Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Release 0.1.0 #11

Merged
merged 32 commits into from
Apr 3, 2023
Merged

Release 0.1.0 #11

merged 32 commits into from
Apr 3, 2023

Conversation

shilman
Copy link
Member

@shilman shilman commented Apr 3, 2023 •
edited
Loading

For SB7.0 release

Version

Published prerelease version: v0.0.1-next.7

Changelog

🐛 Bug Fix

⚠️ Pushed to next

Authors: 3

shilman and others added 30 commits April 15, 2022 19:08
@shilman
Initial commit
fdd9b7a
@shilman
Update release.yml
e6d40d7
@shilman
Add imports analysis
a764a50
@shilman
Remove main entry
9752632
@shilman
Fix Esm support
954724c
@shilman
import ESM modules, not require
c8d4555
@shilman
Add CJS/ESM boundary to package
9f6ff3b
@shilman
Remove type module
84e0610
@shilman
Only build ESM
4e28165
@shilman
Add import file extensions to dist
7082011
@shilman
type module + fix jest
1f3265d
@shilman
Add getTraverse helper to fix type module shenanigans
4bea5cc
@shilman
Modern esm
9a7e7e1
@shilman
Include index.mjs
197a63f
@shilman
Fix MDX comments error
b140761
@tmeasday
Add support for name and isTemplate
12433cf
@tmeasday
Fix test via cloneDeep
5adaa89
@shilman
Merge pull request #1 from storybookjs/initial-release
18cf480 
Initial implementation
@shilman
Merge pull request #2 from storybookjs/modern-esm
afad06b 
Modern ESM
@shilman
Merge branch 'next' into tom/sb-449-index-update-generation-to-produce
c25ec0c
@shilman
Update snapshots
23e16c8
@shilman
Merge pull request #3 from storybookjs/tom/sb-449-index-update-genera…
a7d2714 
…tion-to-produce

Add support for `name` and `isTemplate`
@shilman
Fix yarn pnp by depending on babel/types
c6b5d29
@shilman
Merge pull request #4 from storybookjs/shilman/fix-yarn-pnp
ff8b788 
Fix yarn pnp by depending on babel/types
@shilman
Convert build to tsup
d7a568f
@shilman
Merge pull request #5 from storybookjs/shilman/convert-to-tsup
41d8ee2 
Convert build to tsup
@shilman
Fix imports spread across multiple blocks
302087f
@shilman
Merge pull request #7 from storybookjs/shilman/6-fix-multi-block-imports
734515b 
Fix imports spread across multiple blocks
@Dschungelabenteuer
Fixed exported named declarations causing @storybook/docs-mdx to throw
84af72b
@shilman
Merge pull request #9 from Dschungelabenteuer/fix-export-named-declar…
097fd53 
…ations

Fixed exported named declarations causing @storybook/docs-mdx to throw
@socket-security
Copy link

New dependency changes detected. Learn more about Socket for GitHub ↗︎

🚨 Potential security issues found in this pull request. To accept the risk, merge this PR and you will not be notified again.

Bot Commands

To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of package-name@version specifiers. e.g. @SocketSecurity ignore foo@1.0.0 bar@* or ignore all packages with @SocketSecurity ignore-all

  • @SocketSecurity ignore esbuild@0.15.14
  • @SocketSecurity ignore jest@27.0.6
  • @SocketSecurity ignore jest-cli@27.0.6
  • @SocketSecurity ignore @auto-it/core@10.29.2
  • @SocketSecurity ignore @auto-it/npm@10.29.2
  • @SocketSecurity ignore babel-plugin-istanbul@6.0.0
  • @SocketSecurity ignore browserslist@4.20.2
  • @SocketSecurity ignore cross-spawn@7.0.3
  • @SocketSecurity ignore execa@4.1.0
  • @SocketSecurity ignore execa@5.1.1
  • @SocketSecurity ignore gitlog@4.0.4
  • @SocketSecurity ignore husky@7.0.4
  • @SocketSecurity ignore jest-haste-map@27.0.6
  • @SocketSecurity ignore jest-worker@27.0.6
  • @SocketSecurity ignore jsdom@16.6.0
  • @SocketSecurity ignore mz@2.7.0
  • @SocketSecurity ignore requireg@0.2.2
  • @SocketSecurity ignore tree-kill@1.2.2
  • @SocketSecurity ignore ajv@6.12.6
  • @SocketSecurity ignore expect@27.0.6
  • @SocketSecurity ignore jest-circus@27.0.6
  • @SocketSecurity ignore jest-jasmine2@27.0.6
  • @SocketSecurity ignore jest-message-util@27.0.6
  • @SocketSecurity ignore jest-snapshot@27.0.6
  • @SocketSecurity ignore js-yaml@3.14.1
  • @SocketSecurity ignore load-tsconfig@0.2.3
  • @SocketSecurity ignore lodash@4.17.21
  • @SocketSecurity ignore object-inspect@1.12.0
  • @SocketSecurity ignore prettier@2.3.1
  • @SocketSecurity ignore pretty-format@27.4.2
  • @SocketSecurity ignore rollup@3.3.0
  • @SocketSecurity ignore tsup@6.5.0
  • @SocketSecurity ignore uvu@0.5.3
  • @SocketSecurity ignore await-to-js@3.0.0
  • @SocketSecurity ignore bottleneck@2.19.5
  • @SocketSecurity ignore merge-stream@2.0.0
  • @SocketSecurity ignore @babel/plugin-syntax-import-meta@7.10.4
  • @SocketSecurity ignore @babel/plugin-syntax-logical-assignment-operators@7.10.4
  • @SocketSecurity ignore @babel/plugin-syntax-numeric-separator@7.10.4
  • @SocketSecurity ignore form-data@3.0.1
  • @SocketSecurity ignore tough-cookie@4.0.0
  • @SocketSecurity ignore source-map@0.8.0-beta.0
  • @SocketSecurity ignore source-map@0.5.7
  • @SocketSecurity ignore is-glob@4.0.1
  • @SocketSecurity ignore unicode-canonical-property-names-ecmascript@2.0.0
  • @SocketSecurity ignore unicode-match-property-ecmascript@2.0.0
  • @SocketSecurity ignore unicode-match-property-value-ecmascript@2.0.0
  • @SocketSecurity ignore unicode-property-aliases-ecmascript@2.0.0
  • @SocketSecurity ignore signale@1.4.0
  • @SocketSecurity ignore ms@2.1.2
📜 Install scripts

Install scripts are run when the package is installed. The majority of malware in npm is hidden in install scripts.

Packages should not be running non-essential scripts during install and there are often solutions to problems people solve with install scripts that can be run at publish time instead.

Package Script field Source
esbuild@0.15.14 (added) postinstall package.json via tsup@6.5.0
😵‍💫 Bin script confusion

This package has multiple bin scripts with the same name. This can cause non-deterministic behavior when installing or could be a sign of a supply chain attack

Consider removing one of the conflicting packages. Packages should only export bin scripts with their name

Package Bin script Source
jest@27.0.6 (added) jest package.json via ts-jest@27.0.4
jest-cli@27.0.6 (added) jest package.json via jest@27.0.6, ts-jest@27.0.4
⚠️ Shell access

This module accesses the system shell. Accessing the system shell increases the risk of executing arbitrary code.

Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced.

Package Module Location Source
@auto-it/core@10.29.2 (added) child_process dist/tests/auto-make-changelog.test.js package.json via auto@10.29.2
@auto-it/core@10.29.2 (added) child_process dist/tests/auto.test.js package.json via auto@10.29.2
@auto-it/core@10.29.2 (added) child_process dist/tests/get-remote.test.js package.json via auto@10.29.2
@auto-it/core@10.29.2 (added) child_process dist/tests/release.test.js package.json via auto@10.29.2
@auto-it/core@10.29.2 (added) child_process dist/auto.js package.json via auto@10.29.2
@auto-it/core@10.29.2 (added) child_process dist/release.js package.json via auto@10.29.2
@auto-it/core@10.29.2 (added) child_process dist/utils/tests/load-plugin.test.js package.json via auto@10.29.2
@auto-it/core@10.29.2 (added) child_process dist/utils/tests/verify-auth.test.js package.json via auto@10.29.2
@auto-it/core@10.29.2 (added) child_process dist/utils/exec-promise.js package.json via auto@10.29.2
@auto-it/core@10.29.2 (added) child_process dist/utils/get-current-branch.js package.json via auto@10.29.2
@auto-it/core@10.29.2 (added) child_process dist/utils/load-plugins.js package.json via auto@10.29.2
@auto-it/core@10.29.2 (added) child_process dist/utils/verify-auth.js package.json via auto@10.29.2
@auto-it/npm@10.29.2 (added) child_process dist/index.js package.json via auto@10.29.2
babel-plugin-istanbul@6.0.0 (added) child_process lib/index.js package.json via babel-jest@27.0.6, jest@27.0.6, ts-jest@27.0.4
browserslist@4.20.2 (added) child_process update-db.js package.json via @babel/preset-env@7.16.11
cross-spawn@7.0.3 (added) child_process index.js package.json via auto@10.29.2, jest@27.0.6, lint-staged@12.3.4, ts-jest@27.0.4, tsup@6.5.0
esbuild@0.15.14 (added) child_process install.js package.json via tsup@6.5.0
esbuild@0.15.14 (added) child_process lib/main.js package.json via tsup@6.5.0
execa@4.1.0 (added) child_process index.js package.json via auto@10.29.2
execa@5.1.1 (added) child_process index.js package.json via jest@27.0.6, lint-staged@12.3.4, ts-jest@27.0.4, tsup@6.5.0
gitlog@4.0.4 (added) child_process dist/gitlog.cjs.development.js package.json via auto@10.29.2
gitlog@4.0.4 (added) child_process dist/gitlog.cjs.production.min.js package.json via auto@10.29.2
gitlog@4.0.4 (added) child_process dist/gitlog.esm.js package.json via auto@10.29.2
husky@7.0.4 (added) child_process lib/index.js package.json
jest-haste-map@27.0.6 (added) child_process build/crawlers/node.js package.json via babel-jest@27.0.6, jest@27.0.6, ts-jest@27.0.4
jest-haste-map@27.0.6 (added) child_process build/index.js package.json via babel-jest@27.0.6, jest@27.0.6, ts-jest@27.0.4
jest-worker@27.0.6 (added) child_process build/workers/ChildProcessWorker.js package.json via babel-jest@27.0.6, jest@27.0.6, ts-jest@27.0.4
jsdom@16.6.0 (added) child_process lib/jsdom/living/xhr/XMLHttpRequest-impl.js package.json via jest@27.0.6, jest-environment-jsdom@27.0.6, ts-jest@27.0.4
mz@2.7.0 (added) child_process child_process.js package.json via tsup@6.5.0
requireg@0.2.2 (added) child_process lib/resolvers.js package.json via auto@10.29.2
tree-kill@1.2.2 (added) child_process index.js package.json via concurrently@7.0.0, tsup@6.5.0
⚠️ Uses eval

Package uses eval() which is a dangerous function. This prevents the code from running in certain environments and increases the risk that the code may contain exploits or malicious behavior.

Avoid packages that use eval, since this could potentially execute any code.

Package Eval Type Location Source
ajv@6.12.6 (added) Function dist/ajv.bundle.js package.json via babel-loader@8.2.2
ajv@6.12.6 (added) Function lib/compile/index.js package.json via babel-loader@8.2.2
expect@27.0.6 (added) Function build/asymmetricMatchers.js package.json via jest@27.0.6, ts-jest@27.0.4
expect@27.0.6 (added) Function build/index.js package.json via jest@27.0.6, ts-jest@27.0.4
expect@27.0.6 (added) Function build/index.js package.json via jest@27.0.6, ts-jest@27.0.4
expect@27.0.6 (added) Function build/index.js package.json via jest@27.0.6, ts-jest@27.0.4
expect@27.0.6 (added) Function build/jestMatchersObject.js package.json via jest@27.0.6, ts-jest@27.0.4
expect@27.0.6 (added) Function build/utils.js package.json via jest@27.0.6, ts-jest@27.0.4
jest-circus@27.0.6 (added) Function build/eventHandler.js package.json via jest@27.0.6, ts-jest@27.0.4
jest-circus@27.0.6 (added) Function build/eventHandler.js package.json via jest@27.0.6, ts-jest@27.0.4
jest-circus@27.0.6 (added) Function build/eventHandler.js package.json via jest@27.0.6, ts-jest@27.0.4
jest-circus@27.0.6 (added) Function build/types.js package.json via jest@27.0.6, ts-jest@27.0.4
jest-circus@27.0.6 (added) Function build/utils.js package.json via jest@27.0.6, ts-jest@27.0.4
jest-circus@27.0.6 (added) Function build/utils.js package.json via jest@27.0.6, ts-jest@27.0.4
jest-circus@27.0.6 (added) Function build/utils.js package.json via jest@27.0.6, ts-jest@27.0.4
jest-circus@27.0.6 (added) Function build/utils.js package.json via jest@27.0.6, ts-jest@27.0.4
jest-circus@27.0.6 (added) Function build/utils.js package.json via jest@27.0.6, ts-jest@27.0.4
jest-jasmine2@27.0.6 (added) Function build/jasmineAsyncInstall.js package.json via jest@27.0.6, ts-jest@27.0.4
jest-jasmine2@27.0.6 (added) Function build/jasmineAsyncInstall.js package.json via jest@27.0.6, ts-jest@27.0.4
jest-jasmine2@27.0.6 (added) Function build/jasmineAsyncInstall.js package.json via jest@27.0.6, ts-jest@27.0.4
jest-message-util@27.0.6 (added) Function build/index.js package.json via jest@27.0.6, jest-environment-jsdom@27.0.6, ts-jest@27.0.4
jest-message-util@27.0.6 (added) Function build/index.js package.json via jest@27.0.6, jest-environment-jsdom@27.0.6, ts-jest@27.0.4
jest-message-util@27.0.6 (added) Function build/index.js package.json via jest@27.0.6, jest-environment-jsdom@27.0.6, ts-jest@27.0.4
jest-snapshot@27.0.6 (added) Function build/index.js package.json via jest@27.0.6, ts-jest@27.0.4
jest-snapshot@27.0.6 (added) Function build/index.js package.json via jest@27.0.6, ts-jest@27.0.4
jest-snapshot@27.0.6 (added) Function build/index.js package.json via jest@27.0.6, ts-jest@27.0.4
jest-snapshot@27.0.6 (added) Function build/InlineSnapshots.js package.json via jest@27.0.6, ts-jest@27.0.4
jest-snapshot@27.0.6 (added) Function build/InlineSnapshots.js package.json via jest@27.0.6, ts-jest@27.0.4
jest-snapshot@27.0.6 (added) Function build/InlineSnapshots.js package.json via jest@27.0.6, ts-jest@27.0.4
jest-snapshot@27.0.6 (added) Function build/InlineSnapshots.js package.json via jest@27.0.6, ts-jest@27.0.4
jest-snapshot@27.0.6 (added) Function build/InlineSnapshots.js package.json via jest@27.0.6, ts-jest@27.0.4
jest-snapshot@27.0.6 (added) Function build/State.js package.json via jest@27.0.6, ts-jest@27.0.4
jest-snapshot@27.0.6 (added) Function build/State.js package.json via jest@27.0.6, ts-jest@27.0.4
jest-snapshot@27.0.6 (added) Function build/State.js package.json via jest@27.0.6, ts-jest@27.0.4
jest-snapshot@27.0.6 (added) Function build/utils.js package.json via jest@27.0.6, ts-jest@27.0.4
jest-snapshot@27.0.6 (added) Function build/utils.js package.json via jest@27.0.6, ts-jest@27.0.4
jest-snapshot@27.0.6 (added) Function build/utils.js package.json via jest@27.0.6, ts-jest@27.0.4
jest-snapshot@27.0.6 (added) Function build/utils.js package.json via jest@27.0.6, ts-jest@27.0.4
jest-snapshot@27.0.6 (added) Function build/utils.js package.json via jest@27.0.6, ts-jest@27.0.4
jest-snapshot@27.0.6 (added) Function build/utils.js package.json via jest@27.0.6, ts-jest@27.0.4
jest-snapshot@27.0.6 (added) Function build/utils.js package.json via jest@27.0.6, ts-jest@27.0.4
jest-snapshot@27.0.6 (added) Function build/utils.js package.json via jest@27.0.6, ts-jest@27.0.4
js-yaml@3.14.1 (added) Function dist/js-yaml.js package.json via babel-jest@27.0.6, jest@27.0.6, ts-jest@27.0.4
js-yaml@3.14.1 (added) Function dist/js-yaml.js package.json via babel-jest@27.0.6, jest@27.0.6, ts-jest@27.0.4
js-yaml@3.14.1 (added) Function lib/js-yaml/type/js/function.js package.json via babel-jest@27.0.6, jest@27.0.6, ts-jest@27.0.4
js-yaml@3.14.1 (added) Function lib/js-yaml/type/js/function.js package.json via babel-jest@27.0.6, jest@27.0.6, ts-jest@27.0.4
jsdom@16.6.0 (added) Function lib/jsdom/living/helpers/create-event-accessor.js package.json via jest@27.0.6, jest-environment-jsdom@27.0.6, ts-jest@27.0.4
jsdom@16.6.0 (added) Function lib/jsdom/vm-shim.js package.json via jest@27.0.6, jest-environment-jsdom@27.0.6, ts-jest@27.0.4
load-tsconfig@0.2.3 (added) Function dist/index.cjs package.json via tsup@6.5.0
load-tsconfig@0.2.3 (added) Function dist/index.js package.json via tsup@6.5.0
lodash@4.17.21 (added) Function _root.js package.json via concurrently@7.0.0, jest@27.0.6, jest-environment-jsdom@27.0.6, ts-jest@27.0.4
lodash@4.17.21 (added) Function template.js package.json via concurrently@7.0.0, jest@27.0.6, jest-environment-jsdom@27.0.6, ts-jest@27.0.4
object-inspect@1.12.0 (added) Function test/bigint.js package.json via lint-staged@12.3.4
object-inspect@1.12.0 (added) Function test/bigint.js package.json via lint-staged@12.3.4
object-inspect@1.12.0 (added) Function test/bigint.js package.json via lint-staged@12.3.4
prettier@2.3.1 (added) Function bin-prettier.js package.json
prettier@2.3.1 (added) Function bin-prettier.js package.json
prettier@2.3.1 (added) Function esm/parser-typescript.mjs package.json
prettier@2.3.1 (added) Function esm/standalone.mjs package.json
prettier@2.3.1 (added) Function index.js package.json
prettier@2.3.1 (added) Function index.js package.json
prettier@2.3.1 (added) Function index.js package.json
prettier@2.3.1 (added) Function standalone.js package.json
pretty-format@27.4.2 (added) Function build/plugins/AsymmetricMatcher.js package.json via @types/jest@27.0.3, jest@27.0.6, jest-environment-jsdom@27.0.6, ts-jest@27.0.4
pretty-format@27.4.2 (added) Function build/plugins/ReactTestComponent.js package.json via @types/jest@27.0.3, jest@27.0.6, jest-environment-jsdom@27.0.6, ts-jest@27.0.4
rollup@3.3.0 (added) Function dist/shared/loadConfigFile.js package.json via tsup@6.5.0
rollup@3.3.0 (added) Function dist/shared/loadConfigFile.js package.json via tsup@6.5.0
tsup@6.5.0 (added) Function dist/chunk-EBJAWNYG.js package.json
tsup@6.5.0 (added) Function dist/rollup.js package.json
uvu@0.5.3 (added) Function bin.js package.json via @mdx-js/mdx@2.0.0, hast-util-to-estree@2.0.2
uvu@0.5.3 (added) Function bin.js package.json via @mdx-js/mdx@2.0.0, hast-util-to-estree@2.0.2
await-to-js@3.0.0 (added) eval dist/docs/assets/js/main.js package.json via auto@10.29.2
await-to-js@3.0.0 (added) eval dist/docs/assets/js/main.js package.json via auto@10.29.2
bottleneck@2.19.5 (added) eval lib/RedisConnection.js package.json via auto@10.29.2
⚠️ New author

A new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package.

Scrutinize new collaborator additions to packages because they now have the ability to publish code into your dependency tree. Packages should avoid frequent or unnecessary additions or changes to publishing rights.

Package New Author Previous Author Source
merge-stream@2.0.0 (added) stevemao shinnn package.json via auto@10.29.2, babel-jest@27.0.6, jest@27.0.6, lint-staged@12.3.4, ts-jest@27.0.4, tsup@6.5.0
@babel/plugin-syntax-import-meta@7.10.4 (added) jlhwung nicolo-ribaudo package.json via babel-jest@27.0.6, jest@27.0.6, ts-jest@27.0.4
@babel/plugin-syntax-logical-assignment-operators@7.10.4 (added) jlhwung nicolo-ribaudo package.json via @babel/preset-env@7.16.11, babel-jest@27.0.6, jest@27.0.6, ts-jest@27.0.4
@babel/plugin-syntax-numeric-separator@7.10.4 (added) jlhwung nicolo-ribaudo package.json via @babel/preset-env@7.16.11, babel-jest@27.0.6, jest@27.0.6, ts-jest@27.0.4
form-data@3.0.1 (added) niftylettuce alexindigo package.json via jest@27.0.6, jest-environment-jsdom@27.0.6, ts-jest@27.0.4
tough-cookie@4.0.0 (added) awaterma jstash [package.json](https://github.com/storybookjs/docs-mdx/pull/11/files#diff-7ae45ad102eab3b6d7e7896acd08c427a9b25b3

@shilman shilman changed the title Release 1.0.0 Release 0.1.0 Apr 3, 2023
@shilman shilman added the minor Increment the minor version when merged label Apr 3, 2023
@shilman shilman merged commit 3c9156a into main Apr 3, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
maintenance minor Increment the minor version when merged
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@shilman @tmeasday @Dschungelabenteuer