Charles Bochet
184c4948d6
## Context
AWS Inspector flags the `prod-twenty` image (built from current main)
with 16 findings, and Dependabot alert 174 flags esbuild. This PR fixes
the OpenSSL scanner findings and the esbuild CVE. The typeorm bump
(CVE-2025-60542) was **pulled out of this PR** — see "typeorm status"
below.
## Changes
### Strip `/usr/local/include/node` from runtime stages
(`twenty-server`, `twenty-app-dev`)
15 OpenSSL CVEs (June 9 advisory, incl. CRITICAL CVE-2026-34182) are all
detected via **Node's bundled OpenSSL dev headers**: 3 GENERIC
`openssl/openssl` 3.5.6 detections per CVE at
`/usr/local/include/node/openssl/archs/linux-x86_64/{asm,asm_avx2,no-asm}/include/openssl/opensslv.h`.
The headers are only needed by node-gyp and native addons are compiled
in the build stages — nothing compiles at runtime. Dropping them clears
all 45 detection instances and permanently ends this class of finding
(third occurrence: 3.5.5 → 3.5.6 → 3.5.7). None of these CVEs are
reachable through Node (no CMS/PKCS#7 API, `pfx` is operator-supplied,
Node's QUIC uses ngtcp2, ASN.1 issues need ~2GB inputs).
**Follow-up (~June 17, 2026):** the `node` binary itself still
statically links OpenSSL 3.5.6 — invisible to the scanner after this PR
and unreachable in practice, but the real fix is bumping the pinned
`node:24-alpine` digest once the [announced June 17 Node.js security
releases](https://nodejs.org/en/blog/vulnerability/june-2026-security-releases)
ship a 24.x linking OpenSSL ≥ 3.5.7 (verify via
`deps/openssl/openssl/VERSION.dat` on the release tag — 24.16.0 is still
on 3.5.6). A dated TODO sits next to the cleanup in the Dockerfile.
### esbuild dev-server CORS CVE (Dependabot alert 174,
GHSA-67mh-4wv8-2f99)
`@lingui/cli@5.1.2` (pins `esbuild ^0.21.5`) was the last parent
resolving a vulnerable esbuild (≤ 0.24.2 lets any website send requests
to the dev server and read responses). Instead of a resolution override,
this bumps the lockstepped **lingui suite 5.1.2 → 5.9.5** (within-major;
lingui adopted `esbuild ^0.25.1` in 5.4.1), which:
- removes `esbuild@0.21.5` and all its platform packages from the
lockfile with no forced ranges;
- drops the `@lingui/core` lockstep resolution (its comment marked it
droppable on the next coordinated lingui bump — the tree now resolves a
single `@lingui/core@5.9.5`);
- `@lingui/swc-plugin` stays at `^5.11.0` (peers on `@lingui/core: 5`;
its 6.x line targets lingui 6).
**lingui 5.9.5 behavioral fallout handled here:**
- Translation functions now **throw without an active locale** (5.1.2
fell back silently). The global `i18n` singleton that backs server-side
`` t`…` `` calls only had a messages compiler set, never an activated
locale → activate the source locale in `I18nService.loadTranslations()`,
mirrored in the server jest setup (unit tests bypass Nest bootstrap).
- `msg`/`t` placeholders are now strictly typed (reject
`null`/`undefined`/`unknown`) → one server call site and 16 twenty-front
files adapted with minimal nullish-coalescing fixes that preserve
rendering.
- `.po`/compiled-catalog churn from the new extractor/compiler
(reference reordering, sorted keys — verified content-identical on
unchanged `.po` inputs) is intentionally not committed: the scheduled
i18n workflows regenerate those.
## typeorm status (pulled out)
typeorm 0.3.20 → 0.3.26 was originally in this PR but **made workspace
metadata sync intermittently lossy**: `example-app-postcard` failed
twice with a *different* field missing from the synced PostCard object
each run, and one integration shard's `DataSeedWorkspaceCommand` died
with "Could not find flat entity with universal identifier …" — versus
zero such failures on recent main. Local runs (db reset + seed, group-by
integration suite 19/19) pass, so it is a nondeterministic
CI-load-sensitive regression that needs dedicated debugging (typeorm
changed LIMIT/OFFSET 0 semantics, lazy count for `getManyAndCount`,
upsert WHERE construction, and topological-sort internals in that
range). The resolutions comment documents this as the blocker;
CVE-2025-60542 is MySQL-driver-only (`sqlstring`), so Postgres-only
Twenty is not exposed in the meantime.
## Verification
- `npx nx typecheck twenty-server` / `twenty-front` — clean (no cache)
- `npx nx test twenty-server` — full suite green
- `lingui:extract` + `lingui:compile` — clean for twenty-server /
twenty-emails / twenty-front
- `oxfmt --check` — clean for both packages
- Lockfile diff: lingui 5.9.5 entries, `esbuild@0.21.5` +
`@esbuild/*@0.21.5` platform packages removed, no typeorm changes
203 lines
5.0 KiB
JSON
203 lines
5.0 KiB
JSON
{
|
|
"name": "twenty-shared",
|
|
"private": true,
|
|
"sideEffects": false,
|
|
"main": "dist/index.cjs",
|
|
"module": "dist/index.mjs",
|
|
"types": "dist/index.d.ts",
|
|
"license": "AGPL-3.0",
|
|
"scripts": {
|
|
"build": "npx vite build"
|
|
},
|
|
"engines": {
|
|
"node": "^24.5.0",
|
|
"npm": "please-use-yarn",
|
|
"yarn": "^4.0.2"
|
|
},
|
|
"devDependencies": {
|
|
"@babel/preset-env": "^7.26.9",
|
|
"@babel/preset-typescript": "^7.24.6",
|
|
"@lingui/core": "^5.9.5",
|
|
"@prettier/sync": "^0.5.2",
|
|
"@swc/core": "^1.15.11",
|
|
"@swc/jest": "^0.2.39",
|
|
"@types/babel__preset-env": "^7",
|
|
"@types/handlebars": "^4.1.0",
|
|
"@types/jest": "^30.0.0",
|
|
"@types/lodash.camelcase": "^4.3.7",
|
|
"@types/lodash.escaperegexp": "^4.1.9",
|
|
"@types/qs": "6.9.16",
|
|
"@types/uuid": "^9.0.2",
|
|
"@typescript/native-preview": "^7.0.0-dev.20260116.1",
|
|
"babel-plugin-module-resolver": "^5.0.2",
|
|
"glob": "^11.1.0",
|
|
"jest": "29.7.0",
|
|
"jest-environment-jsdom": "30.0.0-beta.3",
|
|
"prettier": "^3.1.1",
|
|
"slash": "^5.1.0",
|
|
"tsc-alias": "^1.8.16",
|
|
"tsx": "^4.19.3",
|
|
"typescript": "^5.9.3",
|
|
"vite": "^7.0.0",
|
|
"vite-plugin-dts": "^4.5.4",
|
|
"vite-tsconfig-paths": "^4.2.1"
|
|
},
|
|
"dependencies": {
|
|
"@sniptt/guards": "^0.2.0",
|
|
"ai": "6.0.97",
|
|
"class-validator": "^0.14.0",
|
|
"expr-eval-fork": "3.0.3",
|
|
"handlebars": "^4.7.9",
|
|
"libphonenumber-js": "^1.10.26",
|
|
"lodash.camelcase": "^4.3.0",
|
|
"lodash.escaperegexp": "^4.1.2",
|
|
"microdiff": "^1.3.2",
|
|
"qs": "^6.15.2",
|
|
"react-router-dom": "^6.4.4",
|
|
"temporal-polyfill": "^0.3.0",
|
|
"transliteration": "^2.3.5",
|
|
"uuid": "^11.1.1",
|
|
"zod": "^4.1.11"
|
|
},
|
|
"exports": {
|
|
".": {
|
|
"types": "./dist/index.d.ts",
|
|
"import": "./dist/index.mjs",
|
|
"require": "./dist/index.cjs"
|
|
},
|
|
"./ai": {
|
|
"types": "./dist/ai/index.d.ts",
|
|
"import": "./dist/ai.mjs",
|
|
"require": "./dist/ai.cjs"
|
|
},
|
|
"./application": {
|
|
"types": "./dist/application/index.d.ts",
|
|
"import": "./dist/application.mjs",
|
|
"require": "./dist/application.cjs"
|
|
},
|
|
"./constants": {
|
|
"types": "./dist/constants/index.d.ts",
|
|
"import": "./dist/constants.mjs",
|
|
"require": "./dist/constants.cjs"
|
|
},
|
|
"./database-events": {
|
|
"types": "./dist/database-events/index.d.ts",
|
|
"import": "./dist/database-events.mjs",
|
|
"require": "./dist/database-events.cjs"
|
|
},
|
|
"./i18n": {
|
|
"types": "./dist/i18n/index.d.ts",
|
|
"import": "./dist/i18n.mjs",
|
|
"require": "./dist/i18n.cjs"
|
|
},
|
|
"./logic-function": {
|
|
"types": "./dist/logic-function/index.d.ts",
|
|
"import": "./dist/logic-function.mjs",
|
|
"require": "./dist/logic-function.cjs"
|
|
},
|
|
"./metadata": {
|
|
"types": "./dist/metadata/index.d.ts",
|
|
"import": "./dist/metadata.mjs",
|
|
"require": "./dist/metadata.cjs"
|
|
},
|
|
"./testing": {
|
|
"types": "./dist/testing/index.d.ts",
|
|
"import": "./dist/testing.mjs",
|
|
"require": "./dist/testing.cjs"
|
|
},
|
|
"./translations": {
|
|
"types": "./dist/translations/index.d.ts",
|
|
"import": "./dist/translations.mjs",
|
|
"require": "./dist/translations.cjs"
|
|
},
|
|
"./types": {
|
|
"types": "./dist/types/index.d.ts",
|
|
"import": "./dist/types.mjs",
|
|
"require": "./dist/types.cjs"
|
|
},
|
|
"./utils": {
|
|
"types": "./dist/utils/index.d.ts",
|
|
"import": "./dist/utils.mjs",
|
|
"require": "./dist/utils.cjs"
|
|
},
|
|
"./vite": {
|
|
"types": "./dist/vite/index.d.ts",
|
|
"import": "./dist/vite.mjs",
|
|
"require": "./dist/vite.cjs"
|
|
},
|
|
"./workflow": {
|
|
"types": "./dist/workflow/index.d.ts",
|
|
"import": "./dist/workflow.mjs",
|
|
"require": "./dist/workflow.cjs"
|
|
},
|
|
"./workspace": {
|
|
"types": "./dist/workspace/index.d.ts",
|
|
"import": "./dist/workspace.mjs",
|
|
"require": "./dist/workspace.cjs"
|
|
}
|
|
},
|
|
"files": [
|
|
"dist",
|
|
"ai",
|
|
"application",
|
|
"constants",
|
|
"database-events",
|
|
"i18n",
|
|
"logic-function",
|
|
"metadata",
|
|
"testing",
|
|
"translations",
|
|
"types",
|
|
"utils",
|
|
"vite",
|
|
"workflow",
|
|
"workspace"
|
|
],
|
|
"typesVersions": {
|
|
"*": {
|
|
"ai": [
|
|
"dist/ai/index.d.ts"
|
|
],
|
|
"application": [
|
|
"dist/application/index.d.ts"
|
|
],
|
|
"constants": [
|
|
"dist/constants/index.d.ts"
|
|
],
|
|
"database-events": [
|
|
"dist/database-events/index.d.ts"
|
|
],
|
|
"i18n": [
|
|
"dist/i18n/index.d.ts"
|
|
],
|
|
"logic-function": [
|
|
"dist/logic-function/index.d.ts"
|
|
],
|
|
"metadata": [
|
|
"dist/metadata/index.d.ts"
|
|
],
|
|
"testing": [
|
|
"dist/testing/index.d.ts"
|
|
],
|
|
"translations": [
|
|
"dist/translations/index.d.ts"
|
|
],
|
|
"types": [
|
|
"dist/types/index.d.ts"
|
|
],
|
|
"utils": [
|
|
"dist/utils/index.d.ts"
|
|
],
|
|
"vite": [
|
|
"dist/vite/index.d.ts"
|
|
],
|
|
"workflow": [
|
|
"dist/workflow/index.d.ts"
|
|
],
|
|
"workspace": [
|
|
"dist/workspace/index.d.ts"
|
|
]
|
|
}
|
|
}
|
|
}
|