-
-
Notifications
You must be signed in to change notification settings - Fork 9.6k
Closed
Labels
Description
Describe the bug
Hey folks!
We're seeing high vulnerabilities reported by Snyk related to the version of express
being used here, could we safely update it to the latest 4.21.0 minor version (or maybe even the next major version)?
https://www.cve.org/CVERecord?id=CVE-2024-45590 describes the vulnerability, and it looks like express
internally updated the body-parser
dependency already in expressjs/express#5926
Thank you!
Reproduction link
https://www.cve.org/CVERecord?id=CVE-2024-45590
Reproduction steps
N/A
System
Storybook Environment Info:
System:
OS: macOS 14.6.1
CPU: (16) x64 Intel(R) Core(TM) i9-9880H CPU @ 2.30GHz
Shell: 5.9 - /bin/zsh
Binaries:
Node: 18.19.1 - ~/Library/Caches/fnm_multishells/1473_1727252379074/bin/node
Yarn: 1.22.22 - ~/Library/Caches/fnm_multishells/1473_1727252379074/bin/yarn
npm: 10.2.4 - ~/Library/Caches/fnm_multishells/1473_1727252379074/bin/npm <----- active
pnpm: 9.1.0 - ~/Library/Caches/fnm_multishells/1473_1727252379074/bin/pnpm
Browsers:
Chrome: 129.0.6668.60
Safari: 17.6
npmPackages:
@storybook/blocks: 8.3.2 => 8.3.2
@storybook/react: 8.3.2 => 8.3.2
eslint-plugin-storybook: 0.8.0 => 0.8.0
Additional context
No response
dkingyello949 and nicolasfripp