fix(storybook): upgrade transitive brace-expansion to 5.0.8 - #3093
Conversation
Storybook installs from a dedicated npm lockfile, so the root Deno lock upgrade does not protect that dependency graph. Refresh only the vulnerable transitive brace-expansion artifact selected by minimatch. Constraint: Storybook dependency installation is isolated from the repository root deno.lock. Rejected: Rely on the root brace-expansion upgrade | It cannot affect npm --prefix storybook installs. Confidence: high Scope-risk: narrow Reversibility: clean Directive: Audit Storybook through storybook/package-lock.json independently of root Deno dependencies. Tested: npm ls brace-expansion --package-lock-only; npm audit --package-lock-only --audit-level=moderate; npm install --package-lock-only --ignore-scripts --dry-run; git diff --check Not-tested: Full Storybook browser build
|
CI dependency note: the root NPM Dependency Audit failure is inherited from current main and is fixed on #3077, whose exact head passes the same audit. This draft separately fixes Storybook's own package-lock graph; npm audit against that lock reports zero vulnerabilities. It will be rebased after #3077 lands. |
There was a problem hiding this comment.
Pull request overview
Updates the Storybook-owned npm lockfile to pick up the patched brace-expansion@5.0.8 transitive dependency (closing an advisory that the root deno.lock cannot affect), and bumps the framework version to 0.1.1142 to reserve the release.
Changes:
- Bump
storybook/package-lock.jsontransitivebrace-expansionfrom5.0.7to5.0.8. - Update the framework version constant to
0.1.1142. - Update
deno.jsonpackage version to0.1.1142.
Verification
- Not run in this review environment.
- Suggested next step (as already done per PR description):
npm audit --package-lock-only --audit-level=moderateand the repo pre-push checks.
Reviewed changes
Copilot reviewed 2 out of 3 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| storybook/package-lock.json | Updates transitive brace-expansion resolution to 5.0.8 under the Storybook lockfile. |
| src/utils/version-constant.ts | Bumps exported VERSION constant to 0.1.1142 to match the release reservation. |
| deno.json | Bumps package "version" to 0.1.1142 to stay in sync with the shared constant. |
Files not reviewed (1)
- storybook/package-lock.json: Generated file
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 9c2d8b94ba
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
Merge current origin/main into the Storybook brace-expansion branch so the PR carries the landed root audit repair while preserving the reserved 0.1.1142 release version and Storybook-owned package-lock fix. Constraint: PR #3093 must be refreshed by merge, not rebase or force push. Constraint: Version ordering remains reserved at 0.1.1142 despite origin/main carrying 0.1.1133. Rejected: Rebase the PR branch | history rewrite was explicitly out of scope. Rejected: Take origin/main version values | would drop the requested release reservation. Confidence: high Scope-risk: moderate Reversibility: clean Directive: Audit root Deno npm dependencies with deno task audit and Storybook dependencies through storybook/package-lock.json independently. Tested: npm audit --package-lock-only --audit-level=moderate (storybook); npm audit --audit-level=moderate (root, confirmed inapplicable without root npm lock); deno task audit; deno task storybook:check; git diff --cached --check; deno task verify:quick Not-tested: Full deno task verify with complete unit/e2e suite locally; rely on refreshed PR CI for full matrix.
|
Codex Review: Didn't find any major issues. Can't wait for the next one! Reviewed commit: ℹ️ About Codex in GitHubCodex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback". |
Merge current origin/main into PR #3093 without changing the PR-owned Storybook brace-expansion lock repair. The version conflicts were resolved to keep the reserved 0.1.1142 release value while accepting main's root dependency and security state unchanged. Constraint: PR #3093 must be refreshed by merge, not rebase or force push. Constraint: Preserve Storybook package-lock brace-expansion 5.0.8 and the reserved 0.1.1142 release version. Rejected: Take origin/main version 0.1.1136 | would drop the reserved PR release version. Rejected: Keep generated deno.lock drift from verification | it changed unrelated dependency metadata outside this PR's scope. Confidence: high Scope-risk: moderate Reversibility: clean Directive: Keep root Deno dependency pins and Storybook npm lock auditing independent for this branch. Tested: npm audit --package-lock-only --audit-level=moderate in storybook; deno task audit; deno task storybook:check; deno fmt --check deno.json src/utils/version-constant.ts storybook/package-lock.json; deno task fmt:check; deno task lint; deno task typecheck; deno task verify:quick; deno check --frozen --lock=deno.lock public entrypoints; git diff --check Not-tested: Full deno task verify locally; root npm audit is inapplicable because this repo has no root npm lockfile.
Summary
Validation
Release ordering
Draft until lower reserved releases through 0.1.1141 land. This PR must not merge ahead of #3091 and #3092.