storybook [Bug]:故事书7.6.*版本依赖于高度易受攻击的ip软件包

ncecgwcz 于 4个月前发布在其他

关注(0)|答案(3)|浏览(37)

描述bug

我遇到了一个由npm审计标记的高危漏洞问题，与ip包有关。这个问题出现在storybook核心服务器依赖中。我注意到这个漏洞已经在Storybook的最新版本(8.1.9)中得到解决，并在#26014中修复。我们是否可以回滚到7.6.*的路径，这将对那些使用7.6.*的用户有所帮助？

复现链接

https://github.com/storybookjs/storybook

复现步骤

系统

npx storybook@latest info

Storybook Environment Info:

  System:
    OS: macOS 14.5
    CPU: (10) arm64 Apple M1 Max
    Shell: 5.9 - /bin/zsh
  Binaries:
    Node: 20.12.2 - /opt/homebrew/opt/node@20/bin/node
    Yarn: 1.22.19 - /opt/homebrew/bin/yarn
    npm: 10.5.0 - /opt/homebrew/opt/node@20/bin/npm <----- active
  Browsers:
    Chrome: 125.0.6422.142
    Edge: 126.0.2592.56
    Safari: 17.5
  npmPackages:
    @storybook/addon-a11y: 7.6.17 => 7.6.17
    @storybook/addon-actions: 7.6.17 => 7.6.17
    @storybook/addon-controls: 7.6.17 => 7.6.17
    @storybook/addon-designs: 7.0.9 => 7.0.9
    @storybook/addon-docs: 7.6.17 => 7.6.17
    @storybook/addon-storysource: 7.6.17 => 7.6.17
    @storybook/addon-toolbars: 7.6.17 => 7.6.17
    @storybook/addon-viewport: 7.6.17 => 7.6.17
    @storybook/addons: 7.6.17 => 7.6.17
    @storybook/api: 7.6.17 => 7.6.17
    @storybook/cli: 7.6.17 => 7.6.17
    @storybook/client-api: 7.6.17 => 7.6.17
    @storybook/components: 7.6.17 => 7.6.17
    @storybook/core-client: 7.6.17 => 7.6.17
    @storybook/core-events: 7.6.17 => 7.6.17
    @storybook/core-server: 7.6.17 => 7.6.17
    @storybook/html: 7.6.17 => 7.6.17
    @storybook/manager-api: 7.6.17 => 7.6.17
    @storybook/preview-api: 7.6.17 => 7.6.17
    @storybook/source-loader: 7.6.17 => 7.6.17
    @storybook/theming: 7.6.17 => 7.6.17
    @storybook/web-components: 7.6.17 => 7.6.17
    @storybook/web-components-webpack5: 7.6.17 => 7.6.17
    storybook: 7.6.17 => 7.6.17