mirror of
https://github.com/onyx-dot-app/onyx.git
synced 2026-10-23 03:42:59 -05:00
onyx-cherry-pick[bot]
c861af5d1d
Pins `storybook` to `10.6.2` in every manifest and lockfile for
[GHSA-f2ph-cmg5-wxc8](https://osv.dev/vulnerability/GHSA-f2ph-cmg5-wxc8).
Opened by the [CVE Alerts
run](https://github.com/onyx-dot-app/onyx/actions/runs/39650448612).
Closes #16393
I bumped the only `storybook` pin in the repo, a devDependency in
`web/package.json`, from 10.5.0 to 10.6.2. That is the fixed release for
the 10.x line in GHSA-f2ph-cmg5-wxc8. I checked the other `package.json`
files (root, `web/lib/opal`, `web/lib/shared`, `widget`,
`examples/widget`, `desktop`, `mobile`) and none of them pin storybook.
The bug only affects a running `storybook dev` server open in a browser:
a malicious website can send it messages that change story files on the
developer's machine. Onyx only runs Storybook through the `storybook` /
`storybook:build` scripts, and the web `Dockerfile` runs only `next
build` and ships the Next.js standalone output, so production
deployments are not affected. Developers who run `bun run storybook`
locally are exposed until they upgrade. The other Storybook packages
(`@storybook/react`, `@storybook/react-vite`,
`@storybook/addon-docs`, `@storybook/addon-themes`) stay on 10.5.0, so
check that the regenerated lockfile resolves cleanly and consider
aligning them to 10.6.2 in a follow-up.
<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Pins `storybook` from `10.5.0` to `10.6.2` in `web/package.json` and
regenerates `web/bun.lock` to fix
[GHSA-f2ph-cmg5-wxc8](https://osv.dev/vulnerability/GHSA-f2ph-cmg5-wxc8),
which let a malicious website modify story files on a developer's
machine through a running `storybook dev` server.
- The `storybook` pin in `web/package.json` is the only one in the repo;
no other manifest references it.
- Production deployments are not affected: the web `Dockerfile` only
runs `next build` and ships the Next.js standalone output.
- The related Storybook packages (`@storybook/react`,
`@storybook/react-vite`, `@storybook/addon-docs`,
`@storybook/addon-themes`) remain on `10.5.0`; consider aligning them in
a follow-up once the regenerated lockfile resolves cleanly.
<sup>Written for commit 02b614a295.
Summary will update on new commits.</sup>
<a
href="https://cubic.dev/pr/onyx-dot-app/onyx/pull/16394?utm_source=github"
target="_blank" rel="noopener noreferrer"
data-no-image-dialog="true"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source
media="(prefers-color-scheme: light)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img
alt="View guided diff"
src="https://www.cubic.dev/buttons/review-in-cubic-light.svg"></picture></a>
<a
href="https://www.cubic.dev/action/auto-fix/pr/onyx-dot-app/onyx/16394?returnTo=https%3A%2F%2Fgithub.com%2Fonyx-dot-app%2Fonyx%2Fpull%2F16394&source=description"
target="_blank" rel="noopener noreferrer"
data-no-image-dialog="true"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://www.cubic.dev/buttons/turn-on-auto-fix-dark.svg"><source
media="(prefers-color-scheme: light)"
srcset="https://www.cubic.dev/buttons/turn-on-auto-fix-light.svg"><img
alt="Turn on auto-fix"
src="https://www.cubic.dev/buttons/turn-on-auto-fix-light.svg"></picture></a>
<!-- End of auto-generated description by cubic. -->
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
<!-- coderabbit-ai-generated:v1 -->
## Summary by CodeRabbit
* **Chores**
* Updated the Storybook development tooling to version 10.6.2.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: onyx-cherry-pick[bot] <285052878+onyx-cherry-pick[bot]@users.noreply.github.com>
148 lines
4.8 KiB
JSON
148 lines
4.8 KiB
JSON
{
|
|
"name": "web",
|
|
"version": "1.0.0-dev",
|
|
"private": true,
|
|
"workspaces": [
|
|
"lib/opal",
|
|
"lib/shared"
|
|
],
|
|
"scripts": {
|
|
"dev": "node tools/prepare-pdf-assets.cjs && next dev",
|
|
"dev:profile": "node tools/prepare-pdf-assets.cjs && NEXT_PUBLIC_ENABLE_STATS=true next dev",
|
|
"dev:clean": "node tools/prepare-pdf-assets.cjs && bun run clean && next dev",
|
|
"clean": "rm -rf .next node_modules/.cache *.tsbuildinfo",
|
|
"build": "node tools/prepare-pdf-assets.cjs && next build",
|
|
"build:fast": "node tools/prepare-pdf-assets.cjs && SKIP_TYPE_CHECK=1 next build",
|
|
"start": "next start",
|
|
"lint": "oxlint",
|
|
"lint:fix": "oxlint --fix",
|
|
"types:check": "next typegen && node tools/type-check/index.ts",
|
|
"format": "oxfmt src",
|
|
"format:check": "oxfmt --check src",
|
|
"playwright": "playwright test",
|
|
"test": "jest",
|
|
"test:watch": "jest --watch",
|
|
"test:coverage": "jest --coverage",
|
|
"test:verbose": "jest --verbose",
|
|
"test:ci": "jest --ci --maxWorkers=2 --silent --bail",
|
|
"test:changed": "jest --onlyChanged",
|
|
"test:diff": "jest --changedSince=main",
|
|
"test:debug": "node --inspect-brk node_modules/.bin/jest --runInBand",
|
|
"storybook": "storybook dev -p 6006",
|
|
"storybook:build": "storybook build -o storybook-static"
|
|
},
|
|
"dependencies": {
|
|
"@dnd-kit/core": "^6.1.0",
|
|
"@dnd-kit/modifiers": "^7.0.0",
|
|
"@dnd-kit/sortable": "^10.0.0",
|
|
"@dnd-kit/utilities": "^3.2.2",
|
|
"@floating-ui/react-dom": "^2.1.6",
|
|
"@onyx-ai/opal": "file:./lib/opal",
|
|
"@onyx-ai/shared": "file:./lib/shared",
|
|
"@radix-ui/react-accordion": "^1.2.2",
|
|
"@radix-ui/react-avatar": "^1.2.2",
|
|
"@radix-ui/react-collapsible": "^1.1.2",
|
|
"@radix-ui/react-dialog": "^1.1.6",
|
|
"@radix-ui/react-direction": "^1.1.2",
|
|
"@radix-ui/react-dropdown-menu": "^2.1.6",
|
|
"@radix-ui/react-popover": "^1.1.6",
|
|
"@radix-ui/react-radio-group": "^1.2.2",
|
|
"@radix-ui/react-select": "^2.1.6",
|
|
"@radix-ui/react-slider": "^1.4.7",
|
|
"@radix-ui/react-slot": "^1.2.4",
|
|
"@radix-ui/react-tabs": "^1.1.1",
|
|
"@radix-ui/react-tooltip": "^1.2.8",
|
|
"@radix-ui/react-visually-hidden": "^1.2.11",
|
|
"@sentry/nextjs": "^10.54.0",
|
|
"@tanstack/react-table": "^8.21.3",
|
|
"@zip.js/zip.js": "^2.9.0",
|
|
"class-variance-authority": "^0.7.0",
|
|
"clsx": "^2.1.1",
|
|
"copy-to-clipboard": "^3.3.3",
|
|
"date-fns": "^4.1.0",
|
|
"docx-preview": "^0.3.7",
|
|
"dompurify": "3.4.15",
|
|
"formik": "^2.2.9",
|
|
"highlight.js": "^11.12.0",
|
|
"highlightjs-sap-abap": "^0.3.0",
|
|
"js-cookie": "^3.0.5",
|
|
"katex": "^0.17.0",
|
|
"linguist-languages": "^9.3.1",
|
|
"lodash": "^4.18.1",
|
|
"lowlight": "^3.3.0",
|
|
"lucide-react": "^1.25.0",
|
|
"mime": "^4.1.0",
|
|
"motion": "^12.42.2",
|
|
"next": "16.3.8",
|
|
"next-intl": "^4.13.7",
|
|
"next-themes": "^0.4.4",
|
|
"pdfjs-dist": "6.3.289",
|
|
"postcss": "^8.5.10",
|
|
"posthog-js": "^1.421.0",
|
|
"react": "19.2.8",
|
|
"react-day-picker": "^9.13.0",
|
|
"react-dom": "19.2.8",
|
|
"react-dropzone": "^20.1.0",
|
|
"react-icons": "^5.7.0",
|
|
"react-markdown": "^9.0.1",
|
|
"react-pdf": "11.0.0",
|
|
"recharts": "^3.9.2",
|
|
"rehype-highlight": "^7.0.2",
|
|
"rehype-katex": "^7.0.1",
|
|
"rehype-sanitize": "^6.0.0",
|
|
"rehype-stringify": "^10.0.1",
|
|
"remark-gfm": "^4.0.0",
|
|
"remark-math": "^6.0.0",
|
|
"remark-parse": "^11.0.0",
|
|
"remark-rehype": "^11.1.2",
|
|
"sharp": "^0.35.5",
|
|
"swr": "^2.1.5",
|
|
"tailwind-merge": "^3.6.0",
|
|
"tw-animate-css": "^1.4.0",
|
|
"unified": "^11.0.5",
|
|
"yup": "^1.4.0",
|
|
"zustand": "^5.0.8"
|
|
},
|
|
"devDependencies": {
|
|
"@formatjs/icu-messageformat-parser": "^3.5.17",
|
|
"@oxlint/plugins": "^1.71.0",
|
|
"@playwright/test": "^1.39.0",
|
|
"@storybook/addon-docs": "10.5.0",
|
|
"@storybook/addon-mcp": "^0.7.0",
|
|
"@storybook/addon-themes": "10.5.0",
|
|
"@storybook/react": "10.5.0",
|
|
"@storybook/react-vite": "10.5.0",
|
|
"@swc/core": "^1.15.43",
|
|
"@swc/jest": "^0.2.39",
|
|
"@tailwindcss/postcss": "^4.3.3",
|
|
"@tailwindcss/typography": "^0.5.19",
|
|
"@testing-library/jest-dom": "^6.9.1",
|
|
"@testing-library/react": "^16.3.0",
|
|
"@testing-library/user-event": "^14.6.1",
|
|
"@types/hast": "^3.0.4",
|
|
"@types/jest": "^30.0.0",
|
|
"@types/js-cookie": "^3.0.6",
|
|
"@types/lodash": "^4.17.25",
|
|
"@types/node": "24.12.2",
|
|
"@types/react": "19.2.18",
|
|
"@types/react-dom": "19.2.7",
|
|
"@types/stats.js": "^0.17.4",
|
|
"babel-plugin-react-compiler": "^1.0.0",
|
|
"dotenv": "^17.4.2",
|
|
"jest": "^30.4.2",
|
|
"jest-environment-jsdom": "^30.2.0",
|
|
"oxfmt": "0.59.0",
|
|
"oxlint": "^1.66.0",
|
|
"oxlint-plugin-react-doctor": "0.9.11",
|
|
"stats.js": "^0.17.0",
|
|
"storybook": "10.6.2",
|
|
"tailwindcss": "^4.3.3",
|
|
"typescript": "7.1.0-dev.20260916.1",
|
|
"whatwg-fetch": "^3.6.20"
|
|
},
|
|
"overrides": {
|
|
"react-is": "^19.0.0-rc-69d4b800-20241021",
|
|
"tinypool": "2.1.2"
|
|
}
|
|
}
|