postcss Security Vulnerability

Hello!

Thought it would be good to open the discussion and see if someone might have an idea on how to proceed.

postcss versions less than 8.2.10 are vulnerable as per: https://npmjs.com/advisories/1693

It appears several projects under Storybook are using an old version of css-loader (< 5) or postcss-flexbugs-fixes (< 5) or autoprefixer (< 10) which have a dependency on postcss 7. For example:

Core-Server

• https://github.com/storybookjs/storybook/blob/master/lib/core-server/package.json#L66

Builder-Webpack4

• https://github.com/storybookjs/storybook/blob/master/lib/builder-webpack4/package.json#L76
• https://github.com/storybookjs/storybook/blob/master/lib/builder-webpack4/package.json#L82
• https://github.com/storybookjs/storybook/blob/master/lib/builder-webpack4/package.json#L93
• https://github.com/storybookjs/storybook/blob/master/lib/builder-webpack4/package.json#L94

Addon-postcss

• https://github.com/storybookjs/addon-postcss/blob/master/package.json#L46
• https://github.com/storybookjs/addon-postcss/blob/master/package.json#L47

Angular

• https://github.com/storybookjs/storybook/blob/master/app/angular/package.json#L50
• https://github.com/storybookjs/storybook/blob/master/app/angular/package.json#L54

These dependencies on older versions of postcss are preventing us from updating to a later version to address this vulnerability.

Is this something on the Storybook team’s radar/planned for upcoming update?

[shilman]

Ermahgerd!! I just released https://github.com/storybookjs/storybook/releases/tag/v6.3.0-rc.9 containing PR #15276 that references this issue. Upgrade today to the @next NPM tag to try it out!

npx sb upgrade --prerelease

Closing this issue. Please re-open if you think there’s still more to do.

[mayank99]

@storybook/addon-docs and @storybook/react also indirectly use postcss7

From dependabot