fix: authorization bypass in next.js middleware (#15287)
Fixes [Dependabot Alert 216](https://github.com/twentyhq/twenty/security/dependabot/216) - authorization bypass in next.js middleware. Updated `react-email` version from `4.0.3` to `4.0.4`. This bumps up Next.js to a safer version for the mentioned critical alert. However, even the latest `react-email` package has not upgraded to Next.js 15.4.7 - the recommended version by dependabot. Since `react-email` is a devDependency used to preview email templates during development, it never gets inserted into the production build. Therefore, I marking the following alerts as `vulnerable code is never used` with a comment that it never makes it to the production build. <p align="center"> <img width="1142" height="342" alt="image" src="https://github.com/user-attachments/assets/50976fd3-b49c-4ee7-ac26-89f505783d55" /> </p> The only other place where we have next imported is twenty-website, which uses the safe version `14.2.33`. <p align="center"> <img width="421" height="92" alt="image" src="https://github.com/user-attachments/assets/fe1e20dc-7483-44f7-bf26-78f7131ccf46" /> </p>
This commit is contained in:
Abdullah.
@@ -24,7 +24,7 @@
|
||||
"@tiptap/core": "^3.4.2",
|
||||
"@types/react": "^19",
|
||||
"@types/react-dom": "^19",
|
||||
"react-email": "4.0.3"
|
||||
"react-email": "4.0.4"
|
||||
},
|
||||
"exports": {
|
||||
".": {
|
||||
|
||||
@@ -10190,13 +10190,6 @@ __metadata:
|
||||
languageName: node
|
||||
linkType: hard
|
||||
|
||||
"@next/env@npm:14.2.31":
|
||||
version: 14.2.31
|
||||
resolution: "@next/env@npm:14.2.31"
|
||||
checksum: 10c0/56f9fd1521833341468543bbd9427b84f83539aefe04706013a33edc205fa69d473fa701fee0672248c64101ae764352d145c5e335f41ed588532446fd0d1e8d
|
||||
languageName: node
|
||||
linkType: hard
|
||||
|
||||
"@next/env@npm:14.2.33":
|
||||
version: 14.2.33
|
||||
resolution: "@next/env@npm:14.2.33"
|
||||
@@ -10204,10 +10197,10 @@ __metadata:
|
||||
languageName: node
|
||||
linkType: hard
|
||||
|
||||
"@next/env@npm:15.2.2":
|
||||
version: 15.2.2
|
||||
resolution: "@next/env@npm:15.2.2"
|
||||
checksum: 10c0/a5188353cbbb955f4c87b1d04f8d9419af3f05086b5bf640f456d3e0cd810f17811ca0a29a0b5e492d96ce636eeedc6e306f7dd191c82ff8076c00123481709c
|
||||
"@next/env@npm:15.2.3":
|
||||
version: 15.2.3
|
||||
resolution: "@next/env@npm:15.2.3"
|
||||
checksum: 10c0/52e60419f71b991bdab23fc23f05d221dfe07b725140a110eedc158b2612cebcaa71a74726e2f78b1d53ae162ae0a745fdc3263a2bc76eda013cac057a30f05e
|
||||
languageName: node
|
||||
linkType: hard
|
||||
|
||||
@@ -10220,13 +10213,6 @@ __metadata:
|
||||
languageName: node
|
||||
linkType: hard
|
||||
|
||||
"@next/swc-darwin-arm64@npm:14.2.31":
|
||||
version: 14.2.31
|
||||
resolution: "@next/swc-darwin-arm64@npm:14.2.31"
|
||||
conditions: os=darwin & cpu=arm64
|
||||
languageName: node
|
||||
linkType: hard
|
||||
|
||||
"@next/swc-darwin-arm64@npm:14.2.33":
|
||||
version: 14.2.33
|
||||
resolution: "@next/swc-darwin-arm64@npm:14.2.33"
|
||||
@@ -10234,20 +10220,13 @@ __metadata:
|
||||
languageName: node
|
||||
linkType: hard
|
||||
|
||||
"@next/swc-darwin-arm64@npm:15.2.2":
|
||||
version: 15.2.2
|
||||
resolution: "@next/swc-darwin-arm64@npm:15.2.2"
|
||||
"@next/swc-darwin-arm64@npm:15.2.3":
|
||||
version: 15.2.3
|
||||
resolution: "@next/swc-darwin-arm64@npm:15.2.3"
|
||||
conditions: os=darwin & cpu=arm64
|
||||
languageName: node
|
||||
linkType: hard
|
||||
|
||||
"@next/swc-darwin-x64@npm:14.2.31":
|
||||
version: 14.2.31
|
||||
resolution: "@next/swc-darwin-x64@npm:14.2.31"
|
||||
conditions: os=darwin & cpu=x64
|
||||
languageName: node
|
||||
linkType: hard
|
||||
|
||||
"@next/swc-darwin-x64@npm:14.2.33":
|
||||
version: 14.2.33
|
||||
resolution: "@next/swc-darwin-x64@npm:14.2.33"
|
||||
@@ -10255,20 +10234,13 @@ __metadata:
|
||||
languageName: node
|
||||
linkType: hard
|
||||
|
||||
"@next/swc-darwin-x64@npm:15.2.2":
|
||||
version: 15.2.2
|
||||
resolution: "@next/swc-darwin-x64@npm:15.2.2"
|
||||
"@next/swc-darwin-x64@npm:15.2.3":
|
||||
version: 15.2.3
|
||||
resolution: "@next/swc-darwin-x64@npm:15.2.3"
|
||||
conditions: os=darwin & cpu=x64
|
||||
languageName: node
|
||||
linkType: hard
|
||||
|
||||
"@next/swc-linux-arm64-gnu@npm:14.2.31":
|
||||
version: 14.2.31
|
||||
resolution: "@next/swc-linux-arm64-gnu@npm:14.2.31"
|
||||
conditions: os=linux & cpu=arm64 & libc=glibc
|
||||
languageName: node
|
||||
linkType: hard
|
||||
|
||||
"@next/swc-linux-arm64-gnu@npm:14.2.33":
|
||||
version: 14.2.33
|
||||
resolution: "@next/swc-linux-arm64-gnu@npm:14.2.33"
|
||||
@@ -10276,20 +10248,13 @@ __metadata:
|
||||
languageName: node
|
||||
linkType: hard
|
||||
|
||||
"@next/swc-linux-arm64-gnu@npm:15.2.2":
|
||||
version: 15.2.2
|
||||
resolution: "@next/swc-linux-arm64-gnu@npm:15.2.2"
|
||||
"@next/swc-linux-arm64-gnu@npm:15.2.3":
|
||||
version: 15.2.3
|
||||
resolution: "@next/swc-linux-arm64-gnu@npm:15.2.3"
|
||||
conditions: os=linux & cpu=arm64 & libc=glibc
|
||||
languageName: node
|
||||
linkType: hard
|
||||
|
||||
"@next/swc-linux-arm64-musl@npm:14.2.31":
|
||||
version: 14.2.31
|
||||
resolution: "@next/swc-linux-arm64-musl@npm:14.2.31"
|
||||
conditions: os=linux & cpu=arm64 & libc=musl
|
||||
languageName: node
|
||||
linkType: hard
|
||||
|
||||
"@next/swc-linux-arm64-musl@npm:14.2.33":
|
||||
version: 14.2.33
|
||||
resolution: "@next/swc-linux-arm64-musl@npm:14.2.33"
|
||||
@@ -10297,20 +10262,13 @@ __metadata:
|
||||
languageName: node
|
||||
linkType: hard
|
||||
|
||||
"@next/swc-linux-arm64-musl@npm:15.2.2":
|
||||
version: 15.2.2
|
||||
resolution: "@next/swc-linux-arm64-musl@npm:15.2.2"
|
||||
"@next/swc-linux-arm64-musl@npm:15.2.3":
|
||||
version: 15.2.3
|
||||
resolution: "@next/swc-linux-arm64-musl@npm:15.2.3"
|
||||
conditions: os=linux & cpu=arm64 & libc=musl
|
||||
languageName: node
|
||||
linkType: hard
|
||||
|
||||
"@next/swc-linux-x64-gnu@npm:14.2.31":
|
||||
version: 14.2.31
|
||||
resolution: "@next/swc-linux-x64-gnu@npm:14.2.31"
|
||||
conditions: os=linux & cpu=x64 & libc=glibc
|
||||
languageName: node
|
||||
linkType: hard
|
||||
|
||||
"@next/swc-linux-x64-gnu@npm:14.2.33":
|
||||
version: 14.2.33
|
||||
resolution: "@next/swc-linux-x64-gnu@npm:14.2.33"
|
||||
@@ -10318,20 +10276,13 @@ __metadata:
|
||||
languageName: node
|
||||
linkType: hard
|
||||
|
||||
"@next/swc-linux-x64-gnu@npm:15.2.2":
|
||||
version: 15.2.2
|
||||
resolution: "@next/swc-linux-x64-gnu@npm:15.2.2"
|
||||
"@next/swc-linux-x64-gnu@npm:15.2.3":
|
||||
version: 15.2.3
|
||||
resolution: "@next/swc-linux-x64-gnu@npm:15.2.3"
|
||||
conditions: os=linux & cpu=x64 & libc=glibc
|
||||
languageName: node
|
||||
linkType: hard
|
||||
|
||||
"@next/swc-linux-x64-musl@npm:14.2.31":
|
||||
version: 14.2.31
|
||||
resolution: "@next/swc-linux-x64-musl@npm:14.2.31"
|
||||
conditions: os=linux & cpu=x64 & libc=musl
|
||||
languageName: node
|
||||
linkType: hard
|
||||
|
||||
"@next/swc-linux-x64-musl@npm:14.2.33":
|
||||
version: 14.2.33
|
||||
resolution: "@next/swc-linux-x64-musl@npm:14.2.33"
|
||||
@@ -10339,20 +10290,13 @@ __metadata:
|
||||
languageName: node
|
||||
linkType: hard
|
||||
|
||||
"@next/swc-linux-x64-musl@npm:15.2.2":
|
||||
version: 15.2.2
|
||||
resolution: "@next/swc-linux-x64-musl@npm:15.2.2"
|
||||
"@next/swc-linux-x64-musl@npm:15.2.3":
|
||||
version: 15.2.3
|
||||
resolution: "@next/swc-linux-x64-musl@npm:15.2.3"
|
||||
conditions: os=linux & cpu=x64 & libc=musl
|
||||
languageName: node
|
||||
linkType: hard
|
||||
|
||||
"@next/swc-win32-arm64-msvc@npm:14.2.31":
|
||||
version: 14.2.31
|
||||
resolution: "@next/swc-win32-arm64-msvc@npm:14.2.31"
|
||||
conditions: os=win32 & cpu=arm64
|
||||
languageName: node
|
||||
linkType: hard
|
||||
|
||||
"@next/swc-win32-arm64-msvc@npm:14.2.33":
|
||||
version: 14.2.33
|
||||
resolution: "@next/swc-win32-arm64-msvc@npm:14.2.33"
|
||||
@@ -10360,20 +10304,13 @@ __metadata:
|
||||
languageName: node
|
||||
linkType: hard
|
||||
|
||||
"@next/swc-win32-arm64-msvc@npm:15.2.2":
|
||||
version: 15.2.2
|
||||
resolution: "@next/swc-win32-arm64-msvc@npm:15.2.2"
|
||||
"@next/swc-win32-arm64-msvc@npm:15.2.3":
|
||||
version: 15.2.3
|
||||
resolution: "@next/swc-win32-arm64-msvc@npm:15.2.3"
|
||||
conditions: os=win32 & cpu=arm64
|
||||
languageName: node
|
||||
linkType: hard
|
||||
|
||||
"@next/swc-win32-ia32-msvc@npm:14.2.31":
|
||||
version: 14.2.31
|
||||
resolution: "@next/swc-win32-ia32-msvc@npm:14.2.31"
|
||||
conditions: os=win32 & cpu=ia32
|
||||
languageName: node
|
||||
linkType: hard
|
||||
|
||||
"@next/swc-win32-ia32-msvc@npm:14.2.33":
|
||||
version: 14.2.33
|
||||
resolution: "@next/swc-win32-ia32-msvc@npm:14.2.33"
|
||||
@@ -10381,13 +10318,6 @@ __metadata:
|
||||
languageName: node
|
||||
linkType: hard
|
||||
|
||||
"@next/swc-win32-x64-msvc@npm:14.2.31":
|
||||
version: 14.2.31
|
||||
resolution: "@next/swc-win32-x64-msvc@npm:14.2.31"
|
||||
conditions: os=win32 & cpu=x64
|
||||
languageName: node
|
||||
linkType: hard
|
||||
|
||||
"@next/swc-win32-x64-msvc@npm:14.2.33":
|
||||
version: 14.2.33
|
||||
resolution: "@next/swc-win32-x64-msvc@npm:14.2.33"
|
||||
@@ -10395,9 +10325,9 @@ __metadata:
|
||||
languageName: node
|
||||
linkType: hard
|
||||
|
||||
"@next/swc-win32-x64-msvc@npm:15.2.2":
|
||||
version: 15.2.2
|
||||
resolution: "@next/swc-win32-x64-msvc@npm:15.2.2"
|
||||
"@next/swc-win32-x64-msvc@npm:15.2.3":
|
||||
version: 15.2.3
|
||||
resolution: "@next/swc-win32-x64-msvc@npm:15.2.3"
|
||||
conditions: os=win32 & cpu=x64
|
||||
languageName: node
|
||||
linkType: hard
|
||||
@@ -42879,19 +42809,19 @@ __metadata:
|
||||
languageName: node
|
||||
linkType: hard
|
||||
|
||||
"next@npm:15.2.2":
|
||||
version: 15.2.2
|
||||
resolution: "next@npm:15.2.2"
|
||||
"next@npm:15.2.3":
|
||||
version: 15.2.3
|
||||
resolution: "next@npm:15.2.3"
|
||||
dependencies:
|
||||
"@next/env": "npm:15.2.2"
|
||||
"@next/swc-darwin-arm64": "npm:15.2.2"
|
||||
"@next/swc-darwin-x64": "npm:15.2.2"
|
||||
"@next/swc-linux-arm64-gnu": "npm:15.2.2"
|
||||
"@next/swc-linux-arm64-musl": "npm:15.2.2"
|
||||
"@next/swc-linux-x64-gnu": "npm:15.2.2"
|
||||
"@next/swc-linux-x64-musl": "npm:15.2.2"
|
||||
"@next/swc-win32-arm64-msvc": "npm:15.2.2"
|
||||
"@next/swc-win32-x64-msvc": "npm:15.2.2"
|
||||
"@next/env": "npm:15.2.3"
|
||||
"@next/swc-darwin-arm64": "npm:15.2.3"
|
||||
"@next/swc-darwin-x64": "npm:15.2.3"
|
||||
"@next/swc-linux-arm64-gnu": "npm:15.2.3"
|
||||
"@next/swc-linux-arm64-musl": "npm:15.2.3"
|
||||
"@next/swc-linux-x64-gnu": "npm:15.2.3"
|
||||
"@next/swc-linux-x64-musl": "npm:15.2.3"
|
||||
"@next/swc-win32-arm64-msvc": "npm:15.2.3"
|
||||
"@next/swc-win32-x64-msvc": "npm:15.2.3"
|
||||
"@swc/counter": "npm:0.1.3"
|
||||
"@swc/helpers": "npm:0.5.15"
|
||||
busboy: "npm:1.6.0"
|
||||
@@ -42936,69 +42866,11 @@ __metadata:
|
||||
optional: true
|
||||
bin:
|
||||
next: dist/bin/next
|
||||
checksum: 10c0/ed303ae014fa8236afa556d178fe426a81aa2baebff912dfbfbb9178a955cbc7d528d27608b66d6d9fb5b33a415ad550cdd984d9b6dbc2a6ff7f2d991b760029
|
||||
checksum: 10c0/d9f374d42e422b1fc6ef3499e46318b572717c4dd35db04c25bec3b998e693d927ec8edaa7aa819f71aae7ae74645f498184e08ad261e35baeeaac560e915b9c
|
||||
languageName: node
|
||||
linkType: hard
|
||||
|
||||
"next@npm:^14":
|
||||
version: 14.2.31
|
||||
resolution: "next@npm:14.2.31"
|
||||
dependencies:
|
||||
"@next/env": "npm:14.2.31"
|
||||
"@next/swc-darwin-arm64": "npm:14.2.31"
|
||||
"@next/swc-darwin-x64": "npm:14.2.31"
|
||||
"@next/swc-linux-arm64-gnu": "npm:14.2.31"
|
||||
"@next/swc-linux-arm64-musl": "npm:14.2.31"
|
||||
"@next/swc-linux-x64-gnu": "npm:14.2.31"
|
||||
"@next/swc-linux-x64-musl": "npm:14.2.31"
|
||||
"@next/swc-win32-arm64-msvc": "npm:14.2.31"
|
||||
"@next/swc-win32-ia32-msvc": "npm:14.2.31"
|
||||
"@next/swc-win32-x64-msvc": "npm:14.2.31"
|
||||
"@swc/helpers": "npm:0.5.5"
|
||||
busboy: "npm:1.6.0"
|
||||
caniuse-lite: "npm:^1.0.30001579"
|
||||
graceful-fs: "npm:^4.2.11"
|
||||
postcss: "npm:8.4.31"
|
||||
styled-jsx: "npm:5.1.1"
|
||||
peerDependencies:
|
||||
"@opentelemetry/api": ^1.1.0
|
||||
"@playwright/test": ^1.41.2
|
||||
react: ^18.2.0
|
||||
react-dom: ^18.2.0
|
||||
sass: ^1.3.0
|
||||
dependenciesMeta:
|
||||
"@next/swc-darwin-arm64":
|
||||
optional: true
|
||||
"@next/swc-darwin-x64":
|
||||
optional: true
|
||||
"@next/swc-linux-arm64-gnu":
|
||||
optional: true
|
||||
"@next/swc-linux-arm64-musl":
|
||||
optional: true
|
||||
"@next/swc-linux-x64-gnu":
|
||||
optional: true
|
||||
"@next/swc-linux-x64-musl":
|
||||
optional: true
|
||||
"@next/swc-win32-arm64-msvc":
|
||||
optional: true
|
||||
"@next/swc-win32-ia32-msvc":
|
||||
optional: true
|
||||
"@next/swc-win32-x64-msvc":
|
||||
optional: true
|
||||
peerDependenciesMeta:
|
||||
"@opentelemetry/api":
|
||||
optional: true
|
||||
"@playwright/test":
|
||||
optional: true
|
||||
sass:
|
||||
optional: true
|
||||
bin:
|
||||
next: dist/bin/next
|
||||
checksum: 10c0/711214d4383f83fde847a90880876a2ddbac73b822a9384c0f0933d5e8e8618cdd13ca091f96fb8b0cfab68f6378ea47d01d52753cc996b25d9deb44341a8677
|
||||
languageName: node
|
||||
linkType: hard
|
||||
|
||||
"next@npm:^14.2.25":
|
||||
"next@npm:^14, next@npm:^14.2.25":
|
||||
version: 14.2.33
|
||||
resolution: "next@npm:14.2.33"
|
||||
dependencies:
|
||||
@@ -46619,9 +46491,9 @@ __metadata:
|
||||
languageName: node
|
||||
linkType: hard
|
||||
|
||||
"react-email@npm:4.0.3":
|
||||
version: 4.0.3
|
||||
resolution: "react-email@npm:4.0.3"
|
||||
"react-email@npm:4.0.4":
|
||||
version: 4.0.4
|
||||
resolution: "react-email@npm:4.0.4"
|
||||
dependencies:
|
||||
"@babel/parser": "npm:7.24.5"
|
||||
"@babel/traverse": "npm:7.25.6"
|
||||
@@ -46633,13 +46505,13 @@ __metadata:
|
||||
glob: "npm:10.3.4"
|
||||
log-symbols: "npm:4.1.0"
|
||||
mime-types: "npm:2.1.35"
|
||||
next: "npm:15.2.2"
|
||||
next: "npm:15.2.3"
|
||||
normalize-path: "npm:3.0.0"
|
||||
ora: "npm:5.4.1"
|
||||
socket.io: "npm:4.8.1"
|
||||
bin:
|
||||
email: dist/cli/index.js
|
||||
checksum: 10c0/8cb9833b1dabd69245458e916e6a2cbb3a06244267581dc7ac4a91318c51a5f2c451d8bcea4b9c0d2b9ce20f02edd7c89d14eae19d7c6eb92e51a61bf99d759a
|
||||
checksum: 10c0/1c2ad0037b26b40fb8ff08a8d1974ec1a4c181786f40ce2873bc57df90a604208c3d5a75d34cb3c452cbea3cb0912725615776e417d3f43d7ce03a8126f7b367
|
||||
languageName: node
|
||||
linkType: hard
|
||||
|
||||
@@ -51803,7 +51675,7 @@ __metadata:
|
||||
"@tiptap/core": "npm:^3.4.2"
|
||||
"@types/react": "npm:^19"
|
||||
"@types/react-dom": "npm:^19"
|
||||
react-email: "npm:4.0.3"
|
||||
react-email: "npm:4.0.4"
|
||||
twenty-shared: "workspace:*"
|
||||
peerDependencies:
|
||||
react: ^18.2.0 || ^19.0.0
|
||||
|
||||
Reference in New Issue
Block a user