storybook: [Bug]: The latest version depends on the highly vulnerable `ip` package
Describe the bug
The vulnerability is described here: https://github.com/advisories/GHSA-78xj-cgh5-2h22.
As far as I can see now, the ip package is used only ones in the core-server package here — https://github.com/storybookjs/storybook/blob/ece1fb269cc44f43a5384f986a2b9f48613b0095/code/lib/core-server/src/utils/server-address.ts#L13C1-L13C80
This can easily be swapped with some other package, like for instance https://www.npmjs.com/package/ip-address, the way socks’ lib maintainer did here — https://github.com/JoshGlazebrook/socks/pull/94/files.
WDYT guys? Is it a good candidate for a quick fix? I could participate if necessary with the PR, for sure.
To Reproduce
Install any storybook flavour via npm (most of them depend on the vulnerable package through core-server)
System
No response
Additional context
No response
About this issue
- Original URL
- State: closed
- Created 5 months ago
- Reactions: 74
- Comments: 19 (6 by maintainers)
I definitely plan to patch this back to 7.6.x!
Just to set some context for the
ipvulnerability:The affected
ip.isPublic()method is not used by Storybook. Hence, the vulnerability reported bynpm auditdoesn’t affect Storybook users. We should still consider replacing the package with another one since it isn’t maintained anymore.@fyodorio Please feel free to create a PR with the quick fix 😃
@valentinpalkovic made the suggestion via https://github.com/storybookjs/storybook/pull/26025, please review, any feedback is welcome, as I’m a first-time contributor here.
Heads up: The 7.6.17 release contains the fix.
I’m replacing
ipwith https://www.npmjs.com/package/ip-address in some of my packages. I wanted to share this because it took some time for me to figure what theipshould be replaced with.Seems to be fixed with
2.0.1: https://github.com/indutny/node-ip/pull/138#issuecomment-1951710634There is also a PR https://github.com/storybookjs/storybook/pull/26086 (crosslinking https://github.com/storybookjs/storybook/issues/26011)
Please use the 👍 emoji reaction on the initial issue message to upvote the issue, otherwise all core maintainers and participants get notified every time someone posts a „+1“ message, which additionally adds a lot of noise to the thread.
Correct!
nextis the right branch.For those looking for inspiration,
sockreplacedipwithip-addressandproxy-agentsjust inlined the methods they were using+1
Oh no! Into
next. Based on my research the Release bot generates changes.For example this PR#25907 commits into
next. And release bot takes it as a generated changelog and commits intolatest-releasePR#25843.+1
+1