@storybook/addon-docs relies on deprecated packages

[vdhpieter]

Describe the bug

@storybook/addon-docs relies on @jest/transform@26 which relies on jest-haste-map@26 which relies on [email protected] which is deprecated. Updating to @jest/transform@27 will solve this problem.

EDIT another deprecated package was found:

@storybook/builder-webpack4 relies on [email protected] which relies on [email protected] which relies on [email protected] which is deprecated. Updating webpack-dev-middleware to version 4 or later (newest is 5.2.2) will solve this problem.

EDIT 2:

@storybook/builder-webpack4 & @storybook/builder-webpack5 rely on [email protected] which relies on [email protected] which has a security issue. Updating react-dev-utils to version 12.0.0 will solve this problem. (It wil also solve a security issue with immer)

To Reproduce
Not relevant

System
Not relevant

[chyzwar]

For our project bigger problem is that our project use webpack5, jest27, emotion11 but storybook still use older versions. This almost double our dev dependencies and sometimes lead to hoisting problems.

I think it would be great if @storybook/builder-webpack4 and @storybook/builder-webpack5 (webpack4/webpack5) are peer dependencies then project can choose one based on webpack version in project instead of installing it twice.

[shilman]

@chyzwar that's the plan. however it's a breaking change so we can't make the move until SB 7.0

[bdashrad]

@shilman just to clarify, are the peer dependencies not coming until SB 7.0 or the react-dev-utils update? Just looking for some clarification as we attempt to resolve the immer security issue.

[shilman]

@bdashrad I think the immer problem is fixed in 6.5 and i can patch back the fix to 6.4 if somebody verifies (hint hint)

[mikaelkarlsson-se]

@shilman I can confirm that the problem with immer is solved in SB 6.5.0-alpha.7. After upgrading all SB dependencies in my repository I can see in package lock thatreact-dev-utils (v11) has been removed and therefore also immer.
If it's not possible to remove react-dev-utils in SB 6.4 then upgrading react-dev-utils to v12 would be an option to solve the issue as well, see this thread.

[ricardo-fnd]

@chyzwar that's the plan. however it's a breaking change so we can't make the move until SB 7.0

Is this still the solution you guys are implementing to solve this issue?

I have some warnings because @storybook/core-common dependes on nanomatch which is deprecated, [email protected] which will break on node v14+, [email protected] which does not receive security updates since 2019, also some warnings with @storybook/addons-docs and more which I will present to you.

Thank you.

[shilman]

@ricardo-fnd we're in the process of cleaning all this up for SB7. hopefully we'll get the first alphas out in a month or so.

[dartess]

@shilman hi!
I see improvements in version 7.
It seems that there are two packages left with warnings: jest (rather a lot of jest packages) and stable.
Are there any plans to upgrade/replace them?

I tried removing stable and it seems to work, but the list of browsers that support stable sorting is limited: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Array/sort#browser_compatibility . And I don't know if this list is satisfactory for a storybook.

[mogsdad]

I note that V7 (specifically @storybook/[email protected]) is still dependent on @jest/transform@26. Is this a work-in-progress?

[ndelangen]

This is fixed in 7.0 beta