[Snyk] Fix for 1 vulnerabilities

[adamlaska]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • packages/components/package.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	658/1000 Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-SEMVER-3247795	Yes	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: @storybook/react

The new version differs by 250 commits.

• d0c1e8a v6.4.13
• ad95877 Update root, peer deps, version.ts/json to 6.4.13 [ci skip]
• 908cda1 6.4.13 changelog
• ee5c044 Merge pull request #17245 from storybookjs/fix-prettier-2-3-formatting-main
• c3311c0 Update snapshots
• a533573 Fix prettier 2.3 formatting on main
• 59b85c7 Merge pull request #17241 from storybookjs/17008-fix-staticdirs-favicon
• f2a7256 Merge pull request #17022 from Taillook/chore/react-dev-utils
• ec142c8 Merge pull request #17239 from storybookjs/16820-fix-prettier-transpilation
• de25e19 Merge pull request #17206 from storybookjs/angular/fix-angular-13.1
• 8fe4027 Merge pull request #17240 from storybookjs/15574-fix-namedexportsorder-warning
• 8346850 Merge pull request #17213 from storybookjs/16067-fix-manager-process
• 3a0fd74 Merge pull request #17244 from storybookjs/chore_docs_fix_composition_link
• 7e43adc Merge pull request #17224 from storybookjs/chore_docs_update_addons_install_docs
• 373ca10 Merge pull request #17221 from storybookjs/chore_docs_fix_addon_knowledge_base
• 1e1331d Merge pull request #17208 from storybookjs/chore_docs_updates_syntax_highlight_docs
• 00a6c36 Merge pull request #17203 from storybookjs/chore_fix_repro_docs
• f0a2216 6.4.12 latest.json version file
• 180e481 Update git head to 6.4.12, update yarn.lock
• 9ce1a3b v6.4.12
• b278a84 Update root, peer deps, version.ts/json to 6.4.12 [ci skip]
• 7610bf0 6.4.12 changelog
• 704d82a Update git head to 6.4.11, update yarn.lock
• dc7fc7b v6.4.11

See the full diff

Package name: chromatic

The new version differs by 250 commits.

• 6fbb083 Merge pull request [Snyk] Security upgrade @babel/preset-env from 7.9.6 to 7.22.6 #415 from chromaui/next
• c372e18 Merge pull request [Snyk] Fix for 1 vulnerabilities #393 from chromaui/tech/bundling
• da65e22 changelog update
• c836fbd Merge pull request [Snyk] Security upgrade tsdx from 0.6.1 to 0.14.0 #411 from chromaui/tech/improve-getstorybookinfo
• 487388a Merge pull request [Snyk] Security upgrade jest from 24.9.0 to 26.0.0 #412 from chromaui/tech/add-test-workflow_run
• 2609ef8 fix action
• 6fe9642 6.0.0-canary.13
• f001a72 simplify
• c29f7d0 add blanket handler (will fail) and add workflow yml
• 6e3e113 6.0.0-canary.12
• c15c320 fix
• 346a86a 6.0.0-canary.11
• f8613bf fix
• 591c7eb 6.0.0-canary.10
• 8208d09 use yarn list --pattern to get list of dependencies matching @ storybook and get that data to get viewLayer and addons.
• 193fcb0 add dev command
• 1078e57 switch to use bundling & upgrade dependencies
• b5d1bfc 5.10.1
• 055f0a6 5.10.1
• 63ab6c9 Merge pull request [Snyk] Security upgrade jest from 24.9.0 to 25.0.0 #404 from chromaui/fix-node-fetch
• 34bc1f7 Fix the version of `node-fetch` to `2.6.0` due to a bug in `2.6.3`
• 73e4d5f 5.10.0
• 703d8bb 5.10.0
• a93912b Merge pull request [Snyk] Security upgrade karma from 3.0.0 to 5.0.8 #392 from chromaui/turbosnap-absolute-paths

See the full diff

Package name: np

The new version differs by 101 commits.

• c113539 8.0.0
• b2857a4 Update dependencies
• 9cb4bfd Add 2FA support for npm version 9+ ([Snyk] Security upgrade vscode from 1.1.6 to 1.1.37 #693)
• eba203f Improve startup: ensure `package.json` is only parsed once ([Snyk] Security upgrade rollup-plugin-sourcemaps from 0.4.2 to 0.6.0 #688)
• 42a5095 Use `renameFile` from `move-file` for `new-files` fixtures ([Snyk] Security upgrade vscode from 1.1.0 to 1.1.37 #687)
• a5d4c3d Fix remote history check - check if `git fetch` needs to be run ([Snyk] Security upgrade vscode from 1.0.1 to 1.1.37 #685)
• a6ce792 Get files to be packed via `npm pack --dry-run --json` ([Snyk] Security upgrade karma from 3.0.0 to 5.0.8 #682)
• 72879e0 Move to ESM, update dependencies ([Snyk] Security upgrade vscode from 1.1.17 to 1.1.37 #683)
• 6867fb9 Add check for new dependencies ([Snyk] Security upgrade parcel-bundler from 1.9.7 to 1.12.5 #681)
• 8fcca96 7.7.0
• a0a17fd Show new version in non-interactive mode ([Snyk] Security upgrade vscode from 1.0.3 to 1.1.37 #679)
• f992ec1 Fix typo ([Snyk] Security upgrade parcel-bundler from 1.9.7 to 1.12.5 #680)
• aa23a92 7.6.4
• e71f691 Fix UI prompt for new publicly scoped packages ([Snyk] Security upgrade @codesandbox/components from 0.0.3 to 0.0.4 #677)
• 3770647 Meta tweaks
• 62db480 Add "what np isn't" section to the readme ([Snyk] Security upgrade vscode from 1.0.1 to 1.1.37 #672)
• 9fb0128 7.6.3
• 0f5dd33 Fix npm 9 compatibility ([Snyk] Fix for 2 vulnerabilities #666)
• 95622c0 7.6.2
• 6c871f9 Work around npm bug with error reporting ([Snyk] Security upgrade lint-staged from 8.1.0 to 9.0.0 #645)
• 387dddc Fix tests
• 9b7df30 7.6.1
• 845db26 Meta tweaks
• 9cff6da Fix error "glob pattern string required" ([Snyk] Security upgrade karma from 3.0.0 to 5.0.8 #616)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.