Skip to content

Resolve uuid Dependabot advisory#511

Merged
igorp1 merged 1 commit into
mainfrom
cursor/repository-vulnerabilities-check-612e
Jun 1, 2026
Merged

Resolve uuid Dependabot advisory#511
igorp1 merged 1 commit into
mainfrom
cursor/repository-vulnerabilities-check-612e

Conversation

@cursor

@cursor cursor Bot commented Jun 1, 2026

Copy link
Copy Markdown
Contributor

Summary

  • Adds a root Yarn resolution for uuid@11.1.1 to address GHSA-w5hq-g745-h8pq reported through Storybook's @storybook/addon-actions dependency chain.
  • Updates yarn.lock so Storybook resolves uuid to the patched version.

Why a resolution

  • Storybook 8.6.x still declares uuid@^9.0.0, while the advisory is patched in uuid@11.1.1.
  • The repo already has a root resolutions block, and this keeps the fix scoped without a Storybook major-version migration.

Verification

  • yarn why uuid
  • yarn npm audit --all --recursive --json (root: no remaining GHSA/advisory URLs; deprecation notices remain)
  • Example audits for examples/card-form-examples, examples/just-typescript, examples/payments-just-typescript, examples/react-app, and examples/next (no GHSA/advisory URLs)
  • yarn build-storybook
Open in Web View Automation 

Co-authored-by: Andreja Kogovsek <andrejak@users.noreply.github.com>
@igorp1 igorp1 marked this pull request as ready for review June 1, 2026 08:21
@igorp1 igorp1 requested a review from a team as a code owner June 1, 2026 08:21
@igorp1 igorp1 merged commit eef8b12 into main Jun 1, 2026
3 checks passed
@igorp1 igorp1 deleted the cursor/repository-vulnerabilities-check-612e branch June 1, 2026 08:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants