chore(deps): update dependency storybook to v7.6.21 [security]#115
chore(deps): update dependency storybook to v7.6.21 [security]#115renovate[bot] wants to merge 1 commit into
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Seems you are using me but didn't get OPENAI_API_KEY seted in Variables/Secrets for this repo. you could follow readme for more information |
6a81ea0 to
56babe4
Compare
|
Seems you are using me but didn't get OPENAI_API_KEY seted in Variables/Secrets for this repo. you could follow readme for more information |
56babe4 to
c63e980
Compare
|
Seems you are using me but didn't get OPENAI_API_KEY seted in Variables/Secrets for this repo. you could follow readme for more information |
c63e980 to
b275b8c
Compare
|
Seems you are using me but didn't get OPENAI_API_KEY seted in Variables/Secrets for this repo. you could follow readme for more information |
b275b8c to
8df363d
Compare
8df363d to
2fdb01b
Compare
|
Seems you are using me but didn't get OPENAI_API_KEY seted in Variables/Secrets for this repo. you could follow readme for more information |
2fdb01b to
dcc9bd5
Compare
|
Seems you are using me but didn't get OPENAI_API_KEY seted in Variables/Secrets for this repo. you could follow readme for more information |
dcc9bd5 to
dd8d899
Compare
|
Seems you are using me but didn't get OPENAI_API_KEY seted in Variables/Secrets for this repo. you could follow readme for more information |
dd8d899 to
dc32bc3
Compare
|
Seems you are using me but didn't get OPENAI_API_KEY seted in Variables/Secrets for this repo. you could follow readme for more information |
dc32bc3 to
79f4843
Compare
|
Seems you are using me but didn't get OPENAI_API_KEY seted in Variables/Secrets for this repo. you could follow readme for more information |
79f4843 to
126e72c
Compare
01ee923 to
c225fe2
Compare
|
Seems you are using me but didn't get OPENAI_API_KEY seted in Variables/Secrets for this repo. you could follow readme for more information |
c225fe2 to
eb9262d
Compare
|
Seems you are using me but didn't get OPENAI_API_KEY seted in Variables/Secrets for this repo. you could follow readme for more information |
eb9262d to
3c6cfa8
Compare
|
Seems you are using me but didn't get OPENAI_API_KEY seted in Variables/Secrets for this repo. you could follow readme for more information |
3c6cfa8 to
0c443fc
Compare
|
Seems you are using me but didn't get OPENAI_API_KEY seted in Variables/Secrets for this repo. you could follow readme for more information |
0c443fc to
c1bec87
Compare
|
Seems you are using me but didn't get OPENAI_API_KEY seted in Variables/Secrets for this repo. you could follow readme for more information |
c1bec87 to
600674f
Compare
|
Seems you are using me but didn't get OPENAI_API_KEY seted in Variables/Secrets for this repo. you could follow readme for more information |
600674f to
c39c52f
Compare
|
Seems you are using me but didn't get OPENAI_API_KEY seted in Variables/Secrets for this repo. you could follow readme for more information |
c39c52f to
a630d2a
Compare
|
Seems you are using me but didn't get OPENAI_API_KEY seted in Variables/Secrets for this repo. you could follow readme for more information |
a630d2a to
4539e7d
Compare
|
Seems you are using me but didn't get OPENAI_API_KEY seted in Variables/Secrets for this repo. you could follow readme for more information |
This PR contains the following updates:
7.4.6→7.6.21Storybook manager bundle may expose environment variables during build
CVE-2025-68429 / GHSA-8452-54wp-rmv6
More information
Details
On December 11th, the Storybook team received a responsible disclosure alerting them to a potential vulnerability in certain built and published Storybooks.
The vulnerability is a bug in how Storybook handles environment variables defined in a
.envfile, which could, in specific circumstances, lead to those variables being unexpectedly bundled into the artifacts created by thestorybook buildcommand. When a built Storybook is published to the web, the bundle’s source is viewable, thus potentially exposing those variables to anyone with access. If those variables contained secrets, they should be considered compromised.Who is impacted?
For a project to be vulnerable to this issue, it must:
storybook builddirectly or indirectly) in a directory that contains a.envfile (including variants like.env.local).envfile contains sensitive secrets7.0.0or aboveStorybooks built without a
.envfile at build time are not affected, including common CI-based builds where secrets are provided via platform environment variables rather than.envfiles.Users' Storybook runtime environments (i.e.
storybook dev) are not affected. Deployed applications that share a repo with a project's Storybook are not affected.Storybook 6 and below are not affected.
Recommended actions
First, Storybook recommends that everyone audit for any sensitive secrets provided via
.envfiles and rotate those keys.Second, Storybook has released patched versions of all affected major Storybook versions that no longer have this vulnerability. Projects should upgrade their Storybook—on both local machines and CI environments—to one of these versions before publishing again.
10.1.10+9.1.17+8.6.15+7.6.21+Finally, some projects may have been relying on the undocumented behavior at the heart of this issue and will need to change how they reference environment variables after this update. If a project can no longer read necessary environmental variable values, it can either prefix the variables with
STORYBOOK_or use theenvproperty in Storybook’s configuration to manually specify values. In either case, do not include sensitive secrets as they will be included in the built bundle.Further information
Details of the vulnerability can be found on the Storybook announcement.
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:LReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Storybook manager bundle may expose environment variables during build
CVE-2025-68429 / GHSA-8452-54wp-rmv6
More information
Details
On December 11th, the Storybook team received a responsible disclosure alerting them to a potential vulnerability in certain built and published Storybooks.
The vulnerability is a bug in how Storybook handles environment variables defined in a
.envfile, which could, in specific circumstances, lead to those variables being unexpectedly bundled into the artifacts created by thestorybook buildcommand. When a built Storybook is published to the web, the bundle’s source is viewable, thus potentially exposing those variables to anyone with access. If those variables contained secrets, they should be considered compromised.Who is impacted?
For a project to be vulnerable to this issue, it must:
storybook builddirectly or indirectly) in a directory that contains a.envfile (including variants like.env.local).envfile contains sensitive secrets7.0.0or aboveStorybooks built without a
.envfile at build time are not affected, including common CI-based builds where secrets are provided via platform environment variables rather than.envfiles.Users' Storybook runtime environments (i.e.
storybook dev) are not affected. Deployed applications that share a repo with a project's Storybook are not affected.Storybook 6 and below are not affected.
Recommended actions
First, Storybook recommends that everyone audit for any sensitive secrets provided via
.envfiles and rotate those keys.Second, Storybook has released patched versions of all affected major Storybook versions that no longer have this vulnerability. Projects should upgrade their Storybook—on both local machines and CI environments—to one of these versions before publishing again.
10.1.10+9.1.17+8.6.15+7.6.21+Finally, some projects may have been relying on the undocumented behavior at the heart of this issue and will need to change how they reference environment variables after this update. If a project can no longer read necessary environmental variable values, it can either prefix the variables with
STORYBOOK_or use theenvproperty in Storybook’s configuration to manually specify values. In either case, do not include sensitive secrets as they will be included in the built bundle.Further information
Details of the vulnerability can be found on the Storybook announcement.
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:LReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
Release Notes
storybookjs/storybook (storybook)
v7.6.21Compare Source
7.6.21
v7.6.20Compare Source
v7.6.19Compare Source
7.6.19
7.6.18containing wrong dependency identifiers, thanks @jreinhold!v7.6.18Compare Source
7.6.18
v7.6.17Compare Source
v7.6.16Compare Source
v7.6.15Compare Source
This release accidentally didn't contain anything.
v7.6.14Compare Source
trueargs in URL getting ignored - #25950, thanks @JReinhold!v7.6.13Compare Source
v7.6.12Compare Source
upgradedetecting the wrong version of existing Storybooks - #25752, thanks @JReinhold!v7.6.11Compare Source
v7.6.10Compare Source
upgrade- #25642, thanks @JReinhold!v7.6.9Compare Source
init,upgradeandsandbox- #25526, thanks @ndelangen, @jreinhold!v7.6.8Compare Source
v7.6.7Compare Source
v7.6.6Compare Source
v7.6.5Compare Source
$appmodules - #25132, thanks @paoloricciuti!v7.6.4Compare Source
v7.6.3Compare Source
v7.6.2Compare Source
v7.6.1Compare Source
v7.6.0Compare Source
Storybook 7.6 is here with increased performance and much more!
List of all updates
@storybook/core-events/preview-errorsdependency missing for Yarn PnP - #24973, thanks @JReinhold!reactand Storybook packagesdevDependencieswhere possible - #24676, thanks @JReinhold!reactand Storybook packagesdevDependencieswhere possible - ATTEMPT 2 - #24834, thanks @JReinhold!addon-onboardingwhen checking versions - #24634, thanks @JReinhold!useStoryPreparedhook failing withundefineddata - #22631, thanks @SpookyJelly!ofprop toPrimaryblock - #23849, thanks @Wilson2k!defaultPropsinStoriesblock - #24506, thanks @WouterK12!store.settings.lastTrackedStoryId- #24115, thanks @rashidshamloo!"type": "commonjs"compatibility - #24534, thanks @ndelangen!react-docgento v7 - #24530, thanks @shilman!SlotDecoratorcomponent - #24800, thanks @JReinhold!goto,invalidateandinvalidateAll- #24955, thanks @paoloricciuti!--testCLI-flag - #24862, thanks @ndelangen!--testistrue- #24799, thanks @ndelangen!@storybook/blocksifbuild.test.emptyBlocksistrue- #24650, thanks @ndelangen!v7.5.3Compare Source
7.5.3
v7.5.2Compare Source
linkcommand - #24551, thanks @yannbf!v7.5.1Compare Source
v7.5.0Compare Source
Storybook 7.5 enhances your Storybook experience with several key updates:
List of all updates
react-docgento6.0.xand improve argTypes - #23825, thanks @shilman!lang="ts"or optional chaining - #24096, thanks @j3rem1e!@storybook/builder-viteto@storybook/addon-docs- #24166, thanks @bryanjtc!Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.