Build: upgrade yarn

[ndelangen]

yarn upgrade

[socket-security]

Socket Security Pull Request Report

Dependency issues detected. If you merge this pull request, you will not be alerted to the instances of these issues again.

📜 Install scripts

Install scripts are run when the package is installed. The majority of malware in npm is hidden in install scripts.

Packages should not be running non-essential scripts during install and there are often solutions to problems people solve with install scripts that can be run at publish time instead.

Package	Script field	Source
esbuild@0.17.6 (upgraded)	postinstall	code/renderers/vue3/package.json via @digitak/esrun@3.2.19, @storybook/docs-tools@7.0.0-beta.43
puppeteer@18.2.1 (added)	postinstall	code/package.json via @storybook/addon-storyshots-puppeteer@6.5.16, code/addons/storyshots-puppeteer/package.json via @axe-core/puppeteer@4.6.0

⚠️ New author

A new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package.

Scrutinize new collaborator additions to packages because they now have the ability to publish code into your dependency tree. Packages should avoid frequent or unnecessary additions or changes to publishing rights.

Package	New Author	Previous Author	Source
preact@10.12.0 (upgraded)	drewigg	marvinhagemeister	code/package.json via @storybook/addon-storyshots@6.5.16, @storybook/addon-storyshots-puppeteer@6.5.16, @storybook/preact@6.5.16, code/addons/storyshots-core/package.json via preact-render-to-string@5.2.6, code/addons/storyshots-puppeteer/package.json via @storybook/addon-storyshots@7.0.0-beta.43, code/frameworks/preact-vite/package.json via @preact/preset-vite@2.5.0, @storybook/builder-vite@7.0.0-beta.43, @storybook/preact@7.0.0-beta.43, code/frameworks/preact-webpack5/package.json via @storybook/preact@7.0.0-beta.43, @storybook/preset-preact-webpack@7.0.0-beta.43, code/lib/builder-vite/package.json via @preact/preset-vite@2.5.0, code/presets/preact-webpack/package.json, code/renderers/preact/package.json

Pull request report summary

Issue	Status
Install scripts	⚠️ 2 issues
Native code	✅ 0 issues
Bin script confusion	✅ 0 issues
Bin script shell injection	✅ 0 issues
Shell access	✅ 0 issues
Uses eval	✅ 0 issues
Unresolved require	✅ 0 issues
Invalid package.json	✅ 0 issues
HTTP dependency	✅ 0 issues
Git dependency	✅ 0 issues
GitHub dependency	✅ 0 issues
New author	⚠️ 1 issue
Potential typo squat	✅ 0 issues
Known Malware	✅ 0 issues
Telemetry	✅ 0 issues
Protestware/Troll package	✅ 0 issues
AI detected malware	✅ 0 issues

Bot Commands

To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of package-name@version specifiers. e.g. @SocketSecurity ignore foo@1.0.0 bar@2.4.2

• @SocketSecurity ignore esbuild@0.17.6
• @SocketSecurity ignore puppeteer@18.2.1
• @SocketSecurity ignore preact@10.12.0

Powered by socket.dev