Skip to content

[Snyk] Security upgrade @storybook/builder-webpack5 from 0.0.0-use.local to 7.1.0 #320

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
q1blue wants to merge 1 commit into
base: next
Choose a base branch
from
Open

[Snyk] Security upgrade @storybook/builder-webpack5 from 0.0.0-use.local to 7.1.0 #320

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion code/frameworks/preact-webpack5/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,7 +47,7 @@
"prep": "jiti ../../../scripts/prepare/bundle.ts"
},
"dependencies": {
"@storybook/builder-webpack5": "workspace:*",
"@storybook/builder-webpack5": "7.1.0",
Copy link

@gemini-code-assist gemini-code-assist bot Jan 22, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

The PR description explicitly states that yarn.lock failed to update. It is critical to manually update the yarn.lock file to ensure that the 7.1.0 version of @storybook/builder-webpack5 is properly locked. Without this, the security fix might not be consistently applied across environments, and dependency resolution could lead to unexpected issues.

Copy link

@gemini-code-assist gemini-code-assist bot Jan 22, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

The dependency @storybook/builder-webpack5 has been changed from workspace:* to a fixed version 7.1.0. In a Yarn workspace, workspace:* typically signifies that the package should use the local version available within the monorepo. However, the local version of @storybook/builder-webpack5 (as defined in code/builders/builder-webpack5/package.json) is 8.3.0-beta.3. This change means preact-webpack5 will now fetch 7.1.0 from the npm registry, effectively downgrading from the local 8.3.0-beta.3 version and breaking the workspace:* convention. Please confirm if this is the intended behavior, as it could introduce version inconsistencies within the monorepo or unintended external dependencies. If the goal is to use the local, updated version of builder-webpack5, the dependency should ideally remain workspace:*.

"@storybook/preact": "workspace:*",
"@storybook/preset-preact-webpack": "workspace:*",
"@types/node": "^22.0.0"
Expand Down
Loading