fix(security): bump storybook to 7.6.21

[ootakazuhiko]

背景

Storybook 7.6.20 のセキュリティアドバイザリ（CVE-2025-68429）対応のため、7.6.21 へ更新します。

変更

• apps/storybook/package.json の Storybook 系依存を 7.6.21 に更新
• pnpm-lock.yaml を更新

ログ

• pnpm -C apps/storybook add -D @storybook/*@7.6.21 [email protected]

テスト

• なし（CIで確認予定）

影響

• Storybook の脆弱性修正を取り込み

ロールバック

• このPRを revert

関連Issue

• 🚨 Critical Security Issues - Code Scanning Alerts Resolution #1004
• Security: address open code scanning alerts (esbuild/go stdlib, MCP SDK, glob, js-yaml) #1225

[github-actions]

❓ Code Generation Drift Detection

Status:
Regeneration needed: No

---

Automated by AE-Framework Codegen

[github-actions]

Quality Summary

• Adapters:

• Formal: n/a

• Replay: n/a

• Trace IDs:

[github-actions]

🔍 Verification Summary

• Traceability: 6 scenarios
  • Tests: 3 (50%)
  • Impl: 3 (50%)
  • Formal: 3 (50%)

Unlinked (top 5)

- Device registration publishes enough pre-keys and emits audit log (id: device-registration-publishes-enough-pre-keys-and-emits-audit-log) test:N/A impl:N/A formal:N/A - Invalid auth tag triggers audit violation for AES-GCM envelopes (id: invalid-auth-tag-triggers-audit-violation-for-aes-gcm-envelopes) test:N/A impl:N/A formal:N/A - Session rotation stays within forward secrecy thresholds (id: session-rotation-stays-within-forward-secrecy-thresholds) test:N/A impl:N/A formal:N/A

Linked examples (up to 3)

- Successful reservation (id: successful-reservation) test: [traceability/inventory.trace.test.ts](https://github.com/itdojp/ae-framework/blob/172179939bcfe410a5392f316e59cac8de664e8e/tests/traceability/inventory.trace.test.ts) impl: [domain/inventory.ts](https://github.com/itdojp/ae-framework/blob/172179939bcfe410a5392f316e59cac8de664e8e/src/domain/inventory.ts) formal: [tla+/Inventory.tla](https://github.com/itdojp/ae-framework/blob/172179939bcfe410a5392f316e59cac8de664e8e/specs/formal/tla+/Inventory.tla) - Prevent negative stock (id: prevent-negative-stock) test: [traceability/inventory.trace.test.ts](https://github.com/itdojp/ae-framework/blob/172179939bcfe410a5392f316e59cac8de664e8e/tests/traceability/inventory.trace.test.ts) impl: [domain/inventory.ts](https://github.com/itdojp/ae-framework/blob/172179939bcfe410a5392f316e59cac8de664e8e/src/domain/inventory.ts) formal: [tla+/Inventory.tla](https://github.com/itdojp/ae-framework/blob/172179939bcfe410a5392f316e59cac8de664e8e/specs/formal/tla+/Inventory.tla) - Idempotent by order id (id: idempotent-by-order-id) test: [traceability/inventory.trace.test.ts](https://github.com/itdojp/ae-framework/blob/172179939bcfe410a5392f316e59cac8de664e8e/tests/traceability/inventory.trace.test.ts) impl: [domain/inventory.ts](https://github.com/itdojp/ae-framework/blob/172179939bcfe410a5392f316e59cac8de664e8e/src/domain/inventory.ts) formal: [tla+/Inventory.tla](https://github.com/itdojp/ae-framework/blob/172179939bcfe410a5392f316e59cac8de664e8e/specs/formal/tla+/Inventory.tla)

Hit basis (tests/formal)

- Test hits: title=3 id=0 tag=0 - Formal hits: title=0 id=3 tag=0

- Model Check (TLC): 2/8 (25%) modules ok

Non-OK modules (top 5)

- KvOnce (log: artifacts/codex/KvOnce.tlc.log.txt) - KvOnceRefinement (log: artifacts/codex/KvOnceRefinement.tlc.log.txt) - KvOnceImpl (log: artifacts/codex/KvOnceImpl.tlc.log.txt) - KvOnce (log: artifacts/codex/KvOnce.tlc.log.txt) - KvOnceRefinement (log: artifacts/codex/KvOnceRefinement.tlc.log.txt)

- Alloy: detected 2 specs (execution skipped) - Contracts: schemas=true conditions=true machine=true - Contracts exec: parseIn=false pre=false post=false parseOut=false

[github-actions]

CodeX Artifacts Summary

• • Contract/E2E templates: 1 files (dir: tests/api/generated)
• • Tests: PBT files=122, BDD features=0
• • Formal specs: TLA=1, Alloy=1

[Copilot]

Pull request overview

This PR updates Storybook from version 7.6.20 to 7.6.21 to address security advisory CVE-2025-68429. The changes are focused and straightforward:

• All Storybook package dependencies are consistently updated to 7.6.21
• The pnpm lockfile reflects the complete dependency graph update

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File	Description
apps/storybook/package.json	Updated all 9 Storybook package specifiers from ^7.6.10 to ^7.6.21 to ensure the security-patched version is installed
pnpm-lock.yaml	Updated lockfile with resolved Storybook 7.6.21 package versions and their complete dependency trees, removing all 7.6.20 references

Files not reviewed (1)

• pnpm-lock.yaml: Language not supported

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[github-actions]

❓ Code Generation Drift Detection

Status:
Regeneration needed: No

---

Automated by AE-Framework Codegen

[ootakazuhiko]

コンフリクト解消のため main をマージし、pnpm-lock.yaml を再生成しました（merge commit + lockfile refresh）。現在CI再実行中です。

[github-actions]

🔍 Verification Summary

• Traceability: 6 scenarios
  • Tests: 3 (50%)
  • Impl: 3 (50%)
  • Formal: 3 (50%)

Unlinked (top 5)

- Device registration publishes enough pre-keys and emits audit log (id: device-registration-publishes-enough-pre-keys-and-emits-audit-log) test:N/A impl:N/A formal:N/A - Invalid auth tag triggers audit violation for AES-GCM envelopes (id: invalid-auth-tag-triggers-audit-violation-for-aes-gcm-envelopes) test:N/A impl:N/A formal:N/A - Session rotation stays within forward secrecy thresholds (id: session-rotation-stays-within-forward-secrecy-thresholds) test:N/A impl:N/A formal:N/A

Linked examples (up to 3)

- Successful reservation (id: successful-reservation) test: [traceability/inventory.trace.test.ts](https://github.com/itdojp/ae-framework/blob/b1a7dd68527ff03812a95b3f3ef2ab55ed152520/tests/traceability/inventory.trace.test.ts) impl: [domain/inventory.ts](https://github.com/itdojp/ae-framework/blob/b1a7dd68527ff03812a95b3f3ef2ab55ed152520/src/domain/inventory.ts) formal: [tla+/Inventory.tla](https://github.com/itdojp/ae-framework/blob/b1a7dd68527ff03812a95b3f3ef2ab55ed152520/specs/formal/tla+/Inventory.tla) - Prevent negative stock (id: prevent-negative-stock) test: [traceability/inventory.trace.test.ts](https://github.com/itdojp/ae-framework/blob/b1a7dd68527ff03812a95b3f3ef2ab55ed152520/tests/traceability/inventory.trace.test.ts) impl: [domain/inventory.ts](https://github.com/itdojp/ae-framework/blob/b1a7dd68527ff03812a95b3f3ef2ab55ed152520/src/domain/inventory.ts) formal: [tla+/Inventory.tla](https://github.com/itdojp/ae-framework/blob/b1a7dd68527ff03812a95b3f3ef2ab55ed152520/specs/formal/tla+/Inventory.tla) - Idempotent by order id (id: idempotent-by-order-id) test: [traceability/inventory.trace.test.ts](https://github.com/itdojp/ae-framework/blob/b1a7dd68527ff03812a95b3f3ef2ab55ed152520/tests/traceability/inventory.trace.test.ts) impl: [domain/inventory.ts](https://github.com/itdojp/ae-framework/blob/b1a7dd68527ff03812a95b3f3ef2ab55ed152520/src/domain/inventory.ts) formal: [tla+/Inventory.tla](https://github.com/itdojp/ae-framework/blob/b1a7dd68527ff03812a95b3f3ef2ab55ed152520/specs/formal/tla+/Inventory.tla)

Hit basis (tests/formal)

- Test hits: title=3 id=0 tag=0 - Formal hits: title=0 id=3 tag=0

- Model Check (TLC): 2/8 (25%) modules ok

Non-OK modules (top 5)

- KvOnce (log: artifacts/codex/KvOnce.tlc.log.txt) - KvOnceRefinement (log: artifacts/codex/KvOnceRefinement.tlc.log.txt) - KvOnceImpl (log: artifacts/codex/KvOnceImpl.tlc.log.txt) - KvOnce (log: artifacts/codex/KvOnce.tlc.log.txt) - KvOnceRefinement (log: artifacts/codex/KvOnceRefinement.tlc.log.txt)

- Alloy: detected 2 specs (execution skipped) - Contracts: schemas=true conditions=true machine=true - Contracts exec: parseIn=false pre=false post=false parseOut=false

[github-actions]

CodeX Artifacts Summary

• • Contract/E2E templates: 1 files (dir: tests/api/generated)
• • Tests: PBT files=122, BDD features=0
• • Formal specs: TLA=1, Alloy=1