fix(deps): pin storybook to 10.6.2

Merged
ON
2d ago
+32-24

Pins storybook to 10.6.2 in every manifest and lockfile for GHSA-f2ph-cmg5-wxc8. Opened by the CVE Alerts run.

Closes #16393

I bumped the only storybook pin in the repo, a devDependency in web/package.json, from 10.5.0 to 10.6.2. That is the fixed release for the 10.x line in GHSA-f2ph-cmg5-wxc8. I checked the other package.json files (root, web/lib/opal, web/lib/shared, widget, examples/widget, desktop, mobile) and none of them pin storybook. The bug only affects a running storybook dev server open in a browser: a malicious website can send it messages that change story files on the developer's machine. Onyx only runs Storybook through the storybook / storybook:build scripts, and the web Dockerfile runs only next build and ships the Next.js standalone output, so production deployments are not affected. Developers who run bun run storybook locally are exposed until they upgrade. The other Storybook packages (@​storybook/react, @​storybook/react-vite, @​storybook/addon-docs, @​storybook/addon-themes) stay on 10.5.0, so check that the regenerated lockfile resolves cleanly and consider aligning them to 10.6.2 in a follow-up.

Summary by cubic

Pins storybook from 10.5.0 to 10.6.2 in web/package.json and regenerates web/bun.lock to fix GHSA-f2ph-cmg5-wxc8, which let a malicious website modify story files on a developer's machine through a running storybook dev server.

  • The storybook pin in web/package.json is the only one in the repo; no other manifest references it.
  • Production deployments are not affected: the web Dockerfile only runs next build and ships the Next.js standalone output.
  • The related Storybook packages (@storybook/react, @storybook/react-vite, @storybook/addon-docs, @storybook/addon-themes) remain on 10.5.0; consider aligning them in a follow-up once the regenerated lockfile resolves cleanly.

Summary by CodeRabbit

  • Chores
    • Updated the Storybook development tooling to version 10.6.2.