Skip to content

[Bug]: Update express to address vulnerability reported by Snyk CVE-2024-45590 #29206

@ahayes91

Description

@ahayes91

Describe the bug

Hey folks!
We're seeing high vulnerabilities reported by Snyk related to the version of express being used here, could we safely update it to the latest 4.21.0 minor version (or maybe even the next major version)?

https://www.cve.org/CVERecord?id=CVE-2024-45590 describes the vulnerability, and it looks like express internally updated the body-parser dependency already in expressjs/express#5926

Thank you!

Reproduction link

https://www.cve.org/CVERecord?id=CVE-2024-45590

Reproduction steps

N/A

System

Storybook Environment Info:

  System:
    OS: macOS 14.6.1
    CPU: (16) x64 Intel(R) Core(TM) i9-9880H CPU @ 2.30GHz
    Shell: 5.9 - /bin/zsh
  Binaries:
    Node: 18.19.1 - ~/Library/Caches/fnm_multishells/1473_1727252379074/bin/node
    Yarn: 1.22.22 - ~/Library/Caches/fnm_multishells/1473_1727252379074/bin/yarn
    npm: 10.2.4 - ~/Library/Caches/fnm_multishells/1473_1727252379074/bin/npm <----- active
    pnpm: 9.1.0 - ~/Library/Caches/fnm_multishells/1473_1727252379074/bin/pnpm
  Browsers:
    Chrome: 129.0.6668.60
    Safari: 17.6
  npmPackages:
    @storybook/blocks: 8.3.2 => 8.3.2 
    @storybook/react: 8.3.2 => 8.3.2 
    eslint-plugin-storybook: 0.8.0 => 0.8.0

Additional context

No response

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions