / yarn audit throws Regular Expression Denial of Service.
In yarn this is a bit worse because it fails with process code 1 and thus CI.

The following path of dependencies depicts the root origin of the error:

@storybook/addon-storyshots > jest-specific-snapshot >  jest-snapshot > jest-message-util > micromatch > braces

Most libraries have gotten rid of this vulnerability from braces.

Steps to reproduce

Install latest @storybook/framework and @storybook/addon-storyshots and run NPM audit.

Please specify which version of Storybook and optionally any affected addons that you're running

Affected platforms

I'm on macOS but I don't see why it would be different in another OS.

[stale]

Hi everyone! Seems like there hasn't been much going on in this issue lately. If there are still questions, comments, or bugs, please feel free to continue the discussion. Unfortunately, we don't have time to get to every issue. We are always open to contributions so please send us a pull request if you would like to help. Inactive issues will be closed after 30 days. Thanks!

[flexiblefactory]

Still relevant. There are also another 8 issues flagged by npm audit in addition to this one.

[stale]

Hi everyone! Seems like there hasn't been much going on in this issue lately. If there are still questions, comments, or bugs, please feel free to continue the discussion. Unfortunately, we don't have time to get to every issue. We are always open to contributions so please send us a pull request if you would like to help. Inactive issues will be closed after 30 days. Thanks!

[devina91]

I agree, still relevant, I too have this vulnerability. in addition to #6622

[stale]

Hi everyone! Seems like there hasn't been much going on in this issue lately. If there are still questions, comments, or bugs, please feel free to continue the discussion. Unfortunately, we don't have time to get to every issue. We are always open to contributions so please send us a pull request if you would like to help. Inactive issues will be closed after 30 days. Thanks!

[arturopie]

This issue is still relevant. I tried to help by fixing it on a PR, but I couldn't setup the project to run all the tests. If you can point me to the right documentation for setting up my environment to work on this project, I can make a PR.

[shilman]

@arturopie There's a development guide in CONTRIBUTING.md. Did you take a look at that?

https://github.com/storybooks/storybook/blob/next/CONTRIBUTING.md#reproductions

[arturopie]

Yes, I did and got 6 failed test and 3 failed snapshots after running the core tests.

[shilman]

@arturopie Failed tests in the next branch?

[arturopie]

Yes

[agwells]

Upgrading to @storybook/addon-storyshots@5.1.3 resolved this issue for me.