houseassassin/twenty
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

chore(security): bump esbuild to ^0.28.0 to clear CVE-2025-68121 (CVSS 10.0) (#20902)

Browse Source 
## Summary

Follow-up to #20876. That PR bumped `esbuild` to `^0.27.3` to address
the Go-stdlib CVEs the self-hoster reported, but only one of the two Go
CVEs is actually fixed at that level. This PR closes the remaining gap.

### Why 0.27.3 wasn't enough

`esbuild` ships a Go-built binary inside the `@esbuild/<platform>`
packages. The vulnerability lives in the bundled Go toolchain, not in
any JavaScript. Verified by reading the Go `buildinfo` section from
`node_modules/@esbuild/<platform>/bin/esbuild`:

- `esbuild@0.27.7` → built with **Go 1.23.8**
- `esbuild@0.28.0` → built with **Go 1.26.1**

CVE-2024-24790 (IPv6 zone parsing) is fixed in Go 1.21.11 / 1.22.4, so
0.27.x covers it.

**CVE-2025-68121** (crypto/tls cert validation bypass via TLS session
resumption, **CVSS 10.0 / Critical** per
[NVD](https://nvd.nist.gov/vuln/detail/cve-2025-68121)) is fixed only in
Go 1.24.13, 1.25.7, and 1.26.0-rc.3+. Go 1.23.x is past Go's support
window and will not receive this fix. So `esbuild@0.27.x` still ships a
Go binary that Trivy correctly flags as vulnerable.

### Reachable risk in Twenty

Low. `esbuild` does not use `crypto/tls` at runtime — it reads files,
parses, transforms, and writes. The vulnerable code path is dead code
inside the binary, present but never executed. The scan finding is what
we are clearing, not an exploitation risk.

### Fix

Bump `twenty-client-sdk`'s `esbuild` from `^0.27.3` to `^0.28.0`
(resolves to 0.28.0, built with Go 1.26.1).

### Verification

Ran `yarn workspaces focus --production twenty twenty-server
twenty-emails twenty-shared twenty-client-sdk` (the same install the
Dockerfile uses) and confirmed:

- `node_modules/esbuild/` resolves to `esbuild@0.28.0` (single copy)
- The bundled `node_modules/@esbuild/<platform>/bin/esbuild` binary
reports `go1.26.1` in its `buildinfo`

## Test plan

- [x] `nx typecheck twenty-server` passes
- [x] `nx build twenty-client-sdk` passes (esbuild's `build()` API is
stable across 0.27 → 0.28)
- [x] Production focus install shows Go 1.26.1 in the shipped binary
- [ ] CI green
- [ ] Re-run Trivy against the resulting image; confirm CVE-2025-68121
no longer appears
This commit is contained in:
Charles Bochet
2026-05-26 11:49:25 +02:00
committed by GitHub
parent 7ca9081efa
commit e72d10f550
2 changed files with 110 additions and 110 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/twenty-client-sdk/package.json
+1 -1
View File
@@ -42,7 +42,7 @@
"dependencies": {
"@genql/cli": "^3.0.3",
"@genql/runtime": "^2.10.0",
"esbuild": "^0.27.3",
"esbuild": "^0.28.0",
"graphql": "^16.8.1"
},
"devDependencies": {
yarn.lock
+109 -109
View File
@@ -5945,9 +5945,9 @@ __metadata:
languageName: node
linkType: hard
"@esbuild/aix-ppc64@npm:0.27.7":
version: 0.27.7
resolution: "@esbuild/aix-ppc64@npm:0.27.7"
"@esbuild/aix-ppc64@npm:0.28.0":
version: 0.28.0
resolution: "@esbuild/aix-ppc64@npm:0.28.0"
conditions: os=aix & cpu=ppc64
languageName: node
linkType: hard
@@ -5994,9 +5994,9 @@ __metadata:
languageName: node
linkType: hard
"@esbuild/android-arm64@npm:0.27.7":
version: 0.27.7
resolution: "@esbuild/android-arm64@npm:0.27.7"
"@esbuild/android-arm64@npm:0.28.0":
version: 0.28.0
resolution: "@esbuild/android-arm64@npm:0.28.0"
conditions: os=android & cpu=arm64
languageName: node
linkType: hard
@@ -6043,9 +6043,9 @@ __metadata:
languageName: node
linkType: hard
"@esbuild/android-arm@npm:0.27.7":
version: 0.27.7
resolution: "@esbuild/android-arm@npm:0.27.7"
"@esbuild/android-arm@npm:0.28.0":
version: 0.28.0
resolution: "@esbuild/android-arm@npm:0.28.0"
conditions: os=android & cpu=arm
languageName: node
linkType: hard
@@ -6092,9 +6092,9 @@ __metadata:
languageName: node
linkType: hard
"@esbuild/android-x64@npm:0.27.7":
version: 0.27.7
resolution: "@esbuild/android-x64@npm:0.27.7"
"@esbuild/android-x64@npm:0.28.0":
version: 0.28.0
resolution: "@esbuild/android-x64@npm:0.28.0"
conditions: os=android & cpu=x64
languageName: node
linkType: hard
@@ -6141,9 +6141,9 @@ __metadata:
languageName: node
linkType: hard
"@esbuild/darwin-arm64@npm:0.27.7":
version: 0.27.7
resolution: "@esbuild/darwin-arm64@npm:0.27.7"
"@esbuild/darwin-arm64@npm:0.28.0":
version: 0.28.0
resolution: "@esbuild/darwin-arm64@npm:0.28.0"
conditions: os=darwin & cpu=arm64
languageName: node
linkType: hard
@@ -6190,9 +6190,9 @@ __metadata:
languageName: node
linkType: hard
"@esbuild/darwin-x64@npm:0.27.7":
version: 0.27.7
resolution: "@esbuild/darwin-x64@npm:0.27.7"
"@esbuild/darwin-x64@npm:0.28.0":
version: 0.28.0
resolution: "@esbuild/darwin-x64@npm:0.28.0"
conditions: os=darwin & cpu=x64
languageName: node
linkType: hard
@@ -6239,9 +6239,9 @@ __metadata:
languageName: node
linkType: hard
"@esbuild/freebsd-arm64@npm:0.27.7":
version: 0.27.7
resolution: "@esbuild/freebsd-arm64@npm:0.27.7"
"@esbuild/freebsd-arm64@npm:0.28.0":
version: 0.28.0
resolution: "@esbuild/freebsd-arm64@npm:0.28.0"
conditions: os=freebsd & cpu=arm64
languageName: node
linkType: hard
@@ -6288,9 +6288,9 @@ __metadata:
languageName: node
linkType: hard
"@esbuild/freebsd-x64@npm:0.27.7":
version: 0.27.7
resolution: "@esbuild/freebsd-x64@npm:0.27.7"
"@esbuild/freebsd-x64@npm:0.28.0":
version: 0.28.0
resolution: "@esbuild/freebsd-x64@npm:0.28.0"
conditions: os=freebsd & cpu=x64
languageName: node
linkType: hard
@@ -6337,9 +6337,9 @@ __metadata:
languageName: node
linkType: hard
"@esbuild/linux-arm64@npm:0.27.7":
version: 0.27.7
resolution: "@esbuild/linux-arm64@npm:0.27.7"
"@esbuild/linux-arm64@npm:0.28.0":
version: 0.28.0
resolution: "@esbuild/linux-arm64@npm:0.28.0"
conditions: os=linux & cpu=arm64
languageName: node
linkType: hard
@@ -6386,9 +6386,9 @@ __metadata:
languageName: node
linkType: hard
"@esbuild/linux-arm@npm:0.27.7":
version: 0.27.7
resolution: "@esbuild/linux-arm@npm:0.27.7"
"@esbuild/linux-arm@npm:0.28.0":
version: 0.28.0
resolution: "@esbuild/linux-arm@npm:0.28.0"
conditions: os=linux & cpu=arm
languageName: node
linkType: hard
@@ -6435,9 +6435,9 @@ __metadata:
languageName: node
linkType: hard
"@esbuild/linux-ia32@npm:0.27.7":
version: 0.27.7
resolution: "@esbuild/linux-ia32@npm:0.27.7"
"@esbuild/linux-ia32@npm:0.28.0":
version: 0.28.0
resolution: "@esbuild/linux-ia32@npm:0.28.0"
conditions: os=linux & cpu=ia32
languageName: node
linkType: hard
@@ -6484,9 +6484,9 @@ __metadata:
languageName: node
linkType: hard
"@esbuild/linux-loong64@npm:0.27.7":
version: 0.27.7
resolution: "@esbuild/linux-loong64@npm:0.27.7"
"@esbuild/linux-loong64@npm:0.28.0":
version: 0.28.0
resolution: "@esbuild/linux-loong64@npm:0.28.0"
conditions: os=linux & cpu=loong64
languageName: node
linkType: hard
@@ -6533,9 +6533,9 @@ __metadata:
languageName: node
linkType: hard
"@esbuild/linux-mips64el@npm:0.27.7":
version: 0.27.7
resolution: "@esbuild/linux-mips64el@npm:0.27.7"
"@esbuild/linux-mips64el@npm:0.28.0":
version: 0.28.0
resolution: "@esbuild/linux-mips64el@npm:0.28.0"
conditions: os=linux & cpu=mips64el
languageName: node
linkType: hard
@@ -6582,9 +6582,9 @@ __metadata:
languageName: node
linkType: hard
"@esbuild/linux-ppc64@npm:0.27.7":
version: 0.27.7
resolution: "@esbuild/linux-ppc64@npm:0.27.7"
"@esbuild/linux-ppc64@npm:0.28.0":
version: 0.28.0
resolution: "@esbuild/linux-ppc64@npm:0.28.0"
conditions: os=linux & cpu=ppc64
languageName: node
linkType: hard
@@ -6631,9 +6631,9 @@ __metadata:
languageName: node
linkType: hard
"@esbuild/linux-riscv64@npm:0.27.7":
version: 0.27.7
resolution: "@esbuild/linux-riscv64@npm:0.27.7"
"@esbuild/linux-riscv64@npm:0.28.0":
version: 0.28.0
resolution: "@esbuild/linux-riscv64@npm:0.28.0"
conditions: os=linux & cpu=riscv64
languageName: node
linkType: hard
@@ -6680,9 +6680,9 @@ __metadata:
languageName: node
linkType: hard
"@esbuild/linux-s390x@npm:0.27.7":
version: 0.27.7
resolution: "@esbuild/linux-s390x@npm:0.27.7"
"@esbuild/linux-s390x@npm:0.28.0":
version: 0.28.0
resolution: "@esbuild/linux-s390x@npm:0.28.0"
conditions: os=linux & cpu=s390x
languageName: node
linkType: hard
@@ -6729,9 +6729,9 @@ __metadata:
languageName: node
linkType: hard
"@esbuild/linux-x64@npm:0.27.7":
version: 0.27.7
resolution: "@esbuild/linux-x64@npm:0.27.7"
"@esbuild/linux-x64@npm:0.28.0":
version: 0.28.0
resolution: "@esbuild/linux-x64@npm:0.28.0"
conditions: os=linux & cpu=x64
languageName: node
linkType: hard
@@ -6771,9 +6771,9 @@ __metadata:
languageName: node
linkType: hard
"@esbuild/netbsd-arm64@npm:0.27.7":
version: 0.27.7
resolution: "@esbuild/netbsd-arm64@npm:0.27.7"
"@esbuild/netbsd-arm64@npm:0.28.0":
version: 0.28.0
resolution: "@esbuild/netbsd-arm64@npm:0.28.0"
conditions: os=netbsd & cpu=arm64
languageName: node
linkType: hard
@@ -6820,9 +6820,9 @@ __metadata:
languageName: node
linkType: hard
"@esbuild/netbsd-x64@npm:0.27.7":
version: 0.27.7
resolution: "@esbuild/netbsd-x64@npm:0.27.7"
"@esbuild/netbsd-x64@npm:0.28.0":
version: 0.28.0
resolution: "@esbuild/netbsd-x64@npm:0.28.0"
conditions: os=netbsd & cpu=x64
languageName: node
linkType: hard
@@ -6862,9 +6862,9 @@ __metadata:
languageName: node
linkType: hard
"@esbuild/openbsd-arm64@npm:0.27.7":
version: 0.27.7
resolution: "@esbuild/openbsd-arm64@npm:0.27.7"
"@esbuild/openbsd-arm64@npm:0.28.0":
version: 0.28.0
resolution: "@esbuild/openbsd-arm64@npm:0.28.0"
conditions: os=openbsd & cpu=arm64
languageName: node
linkType: hard
@@ -6911,9 +6911,9 @@ __metadata:
languageName: node
linkType: hard
"@esbuild/openbsd-x64@npm:0.27.7":
version: 0.27.7
resolution: "@esbuild/openbsd-x64@npm:0.27.7"
"@esbuild/openbsd-x64@npm:0.28.0":
version: 0.28.0
resolution: "@esbuild/openbsd-x64@npm:0.28.0"
conditions: os=openbsd & cpu=x64
languageName: node
linkType: hard
@@ -6939,9 +6939,9 @@ __metadata:
languageName: node
linkType: hard
"@esbuild/openharmony-arm64@npm:0.27.7":
version: 0.27.7
resolution: "@esbuild/openharmony-arm64@npm:0.27.7"
"@esbuild/openharmony-arm64@npm:0.28.0":
version: 0.28.0
resolution: "@esbuild/openharmony-arm64@npm:0.28.0"
conditions: os=openharmony & cpu=arm64
languageName: node
linkType: hard
@@ -6988,9 +6988,9 @@ __metadata:
languageName: node
linkType: hard
"@esbuild/sunos-x64@npm:0.27.7":
version: 0.27.7
resolution: "@esbuild/sunos-x64@npm:0.27.7"
"@esbuild/sunos-x64@npm:0.28.0":
version: 0.28.0
resolution: "@esbuild/sunos-x64@npm:0.28.0"
conditions: os=sunos & cpu=x64
languageName: node
linkType: hard
@@ -7037,9 +7037,9 @@ __metadata:
languageName: node
linkType: hard
"@esbuild/win32-arm64@npm:0.27.7":
version: 0.27.7
resolution: "@esbuild/win32-arm64@npm:0.27.7"
"@esbuild/win32-arm64@npm:0.28.0":
version: 0.28.0
resolution: "@esbuild/win32-arm64@npm:0.28.0"
conditions: os=win32 & cpu=arm64
languageName: node
linkType: hard
@@ -7086,9 +7086,9 @@ __metadata:
languageName: node
linkType: hard
"@esbuild/win32-ia32@npm:0.27.7":
version: 0.27.7
resolution: "@esbuild/win32-ia32@npm:0.27.7"
"@esbuild/win32-ia32@npm:0.28.0":
version: 0.28.0
resolution: "@esbuild/win32-ia32@npm:0.28.0"
conditions: os=win32 & cpu=ia32
languageName: node
linkType: hard
@@ -7135,9 +7135,9 @@ __metadata:
languageName: node
linkType: hard
"@esbuild/win32-x64@npm:0.27.7":
version: 0.27.7
resolution: "@esbuild/win32-x64@npm:0.27.7"
"@esbuild/win32-x64@npm:0.28.0":
version: 0.28.0
resolution: "@esbuild/win32-x64@npm:0.28.0"
conditions: os=win32 & cpu=x64
languageName: node
linkType: hard
@@ -35094,36 +35094,36 @@ __metadata:
languageName: node
linkType: hard
"esbuild@npm:^0.27.3":
version: 0.27.7
resolution: "esbuild@npm:0.27.7"
"esbuild@npm:^0.28.0":
version: 0.28.0
resolution: "esbuild@npm:0.28.0"
dependencies:
"@esbuild/aix-ppc64": "npm:0.27.7"
"@esbuild/android-arm": "npm:0.27.7"
"@esbuild/android-arm64": "npm:0.27.7"
"@esbuild/android-x64": "npm:0.27.7"
"@esbuild/darwin-arm64": "npm:0.27.7"
"@esbuild/darwin-x64": "npm:0.27.7"
"@esbuild/freebsd-arm64": "npm:0.27.7"
"@esbuild/freebsd-x64": "npm:0.27.7"
"@esbuild/linux-arm": "npm:0.27.7"
"@esbuild/linux-arm64": "npm:0.27.7"
"@esbuild/linux-ia32": "npm:0.27.7"
"@esbuild/linux-loong64": "npm:0.27.7"
"@esbuild/linux-mips64el": "npm:0.27.7"
"@esbuild/linux-ppc64": "npm:0.27.7"
"@esbuild/linux-riscv64": "npm:0.27.7"
"@esbuild/linux-s390x": "npm:0.27.7"
"@esbuild/linux-x64": "npm:0.27.7"
"@esbuild/netbsd-arm64": "npm:0.27.7"
"@esbuild/netbsd-x64": "npm:0.27.7"
"@esbuild/openbsd-arm64": "npm:0.27.7"
"@esbuild/openbsd-x64": "npm:0.27.7"
"@esbuild/openharmony-arm64": "npm:0.27.7"
"@esbuild/sunos-x64": "npm:0.27.7"
"@esbuild/win32-arm64": "npm:0.27.7"
"@esbuild/win32-ia32": "npm:0.27.7"
"@esbuild/win32-x64": "npm:0.27.7"
"@esbuild/aix-ppc64": "npm:0.28.0"
"@esbuild/android-arm": "npm:0.28.0"
"@esbuild/android-arm64": "npm:0.28.0"
"@esbuild/android-x64": "npm:0.28.0"
"@esbuild/darwin-arm64": "npm:0.28.0"
"@esbuild/darwin-x64": "npm:0.28.0"
"@esbuild/freebsd-arm64": "npm:0.28.0"
"@esbuild/freebsd-x64": "npm:0.28.0"
"@esbuild/linux-arm": "npm:0.28.0"
"@esbuild/linux-arm64": "npm:0.28.0"
"@esbuild/linux-ia32": "npm:0.28.0"
"@esbuild/linux-loong64": "npm:0.28.0"
"@esbuild/linux-mips64el": "npm:0.28.0"
"@esbuild/linux-ppc64": "npm:0.28.0"
"@esbuild/linux-riscv64": "npm:0.28.0"
"@esbuild/linux-s390x": "npm:0.28.0"
"@esbuild/linux-x64": "npm:0.28.0"
"@esbuild/netbsd-arm64": "npm:0.28.0"
"@esbuild/netbsd-x64": "npm:0.28.0"
"@esbuild/openbsd-arm64": "npm:0.28.0"
"@esbuild/openbsd-x64": "npm:0.28.0"
"@esbuild/openharmony-arm64": "npm:0.28.0"
"@esbuild/sunos-x64": "npm:0.28.0"
"@esbuild/win32-arm64": "npm:0.28.0"
"@esbuild/win32-ia32": "npm:0.28.0"
"@esbuild/win32-x64": "npm:0.28.0"
dependenciesMeta:
"@esbuild/aix-ppc64":
optional: true
@@ -35179,7 +35179,7 @@ __metadata:
optional: true
bin:
esbuild: bin/esbuild
checksum: 10c0/ccd51f0555708bc9ff4ec9dc3ac92d3daacd45ecaac949ca8645984c5c323bf8cefe98c2df307418685e0b4ce37f9a3bdbfe8e3651fe632a0059a436195a17d4
checksum: 10c0/8acd95c238ec6c4a9d16163277faf228a8994b642d187b3fe667ffbb469008e6748cde144fdc3c175bf8e78ee49e15a0ed9b9f183fdb5fcea1772f87fb1372a4
languageName: node
linkType: hard
@@ -56348,7 +56348,7 @@ __metadata:
"@genql/cli": "npm:^3.0.3"
"@genql/runtime": "npm:^2.10.0"
"@typescript/native-preview": "npm:^7.0.0-dev.20260116.1"
esbuild: "npm:^0.27.3"
esbuild: "npm:^0.28.0"
graphql: "npm:^16.8.1"
tsc-alias: "npm:^1.8.16"
twenty-shared: "workspace:*"