fix(deps): upgrade visual-chromatic tooling to clear the osv-scanner gate#197
Conversation
The `quality / quality` required check has been failing on `main` since 2026-07-24 at the `gate-deps osv-scanner` step. osv-scanner exits 1 on ANY finding, so every open dependabot PR in this repo is unmergeable until the whole set is clean -- no individual bump can turn the gate green. Closes the four open Dependabot alerts in tools/visual-chromatic: GHSA-3jxr-9vmj-r5cp brace-expansion 1.1.13 -> 5.0.8 (fix >=1.1.16) GHSA-4c8g-83qw-93j6 fast-uri 4.0.0 -> 4.1.1 (fix >=4.0.1) GHSA-v2hh-gcrm-f6hx fast-uri 4.0.0 -> 4.1.1 (fix >=4.1.1) GHSA-r28c-9q8g-f849 postcss 8.5.15 -> 8.5.23 (fix >=8.5.18) plus GHSA-mh99-v99m-4gvg, which osv-scanner reports but which has no Dependabot alert yet. It is only fixed in brace-expansion 5.0.8, so a `<2` bound is NOT sufficient -- hence the 5.x floor. Bounded floors (`>=X <NextMajor`), not exact pins: an exact pin freezes the package and blinds dependabot to future patches. The pre-existing entries in this overrides block were unbounded (`>=3.1.2`), which is how fast-uri drifted a whole major to 4.0.0; the three managed here now carry upper bounds. Verified locally (independent of CI): osv-scanner scan source --recursive ./tools/visual-chromatic -> No issues found npm ci --ignore-scripts -> 326 packages, 0 vulnerabilities
![sentry[bot]](https://avatars.githubusercontent.com/in/12637?s=60&v=4){kind=small}
| "overrides": { | ||
| "fast-uri": ">=3.1.2", | ||
| "postcss": ">=8.5.10", | ||
| "brace-expansion": ">=5.0.8 <6", |
There was a problem hiding this comment.
Bug: The brace-expansion override forces minimatch to load an incompatible ESM-only version, which will cause a build-time crash due to an ERR_REQUIRE_ESM error.
Severity: CRITICAL
Suggested Fix
Remove the "brace-expansion": ">=5.0.8 <6" override from package.json. This will allow npm to resolve a version of brace-expansion that is compatible with minimatch@3.1.5 (likely a 2.x version), which uses the CommonJS module system and avoids the ERR_REQUIRE_ESM error during the build.
Prompt for AI Agent
Review the code at the location below. A potential bug has been identified by an AI
agent. Verify if this is a real issue. If it is, propose a fix; if not, explain why it's
not valid.
Location: tools/visual-chromatic/package.json#L14
Potential issue: The `overrides` field in `package.json` forces `brace-expansion` to
version `5.0.8`, which is an ESM-only module. However, a dependency, `minimatch@3.1.5`,
is a CommonJS package that uses `require('brace-expansion')`. This mismatch will cause a
runtime error (`ERR_REQUIRE_ESM`) when `minimatch` is invoked, for example, by
`fork-ts-checker-webpack-plugin` during the Storybook/Chromatic build process. This will
lead to a build failure.
Did we get this right? 👍 / 👎 to inform future reviews.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b56f2c5520
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| "overrides": { | ||
| "fast-uri": ">=3.1.2", | ||
| "postcss": ">=8.5.10", | ||
| "brace-expansion": ">=5.0.8 <6", |
There was a problem hiding this comment.
The lock still installs minimatch 3.1.5, whose braceExpand() requires brace-expansion as a callable function and declares compatibility with ^1.1.7. Version 5 instead exports an object containing expand, so whenever the Storybook/fork-ts-checker dependency chain evaluates a brace glob such as **/*.{ts,tsx}, it throws TypeError: expand is not a function; npm ci alone does not exercise this. Upgrade or remove the minimatch 3 consumer, or avoid applying this incompatible override globally.
Useful? React with 👍 / 👎.
Supersedes the first attempt on this branch, which forced brace-expansion to
5.0.8 and was DEFECTIVE. Recording why, so it is not retried:
brace-expansion 5.x exports { EXPANSION_MAX, EXPANSION_MAX_LENGTH, expand }
with NO callable module and NO default export. minimatch 3.1.5 does
`require('brace-expansion')` and calls it, so forcing 5.x yields
`TypeError: expand is not a function` on any brace pattern. The osv gate
went green anyway because CI never evaluates a brace pattern -- a green
gate was hiding a real runtime break.
Root cause of the finding: GHSA-mh99-v99m-4gvg (CVE-2026-14257) has a single
affected range, `introduced: 0 / fixed: 5.0.8`. There is NO 1.x or 2.x patch,
so no in-major bump could ever clear it while minimatch 3.x is in the tree.
Real fix -- delete the vulnerable subtree instead of patching it. Adopting the
tooling bumps from #192 drops the whole legacy webpack chain
(fork-ts-checker-webpack-plugin -> minimatch ^3.0.4 -> brace-expansion):
@chromatic-com/playwright ^0.12.3 -> ^0.14.10
@playwright/test 1.58.2 -> 1.61.1
chromatic ^16.0.0 -> ^16.10.1
tree: 343 -> 113 packages
minimatch, brace-expansion, fast-uri, fork-ts-checker-webpack-plugin: ABSENT
That alone retires GHSA-3jxr-9vmj-r5cp, GHSA-mh99-v99m-4gvg, GHSA-4c8g-83qw-93j6
and GHSA-v2hh-gcrm-f6hx by removal. Two bounded floors cover the remainder,
which #192's stale lock still carried (postcss 8.5.16, esbuild 0.27.7):
postcss >=8.5.18 <9 (GHSA-r28c-9q8g-f849) -> resolves 8.5.23
esbuild >=0.28.1 <0.29 (GHSA-g7r4-m6w7-qqqr) -> resolves 0.28.1
Bounded floors, not exact pins -- an exact pin freezes the package and blinds
dependabot to future patches. The pre-existing unbounded entries are why
fast-uri drifted a whole major to 4.0.0.
No [[IgnoredVulns]] entry is added: the finding is fixed by upgrade, which is
what osv-scanner.toml's stated policy requires, and CLAUDE.md forbids
suppressions.
Verified locally, independent of CI:
osv-scanner scan source --config=osv-scanner.toml --recursive ./tools/visual-chromatic
-> No issues found (exit 0)
npm ci --ignore-scripts -> exit 0, found 0 vulnerabilities
Prekzursil
changed the title
| "overrides": { | ||
| "fast-uri": ">=3.1.2", | ||
| "postcss": ">=8.5.10", | ||
| "esbuild": ">=0.28.1 <0.29", |
There was a problem hiding this comment.
Bug: The esbuild override to version 0.28.1 is incompatible with the storybook dependency, which only supports esbuild up to version 0.27.0, risking build failures.
Severity: CRITICAL
Suggested Fix
Adjust the esbuild override in package.json to a version that is compatible with Storybook's declared dependency range. For example, use a version within the ^0.27.0 range to resolve the conflict while still addressing potential security concerns in older versions.
Prompt for AI Agent
Review the code at the location below. A potential bug has been identified by an AI
agent. Verify if this is a real issue. If it is, propose a fix; if not, explain why it's
not valid.
Location: tools/visual-chromatic/package.json#L14
Potential issue: The `package.json` override for `esbuild` forces version `0.28.1`. This
version is outside the declared compatibility range of a transitive dependency,
`storybook@10.2.13`, which only supports `esbuild` up to `^0.27.0`. This semantic
versioning violation introduces a risk of build failures or runtime errors in the visual
testing pipeline, as `esbuild@0.28.x` contains internal changes that may be incompatible
with Storybook's expectations. While local installation may succeed, the actual build
process used by Chromatic could fail.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: fb7a3c61d6
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| "overrides": { | ||
| "fast-uri": ">=3.1.2", | ||
| "postcss": ">=8.5.10", | ||
| "esbuild": ">=0.28.1 <0.29", |
There was a problem hiding this comment.
When e2e:chromatic exercises the adapter's bundled Storybook, this override forces esbuild 0.28.1 even though Storybook 10.2.13 explicitly supports only esbuild minors through 0.27 (package-lock.json:1501). Because esbuild's 0.x minor releases may contain breaking API changes, a successful npm ci does not validate this integration; use a patched supported 0.27 release or upgrade Storybook to a version that declares 0.28 compatibility.
Useful? React with 👍 / 👎.
1 participant
fix(deps): upgrade visual-chromatic tooling to clear the osv gate
Supersedes the first attempt on this branch, which forced brace-expansion to
5.0.8 and was DEFECTIVE. Recording why, so it is not retried:
brace-expansion 5.x exports { EXPANSION_MAX, EXPANSION_MAX_LENGTH, expand }
with NO callable module and NO default export. minimatch 3.1.5 does
require('brace-expansion')and calls it, so forcing 5.x yieldsTypeError: expand is not a functionon any brace pattern. The osv gatewent green anyway because CI never evaluates a brace pattern -- a green
gate was hiding a real runtime break.
Root cause of the finding: GHSA-mh99-v99m-4gvg (CVE-2026-14257) has a single
affected range,
introduced: 0 / fixed: 5.0.8. There is NO 1.x or 2.x patch,so no in-major bump could ever clear it while minimatch 3.x is in the tree.
Real fix -- delete the vulnerable subtree instead of patching it. Adopting the
tooling bumps from #192 drops the whole legacy webpack chain
(fork-ts-checker-webpack-plugin -> minimatch ^3.0.4 -> brace-expansion):
@chromatic-com/playwright ^0.12.3 -> ^0.14.10
@playwright/test 1.58.2 -> 1.61.1
chromatic ^16.0.0 -> ^16.10.1
tree: 343 -> 113 packages
minimatch, brace-expansion, fast-uri, fork-ts-checker-webpack-plugin: ABSENT
That alone retires GHSA-3jxr-9vmj-r5cp, GHSA-mh99-v99m-4gvg, GHSA-4c8g-83qw-93j6
and GHSA-v2hh-gcrm-f6hx by removal. Two bounded floors cover the remainder,
which #192's stale lock still carried (postcss 8.5.16, esbuild 0.27.7):
postcss >=8.5.18 <9 (GHSA-r28c-9q8g-f849) -> resolves 8.5.23
esbuild >=0.28.1 <0.29 (GHSA-g7r4-m6w7-qqqr) -> resolves 0.28.1
Bounded floors, not exact pins -- an exact pin freezes the package and blinds
dependabot to future patches. The pre-existing unbounded entries are why
fast-uri drifted a whole major to 4.0.0.
No [[IgnoredVulns]] entry is added: the finding is fixed by upgrade, which is
what osv-scanner.toml's stated policy requires, and CLAUDE.md forbids
suppressions.
Verified locally, independent of CI:
osv-scanner scan source --config=osv-scanner.toml --recursive ./tools/visual-chromatic
-> No issues found (exit 0)
npm ci --ignore-scripts -> exit 0, found 0 vulnerabilities