Add Storybook lockfile example and verified case study#474
Conversation
|
@sonukapoor — conflicts with main (after #475 merged) are resolved. Merged latest main into ayush4; Storybook content is unchanged, and both Storybook + Turborepo are wired in the shared docs. Ready for review and merge. Thanks! |
sonukapoor
left a comment
There was a problem hiding this comment.
The case study content is solid - good verified data, the yarn npm audit comparison (3 vs 92) tells a strong story about what lockfile-wide scanning reveals that default audit scope misses entirely.
Two things before this merges:
Logo should be bundled locally. The current img src points to raw.githubusercontent.com/storybookjs/brand/.... That URL can change or break when the upstream brand repo gets reorganised. The VS Code case study in #484 shows the right pattern - bundle the logo under website/static/img/ and reference it with a site-relative path like /cve-lite-cli/img/storybook-logo.svg. Would be good to match that approach here.
The last commit includes a Cursor co-author line. Co-authored-by: Cursor <cursoragent@cursor.com> will land in git history on merge. Worth squashing that commit into the one before it to keep the history clean. The content is fine - just the attribution.
Pin storybookjs/storybook@cc19ae1 Yarn Berry lockfile (3,008 packages, 92 findings) with CVE Lite vs yarn npm audit comparison. Bundle Storybook wordmark under website/static/img/ and wire docs sidebar, README, examples readme, CHANGELOG, and docs index alongside merged VS Code case study. Closes OWASP#465
|
@sonukapoor — both review items addressed:
Also rebased onto current Ready for re-review. |
Closes #465
Summary
examples/storybook/withpackage.jsonandyarn.lockpinned to storybookjs/storybook@cc19ae1website/docs/case-studies/storybook.mdwith verified baseline scan results (CVE Lite CLI v1.18.0)yarn npm auditon the same lockfile (3 entries vs 92 unique CVE Lite findings across 3,008 packages)Scope note
Documentation and example fixture only — no scanner source changes.