houseassassin/twenty
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

security: clear happy-dom High alerts by upgrading wyw-in-js 0.7 → 1.1 (#21394)

Browse Source 
## What

Clears the 2 High `happy-dom` alerts (GHSA-w4gp-fjgq-3q4g,
GHSA-6q6h-j7hj-3r64) via a parent bump — **no resolution**.

`happy-dom@15.11.7` came from **`@wyw-in-js/transform@0.7.0`**
(Linaria's CSS transform), pinned by a root resolution + a local `.yarn`
patch and requested by `@wyw-in-js/vite@^0.7.0` in twenty-front +
twenty-ui-deprecated.

- `@wyw-in-js/vite` `^0.7.0` → `^1.1.0` (twenty-front,
twenty-ui-deprecated)
- `@wyw-in-js/babel-preset` `^0.6.0` → `^1.1.0` (twenty-ui-deprecated)
- **drop the `@wyw-in-js/transform` 0.7.0 resolutions + the `.yarn`
patch** — the patch added a `visited` cycle-guard to
`TransformCacheCollection.invalidateIfChanged`, which is **already
upstream** in transform 1.1.0, so it's obsolete.

`@wyw-in-js/transform` now resolves to **1.1.0** (→ happy-dom 20.10.2)
and 0.8.1 (website, unchanged, → happy-dom 20.8.9). The vulnerable
0.7.0/15.11.7 are gone.

## Required config change

wyw-in-js 1.x resolves modules in its CSS pre-build via vite's
`resolve.alias` instead of `vite-tsconfig-paths`. So twenty-front's `@/`
and `~/` tsconfig path aliases are mirrored into `vite.config`
`resolve.alias` — otherwise the CSS evaluator throws `Cannot find module
'@/...'` for aliased imports used inside `styled` definitions.

## Verification
- happy-dom now **20.8.9 + 20.10.2** (both patched); no 15.x left
- `nx build twenty-front` — CSS extraction works (**1018 files
transformed**) + `typecheck`
- `nx build twenty-ui`, `twenty-ui-deprecated` (Linaria CSS extraction)
- website's Linaria transform runs fine (local build only stops on a
missing `TWENTY_PARTNERS_API_URL` env var, unrelated)
- `yarn install --immutable` clean
This commit is contained in:
Charles Bochet
2026-06-10 11:24:38 +02:00
committed by GitHub
parent 71480c3888
commit 232ca8eec2
6 changed files with 76 additions and 141 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.yarn/patches/@wyw-in-js-transform-npm-0.7.0-ba641dc99f.patch
-58
View File
@@ -1,58 +0,0 @@
diff --git a/esm/cache.js b/esm/cache.js
index 07cf6d7dd99effb9c3464b620ba67a7f445224f5..248bb527923499a6be8065ee7a3613b55819c58c 100644
--- a/esm/cache.js
+++ b/esm/cache.js
@@ -69,17 +69,20 @@ export class TransformCacheCollection {
this.invalidate(cacheName, filename);
});
}
- invalidateIfChanged(filename, content) {
+ invalidateIfChanged(filename, content, _visited) {
+ const visited = _visited || new Set();
+ if (visited.has(filename)) {
+ return false;
+ }
+ visited.add(filename);
const fileEntrypoint = this.get('entrypoints', filename);
- // We need to check all dependencies of the file
- // because they might have changed as well.
if (fileEntrypoint) {
for (const [, dependency] of fileEntrypoint.dependencies) {
const dependencyFilename = dependency.resolved;
if (dependencyFilename) {
const dependencyContent = fs.readFileSync(dependencyFilename, 'utf8');
- this.invalidateIfChanged(dependencyFilename, dependencyContent);
+ this.invalidateIfChanged(dependencyFilename, dependencyContent, visited);
}
}
}
diff --git a/lib/cache.js b/lib/cache.js
index 0762ed7d3c39b31000f7aa7d8156da15403c8e64..6955410cd3c9ec53cf7a01c8346abc4c47fff791 100644
--- a/lib/cache.js
+++ b/lib/cache.js
@@ -77,17 +77,20 @@ class TransformCacheCollection {
this.invalidate(cacheName, filename);
});
}
- invalidateIfChanged(filename, content) {
+ invalidateIfChanged(filename, content, _visited) {
+ const visited = _visited || new Set();
+ if (visited.has(filename)) {
+ return false;
+ }
+ visited.add(filename);
const fileEntrypoint = this.get('entrypoints', filename);
- // We need to check all dependencies of the file
- // because they might have changed as well.
if (fileEntrypoint) {
for (const [, dependency] of fileEntrypoint.dependencies) {
const dependencyFilename = dependency.resolved;
if (dependencyFilename) {
const dependencyContent = _nodeFs.default.readFileSync(dependencyFilename, 'utf8');
- this.invalidateIfChanged(dependencyFilename, dependencyContent);
+ this.invalidateIfChanged(dependencyFilename, dependencyContent, visited);
}
}
}
package.json
-2
View File
@@ -33,8 +33,6 @@
"graphql-redis-subscriptions/ioredis": "^5.6.0",
"@lingui/core": "5.1.2",
"@types/qs": "6.9.16",
"@wyw-in-js/transform@npm:0.6.0": "patch:@wyw-in-js/transform@npm%3A0.7.0#~/.yarn/patches/@wyw-in-js-transform-npm-0.7.0-ba641dc99f.patch",
"@wyw-in-js/transform@npm:0.7.0": "patch:@wyw-in-js/transform@npm%3A0.7.0#~/.yarn/patches/@wyw-in-js-transform-npm-0.7.0-ba641dc99f.patch",
"@opentelemetry/api": "1.9.1",
"chokidar": "^3.6.0",
"tmp": "^0.2.7",
packages/twenty-front/package.json
+1 -1
View File
@@ -179,7 +179,7 @@
"@types/uuid": "^9.0.2",
"@vitejs/plugin-react-swc": "4.2.3",
"@vitest/coverage-istanbul": "^4.1.0",
"@wyw-in-js/vite": "^0.7.0",
"@wyw-in-js/vite": "^1.1.0",
"dotenv-cli": "^7.4.4",
"jest": "29.7.0",
"jest-environment-jsdom": "30.0.0-beta.3",
packages/twenty-front/vite.config.ts
+8 -3
View File
@@ -243,9 +243,14 @@ export default defineConfig(({ mode }) => {
},
},
resolve: {
alias: {
path: 'rollup-plugin-node-polyfills/polyfills/path',
},
alias: [
// wyw-in-js 1.x resolves modules in its CSS evaluator via vite's
// resolve.alias (it no longer picks up vite-tsconfig-paths), so the
// `@/` and `~/` tsconfig path aliases must be mirrored here.
{ find: /^@\//, replacement: path.resolve(__dirname, 'src/modules') + '/' },
{ find: /^~\//, replacement: path.resolve(__dirname, 'src') + '/' },
{ find: 'path', replacement: 'rollup-plugin-node-polyfills/polyfills/path' },
],
},
};
});
packages/twenty-ui-deprecated/package.json
+2 -2
View File
@@ -29,8 +29,8 @@
"@types/react": "^18.2.39",
"@types/react-dom": "^18.2.15",
"@vitejs/plugin-react-swc": "4.2.3",
"@wyw-in-js/babel-preset": "^0.6.0",
"@wyw-in-js/vite": "^0.7.0",
"@wyw-in-js/babel-preset": "^1.1.0",
"@wyw-in-js/vite": "^1.1.0",
"babel-plugin-inline-import": "^3.0.0",
"babel-plugin-inline-react-svg": "^2.0.2",
"babel-plugin-module-resolver": "^5.0.2",
yarn.lock
+65 -75
View File
@@ -25813,16 +25813,6 @@ __metadata:
languageName: node
linkType: hard
"@wyw-in-js/babel-preset@npm:^0.6.0":
version: 0.6.0
resolution: "@wyw-in-js/babel-preset@npm:0.6.0"
dependencies:
"@babel/core": "npm:^7.23.5"
"@wyw-in-js/transform": "npm:0.6.0"
checksum: 10c0/29a1ee3e5207a41b7009bf582e22d03a686c0a5b70c98e7bf1cb3d7494cf1df7227368e7bb28493385c11b484a37c90b9c7fc10bcd06f9839f4c872e4fd57522
languageName: node
linkType: hard
"@wyw-in-js/babel-preset@npm:^0.8.1":
version: 0.8.1
resolution: "@wyw-in-js/babel-preset@npm:0.8.1"
@@ -25833,13 +25823,13 @@ __metadata:
languageName: node
linkType: hard
"@wyw-in-js/processor-utils@npm:0.7.0":
version: 0.7.0
resolution: "@wyw-in-js/processor-utils@npm:0.7.0"
"@wyw-in-js/babel-preset@npm:^1.1.0":
version: 1.1.0
resolution: "@wyw-in-js/babel-preset@npm:1.1.0"
dependencies:
"@babel/generator": "npm:^7.23.5"
"@wyw-in-js/shared": "npm:0.7.0"
checksum: 10c0/8b9e82f42beb4ae04ecf630f407d9d22421f620204cac1d7083712ffb925880dbbfab7e36da8b4848817b19a95eb16e3bf9bdc9cf9a65bab84fbb9c7f2aa24b0
"@babel/core": "npm:^7.23.5"
"@wyw-in-js/transform": "npm:1.1.0"
checksum: 10c0/542798c00759832b07d58992717a9b34830a564608d99d160933fd5d0b1cc9448634ca4d86371b39d4b62f7819fff6d54cc1f28032ca6f5056322d7949f1a0a5
languageName: node
linkType: hard
@@ -25853,6 +25843,16 @@ __metadata:
languageName: node
linkType: hard
"@wyw-in-js/processor-utils@npm:1.1.0":
version: 1.1.0
resolution: "@wyw-in-js/processor-utils@npm:1.1.0"
dependencies:
"@babel/generator": "npm:^7.23.5"
"@wyw-in-js/shared": "npm:1.1.0"
checksum: 10c0/7f88a1660715071ff6754a1531e511e7d346094080439fc38b74e5123779a3bca6ea765457dccb3b8ab42475a6fb792a40283d080ae5125ac1f42888be651ccd
languageName: node
linkType: hard
"@wyw-in-js/processor-utils@npm:^0.5.3":
version: 0.5.4
resolution: "@wyw-in-js/processor-utils@npm:0.5.4"
@@ -25905,17 +25905,6 @@ __metadata:
languageName: node
linkType: hard
"@wyw-in-js/shared@npm:0.7.0":
version: 0.7.0
resolution: "@wyw-in-js/shared@npm:0.7.0"
dependencies:
debug: "npm:^4.3.4"
find-up: "npm:^5.0.0"
minimatch: "npm:^9.0.3"
checksum: 10c0/0f5603929c390e28bb8512460f7d45e698dc00fc06f926ca901b8f1efea49575a67de3991c6413840972428d0f865209025bd02e02304001e135eded445be40b
languageName: node
linkType: hard
"@wyw-in-js/shared@npm:0.8.1":
version: 0.8.1
resolution: "@wyw-in-js/shared@npm:0.8.1"
@@ -25938,26 +25927,14 @@ __metadata:
languageName: node
linkType: hard
"@wyw-in-js/transform@npm:0.7.0":
version: 0.7.0
resolution: "@wyw-in-js/transform@npm:0.7.0"
"@wyw-in-js/shared@npm:1.1.0":
version: 1.1.0
resolution: "@wyw-in-js/shared@npm:1.1.0"
dependencies:
"@babel/core": "npm:^7.23.5"
"@babel/generator": "npm:^7.23.5"
"@babel/helper-module-imports": "npm:^7.22.15"
"@babel/plugin-transform-modules-commonjs": "npm:^7.23.3"
"@babel/template": "npm:^7.22.15"
"@babel/traverse": "npm:^7.23.5"
"@babel/types": "npm:^7.23.5"
"@wyw-in-js/processor-utils": "npm:0.7.0"
"@wyw-in-js/shared": "npm:0.7.0"
babel-merge: "npm:^3.0.0"
cosmiconfig: "npm:^8.0.0"
happy-dom: "npm:^15.11.0"
source-map: "npm:^0.7.4"
stylis: "npm:^4.3.0"
ts-invariant: "npm:^0.10.3"
checksum: 10c0/643dd854759eef29a82161d89a803e9f8e414917d0fcc4ce3aecb3f5da7c0ba85afae205fd2ee155807ff92ad1644a74ca557ef7c6b210be869099f08bd5543e
debug: "npm:^4.3.4"
find-up: "npm:^5.0.0"
minimatch: "npm:^9.0.3"
checksum: 10c0/95de296de46751ab4cbfed13e0a6237014a03316bed9e107c772ded9aa27b2023d3383014790fafd309c2beb8f5661264dc3c70045f592049fec98acf6f0f94d
languageName: node
linkType: hard
@@ -25984,9 +25961,9 @@ __metadata:
languageName: node
linkType: hard
"@wyw-in-js/transform@patch:@wyw-in-js/transform@npm%3A0.7.0#~/.yarn/patches/@wyw-in-js-transform-npm-0.7.0-ba641dc99f.patch":
version: 0.7.0
resolution: "@wyw-in-js/transform@patch:@wyw-in-js/transform@npm%3A0.7.0#~/.yarn/patches/@wyw-in-js-transform-npm-0.7.0-ba641dc99f.patch::version=0.7.0&hash=95ca78"
"@wyw-in-js/transform@npm:1.1.0":
version: 1.1.0
resolution: "@wyw-in-js/transform@npm:1.1.0"
dependencies:
"@babel/core": "npm:^7.23.5"
"@babel/generator": "npm:^7.23.5"
@@ -25995,27 +25972,27 @@ __metadata:
"@babel/template": "npm:^7.22.15"
"@babel/traverse": "npm:^7.23.5"
"@babel/types": "npm:^7.23.5"
"@wyw-in-js/processor-utils": "npm:0.7.0"
"@wyw-in-js/shared": "npm:0.7.0"
babel-merge: "npm:^3.0.0"
"@wyw-in-js/processor-utils": "npm:1.1.0"
"@wyw-in-js/shared": "npm:1.1.0"
cosmiconfig: "npm:^8.0.0"
happy-dom: "npm:^15.11.0"
happy-dom: "npm:^20.1.0"
minimatch: "npm:^9.0.5"
source-map: "npm:^0.7.4"
stylis: "npm:^4.3.0"
ts-invariant: "npm:^0.10.3"
checksum: 10c0/94a4753b5a6f0c859af6adf20c9668f13d8cc5422f44f1b568ed2d1fd787ff65d25447919498382174ff61985bc28ecb7cbe881481510d23bb65fd0a51b00993
checksum: 10c0/3a33b1d5a88fbccb7d58539d453656e3801e7c179f5645e3f7b82bb44c0548b99c7733e95353b082d24c9c612fa577355c183c94d8b408f896e828f884aff84c
languageName: node
linkType: hard
"@wyw-in-js/vite@npm:^0.7.0":
version: 0.7.0
resolution: "@wyw-in-js/vite@npm:0.7.0"
"@wyw-in-js/vite@npm:^1.1.0":
version: 1.1.0
resolution: "@wyw-in-js/vite@npm:1.1.0"
dependencies:
"@wyw-in-js/shared": "npm:0.7.0"
"@wyw-in-js/transform": "npm:0.7.0"
"@wyw-in-js/shared": "npm:1.1.0"
"@wyw-in-js/transform": "npm:1.1.0"
peerDependencies:
vite: ">=3.2.7"
checksum: 10c0/34cc1fd2c3a997866aecc58111debe2663442bb7badb77e21f9ad23bd8cf75c273f3c7b66017cd3b681dfde05c4954a9d6cad55558c16e087655a0e794194728
checksum: 10c0/73537aaa229a23212f1c486899a7b72c4156b6761336ac12a4c6ab4b68a520565a27c22d5264412aa9936d85d46126527f438ea7c1d828d6271f4681b5f5b571
languageName: node
linkType: hard
@@ -29444,6 +29421,15 @@ __metadata:
languageName: node
linkType: hard
"buffer-image-size@npm:^0.6.4":
version: 0.6.4
resolution: "buffer-image-size@npm:0.6.4"
dependencies:
"@types/node": "npm:*"
checksum: 10c0/7158205c8726caa521d3ae6ef7bc341eff211ff86f7278d122e45062e1720afef2f7ad8e845edc96c04f499b292c4ec8a74df9836a25074881260ba00b863448
languageName: node
linkType: hard
"buffer@npm:^5.2.1, buffer@npm:^5.5.0":
version: 5.7.1
resolution: "buffer@npm:5.7.1"
@@ -37137,17 +37123,6 @@ __metadata:
languageName: node
linkType: hard
"happy-dom@npm:^15.11.0":
version: 15.11.7
resolution: "happy-dom@npm:15.11.7"
dependencies:
entities: "npm:^4.5.0"
webidl-conversions: "npm:^7.0.0"
whatwg-mimetype: "npm:^3.0.0"
checksum: 10c0/22b08cac20192b08edf2e9c857ceeda8333a3301c4b5965a9550787b00db60d6d107c726390bd45a35305cd12ab086abd656bf957a408be0fcdc9fcd389f1973
languageName: node
linkType: hard
"happy-dom@npm:^20.0.10":
version: 20.8.9
resolution: "happy-dom@npm:20.8.9"
@@ -37162,6 +37137,21 @@ __metadata:
languageName: node
linkType: hard
"happy-dom@npm:^20.1.0":
version: 20.10.2
resolution: "happy-dom@npm:20.10.2"
dependencies:
"@types/node": "npm:>=20.0.0"
"@types/whatwg-mimetype": "npm:^3.0.2"
"@types/ws": "npm:^8.18.1"
buffer-image-size: "npm:^0.6.4"
entities: "npm:^7.0.1"
whatwg-mimetype: "npm:^3.0.0"
ws: "npm:^8.21.0"
checksum: 10c0/40c6f451bcc1f73bd709dff94b090daac1871e712bdfaaa1538ddfe7d11777ac74b608aa1193c0f04e6cf1d30b9dade203dcfe556acbea7fbc82d4deb41d2ce0
languageName: node
linkType: hard
"harmony-reflect@npm:^1.4.6":
version: 1.6.2
resolution: "harmony-reflect@npm:1.6.2"
@@ -55148,7 +55138,7 @@ __metadata:
"@types/uuid": "npm:^9.0.2"
"@vitejs/plugin-react-swc": "npm:4.2.3"
"@vitest/coverage-istanbul": "npm:^4.1.0"
"@wyw-in-js/vite": "npm:^0.7.0"
"@wyw-in-js/vite": "npm:^1.1.0"
"@xyflow/react": "npm:^12.4.2"
ai: "npm:6.0.97"
apollo-link-rest: "npm:^0.10.0-rc.2"
@@ -55587,8 +55577,8 @@ __metadata:
"@types/react": "npm:^18.2.39"
"@types/react-dom": "npm:^18.2.15"
"@vitejs/plugin-react-swc": "npm:4.2.3"
"@wyw-in-js/babel-preset": "npm:^0.6.0"
"@wyw-in-js/vite": "npm:^0.7.0"
"@wyw-in-js/babel-preset": "npm:^1.1.0"
"@wyw-in-js/vite": "npm:^1.1.0"
babel-plugin-inline-import: "npm:^3.0.0"
babel-plugin-inline-react-svg: "npm:^2.0.2"
babel-plugin-module-resolver: "npm:^5.0.2"
@@ -58502,7 +58492,7 @@ __metadata:
languageName: node
linkType: hard
"ws@npm:^8.13.0, ws@npm:^8.17.1, ws@npm:^8.18.0, ws@npm:^8.18.3, ws@npm:^8.19.0, ws@npm:^8.20.0":
"ws@npm:^8.13.0, ws@npm:^8.17.1, ws@npm:^8.18.0, ws@npm:^8.18.3, ws@npm:^8.19.0, ws@npm:^8.20.0, ws@npm:^8.21.0":
version: 8.21.0
resolution: "ws@npm:8.21.0"
peerDependencies: