Hotfix/7.6.20

.circleci/config.yml

@@ -8,7 +8,7 @@ parameters:
     default: 'skipped'
 
 executors:
-  sb_node_16_classic:
+  sb_node_18_classic:
     parameters:
       class:
         description: The Resource class
@@ -21,7 +21,7 @@ executors:
         environment:
           NODE_OPTIONS: --max_old_space_size=6144
     resource_class: <<parameters.class>>
-  sb_node_16_browsers:
+  sb_node_18_browsers:
     parameters:
       class:
         description: The Resource class
@@ -85,7 +85,7 @@ jobs:
   pretty-docs:
     executor:
       class: medium
-      name: sb_node_16_classic
+      name: sb_node_18_classic
     steps:
       - git-shallow-clone/checkout_advanced:
           clone_options: '--depth 1 --verbose'
@@ -110,8 +110,8 @@ jobs:
             yarn docs:prettier:check
   build:
     executor:
-      class: large
-      name: sb_node_16_classic
+      class: xlarge
+      name: sb_node_18_classic
     steps:
       - git-shallow-clone/checkout_advanced:
           clone_options: '--depth 1 --verbose'
@@ -154,7 +154,7 @@ jobs:
   lint:
     executor:
       class: large
-      name: sb_node_16_classic
+      name: sb_node_18_classic
     steps:
       - git-shallow-clone/checkout_advanced:
           clone_options: '--depth 1 --verbose'
@@ -170,7 +170,7 @@ jobs:
   check:
     executor:
       class: xlarge
-      name: sb_node_16_classic
+      name: sb_node_18_classic
     steps:
       - git-shallow-clone/checkout_advanced:
           clone_options: '--depth 1 --verbose'
@@ -184,7 +184,7 @@ jobs:
       - report-workflow-on-failure
       - cancel-workflow-on-failure
   script-checks:
-    executor: sb_node_16_browsers
+    executor: sb_node_18_browsers
     steps:
       - git-shallow-clone/checkout_advanced:
           clone_options: '--depth 1 --verbose'
@@ -212,7 +212,7 @@ jobs:
   unit-tests:
     executor:
       class: xlarge
-      name: sb_node_16_browsers
+      name: sb_node_18_browsers
     steps:
       - git-shallow-clone/checkout_advanced:
           clone_options: '--depth 1 --verbose'
@@ -234,7 +234,7 @@ jobs:
   coverage:
     executor:
       class: small
-      name: sb_node_16_browsers
+      name: sb_node_18_browsers
     steps:
       - git-shallow-clone/checkout_advanced:
           clone_options: '--depth 1 --verbose'
@@ -245,7 +245,7 @@ jobs:
   chromatic-internal-storybooks:
     executor:
       class: medium+
-      name: sb_node_16_browsers
+      name: sb_node_18_browsers
     environment:
       NODE_OPTIONS: --max_old_space_size=6144
     steps:
@@ -269,13 +269,16 @@ jobs:
         type: integer
     executor:
       class: medium
-      name: sb_node_16_browsers
+      name: sb_node_18_browsers
     parallelism: << parameters.parallelism >>
     steps:
       - git-shallow-clone/checkout_advanced:
           clone_options: '--depth 1 --verbose'
       - attach_workspace:
           at: .
+      - run:
+          name: Enable Corepack
+          command: sudo corepack enable yarn
       - run:
           name: Creating Sandboxes
           command: yarn task --task sandbox --template $(yarn get-template --cadence << pipeline.parameters.workflow >> --task sandbox) --no-link --start-from=never --junit
@@ -293,7 +296,7 @@ jobs:
         type: integer
     executor:
       class: medium
-      name: sb_node_16_browsers
+      name: sb_node_18_browsers
     parallelism: << parameters.parallelism >>
     steps:
       - git-shallow-clone/checkout_advanced:
@@ -313,7 +316,7 @@ jobs:
         type: integer
     executor:
       class: large
-      name: sb_node_16_browsers
+      name: sb_node_18_browsers
     parallelism: << parameters.parallelism >>
     steps:
       - git-shallow-clone/checkout_advanced:
@@ -392,7 +395,7 @@ jobs:
         type: integer
     executor:
       class: medium
-      name: sb_node_16_browsers
+      name: sb_node_18_browsers
     parallelism: << parameters.parallelism >>
     steps:
       - checkout
@@ -472,7 +475,6 @@ jobs:
           command: yarn upload-bench $(yarn get-template --cadence << pipeline.parameters.workflow >> --task bench)
       - report-workflow-on-failure:
           template: $(yarn get-template --cadence << pipeline.parameters.workflow >> --task bench)
-
 workflows:
   docs:
     when:

CHANGELOG.md

@@ -1,5 +1,11 @@
 ## 7.6.18
 
+- Core: Replace ip function to address security concerns [#27529](https://github.com/storybookjs/storybook/pull/27529), thanks @tony19 
+- Telemetry: Detect Node version [#28299](https://github.com/storybookjs/storybook/pull/28299), thanks @yannbf
+- Angular: Support v18 [#27237](https://github.com/storybookjs/storybook/pull/27237), thanks @valentinpalkovic
+
+## 7.6.18
+
 - Fix bad release in `7.6.18` thanks @jreinhold!
 
 ## 7.6.18

code/frameworks/angular/package.json

@@ -89,17 +89,17 @@
     "zone.js": "^0.13.0"
   },
   "peerDependencies": {
-    "@angular-devkit/architect": ">=0.1400.0 < 0.1800.0",
-    "@angular-devkit/build-angular": ">=14.1.0 < 18.0.0",
-    "@angular-devkit/core": ">=14.1.0 < 18.0.0",
-    "@angular/cli": ">=14.1.0 < 18.0.0",
-    "@angular/common": ">=14.1.0 < 18.0.0",
-    "@angular/compiler": ">=14.1.0 < 18.0.0",
-    "@angular/compiler-cli": ">=14.1.0 < 18.0.0",
-    "@angular/core": ">=14.1.0 < 18.0.0",
-    "@angular/forms": ">=14.1.0 < 18.0.0",
-    "@angular/platform-browser": ">=14.1.0 < 18.0.0",
-    "@angular/platform-browser-dynamic": ">=14.1.0 < 18.0.0",
+    "@angular-devkit/architect": ">=0.1400.0 < 0.1900.0",
+    "@angular-devkit/build-angular": ">=14.1.0 < 19.0.0",
+    "@angular-devkit/core": ">=14.1.0 < 19.0.0",
+    "@angular/cli": ">=14.1.0 < 19.0.0",
+    "@angular/common": ">=14.1.0 < 19.0.0",
+    "@angular/compiler": ">=14.1.0 < 19.0.0",
+    "@angular/compiler-cli": ">=14.1.0 < 19.0.0",
+    "@angular/core": ">=14.1.0 < 19.0.0",
+    "@angular/forms": ">=14.1.0 < 19.0.0",
+    "@angular/platform-browser": ">=14.1.0 < 19.0.0",
+    "@angular/platform-browser-dynamic": ">=14.1.0 < 19.0.0",
     "@babel/core": "*",
     "rxjs": "^6.0.0 || ^7.4.0",
     "typescript": "^4.0.0 || ^5.0.0",

code/lib/core-server/package.json

@@ -87,7 +87,6 @@
     "express": "^4.17.3",
     "fs-extra": "^11.1.0",
     "globby": "^11.0.2",
-    "ip": "^2.0.1",
     "lodash": "^4.17.21",
     "open": "^8.4.0",
     "pretty-hrtime": "^1.0.3",
@@ -105,7 +104,6 @@
   "devDependencies": {
     "@storybook/addon-docs": "workspace:*",
     "@types/compression": "^1.7.0",
-    "@types/ip": "^1.1.0",
     "@types/node-fetch": "^2.5.7",
     "@types/ws": "^8",
     "boxen": "^5.1.2",

code/lib/core-server/src/utils/__tests__/server-address.test.ts

@@ -1,12 +1,24 @@
-import ip from 'ip';
+import type { NetworkInterfaceInfoIPv4 } from 'os';
+import os from 'os';
 import { getServerAddresses } from '../server-address';
 
-jest.mock('ip');
-const mockedIp = ip as jest.Mocked<typeof ip>;
+jest.mock('os');
+const mockedOs = os as jest.Mocked<typeof os>;
 
 describe('getServerAddresses', () => {
+  const mockedNetworkAddress: NetworkInterfaceInfoIPv4 = {
+    address: '192.168.0.5',
+    netmask: '255.255.255.0',
+    family: 'IPv4',
+    mac: '01:02:03:0a:0b:0c',
+    internal: false,
+    cidr: '192.168.0.5/24',
+  };
+
   beforeEach(() => {
-    mockedIp.address.mockReturnValue('192.168.0.5');
+    mockedOs.networkInterfaces.mockReturnValue({
+      eth0: [mockedNetworkAddress],
+    });
   });
 
   it('builds addresses with a specified host', () => {
@@ -18,6 +30,15 @@ describe('getServerAddresses', () => {
   it('builds addresses with local IP when host is not specified', () => {
     const { address, networkAddress } = getServerAddresses(9009, '', 'http');
     expect(address).toEqual('http://localhost:9009/');
-    expect(networkAddress).toEqual('http://192.168.0.5:9009/');
+    expect(networkAddress).toEqual(`http://${mockedNetworkAddress.address}:9009/`);
+  });
+
+  it('builds addresses with default address when host is not specified and external IPv4 is not found', () => {
+    mockedOs.networkInterfaces.mockReturnValueOnce({
+      eth0: [{ ...mockedNetworkAddress, internal: true }],
+    });
+    const { address, networkAddress } = getServerAddresses(9009, '', 'http');
+    expect(address).toEqual('http://localhost:9009/');
+    expect(networkAddress).toEqual('http://0.0.0.0:9009/');
   });
 });

code/lib/core-server/src/utils/server-address.test.ts

@@ -1,7 +1,7 @@
 import detectPort from 'detect-port';
 import { getServerAddresses, getServerPort, getServerChannelUrl } from './server-address';
 
-jest.mock('ip');
+jest.mock('os');
 jest.mock('detect-port');
 jest.mock('@storybook/node-logger');
 

code/lib/core-server/src/utils/server-address.ts

@@ -1,4 +1,4 @@
-import ip from 'ip';
+import os from 'os';
 
 import { logger } from '@storybook/node-logger';
 import detectFreePort from 'detect-port';
@@ -10,7 +10,7 @@ export function getServerAddresses(
   initialPath?: string
 ) {
   const address = new URL(`${proto}://localhost:${port}/`);
-  const networkAddress = new URL(`${proto}://${host || ip.address()}:${port}/`);
+  const networkAddress = new URL(`${proto}://${host || getLocalIp()}:${port}/`);
 
   if (initialPath) {
     const searchParams = `?path=${decodeURIComponent(
@@ -35,3 +35,10 @@ export const getServerPort = (port?: number) =>
 export const getServerChannelUrl = (port: number, { https }: { https?: boolean }) => {
   return `${https ? 'wss' : 'ws'}://localhost:${port}/storybook-server-channel`;
 };
+
+const getLocalIp = () => {
+  const allIps = Object.values(os.networkInterfaces()).flat();
+  const allFilteredIps = allIps.filter((ip) => ip && ip.family === 'IPv4' && !ip.internal);
+
+  return allFilteredIps.length ? allFilteredIps[0]?.address : '0.0.0.0';
+};

code/lib/telemetry/src/storybook-metadata.ts

@@ -76,11 +76,11 @@ export const computeStorybookMetadata = async ({
 
   try {
     const packageManagerType = await detect({ cwd: getProjectRoot() });
-    const packageManagerVerson = await getNpmVersion(packageManagerType);
+    const packageManagerVersion = await getNpmVersion(packageManagerType);
 
     metadata.packageManager = {
       type: packageManagerType,
-      version: packageManagerVerson,
+      version: packageManagerVersion,
     };
     // Better be safe than sorry, some codebases/paths might end up breaking with something like "spawn pnpm ENOENT"
     // so we just set the package manager if the detection is successful

code/lib/telemetry/src/telemetry.ts

@@ -46,6 +46,7 @@ const globalContext = {
   inCI: Boolean(process.env.CI),
   isTTY: process.stdout.isTTY,
   platform: getOperatingSystem(),
+  nodeVersion: process.versions.node,
 } as Record<string, any>;
 
 const prepareRequest = async (data: TelemetryData, context: Record<string, any>, options: any) => {

code/package.json

@@ -295,6 +295,7 @@
     "type": "opencollective",
     "url": "https://opencollective.com/storybook"
   },
+  "deferredNextVersion": "7.6.20",
   "pr-log": {
     "skipLabels": [
       "cleanup"