Charles Bochet
184c4948d6
## Context
AWS Inspector flags the `prod-twenty` image (built from current main)
with 16 findings, and Dependabot alert 174 flags esbuild. This PR fixes
the OpenSSL scanner findings and the esbuild CVE. The typeorm bump
(CVE-2025-60542) was **pulled out of this PR** — see "typeorm status"
below.
## Changes
### Strip `/usr/local/include/node` from runtime stages
(`twenty-server`, `twenty-app-dev`)
15 OpenSSL CVEs (June 9 advisory, incl. CRITICAL CVE-2026-34182) are all
detected via **Node's bundled OpenSSL dev headers**: 3 GENERIC
`openssl/openssl` 3.5.6 detections per CVE at
`/usr/local/include/node/openssl/archs/linux-x86_64/{asm,asm_avx2,no-asm}/include/openssl/opensslv.h`.
The headers are only needed by node-gyp and native addons are compiled
in the build stages — nothing compiles at runtime. Dropping them clears
all 45 detection instances and permanently ends this class of finding
(third occurrence: 3.5.5 → 3.5.6 → 3.5.7). None of these CVEs are
reachable through Node (no CMS/PKCS#7 API, `pfx` is operator-supplied,
Node's QUIC uses ngtcp2, ASN.1 issues need ~2GB inputs).
**Follow-up (~June 17, 2026):** the `node` binary itself still
statically links OpenSSL 3.5.6 — invisible to the scanner after this PR
and unreachable in practice, but the real fix is bumping the pinned
`node:24-alpine` digest once the [announced June 17 Node.js security
releases](https://nodejs.org/en/blog/vulnerability/june-2026-security-releases)
ship a 24.x linking OpenSSL ≥ 3.5.7 (verify via
`deps/openssl/openssl/VERSION.dat` on the release tag — 24.16.0 is still
on 3.5.6). A dated TODO sits next to the cleanup in the Dockerfile.
### esbuild dev-server CORS CVE (Dependabot alert 174,
GHSA-67mh-4wv8-2f99)
`@lingui/cli@5.1.2` (pins `esbuild ^0.21.5`) was the last parent
resolving a vulnerable esbuild (≤ 0.24.2 lets any website send requests
to the dev server and read responses). Instead of a resolution override,
this bumps the lockstepped **lingui suite 5.1.2 → 5.9.5** (within-major;
lingui adopted `esbuild ^0.25.1` in 5.4.1), which:
- removes `esbuild@0.21.5` and all its platform packages from the
lockfile with no forced ranges;
- drops the `@lingui/core` lockstep resolution (its comment marked it
droppable on the next coordinated lingui bump — the tree now resolves a
single `@lingui/core@5.9.5`);
- `@lingui/swc-plugin` stays at `^5.11.0` (peers on `@lingui/core: 5`;
its 6.x line targets lingui 6).
**lingui 5.9.5 behavioral fallout handled here:**
- Translation functions now **throw without an active locale** (5.1.2
fell back silently). The global `i18n` singleton that backs server-side
`` t`…` `` calls only had a messages compiler set, never an activated
locale → activate the source locale in `I18nService.loadTranslations()`,
mirrored in the server jest setup (unit tests bypass Nest bootstrap).
- `msg`/`t` placeholders are now strictly typed (reject
`null`/`undefined`/`unknown`) → one server call site and 16 twenty-front
files adapted with minimal nullish-coalescing fixes that preserve
rendering.
- `.po`/compiled-catalog churn from the new extractor/compiler
(reference reordering, sorted keys — verified content-identical on
unchanged `.po` inputs) is intentionally not committed: the scheduled
i18n workflows regenerate those.
## typeorm status (pulled out)
typeorm 0.3.20 → 0.3.26 was originally in this PR but **made workspace
metadata sync intermittently lossy**: `example-app-postcard` failed
twice with a *different* field missing from the synced PostCard object
each run, and one integration shard's `DataSeedWorkspaceCommand` died
with "Could not find flat entity with universal identifier …" — versus
zero such failures on recent main. Local runs (db reset + seed, group-by
integration suite 19/19) pass, so it is a nondeterministic
CI-load-sensitive regression that needs dedicated debugging (typeorm
changed LIMIT/OFFSET 0 semantics, lazy count for `getManyAndCount`,
upsert WHERE construction, and topological-sort internals in that
range). The resolutions comment documents this as the blocker;
CVE-2025-60542 is MySQL-driver-only (`sqlstring`), so Postgres-only
Twenty is not exposed in the meantime.
## Verification
- `npx nx typecheck twenty-server` / `twenty-front` — clean (no cache)
- `npx nx test twenty-server` — full suite green
- `lingui:extract` + `lingui:compile` — clean for twenty-server /
twenty-emails / twenty-front
- `oxfmt --check` — clean for both packages
- Lockfile diff: lingui 5.9.5 entries, `esbuild@0.21.5` +
`@esbuild/*@0.21.5` platform packages removed, no typeorm changes
205 lines
6.6 KiB
JSON
205 lines
6.6 KiB
JSON
{
|
|
"name": "twenty-front",
|
|
"private": true,
|
|
"type": "module",
|
|
"scripts": {
|
|
"build": "NODE_ENV=production NODE_OPTIONS=--max-old-space-size=8192 npx vite build",
|
|
"build:sourcemaps": "NODE_ENV=production VITE_BUILD_SOURCEMAP=true NODE_OPTIONS=--max-old-space-size=8192 npx vite build",
|
|
"start:prod": "NODE_ENV=production npx serve -s build",
|
|
"tsup": "npx tsup"
|
|
},
|
|
"engines": {
|
|
"node": "^24.5.0",
|
|
"npm": "please-use-yarn",
|
|
"yarn": "^4.0.2"
|
|
},
|
|
"browserslist": {
|
|
"production": [
|
|
">0.2%",
|
|
"not dead",
|
|
"not op_mini all"
|
|
],
|
|
"development": [
|
|
"last 1 chrome version",
|
|
"last 1 firefox version",
|
|
"last 1 safari version"
|
|
]
|
|
},
|
|
"msw": {
|
|
"workerDirectory": "public"
|
|
},
|
|
"dependencies": {
|
|
"@apollo/client": "^4.0.0",
|
|
"@blocknote/mantine": "^0.51.4",
|
|
"@blocknote/react": "^0.51.4",
|
|
"@blocknote/xl-docx-exporter": "^0.51.4",
|
|
"@blocknote/xl-pdf-exporter": "^0.51.4",
|
|
"@calcom/embed-react": "^1.5.3",
|
|
"@cyntler/react-doc-viewer": "^1.17.0",
|
|
"@dagrejs/dagre": "^1.1.8",
|
|
"@dnd-kit/react": "^0.3.2",
|
|
"@floating-ui/react": "^0.24.3",
|
|
"@graphiql/plugin-explorer": "^1.0.2",
|
|
"@graphiql/react": "^0.23.0",
|
|
"@hello-pangea/dnd": "^16.2.0",
|
|
"@hookform/resolvers": "^5.2.2",
|
|
"@lingui/core": "^5.9.5",
|
|
"@lingui/detect-locale": "^5.9.5",
|
|
"@lingui/react": "^5.9.5",
|
|
"@mantine/core": "^8.3.11",
|
|
"@mantine/hooks": "^8.3.11",
|
|
"@mantine/utils": "^6.0.22",
|
|
"@monaco-editor/react": "^4.7.0",
|
|
"@nivo/core": "^0.99.0",
|
|
"@nivo/line": "^0.99.0",
|
|
"@nivo/pie": "^0.99.0",
|
|
"@nivo/radial-bar": "^0.99.0",
|
|
"@react-email/components": "^0.5.3",
|
|
"@react-pdf/renderer": "^4.1.6",
|
|
"@scalar/api-reference-react": "^0.9.42",
|
|
"@sentry/react": "^10.51.0",
|
|
"@sniptt/guards": "^0.2.0",
|
|
"@tiptap/core": "3.4.2",
|
|
"@tiptap/extension-bold": "3.4.2",
|
|
"@tiptap/extension-document": "3.4.2",
|
|
"@tiptap/extension-hard-break": "3.4.2",
|
|
"@tiptap/extension-heading": "3.4.2",
|
|
"@tiptap/extension-image": "3.4.4",
|
|
"@tiptap/extension-italic": "3.4.2",
|
|
"@tiptap/extension-link": "3.4.2",
|
|
"@tiptap/extension-list": "3.4.2",
|
|
"@tiptap/extension-paragraph": "3.4.2",
|
|
"@tiptap/extension-strike": "3.4.2",
|
|
"@tiptap/extension-text": "3.4.2",
|
|
"@tiptap/extension-underline": "3.4.2",
|
|
"@tiptap/extensions": "3.4.2",
|
|
"@tiptap/react": "3.4.2",
|
|
"@types/marked": "^6.0.0",
|
|
"@xyflow/react": "^12.4.2",
|
|
"ai": "6.0.97",
|
|
"apollo-link-rest": "^0.10.0-rc.2",
|
|
"apollo-upload-client": "^19.0.0",
|
|
"buffer": "^6.0.3",
|
|
"country-flag-icons": "^1.5.11",
|
|
"cron-parser": "5.1.1",
|
|
"d3-shape": "^3.2.0",
|
|
"date-fns": "^2.30.0",
|
|
"date-fns-tz": "^2.0.0",
|
|
"deep-equal": "^2.2.2",
|
|
"file-saver": "^2.0.5",
|
|
"framer-motion": "^11.18.0",
|
|
"fuse.js": "^7.1.0",
|
|
"graphiql": "^3.1.1",
|
|
"graphql": "16.8.1",
|
|
"graphql-sse": "^2.5.4",
|
|
"graphql-tag": "^2.12.6",
|
|
"immer": "^10.1.1",
|
|
"input-otp": "^1.4.2",
|
|
"jotai": "^2.17.1",
|
|
"js-cookie": "^3.0.5",
|
|
"json-2-csv": "^5.4.0",
|
|
"json-logic-js": "^2.0.5",
|
|
"jwt-decode": "^4.0.0",
|
|
"libphonenumber-js": "^1.10.26",
|
|
"linkify-react": "^4.1.3",
|
|
"linkifyjs": "^4.1.3",
|
|
"lodash.camelcase": "^4.3.0",
|
|
"lodash.groupby": "^4.6.0",
|
|
"lodash.isempty": "^4.4.0",
|
|
"lodash.omit": "^4.5.0",
|
|
"lodash.uniqby": "^4.7.0",
|
|
"marked": "^17.0.1",
|
|
"microdiff": "^1.3.2",
|
|
"papaparse": "^5.4.1",
|
|
"pluralize": "^8.0.0",
|
|
"qs": "^6.15.2",
|
|
"react": "^18.2.0",
|
|
"react-data-grid": "7.0.0-beta.13",
|
|
"react-datepicker": "^6.7.1",
|
|
"react-dom": "^18.2.0",
|
|
"react-dropzone": "^14.2.3",
|
|
"react-error-boundary": "^4.0.11",
|
|
"react-grid-layout": "^1.5.2",
|
|
"react-helmet-async": "^1.3.0",
|
|
"react-hook-form": "^7.45.1",
|
|
"react-hotkeys-hook": "^4.4.4",
|
|
"react-imask": "^7.6.0",
|
|
"react-intersection-observer": "^9.15.1",
|
|
"react-loading-skeleton": "^3.3.1",
|
|
"react-markdown": "^10.1.0",
|
|
"react-phone-number-input": "patch:react-phone-number-input@npm%3A3.4.5#../../.yarn/patches/react-phone-number-input-npm-3.4.5-dc2895c306.patch",
|
|
"react-qr-code": "^2.0.18",
|
|
"react-responsive": "^9.0.2",
|
|
"react-router-dom": "^6.4.4",
|
|
"react-textarea-autosize": "^8.4.1",
|
|
"remark-gfm": "^4.0.1",
|
|
"rxjs": "^7.2.0",
|
|
"temporal-polyfill": "^0.3.0",
|
|
"transliteration": "^2.3.5",
|
|
"ts-key-enum": "^2.0.12",
|
|
"twenty-front-component-renderer": "workspace:*",
|
|
"twenty-shared": "workspace:*",
|
|
"twenty-ui": "workspace:*",
|
|
"twenty-ui-deprecated": "workspace:*",
|
|
"type-fest": "4.10.1",
|
|
"use-debounce": "^10.0.0",
|
|
"uuid": "^11.1.1",
|
|
"xlsx-ugnis": "^0.19.3",
|
|
"zod": "^4.1.11"
|
|
},
|
|
"devDependencies": {
|
|
"@babel/core": "^7.14.5",
|
|
"@babel/preset-typescript": "^7.24.6",
|
|
"@graphql-codegen/cli": "^6.3.1",
|
|
"@graphql-codegen/typed-document-node": "^6.1.8",
|
|
"@graphql-codegen/typescript": "^5.0.10",
|
|
"@graphql-codegen/typescript-operations": "^5.1.0",
|
|
"@lingui/cli": "^5.9.5",
|
|
"@lingui/swc-plugin": "^5.11.0",
|
|
"@lingui/vite-plugin": "^5.9.5",
|
|
"@playwright/test": "^1.60.0",
|
|
"@storybook-community/storybook-addon-cookie": "^5.0.0",
|
|
"@storybook/addon-coverage": "^3.0.0",
|
|
"@storybook/addon-docs": "^10.3.3",
|
|
"@storybook/addon-links": "^10.3.3",
|
|
"@storybook/react-vite": "^10.3.3",
|
|
"@swc/core": "^1.15.11",
|
|
"@swc/jest": "^0.2.39",
|
|
"@testing-library/dom": "^10.4.0",
|
|
"@testing-library/jest-dom": "^6.6.3",
|
|
"@testing-library/react": "^16.3.0",
|
|
"@tiptap/suggestion": "3.4.2",
|
|
"@types/deep-equal": "^1.0.1",
|
|
"@types/file-saver": "^2.0.7",
|
|
"@types/jest": "^30.0.0",
|
|
"@types/js-cookie": "^3.0.3",
|
|
"@types/json-logic-js": "^2",
|
|
"@types/react-datepicker": "^6.2.0",
|
|
"@types/react-grid-layout": "^1",
|
|
"@types/uuid": "^9.0.2",
|
|
"@vitejs/plugin-react-swc": "4.2.3",
|
|
"@vitest/coverage-istanbul": "^4.1.0",
|
|
"@wyw-in-js/vite": "^1.1.0",
|
|
"dotenv-cli": "^7.4.4",
|
|
"jest": "29.7.0",
|
|
"jest-environment-jsdom": "30.0.0-beta.3",
|
|
"jest-fetch-mock": "^3.0.3",
|
|
"monaco-editor": "^0.51.0",
|
|
"monaco-editor-auto-typings": "^0.4.5",
|
|
"msw": "^2.12.7",
|
|
"msw-storybook-addon": "^2.0.6",
|
|
"optionator": "^0.9.1",
|
|
"oxlint": "^1.51.0",
|
|
"oxlint-tsgolint": "^0.16.0",
|
|
"playwright": "^1.60.0",
|
|
"prettier": "^3.1.1",
|
|
"rollup-plugin-node-polyfills": "^0.2.1",
|
|
"rollup-plugin-visualizer": "^5.14.0",
|
|
"storybook-addon-mock-date": "2.0.0",
|
|
"storybook-addon-pseudo-states": "^10.3.3",
|
|
"ts-jest": "^29.1.1",
|
|
"vite-plugin-svgr": "^4.3.0",
|
|
"vite-tsconfig-paths": "^4.2.1"
|
|
}
|
|
}
|