Abdullah.
d205c72fa2
## fix(security): remove vulnerable lodash 4.17.23 (code injection + prototype pollution) Resolves [Dependabot Alert #824](https://github.com/twentyhq/twenty/security/dependabot/824) and [#823](https://github.com/twentyhq/twenty/security/dependabot/823). ### What `lodash` `<= 4.17.23` is affected by: - **Code injection via `_.template`** ([#824](https://github.com/twentyhq/twenty/security/dependabot/824), High) - **Prototype pollution via `_.unset`/`_.omit`** ([#823](https://github.com/twentyhq/twenty/security/dependabot/823), Medium) Both are patched in `4.18.0`. The repo already resolved lodash to `4.18.1` everywhere **except** one copy held at `4.17.23` by `@stoplight/spectral-functions@1.10.1`, whose `~4.17.21` range capped lodash below `4.18.0`. ### How Instead of a standing `resolutions` override, this bumps the parent that imposed the cap: **`@stoplight/spectral-functions` 1.10.1 → 1.10.3** (pulled transitively via `@asyncapi/parser` ← `@mintlify/common`, accepted through `^1.7.2`). 1.10.3 widened its lodash dependency to `^4.18.1`, so the capped bucket collapses into the existing `4.18.1` resolution and the vulnerable copy is removed — leaving the dependency graph honest with no lingering override. ### Also Refreshes `@types/lodash` to the latest **4.17.24**: bumps the `twenty-client-sdk` pin `^4.17.15 → ^4.17.24` and dedupes the stale transitive `*` bucket (4.17.15) into a single `4.17.24` resolution. Type-stub only. ### Verification - The only real `lodash` resolution is now `4.18.1` (remaining `4.17.x` entries are `@types/lodash` type stubs, not the library); `@types/lodash` resolves to a single `4.17.24` bucket. - Lockfile-only dependency change; `yarn install --immutable` passes; `twenty-client-sdk` typecheck passes.
73 lines
1.7 KiB
JSON
73 lines
1.7 KiB
JSON
{
|
|
"name": "twenty-client-sdk",
|
|
"version": "2.15.0",
|
|
"sideEffects": false,
|
|
"license": "AGPL-3.0",
|
|
"scripts": {
|
|
"build": "npx rimraf dist && npx vite build && tsgo -p tsconfig.lib.json --declaration --emitDeclarationOnly --noEmit false --outDir dist --rootDir src && npx tsc-alias -p tsconfig.lib.json --outDir dist"
|
|
},
|
|
"exports": {
|
|
"./core": {
|
|
"types": "./dist/core/index.d.ts",
|
|
"import": "./dist/core.mjs",
|
|
"require": "./dist/core.cjs"
|
|
},
|
|
"./metadata": {
|
|
"types": "./dist/metadata/index.d.ts",
|
|
"import": "./dist/metadata.mjs",
|
|
"require": "./dist/metadata.cjs"
|
|
},
|
|
"./rest": {
|
|
"types": "./dist/rest/index.d.ts",
|
|
"import": "./dist/rest.mjs",
|
|
"require": "./dist/rest.cjs"
|
|
},
|
|
"./generate": {
|
|
"types": "./dist/generate/index.d.ts",
|
|
"import": "./dist/generate.mjs",
|
|
"require": "./dist/generate.cjs"
|
|
}
|
|
},
|
|
"typesVersions": {
|
|
"*": {
|
|
"core": [
|
|
"dist/core/index.d.ts"
|
|
],
|
|
"metadata": [
|
|
"dist/metadata/index.d.ts"
|
|
],
|
|
"rest": [
|
|
"dist/rest/index.d.ts"
|
|
],
|
|
"generate": [
|
|
"dist/generate/index.d.ts"
|
|
]
|
|
}
|
|
},
|
|
"files": [
|
|
"dist"
|
|
],
|
|
"dependencies": {
|
|
"@genql/runtime": "^2.10.0",
|
|
"esbuild": "^0.28.1",
|
|
"graphql": "^16.8.1",
|
|
"lodash": "^4.17.21",
|
|
"prettier": "^3.8.3"
|
|
},
|
|
"devDependencies": {
|
|
"@types/lodash": "^4.17.24",
|
|
"@typescript/native-preview": "^7.0.0-dev.20260116.1",
|
|
"tsc-alias": "^1.8.16",
|
|
"twenty-shared": "workspace:*",
|
|
"typescript": "^5.9.3",
|
|
"vite": "^8.0.0",
|
|
"vite-plugin-dts": "^4.5.4",
|
|
"vite-tsconfig-paths": "^4.2.1",
|
|
"vitest": "^4.1.0"
|
|
},
|
|
"engines": {
|
|
"node": "^24.5.0",
|
|
"yarn": "^4.0.2"
|
|
}
|
|
}
|