[Snyk] Fix for 2 vulnerabilities

[snyk-bot]

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • packages/components/package.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	484/1000 Why? Has a fix available, CVSS 5.4	Open Redirect SNYK-JS-GOT-2932019	Yes	No Known Exploit
	551/1000 Why? Recently disclosed, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-MARKDOWNTOJSX-3310443	Yes	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: @storybook/addon-viewport

The new version differs by 250 commits.

• 829c72e v6.2.0
• f8bfee0 Update root, peer deps, version.ts/json to 6.2.0
• 2814acc CLI: Don't update versions.json on CLI prepare
• 637daa1 Update 6.2 changelog
• c760793 6.2 release
• 5595b1e Merge pull request #14348 from gabiseabra/fix/issue_13771
• a686a99 6.2.0-rc.13 next.json version file
• 6be8b92 Update git head to 6.2.0-rc.13
• c1dfd5b v6.2.0-rc.13
• 4ef7b5a Update root, peer deps, version.ts/json to 6.2.0-rc.13
• d954d50 6.2.0-rc.13 changelog
• 1913c92 Merge pull request #14390 from YozhEzhi/patch-1
• ee98e0e Merge branch 'next' of github.com:storybookjs/storybook into next
• a8aadc4 Update CHANGELOG.md
• 44eca58 Merge pull request #14392 from storybookjs/fix-raw-toggle
• f10ef90 Merge pull request #14391 from YozhEzhi/patch-3
• b1ee5e9 Prevent invalid initial color to be accepted as preset
• 2c6b796 Color picker can't deal with 'transparent' keyword
• 6951762 Don't show RAW toggle when data isn't representable by REJT
• 259b12a Update my-component-story-use-globaltype.js.mdx
• a8a846b Update my-component-story-use-globaltype.mdx.mdx
• 57fc3cd 6.2.0-rc.12 next.json version file
• ba0f535 Fix changelog
• 6ec5750 Update git head to 6.2.0-rc.12

See the full diff

Package name: @storybook/react

The new version differs by 250 commits.

• 829c72e v6.2.0
• f8bfee0 Update root, peer deps, version.ts/json to 6.2.0
• 2814acc CLI: Don't update versions.json on CLI prepare
• 637daa1 Update 6.2 changelog
• c760793 6.2 release
• 5595b1e Merge pull request #14348 from gabiseabra/fix/issue_13771
• a686a99 6.2.0-rc.13 next.json version file
• 6be8b92 Update git head to 6.2.0-rc.13
• c1dfd5b v6.2.0-rc.13
• 4ef7b5a Update root, peer deps, version.ts/json to 6.2.0-rc.13
• d954d50 6.2.0-rc.13 changelog
• 1913c92 Merge pull request #14390 from YozhEzhi/patch-1
• ee98e0e Merge branch 'next' of github.com:storybookjs/storybook into next
• a8aadc4 Update CHANGELOG.md
• 44eca58 Merge pull request #14392 from storybookjs/fix-raw-toggle
• f10ef90 Merge pull request #14391 from YozhEzhi/patch-3
• b1ee5e9 Prevent invalid initial color to be accepted as preset
• 2c6b796 Color picker can't deal with 'transparent' keyword
• 6951762 Don't show RAW toggle when data isn't representable by REJT
• 259b12a Update my-component-story-use-globaltype.js.mdx
• a8a846b Update my-component-story-use-globaltype.mdx.mdx
• 57fc3cd 6.2.0-rc.12 next.json version file
• ba0f535 Fix changelog
• 6ec5750 Update git head to 6.2.0-rc.12

See the full diff

Package name: np

The new version differs by 101 commits.

• c113539 8.0.0
• b2857a4 Update dependencies
• 9cb4bfd Add 2FA support for npm version 9+ ([Snyk] Security upgrade vscode from 1.1.6 to 1.1.37 #693)
• eba203f Improve startup: ensure `package.json` is only parsed once ([Snyk] Security upgrade rollup-plugin-sourcemaps from 0.4.2 to 0.6.0 #688)
• 42a5095 Use `renameFile` from `move-file` for `new-files` fixtures ([Snyk] Security upgrade vscode from 1.1.0 to 1.1.37 #687)
• a5d4c3d Fix remote history check - check if `git fetch` needs to be run ([Snyk] Security upgrade vscode from 1.0.1 to 1.1.37 #685)
• a6ce792 Get files to be packed via `npm pack --dry-run --json` ([Snyk] Security upgrade karma from 3.0.0 to 5.0.8 #682)
• 72879e0 Move to ESM, update dependencies ([Snyk] Security upgrade vscode from 1.1.17 to 1.1.37 #683)
• 6867fb9 Add check for new dependencies ([Snyk] Security upgrade parcel-bundler from 1.9.7 to 1.12.5 #681)
• 8fcca96 7.7.0
• a0a17fd Show new version in non-interactive mode ([Snyk] Security upgrade vscode from 1.0.3 to 1.1.37 #679)
• f992ec1 Fix typo ([Snyk] Security upgrade parcel-bundler from 1.9.7 to 1.12.5 #680)
• aa23a92 7.6.4
• e71f691 Fix UI prompt for new publicly scoped packages ([Snyk] Security upgrade @codesandbox/components from 0.0.3 to 0.0.4 #677)
• 3770647 Meta tweaks
• 62db480 Add "what np isn't" section to the readme ([Snyk] Security upgrade vscode from 1.0.1 to 1.1.37 #672)
• 9fb0128 7.6.3
• 0f5dd33 Fix npm 9 compatibility ([Snyk] Fix for 2 vulnerabilities #666)
• 95622c0 7.6.2
• 6c871f9 Work around npm bug with error reporting ([Snyk] Security upgrade lint-staged from 8.1.0 to 9.0.0 #645)
• 387dddc Fix tests
• 9b7df30 7.6.1
• 845db26 Meta tweaks
• 9cff6da Fix error "glob pattern string required" ([Snyk] Security upgrade karma from 3.0.0 to 5.0.8 #616)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Open Redirect
🦉 Regular Expression Denial of Service (ReDoS)