Skip to content

Commit

Permalink
Remove @storybook/html peer dependency from root package.json and re-…
Browse files Browse the repository at this point in the history
…enable audit for prod (#1322)

# Pull Request

## 🤨 Rationale

Fixes #1317.

The `npm audit` of production dependencies was failing because of deps
that Storybook brought in. But Storybook should really be a dev
dependency.

Storybook is listed as a production dependency because it's in
`peerDependencies` in the root `package.json`. We added it there in
[this
commit](321cdd3)
of the PR that migrated us to Storybook 7. I believe the rationale was
that it was necessary to apply [a
patch](https://github.com/ni/nimble/blob/main/patches/%40storybook%2Bhtml%2B7.0.0.patch)
to the package. (I'd like to remove that patch but I think it's not
possible until storybookjs/storybook#22384 is
available. Currently it's only released in an alpha branch)

## 👩‍💻 Implementation

1. Remove `@storybook/html` from `peerDependencies` in the root
`package.json`
2. `git clean -fdx`
3. `npm install` to regenerate `package-lock.json`
4. Re-enable audit for all severity levels for prod dependencies

## 🧪 Testing

I locally verified that the patch was still applied to the file inside
node_modules. If it isn't applied, I believe we'd see a build error.

I locally verified that `npm audit --only=prod` succeeds now.

Otherwise relying on the PR build.

## ✅ Checklist

<!--- Review the list and put an x in the boxes that apply or ~~strike
through~~ around items that don't (along with an explanation). -->

- [ ] I have updated the project documentation to reflect my changes or
determined no changes are needed.
  • Loading branch information
jattasNI authored Jun 23, 2023
1 parent 12c7e16 commit b574fdf
Show file tree
Hide file tree
Showing 3 changed files with 584 additions and 196 deletions.
2 changes: 1 addition & 1 deletion .github/workflows/main.yml
Original file line number Diff line number Diff line change
Expand Up @@ -44,7 +44,7 @@ jobs:
- run: npm outdated || exit 0

# Audit
- run: npm audit --only=prod --audit-level=high
- run: npm audit --only=prod
# https://github.com/ni/nimble/issues/801
# - run: npm audit --audit-level=critical

Expand Down
Loading

0 comments on commit b574fdf

Please sign in to comment.