histoire-dev / histoire-dev/histoire

Warning in build = Use of eval in flexsearch

Open
#646 2 comments 1 reaction 0 assignees View on GitHub
to triage
Dominant language
TypeScript
Stars
3.6k
Forks
212
PR merge metrics
No merged PRs in 30d

Description

### Describe the bug

When I build my Histoire stories I get the following warning.
Use of eval in "node_modules/flexsearch/dist/flexsearch.bundle.js" is strongly discouraged as it poses security risks and may cause issues with minification.
Flexsearch is included in my bundle because Histoire requires it. I have no other packages that require flexsearch. Because of this warning I can no longer add the Histoire build to my Github actions.

### Reproduction

https://stackblitz.com/edit/histoire-vue3-starter-h4ejvh?file=package.json
If I use the Vue starter exactly as it is now and run `npm run story:build` I get this warning.

### Used Package Manager

npm

### Validations

- [X] Follow our [Code of Conduct](https://github.com/histoire-dev/histoire/blob/main/CODE_OF_CONDUCT.md)
- [X] Read the [Contributing Guidelines](https://github.com/histoire-dev/histoire/blob/main/CONTRIBUTING.md).
- [X] Read the [docs](https://histoire.dev/guide/).
- [X] Check that there isn't [already an issue](https://github.com/histoire-dev/histoire/issues) that reports the same bug to avoid creating a duplicate.
- [X] Check that this is a concrete bug. For Q&A open a [GitHub Discussion](https://github.com/histoire-dev/histoire/discussions).
- [X] The provided reproduction is a [minimal reproducible example](https://stackoverflow.com/help/minimal-reproducible-example) of the bug.

Contributor guide

Open the contributing guide

Research direction

Start with the StackBlitz reproduction and its package.json, then run npm run story:build to confirm the flexsearch eval warning. Trace how Histoire brings flexsearch into the build and identify a project-level change that removes or prevents the warning. Done means the reproduced build completes without this warning.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript, vite
Domain
build-system
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
52/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.