npm warnings about glob, rimraf and inflight, all caused by a too old version of jscodeshift in Storybook's dependencies

[robin-bourgeon-eficia]

Summary

Hello,
My project has "@storybook/cli": "^10.3.3" in its package.json. I did a fresh npm install after removing both package-lock.json and node_modules, and I am getting the following warnings about dependencies that are either not supported anymore, leaking memory, or containing vulnerabilities:

npm warn deprecated inflight@1.0.6: This module is not supported, and leaks memory. Do not use it. Check out lru-cache if you want a good and tested way to coalesce async requests by a key value, which is much more comprehensive and powerful.

npm warn deprecated rimraf@2.6.3: Rimraf versions prior to v4 are no longer supported

npm warn deprecated glob@7.2.3: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me

so I did a npm list -a to inspect the tree and see which dependencies of my project are importing inflight@1.0.6, rimraf@2.6.3, and glob@7.2.3.

It turns out that:

• inflight@1.0.6 is imported by glob@7.2.3
• glob@7.2.3 is imported by rimraf@2.6.3
• rimraf@2.6.3 is imported by temp@0.8.4
• temp@0.8.4 is imported by jscodeshift@0.15.2
• and finally, jscodeshift@0.15.2 is imported by @storybook/cli@10.3.3.

So it seems that the fact that @storybook/cli@10.3.3 imports jscodeshift@0.15.2 is the root cause of the warnings.

The latest version of jscodeshift does not import temp anymore, which can be seen here in the current package.json of jscodeshift: https://github.com/facebook/jscodeshift/blob/main/package.json

So, do you plan upgrading your dependency on jscodeshift to the latest version, which could potentially fix all these issues at once?

Additional information

No response

Create a reproduction

No response

[tamish-max]

Your dependency analysis looks right to me.

One nuance, though: this is in the CLI / codemod toolchain, not the Storybook runtime that serves your stories. So the install warnings are real, but they don’t necessarily mean your built Storybook is using those packages in production.

If you want a short-term workaround on your side, you can usually silence/modernize that subtree with package-manager overrides/resolutions.

But at the Storybook level, bumping jscodeshift (or otherwise trimming that old temp -> rimraf -> glob -> inflight chain) seems like the proper fix.

So I’d say:

• yes, your root-cause analysis seems correct
• yes, it would be worth Storybook updating that dependency chain
• but the impact is mainly on install-time tooling, not runtime Storybook execution

[mg1986jp]

Your dependency chain analysis is correct. jscodeshift@0.15.2 is the root cause.

These are just npm warnings though — glob@7, rimraf@2, and inflight still work fine, they're just not actively maintained. The "security vulnerabilities" npm mentions for glob are about ReDoS in edge cases that don't apply here since jscodeshift controls the glob patterns it passes.

For now you can suppress the warnings with:

npm install --no-warnings

or add to .npmrc:

loglevel=error

The actual fix has to come from the Storybook team bumping jscodeshift. jscodeshift is used for codemods (the migration scripts), so it's only pulled in by @storybook/cli — it doesn't run in your production build.

If the warnings bother you in CI, you can also use overrides in your package.json to force newer versions, but that might break Storybook's codemods if they rely on specific jscodeshift behavior:

{
  "overrides": {
    "jscodeshift": "17.1.2"
  }
}

Test your Storybook codemods after if you go that route.