From e72d10f5508518d54560e264ac24e5836ff3b32e Mon Sep 17 00:00:00 2001 From: Charles Bochet Date: Tue, 26 May 2026 11:49:25 +0200 Subject: [PATCH] chore(security): bump esbuild to ^0.28.0 to clear CVE-2025-68121 (CVSS 10.0) (#20902) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Summary Follow-up to #20876. That PR bumped `esbuild` to `^0.27.3` to address the Go-stdlib CVEs the self-hoster reported, but only one of the two Go CVEs is actually fixed at that level. This PR closes the remaining gap. ### Why 0.27.3 wasn't enough `esbuild` ships a Go-built binary inside the `@esbuild/` packages. The vulnerability lives in the bundled Go toolchain, not in any JavaScript. Verified by reading the Go `buildinfo` section from `node_modules/@esbuild//bin/esbuild`: - `esbuild@0.27.7` → built with **Go 1.23.8** - `esbuild@0.28.0` → built with **Go 1.26.1** CVE-2024-24790 (IPv6 zone parsing) is fixed in Go 1.21.11 / 1.22.4, so 0.27.x covers it. **CVE-2025-68121** (crypto/tls cert validation bypass via TLS session resumption, **CVSS 10.0 / Critical** per [NVD](https://nvd.nist.gov/vuln/detail/cve-2025-68121)) is fixed only in Go 1.24.13, 1.25.7, and 1.26.0-rc.3+. Go 1.23.x is past Go's support window and will not receive this fix. So `esbuild@0.27.x` still ships a Go binary that Trivy correctly flags as vulnerable. ### Reachable risk in Twenty Low. `esbuild` does not use `crypto/tls` at runtime — it reads files, parses, transforms, and writes. The vulnerable code path is dead code inside the binary, present but never executed. The scan finding is what we are clearing, not an exploitation risk. ### Fix Bump `twenty-client-sdk`'s `esbuild` from `^0.27.3` to `^0.28.0` (resolves to 0.28.0, built with Go 1.26.1). ### Verification Ran `yarn workspaces focus --production twenty twenty-server twenty-emails twenty-shared twenty-client-sdk` (the same install the Dockerfile uses) and confirmed: - `node_modules/esbuild/` resolves to `esbuild@0.28.0` (single copy) - The bundled `node_modules/@esbuild//bin/esbuild` binary reports `go1.26.1` in its `buildinfo` ## Test plan - [x] `nx typecheck twenty-server` passes - [x] `nx build twenty-client-sdk` passes (esbuild's `build()` API is stable across 0.27 → 0.28) - [x] Production focus install shows Go 1.26.1 in the shipped binary - [ ] CI green - [ ] Re-run Trivy against the resulting image; confirm CVE-2025-68121 no longer appears --- packages/twenty-client-sdk/package.json | 2 +- yarn.lock | 218 ++++++++++++------------ 2 files changed, 110 insertions(+), 110 deletions(-) diff --git a/packages/twenty-client-sdk/package.json b/packages/twenty-client-sdk/package.json index cd9ef6ccf0..34ce0c64e2 100644 --- a/packages/twenty-client-sdk/package.json +++ b/packages/twenty-client-sdk/package.json @@ -42,7 +42,7 @@ "dependencies": { "@genql/cli": "^3.0.3", "@genql/runtime": "^2.10.0", - "esbuild": "^0.27.3", + "esbuild": "^0.28.0", "graphql": "^16.8.1" }, "devDependencies": { diff --git a/yarn.lock b/yarn.lock index e79486ac62..b653a2f3b6 100644 --- a/yarn.lock +++ b/yarn.lock @@ -5945,9 +5945,9 @@ __metadata: languageName: node linkType: hard -"@esbuild/aix-ppc64@npm:0.27.7": - version: 0.27.7 - resolution: "@esbuild/aix-ppc64@npm:0.27.7" +"@esbuild/aix-ppc64@npm:0.28.0": + version: 0.28.0 + resolution: "@esbuild/aix-ppc64@npm:0.28.0" conditions: os=aix & cpu=ppc64 languageName: node linkType: hard @@ -5994,9 +5994,9 @@ __metadata: languageName: node linkType: hard -"@esbuild/android-arm64@npm:0.27.7": - version: 0.27.7 - resolution: "@esbuild/android-arm64@npm:0.27.7" +"@esbuild/android-arm64@npm:0.28.0": + version: 0.28.0 + resolution: "@esbuild/android-arm64@npm:0.28.0" conditions: os=android & cpu=arm64 languageName: node linkType: hard @@ -6043,9 +6043,9 @@ __metadata: languageName: node linkType: hard -"@esbuild/android-arm@npm:0.27.7": - version: 0.27.7 - resolution: "@esbuild/android-arm@npm:0.27.7" +"@esbuild/android-arm@npm:0.28.0": + version: 0.28.0 + resolution: "@esbuild/android-arm@npm:0.28.0" conditions: os=android & cpu=arm languageName: node linkType: hard @@ -6092,9 +6092,9 @@ __metadata: languageName: node linkType: hard -"@esbuild/android-x64@npm:0.27.7": - version: 0.27.7 - resolution: "@esbuild/android-x64@npm:0.27.7" +"@esbuild/android-x64@npm:0.28.0": + version: 0.28.0 + resolution: "@esbuild/android-x64@npm:0.28.0" conditions: os=android & cpu=x64 languageName: node linkType: hard @@ -6141,9 +6141,9 @@ __metadata: languageName: node linkType: hard -"@esbuild/darwin-arm64@npm:0.27.7": - version: 0.27.7 - resolution: "@esbuild/darwin-arm64@npm:0.27.7" +"@esbuild/darwin-arm64@npm:0.28.0": + version: 0.28.0 + resolution: "@esbuild/darwin-arm64@npm:0.28.0" conditions: os=darwin & cpu=arm64 languageName: node linkType: hard @@ -6190,9 +6190,9 @@ __metadata: languageName: node linkType: hard -"@esbuild/darwin-x64@npm:0.27.7": - version: 0.27.7 - resolution: "@esbuild/darwin-x64@npm:0.27.7" +"@esbuild/darwin-x64@npm:0.28.0": + version: 0.28.0 + resolution: "@esbuild/darwin-x64@npm:0.28.0" conditions: os=darwin & cpu=x64 languageName: node linkType: hard @@ -6239,9 +6239,9 @@ __metadata: languageName: node linkType: hard -"@esbuild/freebsd-arm64@npm:0.27.7": - version: 0.27.7 - resolution: "@esbuild/freebsd-arm64@npm:0.27.7" +"@esbuild/freebsd-arm64@npm:0.28.0": + version: 0.28.0 + resolution: "@esbuild/freebsd-arm64@npm:0.28.0" conditions: os=freebsd & cpu=arm64 languageName: node linkType: hard @@ -6288,9 +6288,9 @@ __metadata: languageName: node linkType: hard -"@esbuild/freebsd-x64@npm:0.27.7": - version: 0.27.7 - resolution: "@esbuild/freebsd-x64@npm:0.27.7" +"@esbuild/freebsd-x64@npm:0.28.0": + version: 0.28.0 + resolution: "@esbuild/freebsd-x64@npm:0.28.0" conditions: os=freebsd & cpu=x64 languageName: node linkType: hard @@ -6337,9 +6337,9 @@ __metadata: languageName: node linkType: hard -"@esbuild/linux-arm64@npm:0.27.7": - version: 0.27.7 - resolution: "@esbuild/linux-arm64@npm:0.27.7" +"@esbuild/linux-arm64@npm:0.28.0": + version: 0.28.0 + resolution: "@esbuild/linux-arm64@npm:0.28.0" conditions: os=linux & cpu=arm64 languageName: node linkType: hard @@ -6386,9 +6386,9 @@ __metadata: languageName: node linkType: hard -"@esbuild/linux-arm@npm:0.27.7": - version: 0.27.7 - resolution: "@esbuild/linux-arm@npm:0.27.7" +"@esbuild/linux-arm@npm:0.28.0": + version: 0.28.0 + resolution: "@esbuild/linux-arm@npm:0.28.0" conditions: os=linux & cpu=arm languageName: node linkType: hard @@ -6435,9 +6435,9 @@ __metadata: languageName: node linkType: hard -"@esbuild/linux-ia32@npm:0.27.7": - version: 0.27.7 - resolution: "@esbuild/linux-ia32@npm:0.27.7" +"@esbuild/linux-ia32@npm:0.28.0": + version: 0.28.0 + resolution: "@esbuild/linux-ia32@npm:0.28.0" conditions: os=linux & cpu=ia32 languageName: node linkType: hard @@ -6484,9 +6484,9 @@ __metadata: languageName: node linkType: hard -"@esbuild/linux-loong64@npm:0.27.7": - version: 0.27.7 - resolution: "@esbuild/linux-loong64@npm:0.27.7" +"@esbuild/linux-loong64@npm:0.28.0": + version: 0.28.0 + resolution: "@esbuild/linux-loong64@npm:0.28.0" conditions: os=linux & cpu=loong64 languageName: node linkType: hard @@ -6533,9 +6533,9 @@ __metadata: languageName: node linkType: hard -"@esbuild/linux-mips64el@npm:0.27.7": - version: 0.27.7 - resolution: "@esbuild/linux-mips64el@npm:0.27.7" +"@esbuild/linux-mips64el@npm:0.28.0": + version: 0.28.0 + resolution: "@esbuild/linux-mips64el@npm:0.28.0" conditions: os=linux & cpu=mips64el languageName: node linkType: hard @@ -6582,9 +6582,9 @@ __metadata: languageName: node linkType: hard -"@esbuild/linux-ppc64@npm:0.27.7": - version: 0.27.7 - resolution: "@esbuild/linux-ppc64@npm:0.27.7" +"@esbuild/linux-ppc64@npm:0.28.0": + version: 0.28.0 + resolution: "@esbuild/linux-ppc64@npm:0.28.0" conditions: os=linux & cpu=ppc64 languageName: node linkType: hard @@ -6631,9 +6631,9 @@ __metadata: languageName: node linkType: hard -"@esbuild/linux-riscv64@npm:0.27.7": - version: 0.27.7 - resolution: "@esbuild/linux-riscv64@npm:0.27.7" +"@esbuild/linux-riscv64@npm:0.28.0": + version: 0.28.0 + resolution: "@esbuild/linux-riscv64@npm:0.28.0" conditions: os=linux & cpu=riscv64 languageName: node linkType: hard @@ -6680,9 +6680,9 @@ __metadata: languageName: node linkType: hard -"@esbuild/linux-s390x@npm:0.27.7": - version: 0.27.7 - resolution: "@esbuild/linux-s390x@npm:0.27.7" +"@esbuild/linux-s390x@npm:0.28.0": + version: 0.28.0 + resolution: "@esbuild/linux-s390x@npm:0.28.0" conditions: os=linux & cpu=s390x languageName: node linkType: hard @@ -6729,9 +6729,9 @@ __metadata: languageName: node linkType: hard -"@esbuild/linux-x64@npm:0.27.7": - version: 0.27.7 - resolution: "@esbuild/linux-x64@npm:0.27.7" +"@esbuild/linux-x64@npm:0.28.0": + version: 0.28.0 + resolution: "@esbuild/linux-x64@npm:0.28.0" conditions: os=linux & cpu=x64 languageName: node linkType: hard @@ -6771,9 +6771,9 @@ __metadata: languageName: node linkType: hard -"@esbuild/netbsd-arm64@npm:0.27.7": - version: 0.27.7 - resolution: "@esbuild/netbsd-arm64@npm:0.27.7" +"@esbuild/netbsd-arm64@npm:0.28.0": + version: 0.28.0 + resolution: "@esbuild/netbsd-arm64@npm:0.28.0" conditions: os=netbsd & cpu=arm64 languageName: node linkType: hard @@ -6820,9 +6820,9 @@ __metadata: languageName: node linkType: hard -"@esbuild/netbsd-x64@npm:0.27.7": - version: 0.27.7 - resolution: "@esbuild/netbsd-x64@npm:0.27.7" +"@esbuild/netbsd-x64@npm:0.28.0": + version: 0.28.0 + resolution: "@esbuild/netbsd-x64@npm:0.28.0" conditions: os=netbsd & cpu=x64 languageName: node linkType: hard @@ -6862,9 +6862,9 @@ __metadata: languageName: node linkType: hard -"@esbuild/openbsd-arm64@npm:0.27.7": - version: 0.27.7 - resolution: "@esbuild/openbsd-arm64@npm:0.27.7" +"@esbuild/openbsd-arm64@npm:0.28.0": + version: 0.28.0 + resolution: "@esbuild/openbsd-arm64@npm:0.28.0" conditions: os=openbsd & cpu=arm64 languageName: node linkType: hard @@ -6911,9 +6911,9 @@ __metadata: languageName: node linkType: hard -"@esbuild/openbsd-x64@npm:0.27.7": - version: 0.27.7 - resolution: "@esbuild/openbsd-x64@npm:0.27.7" +"@esbuild/openbsd-x64@npm:0.28.0": + version: 0.28.0 + resolution: "@esbuild/openbsd-x64@npm:0.28.0" conditions: os=openbsd & cpu=x64 languageName: node linkType: hard @@ -6939,9 +6939,9 @@ __metadata: languageName: node linkType: hard -"@esbuild/openharmony-arm64@npm:0.27.7": - version: 0.27.7 - resolution: "@esbuild/openharmony-arm64@npm:0.27.7" +"@esbuild/openharmony-arm64@npm:0.28.0": + version: 0.28.0 + resolution: "@esbuild/openharmony-arm64@npm:0.28.0" conditions: os=openharmony & cpu=arm64 languageName: node linkType: hard @@ -6988,9 +6988,9 @@ __metadata: languageName: node linkType: hard -"@esbuild/sunos-x64@npm:0.27.7": - version: 0.27.7 - resolution: "@esbuild/sunos-x64@npm:0.27.7" +"@esbuild/sunos-x64@npm:0.28.0": + version: 0.28.0 + resolution: "@esbuild/sunos-x64@npm:0.28.0" conditions: os=sunos & cpu=x64 languageName: node linkType: hard @@ -7037,9 +7037,9 @@ __metadata: languageName: node linkType: hard -"@esbuild/win32-arm64@npm:0.27.7": - version: 0.27.7 - resolution: "@esbuild/win32-arm64@npm:0.27.7" +"@esbuild/win32-arm64@npm:0.28.0": + version: 0.28.0 + resolution: "@esbuild/win32-arm64@npm:0.28.0" conditions: os=win32 & cpu=arm64 languageName: node linkType: hard @@ -7086,9 +7086,9 @@ __metadata: languageName: node linkType: hard -"@esbuild/win32-ia32@npm:0.27.7": - version: 0.27.7 - resolution: "@esbuild/win32-ia32@npm:0.27.7" +"@esbuild/win32-ia32@npm:0.28.0": + version: 0.28.0 + resolution: "@esbuild/win32-ia32@npm:0.28.0" conditions: os=win32 & cpu=ia32 languageName: node linkType: hard @@ -7135,9 +7135,9 @@ __metadata: languageName: node linkType: hard -"@esbuild/win32-x64@npm:0.27.7": - version: 0.27.7 - resolution: "@esbuild/win32-x64@npm:0.27.7" +"@esbuild/win32-x64@npm:0.28.0": + version: 0.28.0 + resolution: "@esbuild/win32-x64@npm:0.28.0" conditions: os=win32 & cpu=x64 languageName: node linkType: hard @@ -35094,36 +35094,36 @@ __metadata: languageName: node linkType: hard -"esbuild@npm:^0.27.3": - version: 0.27.7 - resolution: "esbuild@npm:0.27.7" +"esbuild@npm:^0.28.0": + version: 0.28.0 + resolution: "esbuild@npm:0.28.0" dependencies: - "@esbuild/aix-ppc64": "npm:0.27.7" - "@esbuild/android-arm": "npm:0.27.7" - "@esbuild/android-arm64": "npm:0.27.7" - "@esbuild/android-x64": "npm:0.27.7" - "@esbuild/darwin-arm64": "npm:0.27.7" - "@esbuild/darwin-x64": "npm:0.27.7" - "@esbuild/freebsd-arm64": "npm:0.27.7" - "@esbuild/freebsd-x64": "npm:0.27.7" - "@esbuild/linux-arm": "npm:0.27.7" - "@esbuild/linux-arm64": "npm:0.27.7" - "@esbuild/linux-ia32": "npm:0.27.7" - "@esbuild/linux-loong64": "npm:0.27.7" - "@esbuild/linux-mips64el": "npm:0.27.7" - "@esbuild/linux-ppc64": "npm:0.27.7" - "@esbuild/linux-riscv64": "npm:0.27.7" - "@esbuild/linux-s390x": "npm:0.27.7" - "@esbuild/linux-x64": "npm:0.27.7" - "@esbuild/netbsd-arm64": "npm:0.27.7" - "@esbuild/netbsd-x64": "npm:0.27.7" - "@esbuild/openbsd-arm64": "npm:0.27.7" - "@esbuild/openbsd-x64": "npm:0.27.7" - "@esbuild/openharmony-arm64": "npm:0.27.7" - "@esbuild/sunos-x64": "npm:0.27.7" - "@esbuild/win32-arm64": "npm:0.27.7" - "@esbuild/win32-ia32": "npm:0.27.7" - "@esbuild/win32-x64": "npm:0.27.7" + "@esbuild/aix-ppc64": "npm:0.28.0" + "@esbuild/android-arm": "npm:0.28.0" + "@esbuild/android-arm64": "npm:0.28.0" + "@esbuild/android-x64": "npm:0.28.0" + "@esbuild/darwin-arm64": "npm:0.28.0" + "@esbuild/darwin-x64": "npm:0.28.0" + "@esbuild/freebsd-arm64": "npm:0.28.0" + "@esbuild/freebsd-x64": "npm:0.28.0" + "@esbuild/linux-arm": "npm:0.28.0" + "@esbuild/linux-arm64": "npm:0.28.0" + "@esbuild/linux-ia32": "npm:0.28.0" + "@esbuild/linux-loong64": "npm:0.28.0" + "@esbuild/linux-mips64el": "npm:0.28.0" + "@esbuild/linux-ppc64": "npm:0.28.0" + "@esbuild/linux-riscv64": "npm:0.28.0" + "@esbuild/linux-s390x": "npm:0.28.0" + "@esbuild/linux-x64": "npm:0.28.0" + "@esbuild/netbsd-arm64": "npm:0.28.0" + "@esbuild/netbsd-x64": "npm:0.28.0" + "@esbuild/openbsd-arm64": "npm:0.28.0" + "@esbuild/openbsd-x64": "npm:0.28.0" + "@esbuild/openharmony-arm64": "npm:0.28.0" + "@esbuild/sunos-x64": "npm:0.28.0" + "@esbuild/win32-arm64": "npm:0.28.0" + "@esbuild/win32-ia32": "npm:0.28.0" + "@esbuild/win32-x64": "npm:0.28.0" dependenciesMeta: "@esbuild/aix-ppc64": optional: true @@ -35179,7 +35179,7 @@ __metadata: optional: true bin: esbuild: bin/esbuild - checksum: 10c0/ccd51f0555708bc9ff4ec9dc3ac92d3daacd45ecaac949ca8645984c5c323bf8cefe98c2df307418685e0b4ce37f9a3bdbfe8e3651fe632a0059a436195a17d4 + checksum: 10c0/8acd95c238ec6c4a9d16163277faf228a8994b642d187b3fe667ffbb469008e6748cde144fdc3c175bf8e78ee49e15a0ed9b9f183fdb5fcea1772f87fb1372a4 languageName: node linkType: hard @@ -56348,7 +56348,7 @@ __metadata: "@genql/cli": "npm:^3.0.3" "@genql/runtime": "npm:^2.10.0" "@typescript/native-preview": "npm:^7.0.0-dev.20260116.1" - esbuild: "npm:^0.27.3" + esbuild: "npm:^0.28.0" graphql: "npm:^16.8.1" tsc-alias: "npm:^1.8.16" twenty-shared: "workspace:*"