efbdee5508
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [storybook](https://storybook.js.org) ([source](https://redirect.github.com/storybookjs/storybook/tree/HEAD/code/core)) | [`10.1.5` -> `10.1.10`](https://renovatebot.com/diffs/npm/storybook/10.1.5/10.1.10) |  |  | ### GitHub Vulnerability Alerts #### [CVE-2025-68429](https://redirect.github.com/storybookjs/storybook/security/advisories/GHSA-8452-54wp-rmv6) On December 11th, the Storybook team received a responsible disclosure alerting them to a potential vulnerability in certain built and published Storybooks. The vulnerability is a bug in how Storybook handles environment variables defined in a `.env` file, which could, in specific circumstances, lead to those variables being unexpectedly bundled into the artifacts created by the `storybook build` command. When a built Storybook is published to the web, the bundle’s source is viewable, thus potentially exposing those variables to anyone with access. If those variables contained secrets, they should be considered compromised. ## Who is impacted? For a project to be vulnerable to this issue, it must: - Build the Storybook (i.e. run `storybook build` directly or indirectly) in a directory that contains a `.env` file (including variants like `.env.local`) - The `.env` file contains sensitive secrets - Use Storybook version `7.0.0` or above - Publish the built Storybook to the web Storybooks built without a `.env` file at build time are not affected, including common CI-based builds where secrets are provided via platform environment variables rather than `.env` files. Users' Storybook runtime environments (i.e. `storybook dev`) are not affected. Deployed applications that share a repo with a project's Storybook are not affected. Storybook 6 and below are not affected. ## Recommended actions First, Storybook recommends that everyone audit for any sensitive secrets provided via `.env` files and rotate those keys. Second, Storybook has released patched versions of all affected major Storybook versions that no longer have this vulnerability. Projects should upgrade their Storybook—on both local machines and CI environments—to one of these versions **before publishing again**. - `10.1.10+` - `9.1.17+` - `8.6.15+` - `7.6.21+` Finally, some projects may have been relying on the undocumented behavior at the heart of this issue and will need to change how they reference environment variables after this update. If a project can no longer read necessary environmental variable values, it can either prefix the variables with `STORYBOOK_` or use the [`env` property in Storybook’s configuration](https://storybook.js.org/docs/configure/environment-variables#using-storybook-configuration) to manually specify values. In either case, **do not** include sensitive secrets as they *will* be included in the built bundle. ## Further information Details of the vulnerability can be found on the [Storybook announcement](https://storybook.js.org/blog/security-advisory). --- ### Release Notes <details> <summary>storybookjs/storybook (storybook)</summary> ### [`v10.1.10`](https://redirect.github.com/storybookjs/storybook/blob/HEAD/CHANGELOG.md#10110) [Compare Source](https://redirect.github.com/storybookjs/storybook/compare/v10.1.9...v10.1.10) - Core: Fix `.env`-file parsing - [#​33383](https://redirect.github.com/storybookjs/storybook/pull/33383), thanks [@​JReinhold](https://redirect.github.com/JReinhold)! - Next.js: Handle v14 compatibility for draftMode import - [#​33341](https://redirect.github.com/storybookjs/storybook/pull/33341), thanks [@​tanujbhaud](https://redirect.github.com/tanujbhaud)! ### [`v10.1.9`](https://redirect.github.com/storybookjs/storybook/blob/HEAD/CHANGELOG.md#1019) [Compare Source](https://redirect.github.com/storybookjs/storybook/compare/v10.1.8...v10.1.9) - Telemetry: Remove instance of check for sub-error handling - [#​33356](https://redirect.github.com/storybookjs/storybook/pull/33356), thanks [@​valentinpalkovic](https://redirect.github.com/valentinpalkovic)! ### [`v10.1.8`](https://redirect.github.com/storybookjs/storybook/compare/v10.1.7...7cd0cbca4ee2f2c082c9876de2fb2feba6c12bbf) [Compare Source](https://redirect.github.com/storybookjs/storybook/compare/v10.1.7...v10.1.8) ### [`v10.1.7`](https://redirect.github.com/storybookjs/storybook/blob/HEAD/CHANGELOG.md#1017) [Compare Source](https://redirect.github.com/storybookjs/storybook/compare/v10.1.6...v10.1.7) - Automigrate: Fix missing await - [#​33333](https://redirect.github.com/storybookjs/storybook/pull/33333), thanks [@​valentinpalkovic](https://redirect.github.com/valentinpalkovic)! - CLI: Remove REACT\_PROJECT projectType - [#​33334](https://redirect.github.com/storybookjs/storybook/pull/33334), thanks [@​valentinpalkovic](https://redirect.github.com/valentinpalkovic)! - Core: Exclude open from pre-bundling to make local xdg-open reachable - [#​33325](https://redirect.github.com/storybookjs/storybook/pull/33325), thanks [@​Sidnioulz](https://redirect.github.com/Sidnioulz)! - Nextjs-Vite: Install `vite` during migration if not installed yet - [#​33316](https://redirect.github.com/storybookjs/storybook/pull/33316), thanks [@​ghengeveld](https://redirect.github.com/ghengeveld)! - Telemetry: Fix race condition in telemetry cache causing malformed JSON - [#​33323](https://redirect.github.com/storybookjs/storybook/pull/33323), thanks [@​valentinpalkovic](https://redirect.github.com/valentinpalkovic)! ### [`v10.1.6`](https://redirect.github.com/storybookjs/storybook/blob/HEAD/CHANGELOG.md#1016) [Compare Source](https://redirect.github.com/storybookjs/storybook/compare/v10.1.5...v10.1.6) - Manager: Do not display non-existing shortcuts in the settings page - [#​32711](https://redirect.github.com/storybookjs/storybook/pull/32711), thanks [@​DKER2](https://redirect.github.com/DKER2)! - Preview: Enforce inert body if manager is focus-trapped - [#​33186](https://redirect.github.com/storybookjs/storybook/pull/33186), thanks [@​Sidnioulz](https://redirect.github.com/Sidnioulz)! - Telemetry: Await pending operations in getLastEvents to prevent race conditions - [#​33285](https://redirect.github.com/storybookjs/storybook/pull/33285), thanks [@​valentinpalkovic](https://redirect.github.com/valentinpalkovic)! - UI: Fix keyboard navigation bug for "reset" option in `Select` - [#​33268](https://redirect.github.com/storybookjs/storybook/pull/33268), thanks [@​Sidnioulz](https://redirect.github.com/Sidnioulz)! </details> --- ### Configuration 📅 **Schedule**: Branch creation - "" (UTC), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/toeverything/AFFiNE). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0Mi41OS4wIiwidXBkYXRlZEluVmVyIjoiNDIuNTkuMCIsInRhcmdldEJyYW5jaCI6ImNhbmFyeSIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
AFFiNE.Pro
Write, Draw and Plan All at Once
A privacy-focused, local-first, open-source, and ready-to-use alternative for Notion & Miro.
One hyper-fused platform for wildly creative minds.
Special thanks to Blaze for their support of this project. They provide high-performance Apple Silicon macOS and Linux (AMD64 & ARM64) runners for GitHub Actions, greatly reducing our automated build times.
Getting started & staying tuned with us.
Star us, and you will receive all release notifications from GitHub without any delay!
What is AFFiNE
AFFiNE is an open-source, all-in-one workspace and an operating system for all the building blocks that assemble your knowledge base and much more -- wiki, knowledge management, presentation and digital assets. It's a better alternative to Notion and Miro.
Features
A true canvas for blocks in any form. Docs and whiteboard are now fully merged.
- Many editor apps claim to be a canvas for productivity, but AFFiNE is one of the very few which allows you to put any building block on an edgeless canvas -- rich text, sticky notes, any embedded web pages, multi-view databases, linked pages, shapes and even slides. We have it all.
Multimodal AI partner ready to kick in any work
- Write up professional work report? Turn an outline into expressive and presentable slides? Summary an article into a well-structured mindmap? Sorting your job plan and backlog for tasks? Or... draw and code prototype apps and web pages directly all with one prompt? With you, AFFiNE AI pushes your creativity to the edge of your imagination, just like Canvas AI to generate mind map for brainstorming.
Local-first & Real-time collaborative
- We love the idea of local-first that you always own your data on your disk, in spite of the cloud. Furthermore, AFFiNE supports real-time sync and collaborations on web and cross-platform clients.
Self-host & Shape your own AFFiNE
- You have the freedom to manage, self-host, fork and build your own AFFiNE. Plugin community and third-party blocks are coming soon. More tractions on Blocksuite. Check there to learn how to self-host AFFiNE.
Acknowledgement
“We shape our tools and thereafter our tools shape us”. A lot of pioneers have inspired us along the way, e.g.:
- Quip & Notion with their great concept of “everything is a block”
- Trello with their Kanban
- Airtable & Miro with their no-code programmable datasheets
- Miro & Whimiscal with their edgeless visual whiteboard
- Remote & Capacities with their object-based tag system
There is a large overlap of their atomic “building blocks” between these apps. They are not open source, nor do they have a plugin system like Vscode for contributors to customize. We want to have something that contains all the features we love and also goes one step even further.
Thanks for checking us out, we appreciate your interest and sincerely hope that AFFiNE resonates with you! 🎵 Checking https://affine.pro/ for more details ions.
Contributing
| Bug Reports | Feature Requests | Questions/Discussions | AFFiNE Community |
|---|---|---|---|
| Create a bug report | Submit a feature request | Check GitHub Discussion | Vist the AFFiNE Community |
| Something isn't working as expected | An idea for a new feature, or improvements | Discuss and ask questions | A place to ask, learn and engage with others |
Calling all developers, testers, tech writers and more! Contributions of all types are more than welcome, you can read more in docs/types-of-contributions.md. If you are interested in contributing code, read our docs/CONTRIBUTING.md and feel free to check out our GitHub issues to get stuck in to show us what you’re made of.
Before you start contributing, please make sure you have read and accepted our Contributor License Agreement. To indicate your agreement, simply edit this file and submit a pull request.
For bug reports, feature requests and other suggestions you can also create a new issue and choose the most appropriate template for your feedback.
For translation and language support you can visit our i18n General Space.
Looking for other ways to contribute and wondering where to start? Check out the AFFiNE Ambassador program, we work closely with passionate community members and provide them with a wide range of support and resources.
If you have questions, you are welcome to contact us. One of the best places to get more info and learn more is in the AFFiNE Community where you can engage with other like-minded individuals.
Templates
AFFiNE now provides pre-built templates from our team. Following are the Top 10 most popular templates among AFFiNE users,if you want to contribute, you can contribute your own template so other people can use it too.
- vision board template
- one pager template
- sample lesson plan math template
- grr lesson plan template free
- free editable lesson plan template for pre k
- high note collection planners
- digital planner
- ADHD Planner
- Reading Log
- Cornell Notes Template
Blog
Welcome to the AFFiNE blog section! Here, you’ll find the latest insights, tips, and guides on how to maximize your experience with AFFiNE and AFFiNE AI, the leading Canvas AI tool for flexible note-taking and creative organization.
- vision board template
- ai homework helper
- vision board maker
- itinerary template
- one pager template
- cornell notes template
- swot chart template
- apps like luna task
- note taking ai from rough notes to mind map
- canvas ai
- one pager
- SOP Template
- Chore Chart
Ecosystem
| Name | ||
|---|---|---|
| @affine/component | AFFiNE Component Resources |  |
| @toeverything/theme | AFFiNE theme |  |
Upstreams
We would also like to give thanks to open-source projects that make AFFiNE possible:
- Blocksuite - 💠 BlockSuite is the open-source collaborative editor project behind AFFiNE.
- OctoBase - 🐙 OctoBase is the open-source database behind AFFiNE, local-first, yet collaborative. A light-weight, scalable, data engine written in Rust.
- yjs - Fundamental support of CRDTs for our implementation on state management and data sync.
- electron - Build cross-platform desktop apps with JavaScript, HTML, and CSS.
- React - The library for web and native user interfaces.
- napi-rs - A framework for building compiled Node.js add-ons in Rust via Node-API.
- Jotai - Primitive and flexible state management for React.
- async-call-rpc - A lightweight JSON RPC client & server.
- Vite - Next generation frontend tooling.
- Other upstream dependencies.
Thanks a lot to the community for providing such powerful and simple libraries, so that we can focus more on the implementation of the product logic, and we hope that in the future our projects will also provide a more easy-to-use knowledge base for everyone.
Contributors
We would like to express our gratitude to all the individuals who have already contributed to AFFiNE! If you have any AFFiNE-related project, documentation, tool or template, please feel free to contribute it by submitting a pull request to our curated list on GitHub: awesome-affine.
Self-Host
Begin with Docker to deploy your own feature-rich, unrestricted version of AFFiNE. Our team is diligently updating to the latest version. For more information on how to self-host AFFiNE, please refer to our documentation.
Hiring
Some amazing companies, including AFFiNE, are looking for developers! Are you interested in joining AFFiNE or its partners? Check out our Discord channel for some of the latest jobs available.
Feature Request
For feature requests, please see community.affine.pro.
Building
Codespaces
From the GitHub repo main page, click the green "Code" button and select "Create codespace on master". This will open a new Codespace with the (supposedly auto-forked AFFiNE repo cloned, built, and ready to go.
Local
See BUILDING.md for instructions on how to build AFFiNE from source code.
Contributing
We welcome contributions from everyone. See docs/contributing/tutorial.md for details.
Thanks
Thanks to Chromatic for providing the visual testing platform that helps us review UI changes and catch visual regressions.
License
Editions
-
AFFiNE Community Edition (CE) is the current available version, it's free for self-host under the MIT license.
-
AFFiNE Enterprise Edition (EE) is yet to be published, it will have more advanced features and enterprise-oriented offerings, including but not exclusive to rebranding and SSO, advanced admin and audit, etc., you may refer to https://affine.pro/pricing for more information
See LICENSE for details.