fix: babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code (#15840)
Resolves [Dependabot Alert 95](https://github.com/twentyhq/twenty/security/dependabot/95) - babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code. These were the few options we had for a direct drop-in replacement. - [x-var](https://www.npmjs.com/package/x-var?activeTab=readme) - [cross-let](https://www.npmjs.com/package/cross-let) - [cross-var-no-babel](https://www.npmjs.com/package/cross-var-no-babel) x-var has the most weekly downloads among the three and it is also the most actively maintained fork of the original cross-var package that introduced the vulnerability. There is no syntax difference per the documentation, but I do not have a windows machine to test. `cross-var-no-babel` offers the most minimal changes, but is also abandoned without a public-facing repo.
This commit is contained in:
@@ -149,7 +149,6 @@
|
||||
"@yarnpkg/types": "^4.0.0",
|
||||
"chromatic": "^6.18.0",
|
||||
"concurrently": "^8.2.2",
|
||||
"cross-var": "^1.1.0",
|
||||
"danger": "^13.0.4",
|
||||
"dotenv-cli": "^7.4.4",
|
||||
"esbuild": "^0.25.10",
|
||||
|
||||
Reference in New Issue
Block a user