Charles Bochet
0403762516
## What The standalone apps under `packages/twenty-apps/*` each ship **their own `yarn.lock`** (they're not part of the root workspace), and those lockfiles still pulled vulnerable transitive versions of `axios`, `undici`, `tmp`, `qs`, `ws`, `brace-expansion`, `uuid` (via `twenty-sdk` / `twenty-client-sdk`). This was ~130 of the open Dependabot alerts — none of them reachable from the root-lockfile PRs. Ran `yarn up -R` per app to re-resolve the vulnerable transitives within their existing ranges, across all 13 flagged apps: - **`axios` → 1.17.0** — clears the entire proxy-auth-leak / ReDoS / config-merge MITM advisory set (the 56 axios alerts) - **`qs`, `brace-expansion`, `uuid`** → patched - **`undici`, `ws`** → patched on the in-range majors (older majors that parents pin exactly remain, same situation as the root lockfile) ## Scope - **Lockfile-only**, 13 apps. No `package.json` changes. - Test **fixtures** (`packages/twenty-apps/fixtures/*`) intentionally left untouched — Dependabot didn't flag them and they back snapshot tests.
32 lines
702 B
JSON
32 lines
702 B
JSON
{
|
|
"name": "hello-world",
|
|
"version": "0.1.0",
|
|
"license": "MIT",
|
|
"engines": {
|
|
"node": "^24.5.0",
|
|
"npm": "please-use-yarn",
|
|
"yarn": ">=4.0.2"
|
|
},
|
|
"packageManager": "yarn@4.13.0",
|
|
"scripts": {
|
|
"twenty": "twenty",
|
|
"lint": "oxlint -c .oxlintrc.json .",
|
|
"lint:fix": "oxlint --fix -c .oxlintrc.json .",
|
|
"test": "vitest run",
|
|
"test:watch": "vitest"
|
|
},
|
|
"dependencies": {
|
|
"twenty-client-sdk": "0.9.0",
|
|
"twenty-sdk": "0.9.0"
|
|
},
|
|
"devDependencies": {
|
|
"@types/node": "^24.7.2",
|
|
"@types/react": "^18.2.0",
|
|
"oxlint": "^0.16.0",
|
|
"react": "^18.2.0",
|
|
"typescript": "^5.9.3",
|
|
"vite-tsconfig-paths": "^4.2.1",
|
|
"vitest": "^3.1.1"
|
|
}
|
|
}
|