Charles Bochet
6e30405489
## Context The Oneleet monitor **"AWS ECR repository image vulnerabilities are remediated"** is alerting on `prod-twenty` images: 1 CRITICAL + 6 HIGH advisories breach their SLA in 7 days, plus a set of MEDIUMs. All of them are npm packages baked into the image. ## Changes | Package | Before | After | How | Advisories | |---|---|---|---|---| | undici | 7.28.0 / 6.27.0 | 8.9.0 | jsdom `^30` bump + node-gyp refresh; global `undici: ^8.9.0` resolution for @module-federation/dts-plugin, e2b and miniflare, which still pin 7.28.0 at latest (replaces the old scoped dts-plugin resolution) | CVE-2026-13697 (critical), CVE-2026-14643, CVE-2026-15157/16728/16729 | | sharp | 0.34.5 | 0.35.3 | direct bump in twenty-sdk; @argos-ci refresh; `next/sharp` resolution (next 16.3.0 with the fix is still quarantined by yarn's minimal-age gate) | GHSA-f88m-g3jw-g9cj | | axios | 1.17.0 | 1.19.0 | lockfile refresh | GHSA-gcfj-64vw-6mp9 + 10 medium | | ip-address | 10.2.0 | 10.4.0 | lockfile refresh | CVE-2026-69192, CVE-2026-54272, CVE-2026-69198 | | brace-expansion | 2.1.2 | 2.1.4 | lockfile refresh (backport exists; Inspector only lists 5.x) | CVE-2026-69152, CVE-2026-14257, CVE-2026-13149 | | typeorm | 0.3.29 | 0.3.31 | pin bump; the local yarn patch applies unchanged | GHSA-2rp8-mm9q-fp49 | ## Validation - `yarn.lock` contains no remaining vulnerable versions (undici resolves only to 8.9.0) - `yarn npm audit`: no remaining advisories among the bumped packages - `nx build` green for twenty-server, twenty-front (exercises module-federation dts-plugin on undici 8), twenty-sdk, twenty-website; twenty-server typecheck green (typeorm patch is type-level) - Runtime smoke: jsdom 30 DOM parse, sharp 0.35.3 png encode, undici 8.9.0 load ## Not covered - **react-router / react-router-dom 6.30.4** (medium, 1–3 month SLA): react-router-dom 6.x has **no fixed release**; the fix is the v7 migration (~225 files) — separate effort. - `prod-business-dash` body-parser 2.2.2 → 2.3.0 lives in its own repo. <!-- This is an auto-generated description by cubic. --> <a href="https://cubic.dev/pr/twentyhq/twenty/pull/23813?utm_source=github" target="_blank" rel="noopener noreferrer" data-no-image-dialog="true"><picture><source media="(prefers-color-scheme: dark)" srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source media="(prefers-color-scheme: light)" srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img alt="Review in cubic" src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a> <!-- End of auto-generated description by cubic. -->
142 lines
3.6 KiB
JSON
142 lines
3.6 KiB
JSON
{
|
|
"name": "twenty-sdk",
|
|
"version": "2.28.0",
|
|
"sideEffects": false,
|
|
"bin": {
|
|
"twenty": "dist/cli.cjs"
|
|
},
|
|
"files": [
|
|
"dist",
|
|
"README.md",
|
|
"CHANGELOG.md",
|
|
"package.json"
|
|
],
|
|
"scripts": {
|
|
"build": "npx rimraf dist && npx vite build"
|
|
},
|
|
"keywords": [
|
|
"twenty",
|
|
"cli",
|
|
"sdk",
|
|
"crm",
|
|
"application",
|
|
"development"
|
|
],
|
|
"exports": {
|
|
"./billing": {
|
|
"types": "./dist/billing/index.d.ts",
|
|
"import": "./dist/billing/index.mjs",
|
|
"require": "./dist/billing/index.cjs"
|
|
},
|
|
"./define": {
|
|
"types": "./dist/define/index.d.ts",
|
|
"import": "./dist/define/index.mjs",
|
|
"require": "./dist/define/index.cjs"
|
|
},
|
|
"./front-component": {
|
|
"types": "./dist/front-component/index.d.ts",
|
|
"import": "./dist/front-component/index.mjs",
|
|
"require": "./dist/front-component/index.cjs"
|
|
},
|
|
"./logic-function": {
|
|
"types": "./dist/logic-function/index.d.ts",
|
|
"import": "./dist/logic-function/index.mjs",
|
|
"require": "./dist/logic-function/index.cjs"
|
|
},
|
|
"./utils": {
|
|
"types": "./dist/utils/index.d.ts",
|
|
"import": "./dist/utils/index.mjs",
|
|
"require": "./dist/utils/index.cjs"
|
|
},
|
|
"./cli": {
|
|
"types": "./dist/cli/operations/index.d.ts",
|
|
"import": "./dist/operations.mjs",
|
|
"require": "./dist/operations.cjs"
|
|
},
|
|
"./front-component-renderer": {
|
|
"types": "./dist/front-component-renderer/index.d.ts",
|
|
"import": "./dist/front-component-renderer.mjs",
|
|
"require": "./dist/front-component-renderer.cjs"
|
|
},
|
|
"./front-component-renderer/build": {
|
|
"types": "./dist/front-component-renderer/build/index.d.ts",
|
|
"import": "./dist/front-component-renderer/build.mjs",
|
|
"require": "./dist/front-component-renderer/build.cjs"
|
|
}
|
|
},
|
|
"license": "MIT",
|
|
"dependencies": {
|
|
"@sniptt/guards": "^0.2.0",
|
|
"axios": "^1.16.0",
|
|
"chalk": "^5.3.0",
|
|
"chokidar": "^4.0.0",
|
|
"commander": "^12.0.0",
|
|
"esbuild": "^0.28.1",
|
|
"graphql": "^16.8.1",
|
|
"graphql-sse": "^2.5.4",
|
|
"ink": "^6.8.0",
|
|
"inquirer": "^14.0.0",
|
|
"jsonc-parser": "^3.2.0",
|
|
"preact": "^10.28.3",
|
|
"react": "^19.2.0",
|
|
"react-dom": "^19.2.0",
|
|
"semver": "7.6.3",
|
|
"sharp": "^0.35.3",
|
|
"tinyglobby": "^0.2.15",
|
|
"twenty-client-sdk": "workspace:*",
|
|
"typescript": "^5.9.3",
|
|
"uuid": "^13.0.2"
|
|
},
|
|
"devDependencies": {
|
|
"@prettier/sync": "^0.5.2",
|
|
"@types/node": "^24.0.0",
|
|
"@types/react": "^19.2.0",
|
|
"@types/react-dom": "^19.2.0",
|
|
"@types/semver": "^7.5.8",
|
|
"@typescript/native-preview": "^7.0.0-dev.20260116.1",
|
|
"@vitest/coverage-v8": "^4.0.18",
|
|
"prettier": "^3.1.1",
|
|
"rollup-plugin-dts": "^6.4.1",
|
|
"ts-morph": "^25.0.0",
|
|
"tsc-alias": "^1.8.16",
|
|
"tsx": "^4.7.0",
|
|
"twenty-shared": "workspace:*",
|
|
"twenty-ui": "workspace:*",
|
|
"vite": "^8.0.0",
|
|
"vite-plugin-dts": "^4.5.4",
|
|
"wait-on": "^9.0.10"
|
|
},
|
|
"engines": {
|
|
"node": "^24.5.0",
|
|
"yarn": "^4.0.2"
|
|
},
|
|
"typesVersions": {
|
|
"*": {
|
|
"billing": [
|
|
"dist/billing/index.d.ts"
|
|
],
|
|
"define": [
|
|
"dist/define/index.d.ts"
|
|
],
|
|
"front-component": [
|
|
"dist/front-component/index.d.ts"
|
|
],
|
|
"logic-function": [
|
|
"dist/logic-function/index.d.ts"
|
|
],
|
|
"utils": [
|
|
"dist/utils/index.d.ts"
|
|
],
|
|
"cli": [
|
|
"dist/cli/operations/index.d.ts"
|
|
],
|
|
"front-component-renderer": [
|
|
"dist/front-component-renderer/index.d.ts"
|
|
],
|
|
"front-component-renderer/build": [
|
|
"dist/front-component-renderer/build/index.d.ts"
|
|
]
|
|
}
|
|
}
|
|
}
|