-
-
Couldn't load subscription status.
- Fork 9.7k
Closed
Labels
Description
Describe the bug
Hey folks!
We're seeing high vulnerabilities reported by Snyk related to the version of express being used here, could we safely update it to the latest 4.21.0 minor version (or maybe even the next major version)?
https://www.cve.org/CVERecord?id=CVE-2024-45590 describes the vulnerability, and it looks like express internally updated the body-parser dependency already in expressjs/express#5926
Thank you!
Reproduction link
https://www.cve.org/CVERecord?id=CVE-2024-45590
Reproduction steps
N/A
System
Storybook Environment Info:
System:
OS: macOS 14.6.1
CPU: (16) x64 Intel(R) Core(TM) i9-9880H CPU @ 2.30GHz
Shell: 5.9 - /bin/zsh
Binaries:
Node: 18.19.1 - ~/Library/Caches/fnm_multishells/1473_1727252379074/bin/node
Yarn: 1.22.22 - ~/Library/Caches/fnm_multishells/1473_1727252379074/bin/yarn
npm: 10.2.4 - ~/Library/Caches/fnm_multishells/1473_1727252379074/bin/npm <----- active
pnpm: 9.1.0 - ~/Library/Caches/fnm_multishells/1473_1727252379074/bin/pnpm
Browsers:
Chrome: 129.0.6668.60
Safari: 17.6
npmPackages:
@storybook/blocks: 8.3.2 => 8.3.2
@storybook/react: 8.3.2 => 8.3.2
eslint-plugin-storybook: 0.8.0 => 0.8.0Additional context
No response
dkingyello949 and nicolasfripp