
Security News
November CVEs Fell 25% YoY, Driven by Slowdowns at Major CNAs
November CVE publications fell 25% YoY even as 2025 totals rose, showing how a few major CNAs can swing “global” counts and skew perceived risk.
@preply/ds-docs
Advanced tools
Documentation entry point.
Follow the instructions in @preply/ds-workspace.
Reach out to #design-system-public if you think you can help and keep an eye on DS Confluence for more docs, guides, work in progress, decisions, the works.
WIP
Related scripts:
yarn build:storybook - static build, outputs to dist/.yarn build:meta - copies assets, instrumentation data, and metadata collected by fe-toolsYou probably want to execute yarn dev and/or yarn docs in the root, as per instructions in @preply/ds-workspace.
You can also execute yarn dev in this folder, but make sure you have first executed yarn build in root, or that you have the root yarn dev script running in the background.
To execute the static build run yarn build && yarn serve.
Homepage and DS wide capabilities are documented in pages/.
Remaining docs are co-located with the source code in @preply/ds-web-lib (components) and @preply/ds-web-core (capabilities).
*.stories.tsx - typically one single "canvas" story*.stories.mdx - examples, guidelines, accessibility, notes, ...WIP Note: If you want to see live metadata on your local instance you have to follow the steps outlined in fe-tools.
Uses storybook@latest + wepback.
Scans for pages in the monorepo, namely in:
Details about global tools and configurations in @preply/ds-workspace.
This package should depend only on:
@storybook/*** and Webpack loadersDo NOT add dependencies on Preply component libraries, especially DS packages like ds-core, ds-web-lib, ...
webpack@4 and loadersStorybook still ships with webpack4 but it's possible to use webpack 5.
We tried this but a series of new issues, such as this recent gh issue (Jul 2011) popped up because the plugin ecosystem is still catching up with the breaking changes.
Instead, we downgraded the css loaders gh issue to the latest versions that are compatible with Webpack4:
css-loader@5.2.6less-loader@7.3.0postcss-loader@4.2.0postcss-preset-env@6.7.0style-loader@2.0.0 styled-components@4.1.3Pinned to 4.1.3 to stay inline with yarn-workspace/packages/shared. Tried to update to latest: v5.3.1 (releases) but it created a fuss with hoisted deps. Not critical for this project at the moment.
WIP: Consolidate these notes with follow ups from previous epics
We are using a container (addons/docs) added on each MDX page because of this issue.
Rendering <Story> (instead of <Canvas>) in an MDX file causes Storybook to display each "story" in the Menu, which breaks the usability of the docs page (even more :-D). Some people have suggested to Add an option to hide a story from the sidebar for this same reason (as well as hiding stories that exist for snapshot purposes only). Right now I can accomplish this same thing with the block but I don't want the added link on the Sidebar.
Even actively developing a component, the Controls widget sometimes displays props that no longer exist. It's a cache issue with typescript doc gen under the hood. You will need to restart
First line in code samples in MDX docs are always poorly indent. Just an annoying detail.
Code samples in Canvas page shows <StoryContextDSWeb/> because it's being injected in each stories.tsx via decorators: [story => <StoryContextDSWeb>{story()}</StoryContextDSWeb>]. It's preferrable to have this flexibility (as opposed to registering global decorators) even if the code sample is a tad polluted (another annoying detail).
Serialization of props to url causes issue with an ugly warning react_devtools_backend.js: Omitted potentially unsafe URL args.
FIX ME! Super annoying: Scroll to top after navigating between docs pages. Apparently this issue was fixed.
FAQs
Unknown package
The npm package @preply/ds-docs receives a total of 207 weekly downloads. As such, @preply/ds-docs popularity was classified as not popular.
We found that @preply/ds-docs demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 8 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
November CVE publications fell 25% YoY even as 2025 totals rose, showing how a few major CNAs can swing “global” counts and skew perceived risk.

Security News
React disclosed a CVSS 10.0 RCE in React Server Components and is advising users to upgrade affected packages and frameworks to patched versions now.

Research
/Security News
We spotted a wave of auto-generated “elf-*” npm packages published every two minutes from new accounts, with simple malware variants and early takedowns underway.