From 9c2d8b94ba8284bed6df7054f5a4f1817b5db393 Mon Sep 17 00:00:00 2001 From: Koji Wakayama Date: Sat, 25 Jul 2026 05:45:13 +0200 Subject: [PATCH] Close the Storybook dependency alert at its own lock boundary Storybook installs from a dedicated npm lockfile, so the root Deno lock upgrade does not protect that dependency graph. Refresh only the vulnerable transitive brace-expansion artifact selected by minimatch. Constraint: Storybook dependency installation is isolated from the repository root deno.lock. Rejected: Rely on the root brace-expansion upgrade | It cannot affect npm --prefix storybook installs. Confidence: high Scope-risk: narrow Reversibility: clean Directive: Audit Storybook through storybook/package-lock.json independently of root Deno dependencies. Tested: npm ls brace-expansion --package-lock-only; npm audit --package-lock-only --audit-level=moderate; npm install --package-lock-only --ignore-scripts --dry-run; git diff --check Not-tested: Full Storybook browser build --- deno.json | 2 +- src/utils/version-constant.ts | 2 +- storybook/package-lock.json | 6 +++--- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/deno.json b/deno.json index 6ee9a8f2df..ed62d9f05b 100644 --- a/deno.json +++ b/deno.json @@ -1,6 +1,6 @@ { "name": "veryfront", - "version": "0.1.1132", + "version": "0.1.1142", "license": "Apache-2.0", "nodeModulesDir": "auto", "minimumDependencyAge": { diff --git a/src/utils/version-constant.ts b/src/utils/version-constant.ts index bb5904a495..09ac45f4e6 100644 --- a/src/utils/version-constant.ts +++ b/src/utils/version-constant.ts @@ -1,4 +1,4 @@ // Keep in sync with deno.json version. // scripts/release.ts updates this constant during releases. /** Shared version value. */ -export const VERSION = "0.1.1132"; +export const VERSION = "0.1.1142"; diff --git a/storybook/package-lock.json b/storybook/package-lock.json index bebf0712e5..93d94e00e8 100644 --- a/storybook/package-lock.json +++ b/storybook/package-lock.json @@ -2937,9 +2937,9 @@ } }, "node_modules/brace-expansion": { - "version": "5.0.7", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.7.tgz", - "integrity": "sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==", + "version": "5.0.8", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.8.tgz", + "integrity": "sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg==", "dev": true, "license": "MIT", "dependencies": {