From 3b8db734a5ab07956d915ea91a4a8a3510832dae Mon Sep 17 00:00:00 2001
From: "Abdullah." <125115953+mabdullahabaid@users.noreply.github.com>
Date: Thu, 27 Nov 2025 20:36:36 +0500
Subject: [PATCH] fix: glob CLI command injection via -c/--cmd executes matches
 with shell:true (#16139)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Resolves [Dependabot Alert
318](https://github.com/twentyhq/twenty/security/dependabot/318),
[Dependabot Alert
321](https://github.com/twentyhq/twenty/security/dependabot/321) and
[Dependabot Alert
322](https://github.com/twentyhq/twenty/security/dependabot/322).

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> Bumps glob to 10.5.0 across packages and adds @types/node and
twenty-sdk to rollup-engine dependencies.
>
> - **Dependencies**:
>   - Upgrade `glob` to `10.5.0` across multiple `yarn.lock` files.
>   - In `packages/twenty-apps/community/rollup-engine`:
>     - Add `@types/node@^24.7.2` (adds `undici-types`).
>     - Add `twenty-sdk@0.0.3`.
>
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
0aee78e0fa90918320aa35bf38d89c3a4c801666. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

Co-authored-by: Félix Malfait <felix.malfait@gmail.com>
---
 .../twenty-apps/community/fireflies/yarn.lock |  6 ++--
 .../community/rollup-engine/yarn.lock         | 31 +++++++++++++++++--
 .../serverless/drivers/layers/1/yarn.lock     |  6 ++--
 3 files changed, 34 insertions(+), 9 deletions(-)

diff --git a/packages/twenty-apps/community/fireflies/yarn.lock b/packages/twenty-apps/community/fireflies/yarn.lock
index 1a15973305..a891c93643 100644
--- a/packages/twenty-apps/community/fireflies/yarn.lock
+++ b/packages/twenty-apps/community/fireflies/yarn.lock
@@ -2056,8 +2056,8 @@ __metadata:
   linkType: hard
 
 "glob@npm:^10.2.2":
-  version: 10.4.5
-  resolution: "glob@npm:10.4.5"
+  version: 10.5.0
+  resolution: "glob@npm:10.5.0"
   dependencies:
     foreground-child: "npm:^3.1.0"
     jackspeak: "npm:^3.1.2"
@@ -2067,7 +2067,7 @@ __metadata:
     path-scurry: "npm:^1.11.1"
   bin:
     glob: dist/esm/bin.mjs
-  checksum: 10c0/19a9759ea77b8e3ca0a43c2f07ecddc2ad46216b786bb8f993c445aee80d345925a21e5280c7b7c6c59e860a0154b84e4b2b60321fea92cd3c56b4a7489f160e
+  checksum: 10c0/100705eddbde6323e7b35e1d1ac28bcb58322095bd8e63a7d0bef1a2cdafe0d0f7922a981b2b48369a4f8c1b077be5c171804534c3509dfe950dde15fbe6d828
   languageName: node
   linkType: hard
 
diff --git a/packages/twenty-apps/community/rollup-engine/yarn.lock b/packages/twenty-apps/community/rollup-engine/yarn.lock
index 0bf27a18d1..61018440d3 100644
--- a/packages/twenty-apps/community/rollup-engine/yarn.lock
+++ b/packages/twenty-apps/community/rollup-engine/yarn.lock
@@ -239,6 +239,15 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@types/node@npm:^24.7.2":
+  version: 24.10.1
+  resolution: "@types/node@npm:24.10.1"
+  dependencies:
+    undici-types: "npm:~7.16.0"
+  checksum: 10c0/d6bca7a78f550fbb376f236f92b405d676003a8a09a1b411f55920ef34286ee3ee51f566203920e835478784df52662b5b2af89159d9d319352e9ea21801c002
+  languageName: node
+  linkType: hard
+
 "abbrev@npm:^3.0.0":
   version: 3.0.1
   resolution: "abbrev@npm:3.0.1"
@@ -572,8 +581,8 @@ __metadata:
   linkType: hard
 
 "glob@npm:^10.2.2":
-  version: 10.4.5
-  resolution: "glob@npm:10.4.5"
+  version: 10.5.0
+  resolution: "glob@npm:10.5.0"
   dependencies:
     foreground-child: "npm:^3.1.0"
     jackspeak: "npm:^3.1.2"
@@ -583,7 +592,7 @@ __metadata:
     path-scurry: "npm:^1.11.1"
   bin:
     glob: dist/esm/bin.mjs
-  checksum: 10c0/19a9759ea77b8e3ca0a43c2f07ecddc2ad46216b786bb8f993c445aee80d345925a21e5280c7b7c6c59e860a0154b84e4b2b60321fea92cd3c56b4a7489f160e
+  checksum: 10c0/100705eddbde6323e7b35e1d1ac28bcb58322095bd8e63a7d0bef1a2cdafe0d0f7922a981b2b48369a4f8c1b077be5c171804534c3509dfe950dde15fbe6d828
   languageName: node
   linkType: hard
 
@@ -907,8 +916,10 @@ __metadata:
   version: 0.0.0-use.local
   resolution: "rollup-engine@workspace:."
   dependencies:
+    "@types/node": "npm:^24.7.2"
     dotenv: "npm:^16.4.5"
     tsx: "npm:^4.20.6"
+    twenty-sdk: "npm:0.0.3"
   languageName: unknown
   linkType: soft
 
@@ -1067,6 +1078,20 @@ __metadata:
   languageName: node
   linkType: hard
 
+"twenty-sdk@npm:0.0.3":
+  version: 0.0.3
+  resolution: "twenty-sdk@npm:0.0.3"
+  checksum: 10c0/0a3c85c27edb22fb50f7eb0da4f9770e85729fce05e9e0118ad0cdfc36e42425c93340a6cd1c276daf30aeeaa612db0cd905831c0a8287a31bff3da5be9b0562
+  languageName: node
+  linkType: hard
+
+"undici-types@npm:~7.16.0":
+  version: 7.16.0
+  resolution: "undici-types@npm:7.16.0"
+  checksum: 10c0/3033e2f2b5c9f1504bdc5934646cb54e37ecaca0f9249c983f7b1fc2e87c6d18399ebb05dc7fd5419e02b2e915f734d872a65da2e3eeed1813951c427d33cc9a
+  languageName: node
+  linkType: hard
+
 "unique-filename@npm:^4.0.0":
   version: 4.0.0
   resolution: "unique-filename@npm:4.0.0"
diff --git a/packages/twenty-server/src/engine/core-modules/serverless/drivers/layers/1/yarn.lock b/packages/twenty-server/src/engine/core-modules/serverless/drivers/layers/1/yarn.lock
index d838a59e1b..0382ab5482 100644
--- a/packages/twenty-server/src/engine/core-modules/serverless/drivers/layers/1/yarn.lock
+++ b/packages/twenty-server/src/engine/core-modules/serverless/drivers/layers/1/yarn.lock
@@ -1389,8 +1389,8 @@ __metadata:
   linkType: hard
 
 "glob@npm:^10.0.0, glob@npm:^10.2.2, glob@npm:^10.3.10":
-  version: 10.4.5
-  resolution: "glob@npm:10.4.5"
+  version: 10.5.0
+  resolution: "glob@npm:10.5.0"
   dependencies:
     foreground-child: "npm:^3.1.0"
     jackspeak: "npm:^3.1.2"
@@ -1400,7 +1400,7 @@ __metadata:
     path-scurry: "npm:^1.11.1"
   bin:
     glob: dist/esm/bin.mjs
-  checksum: 10c0/19a9759ea77b8e3ca0a43c2f07ecddc2ad46216b786bb8f993c445aee80d345925a21e5280c7b7c6c59e860a0154b84e4b2b60321fea92cd3c56b4a7489f160e
+  checksum: 10c0/100705eddbde6323e7b35e1d1ac28bcb58322095bd8e63a7d0bef1a2cdafe0d0f7922a981b2b48369a4f8c1b077be5c171804534c3509dfe950dde15fbe6d828
   languageName: node
   linkType: hard