houseassassin/twenty
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

chore(server): bump @nestjs to 11.1.24 + serve-static 5.0.5 to clear CVEs (#21333)

Browse Source 
Bumps `@nestjs` packages to clear the scanner findings they pin on the
prod image. All within-major bumps, past the repo's `npmMinimalAgeGate:
3d`.

## Changes

| Package | From → To | Clears |
|---|---|---|
| `@nestjs/common` | 11.1.16 → **11.1.24** | `file-type@21.3.0` → 21.3.4
|
| `@nestjs/core` | ^11.1.18 → **^11.1.24** | (path-to-regexp 8.4.2) |
| `@nestjs/platform-express` | 11.1.16 → **11.1.24** |
`path-to-regexp@8.3.0` → 8.4.2 |
| `@nestjs/serve-static` | 5.0.4 → **5.0.5** | `path-to-regexp@8.3.0` →
8.4.2 |
| `@nestjs/testing` | 11.1.16 → **11.1.24** | — |

Verified in the regenerated lockfile: **`file-type@21.3.0` and
`path-to-regexp@8.3.0` are gone**. `twenty-server:typecheck` passes
locally.

## Not in scope

- **`lodash@4.17.21`** and **`ws@8.16.0`** are pinned by
**`@nestjs/graphql@12.1.1`** (and lodash also by
`@nestjs/config@3.3.0`). Bumping graphql 12→13 would clear them, but
it's blocked by a **316-line custom patch** implementing Twenty's
multi-schema scoping (`resolverSchemaScope`, `computeReachableTypes`)
welded to 12.1.1's compiled internals — a dedicated effort, not a
routine bump. (Twenty uses the Yoga driver, so it's *not* an Apollo
migration.)
- `@nestjs/config` 3→4 alone wouldn't clear `lodash` (graphql still pins
it), so deferred with the graphql work.
- `path-to-regexp@0.1.12` is express 4.x's own — separate from @nestjs.
This commit is contained in:
Charles Bochet
2026-06-08 19:19:42 +02:00
committed by GitHub
parent bc3036c5da
commit 434f5cbcd2
2 changed files with 36 additions and 55 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/twenty-server/package.json
+5 -5
View File
@@ -49,16 +49,16 @@
"@microsoft/microsoft-graph-types": "^2.40.0",
"@nestjs/axios": "3.1.2",
"@nestjs/cache-manager": "^2.3.0",
"@nestjs/common": "11.1.16",
"@nestjs/common": "11.1.24",
"@nestjs/config": "3.3.0",
"@nestjs/core": "^11.1.18",
"@nestjs/core": "^11.1.24",
"@nestjs/event-emitter": "2.1.0",
"@nestjs/graphql": "patch:@nestjs/graphql@12.1.1#./patches/@nestjs+graphql+12.1.1.patch",
"@nestjs/jwt": "11.0.1",
"@nestjs/passport": "11.0.5",
"@nestjs/platform-express": "11.1.16",
"@nestjs/platform-express": "11.1.24",
"@nestjs/schedule": "^6.0.1",
"@nestjs/serve-static": "5.0.4",
"@nestjs/serve-static": "5.0.5",
"@nestjs/terminus": "11.0.0",
"@nestjs/typeorm": "11.0.0",
"@node-saml/node-saml": "5.1.0",
@@ -176,7 +176,7 @@
"@lingui/cli": "^5.1.2",
"@nestjs/cli": "^11.0.16",
"@nestjs/schematics": "^11.0.9",
"@nestjs/testing": "11.1.16",
"@nestjs/testing": "11.1.24",
"@swc/cli": "^0.7.10",
"@swc/core": "^1.15.11",
"@swc/jest": "^0.2.39",