Skip to content

chore: upgrade storybook and vite#144

Merged
briantstephan merged 4 commits intomainfrom
fix-vulns
Mar 11, 2026
Merged

chore: upgrade storybook and vite#144
briantstephan merged 4 commits intomainfrom
fix-vulns

Conversation

@briantstephan
Copy link
Contributor

Upgrades storybook to fix a storybook vulnerability, and upgrades vite to fix a rollup vulnerability.

https://yext.atlassian.net/browse/VULN-42401
https://yext.atlassian.net/browse/VULN-42402

@changeset-bot
Copy link

changeset-bot bot commented Mar 9, 2026

⚠️ No Changeset found

Latest commit: 6e3fb8d

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@coderabbitai
Copy link

coderabbitai bot commented Mar 9, 2026

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 9a299352-dd1e-4e86-ba17-9c5c7f436b78

📥 Commits

Reviewing files that changed from the base of the PR and between f1c9743 and 6e3fb8d.

⛔ Files ignored due to path filters (1)
  • pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml
📒 Files selected for processing (1)
  • packages/pages-components/package.json
🚧 Files skipped from review as they are similar to previous changes (1)
  • packages/pages-components/package.json

Walkthrough

This pull request makes two changes in packages/pages-components: (1) a formatting change in CHANGELOG.md replacing a list marker from * to - with no content change; (2) dependency version bumps in package.json: Storybook-related packages updated to ^8.6.17 and Vite updated from ^5.4.11 to ^5.4.21.

Possibly related PRs

Suggested reviewers

  • mkilpatrick
  • asanehisa
🚥 Pre-merge checks | ✅ 2
✅ Passed checks (2 passed)
Check name Status Explanation
Title check ✅ Passed The title accurately describes the main changes in the changeset, which involve upgrading Storybook and Vite dependencies.
Description check ✅ Passed The description is directly related to the changeset, explaining the purpose of upgrading Storybook and Vite to address vulnerabilities.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Post copyable unit tests in a comment
  • Commit unit tests in branch fix-vulns

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

benlife5
benlife5 previously approved these changes Mar 9, 2026
Copy link

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@packages/pages-components/package.json`:
- Around line 88-91: Update every direct `@storybook/`* dependency entry that
currently uses ^8.6.14 to at least ^8.6.17 in package.json (e.g.,
`@storybook/addon-`*, `@storybook/react`, etc.) so all Storybook packages share the
patched floor; after changing the version strings run the package manager to
refresh the lockfile (npm/yarn/pnpm install) and verify storybook resolves to
8.6.17+ in the lockfile.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 87d3f674-b170-4d71-8c7a-f574ea1e6568

📥 Commits

Reviewing files that changed from the base of the PR and between dd01e35 and f1c9743.

⛔ Files ignored due to path filters (1)
  • pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml
📒 Files selected for processing (2)
  • packages/pages-components/CHANGELOG.md
  • packages/pages-components/package.json

@briantstephan briantstephan merged commit f717519 into main Mar 11, 2026
22 checks passed
@briantstephan briantstephan deleted the fix-vulns branch March 11, 2026 20:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants