From 9d951757d84bc3b9f1ff15ceb2997ebdba08aae3 Mon Sep 17 00:00:00 2001
From: "Abdullah." <125115953+mabdullahabaid@users.noreply.github.com>
Date: Thu, 23 Oct 2025 16:34:22 +0500
Subject: [PATCH] fix: authorization bypass in next.js middleware (#15287)
Fixes [Dependabot Alert
216](https://github.com/twentyhq/twenty/security/dependabot/216) -
authorization bypass in next.js middleware.
Updated `react-email` version from `4.0.3` to `4.0.4`. This bumps up
Next.js to a safer version for the mentioned critical alert. However,
even the latest `react-email` package has not upgraded to Next.js 15.4.7
- the recommended version by dependabot.
Since `react-email` is a devDependency used to preview email templates
during development, it never gets inserted into the production build.
Therefore, I marking the following alerts as `vulnerable code is never
used` with a comment that it never makes it to the production build.
The only other place where we have next imported is twenty-website,
which uses the safe version `14.2.33`.
---
packages/twenty-emails/package.json | 2 +-
yarn.lock | 224 ++++++----------------------
2 files changed, 49 insertions(+), 177 deletions(-)
diff --git a/packages/twenty-emails/package.json b/packages/twenty-emails/package.json
index 07f3da620e..90a98aecf3 100644
--- a/packages/twenty-emails/package.json
+++ b/packages/twenty-emails/package.json
@@ -24,7 +24,7 @@
"@tiptap/core": "^3.4.2",
"@types/react": "^19",
"@types/react-dom": "^19",
- "react-email": "4.0.3"
+ "react-email": "4.0.4"
},
"exports": {
".": {
diff --git a/yarn.lock b/yarn.lock
index ecfa82b38f..9320f3545a 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -10190,13 +10190,6 @@ __metadata:
languageName: node
linkType: hard
-"@next/env@npm:14.2.31":
- version: 14.2.31
- resolution: "@next/env@npm:14.2.31"
- checksum: 10c0/56f9fd1521833341468543bbd9427b84f83539aefe04706013a33edc205fa69d473fa701fee0672248c64101ae764352d145c5e335f41ed588532446fd0d1e8d
- languageName: node
- linkType: hard
-
"@next/env@npm:14.2.33":
version: 14.2.33
resolution: "@next/env@npm:14.2.33"
@@ -10204,10 +10197,10 @@ __metadata:
languageName: node
linkType: hard
-"@next/env@npm:15.2.2":
- version: 15.2.2
- resolution: "@next/env@npm:15.2.2"
- checksum: 10c0/a5188353cbbb955f4c87b1d04f8d9419af3f05086b5bf640f456d3e0cd810f17811ca0a29a0b5e492d96ce636eeedc6e306f7dd191c82ff8076c00123481709c
+"@next/env@npm:15.2.3":
+ version: 15.2.3
+ resolution: "@next/env@npm:15.2.3"
+ checksum: 10c0/52e60419f71b991bdab23fc23f05d221dfe07b725140a110eedc158b2612cebcaa71a74726e2f78b1d53ae162ae0a745fdc3263a2bc76eda013cac057a30f05e
languageName: node
linkType: hard
@@ -10220,13 +10213,6 @@ __metadata:
languageName: node
linkType: hard
-"@next/swc-darwin-arm64@npm:14.2.31":
- version: 14.2.31
- resolution: "@next/swc-darwin-arm64@npm:14.2.31"
- conditions: os=darwin & cpu=arm64
- languageName: node
- linkType: hard
-
"@next/swc-darwin-arm64@npm:14.2.33":
version: 14.2.33
resolution: "@next/swc-darwin-arm64@npm:14.2.33"
@@ -10234,20 +10220,13 @@ __metadata:
languageName: node
linkType: hard
-"@next/swc-darwin-arm64@npm:15.2.2":
- version: 15.2.2
- resolution: "@next/swc-darwin-arm64@npm:15.2.2"
+"@next/swc-darwin-arm64@npm:15.2.3":
+ version: 15.2.3
+ resolution: "@next/swc-darwin-arm64@npm:15.2.3"
conditions: os=darwin & cpu=arm64
languageName: node
linkType: hard
-"@next/swc-darwin-x64@npm:14.2.31":
- version: 14.2.31
- resolution: "@next/swc-darwin-x64@npm:14.2.31"
- conditions: os=darwin & cpu=x64
- languageName: node
- linkType: hard
-
"@next/swc-darwin-x64@npm:14.2.33":
version: 14.2.33
resolution: "@next/swc-darwin-x64@npm:14.2.33"
@@ -10255,20 +10234,13 @@ __metadata:
languageName: node
linkType: hard
-"@next/swc-darwin-x64@npm:15.2.2":
- version: 15.2.2
- resolution: "@next/swc-darwin-x64@npm:15.2.2"
+"@next/swc-darwin-x64@npm:15.2.3":
+ version: 15.2.3
+ resolution: "@next/swc-darwin-x64@npm:15.2.3"
conditions: os=darwin & cpu=x64
languageName: node
linkType: hard
-"@next/swc-linux-arm64-gnu@npm:14.2.31":
- version: 14.2.31
- resolution: "@next/swc-linux-arm64-gnu@npm:14.2.31"
- conditions: os=linux & cpu=arm64 & libc=glibc
- languageName: node
- linkType: hard
-
"@next/swc-linux-arm64-gnu@npm:14.2.33":
version: 14.2.33
resolution: "@next/swc-linux-arm64-gnu@npm:14.2.33"
@@ -10276,20 +10248,13 @@ __metadata:
languageName: node
linkType: hard
-"@next/swc-linux-arm64-gnu@npm:15.2.2":
- version: 15.2.2
- resolution: "@next/swc-linux-arm64-gnu@npm:15.2.2"
+"@next/swc-linux-arm64-gnu@npm:15.2.3":
+ version: 15.2.3
+ resolution: "@next/swc-linux-arm64-gnu@npm:15.2.3"
conditions: os=linux & cpu=arm64 & libc=glibc
languageName: node
linkType: hard
-"@next/swc-linux-arm64-musl@npm:14.2.31":
- version: 14.2.31
- resolution: "@next/swc-linux-arm64-musl@npm:14.2.31"
- conditions: os=linux & cpu=arm64 & libc=musl
- languageName: node
- linkType: hard
-
"@next/swc-linux-arm64-musl@npm:14.2.33":
version: 14.2.33
resolution: "@next/swc-linux-arm64-musl@npm:14.2.33"
@@ -10297,20 +10262,13 @@ __metadata:
languageName: node
linkType: hard
-"@next/swc-linux-arm64-musl@npm:15.2.2":
- version: 15.2.2
- resolution: "@next/swc-linux-arm64-musl@npm:15.2.2"
+"@next/swc-linux-arm64-musl@npm:15.2.3":
+ version: 15.2.3
+ resolution: "@next/swc-linux-arm64-musl@npm:15.2.3"
conditions: os=linux & cpu=arm64 & libc=musl
languageName: node
linkType: hard
-"@next/swc-linux-x64-gnu@npm:14.2.31":
- version: 14.2.31
- resolution: "@next/swc-linux-x64-gnu@npm:14.2.31"
- conditions: os=linux & cpu=x64 & libc=glibc
- languageName: node
- linkType: hard
-
"@next/swc-linux-x64-gnu@npm:14.2.33":
version: 14.2.33
resolution: "@next/swc-linux-x64-gnu@npm:14.2.33"
@@ -10318,20 +10276,13 @@ __metadata:
languageName: node
linkType: hard
-"@next/swc-linux-x64-gnu@npm:15.2.2":
- version: 15.2.2
- resolution: "@next/swc-linux-x64-gnu@npm:15.2.2"
+"@next/swc-linux-x64-gnu@npm:15.2.3":
+ version: 15.2.3
+ resolution: "@next/swc-linux-x64-gnu@npm:15.2.3"
conditions: os=linux & cpu=x64 & libc=glibc
languageName: node
linkType: hard
-"@next/swc-linux-x64-musl@npm:14.2.31":
- version: 14.2.31
- resolution: "@next/swc-linux-x64-musl@npm:14.2.31"
- conditions: os=linux & cpu=x64 & libc=musl
- languageName: node
- linkType: hard
-
"@next/swc-linux-x64-musl@npm:14.2.33":
version: 14.2.33
resolution: "@next/swc-linux-x64-musl@npm:14.2.33"
@@ -10339,20 +10290,13 @@ __metadata:
languageName: node
linkType: hard
-"@next/swc-linux-x64-musl@npm:15.2.2":
- version: 15.2.2
- resolution: "@next/swc-linux-x64-musl@npm:15.2.2"
+"@next/swc-linux-x64-musl@npm:15.2.3":
+ version: 15.2.3
+ resolution: "@next/swc-linux-x64-musl@npm:15.2.3"
conditions: os=linux & cpu=x64 & libc=musl
languageName: node
linkType: hard
-"@next/swc-win32-arm64-msvc@npm:14.2.31":
- version: 14.2.31
- resolution: "@next/swc-win32-arm64-msvc@npm:14.2.31"
- conditions: os=win32 & cpu=arm64
- languageName: node
- linkType: hard
-
"@next/swc-win32-arm64-msvc@npm:14.2.33":
version: 14.2.33
resolution: "@next/swc-win32-arm64-msvc@npm:14.2.33"
@@ -10360,20 +10304,13 @@ __metadata:
languageName: node
linkType: hard
-"@next/swc-win32-arm64-msvc@npm:15.2.2":
- version: 15.2.2
- resolution: "@next/swc-win32-arm64-msvc@npm:15.2.2"
+"@next/swc-win32-arm64-msvc@npm:15.2.3":
+ version: 15.2.3
+ resolution: "@next/swc-win32-arm64-msvc@npm:15.2.3"
conditions: os=win32 & cpu=arm64
languageName: node
linkType: hard
-"@next/swc-win32-ia32-msvc@npm:14.2.31":
- version: 14.2.31
- resolution: "@next/swc-win32-ia32-msvc@npm:14.2.31"
- conditions: os=win32 & cpu=ia32
- languageName: node
- linkType: hard
-
"@next/swc-win32-ia32-msvc@npm:14.2.33":
version: 14.2.33
resolution: "@next/swc-win32-ia32-msvc@npm:14.2.33"
@@ -10381,13 +10318,6 @@ __metadata:
languageName: node
linkType: hard
-"@next/swc-win32-x64-msvc@npm:14.2.31":
- version: 14.2.31
- resolution: "@next/swc-win32-x64-msvc@npm:14.2.31"
- conditions: os=win32 & cpu=x64
- languageName: node
- linkType: hard
-
"@next/swc-win32-x64-msvc@npm:14.2.33":
version: 14.2.33
resolution: "@next/swc-win32-x64-msvc@npm:14.2.33"
@@ -10395,9 +10325,9 @@ __metadata:
languageName: node
linkType: hard
-"@next/swc-win32-x64-msvc@npm:15.2.2":
- version: 15.2.2
- resolution: "@next/swc-win32-x64-msvc@npm:15.2.2"
+"@next/swc-win32-x64-msvc@npm:15.2.3":
+ version: 15.2.3
+ resolution: "@next/swc-win32-x64-msvc@npm:15.2.3"
conditions: os=win32 & cpu=x64
languageName: node
linkType: hard
@@ -42879,19 +42809,19 @@ __metadata:
languageName: node
linkType: hard
-"next@npm:15.2.2":
- version: 15.2.2
- resolution: "next@npm:15.2.2"
+"next@npm:15.2.3":
+ version: 15.2.3
+ resolution: "next@npm:15.2.3"
dependencies:
- "@next/env": "npm:15.2.2"
- "@next/swc-darwin-arm64": "npm:15.2.2"
- "@next/swc-darwin-x64": "npm:15.2.2"
- "@next/swc-linux-arm64-gnu": "npm:15.2.2"
- "@next/swc-linux-arm64-musl": "npm:15.2.2"
- "@next/swc-linux-x64-gnu": "npm:15.2.2"
- "@next/swc-linux-x64-musl": "npm:15.2.2"
- "@next/swc-win32-arm64-msvc": "npm:15.2.2"
- "@next/swc-win32-x64-msvc": "npm:15.2.2"
+ "@next/env": "npm:15.2.3"
+ "@next/swc-darwin-arm64": "npm:15.2.3"
+ "@next/swc-darwin-x64": "npm:15.2.3"
+ "@next/swc-linux-arm64-gnu": "npm:15.2.3"
+ "@next/swc-linux-arm64-musl": "npm:15.2.3"
+ "@next/swc-linux-x64-gnu": "npm:15.2.3"
+ "@next/swc-linux-x64-musl": "npm:15.2.3"
+ "@next/swc-win32-arm64-msvc": "npm:15.2.3"
+ "@next/swc-win32-x64-msvc": "npm:15.2.3"
"@swc/counter": "npm:0.1.3"
"@swc/helpers": "npm:0.5.15"
busboy: "npm:1.6.0"
@@ -42936,69 +42866,11 @@ __metadata:
optional: true
bin:
next: dist/bin/next
- checksum: 10c0/ed303ae014fa8236afa556d178fe426a81aa2baebff912dfbfbb9178a955cbc7d528d27608b66d6d9fb5b33a415ad550cdd984d9b6dbc2a6ff7f2d991b760029
+ checksum: 10c0/d9f374d42e422b1fc6ef3499e46318b572717c4dd35db04c25bec3b998e693d927ec8edaa7aa819f71aae7ae74645f498184e08ad261e35baeeaac560e915b9c
languageName: node
linkType: hard
-"next@npm:^14":
- version: 14.2.31
- resolution: "next@npm:14.2.31"
- dependencies:
- "@next/env": "npm:14.2.31"
- "@next/swc-darwin-arm64": "npm:14.2.31"
- "@next/swc-darwin-x64": "npm:14.2.31"
- "@next/swc-linux-arm64-gnu": "npm:14.2.31"
- "@next/swc-linux-arm64-musl": "npm:14.2.31"
- "@next/swc-linux-x64-gnu": "npm:14.2.31"
- "@next/swc-linux-x64-musl": "npm:14.2.31"
- "@next/swc-win32-arm64-msvc": "npm:14.2.31"
- "@next/swc-win32-ia32-msvc": "npm:14.2.31"
- "@next/swc-win32-x64-msvc": "npm:14.2.31"
- "@swc/helpers": "npm:0.5.5"
- busboy: "npm:1.6.0"
- caniuse-lite: "npm:^1.0.30001579"
- graceful-fs: "npm:^4.2.11"
- postcss: "npm:8.4.31"
- styled-jsx: "npm:5.1.1"
- peerDependencies:
- "@opentelemetry/api": ^1.1.0
- "@playwright/test": ^1.41.2
- react: ^18.2.0
- react-dom: ^18.2.0
- sass: ^1.3.0
- dependenciesMeta:
- "@next/swc-darwin-arm64":
- optional: true
- "@next/swc-darwin-x64":
- optional: true
- "@next/swc-linux-arm64-gnu":
- optional: true
- "@next/swc-linux-arm64-musl":
- optional: true
- "@next/swc-linux-x64-gnu":
- optional: true
- "@next/swc-linux-x64-musl":
- optional: true
- "@next/swc-win32-arm64-msvc":
- optional: true
- "@next/swc-win32-ia32-msvc":
- optional: true
- "@next/swc-win32-x64-msvc":
- optional: true
- peerDependenciesMeta:
- "@opentelemetry/api":
- optional: true
- "@playwright/test":
- optional: true
- sass:
- optional: true
- bin:
- next: dist/bin/next
- checksum: 10c0/711214d4383f83fde847a90880876a2ddbac73b822a9384c0f0933d5e8e8618cdd13ca091f96fb8b0cfab68f6378ea47d01d52753cc996b25d9deb44341a8677
- languageName: node
- linkType: hard
-
-"next@npm:^14.2.25":
+"next@npm:^14, next@npm:^14.2.25":
version: 14.2.33
resolution: "next@npm:14.2.33"
dependencies:
@@ -46619,9 +46491,9 @@ __metadata:
languageName: node
linkType: hard
-"react-email@npm:4.0.3":
- version: 4.0.3
- resolution: "react-email@npm:4.0.3"
+"react-email@npm:4.0.4":
+ version: 4.0.4
+ resolution: "react-email@npm:4.0.4"
dependencies:
"@babel/parser": "npm:7.24.5"
"@babel/traverse": "npm:7.25.6"
@@ -46633,13 +46505,13 @@ __metadata:
glob: "npm:10.3.4"
log-symbols: "npm:4.1.0"
mime-types: "npm:2.1.35"
- next: "npm:15.2.2"
+ next: "npm:15.2.3"
normalize-path: "npm:3.0.0"
ora: "npm:5.4.1"
socket.io: "npm:4.8.1"
bin:
email: dist/cli/index.js
- checksum: 10c0/8cb9833b1dabd69245458e916e6a2cbb3a06244267581dc7ac4a91318c51a5f2c451d8bcea4b9c0d2b9ce20f02edd7c89d14eae19d7c6eb92e51a61bf99d759a
+ checksum: 10c0/1c2ad0037b26b40fb8ff08a8d1974ec1a4c181786f40ce2873bc57df90a604208c3d5a75d34cb3c452cbea3cb0912725615776e417d3f43d7ce03a8126f7b367
languageName: node
linkType: hard
@@ -51803,7 +51675,7 @@ __metadata:
"@tiptap/core": "npm:^3.4.2"
"@types/react": "npm:^19"
"@types/react-dom": "npm:^19"
- react-email: "npm:4.0.3"
+ react-email: "npm:4.0.4"
twenty-shared: "workspace:*"
peerDependencies:
react: ^18.2.0 || ^19.0.0