houseassassin/twenty
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(deps): pin form-data under nx and zapier-platform-core to 4.0.6 (#22023)

Browse Source 
## Summary

Adds two scoped `resolutions` (`nx/form-data` +
`zapier-platform-core/form-data` → `4.0.6`) forcing the lone vulnerable
`form-data@4.0.5` up to the patched `4.0.6`, resolving [Dependabot alert
#1506](https://github.com/twentyhq/twenty/security/dependabot/1506) —
CVE-2026-12143 / GHSA-hmw2-7cc7-3qxx (CRLF injection via unescaped
multipart field names/filenames, vulnerable `>=4.0.0 <4.0.6`).

## Why scoped resolutions (not a parent-bump)

- `form-data@4.0.5` is pinned **exactly** by `nx@22.7.5` (root devDep)
and `zapier-platform-core@19.0.0` (twenty-zapier) — and **both still pin
4.0.5 in their latest release**, so no parent upgrade carries the fix.
- Every *other* form-data consumer already resolves `4.0.6` naturally
via its `^4.0.x` range, so the two scoped pins simply **dedupe**
nx/zapier's copy onto that existing 4.0.6 — no new copy introduced.
- Scoped, not global, to match the existing `express/qs` +
`@cypress/request/qs` two-entry pattern (only form-data 4.x is in the
tree).

## Changes

- `package.json`: the two `resolutions` entries **plus** a matching
`"//resolutions"` doc entry (advisory, why-no-parent-bump, scope
rationale, drop condition).

## Verification

- `yarn install --immutable` passes.
- No form-data in `[4.0.0, 4.0.6)` remains in `yarn.lock`.
This commit is contained in:
Abdullah.
2026-06-23 19:40:54 +05:00
committed by GitHub
parent bab71afe54
commit 11218561d0
2 changed files with 5 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
package.json
+3 -1
View File
File diff suppressed because one or more lines are too long
yarn.lock
+2 -15
View File
@@ -33879,20 +33879,7 @@ __metadata:
languageName: node
linkType: hard
"form-data@npm:4.0.5":
version: 4.0.5
resolution: "form-data@npm:4.0.5"
dependencies:
asynckit: "npm:^0.4.0"
combined-stream: "npm:^1.0.8"
es-set-tostringtag: "npm:^2.1.0"
hasown: "npm:^2.0.2"
mime-types: "npm:^2.1.12"
checksum: 10c0/dd6b767ee0bbd6d84039db12a0fa5a2028160ffbfaba1800695713b46ae974a5f6e08b3356c3195137f8530dcd9dfcb5d5ae1eeff53d0db1e5aad863b619ce3b
languageName: node
linkType: hard
"form-data@npm:^4.0.0, form-data@npm:^4.0.4, form-data@npm:^4.0.5, form-data@npm:~4.0.4":
"form-data@npm:4.0.6, form-data@npm:^4.0.0, form-data@npm:^4.0.4, form-data@npm:^4.0.5, form-data@npm:~4.0.4":
version: 4.0.6
resolution: "form-data@npm:4.0.6"
dependencies:
@@ -42091,7 +42078,7 @@ __metadata:
languageName: node
linkType: hard
"mime-types@npm:2.1.35, mime-types@npm:^2.1.12, mime-types@npm:^2.1.27, mime-types@npm:^2.1.35, mime-types@npm:~2.1.19, mime-types@npm:~2.1.24, mime-types@npm:~2.1.34, mime-types@npm:~2.1.35":
"mime-types@npm:2.1.35, mime-types@npm:^2.1.27, mime-types@npm:^2.1.35, mime-types@npm:~2.1.19, mime-types@npm:~2.1.24, mime-types@npm:~2.1.34, mime-types@npm:~2.1.35":
version: 2.1.35
resolution: "mime-types@npm:2.1.35"
dependencies: