Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Bug]: Update express to address vulnerability reported by Snyk CVE-2024-45590 #29206

Closed
ahayes91 opened this issue Sep 25, 2024 · 3 comments
Closed

Comments

@ahayes91
Copy link
Contributor

Describe the bug

Hey folks!
We're seeing high vulnerabilities reported by Snyk related to the version of express being used here, could we safely update it to the latest 4.21.0 minor version (or maybe even the next major version)?

https://www.cve.org/CVERecord?id=CVE-2024-45590 describes the vulnerability, and it looks like express internally updated the body-parser dependency already in expressjs/express#5926

Thank you!

Reproduction link

https://www.cve.org/CVERecord?id=CVE-2024-45590

Reproduction steps

N/A

System

Storybook Environment Info:

  System:
    OS: macOS 14.6.1
    CPU: (16) x64 Intel(R) Core(TM) i9-9880H CPU @ 2.30GHz
    Shell: 5.9 - /bin/zsh
  Binaries:
    Node: 18.19.1 - ~/Library/Caches/fnm_multishells/1473_1727252379074/bin/node
    Yarn: 1.22.22 - ~/Library/Caches/fnm_multishells/1473_1727252379074/bin/yarn
    npm: 10.2.4 - ~/Library/Caches/fnm_multishells/1473_1727252379074/bin/npm <----- active
    pnpm: 9.1.0 - ~/Library/Caches/fnm_multishells/1473_1727252379074/bin/pnpm
  Browsers:
    Chrome: 129.0.6668.60
    Safari: 17.6
  npmPackages:
    @storybook/blocks: 8.3.2 => 8.3.2 
    @storybook/react: 8.3.2 => 8.3.2 
    eslint-plugin-storybook: 0.8.0 => 0.8.0

Additional context

No response

@dkingyello949
Copy link

I would also appreciate an update on this 👍

@ahayes91
Copy link
Contributor Author

#29079 should sort this actually!

@vanessayuenn
Copy link
Contributor

We moved away from using express all together! Closed via #29230.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

3 participants