houseassassin/twenty
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
d0884bd70835db811dfb9498be3af21d8d3e7d1c
twenty/packages/twenty-server/package.json
T
Charles Bochet 184c4948d6 security: strip Node dev headers from images + lingui 5.9.5 (drops vulnerable esbuild) (#21448) 
## Context

AWS Inspector flags the `prod-twenty` image (built from current main)
with 16 findings, and Dependabot alert 174 flags esbuild. This PR fixes
the OpenSSL scanner findings and the esbuild CVE. The typeorm bump
(CVE-2025-60542) was **pulled out of this PR** — see "typeorm status"
below.

## Changes

### Strip `/usr/local/include/node` from runtime stages
(`twenty-server`, `twenty-app-dev`)
15 OpenSSL CVEs (June 9 advisory, incl. CRITICAL CVE-2026-34182) are all
detected via **Node's bundled OpenSSL dev headers**: 3 GENERIC
`openssl/openssl` 3.5.6 detections per CVE at
`/usr/local/include/node/openssl/archs/linux-x86_64/{asm,asm_avx2,no-asm}/include/openssl/opensslv.h`.
The headers are only needed by node-gyp and native addons are compiled
in the build stages — nothing compiles at runtime. Dropping them clears
all 45 detection instances and permanently ends this class of finding
(third occurrence: 3.5.5 → 3.5.6 → 3.5.7). None of these CVEs are
reachable through Node (no CMS/PKCS#7 API, `pfx` is operator-supplied,
Node's QUIC uses ngtcp2, ASN.1 issues need ~2GB inputs).

**Follow-up (~June 17, 2026):** the `node` binary itself still
statically links OpenSSL 3.5.6 — invisible to the scanner after this PR
and unreachable in practice, but the real fix is bumping the pinned
`node:24-alpine` digest once the [announced June 17 Node.js security
releases](https://nodejs.org/en/blog/vulnerability/june-2026-security-releases)
ship a 24.x linking OpenSSL ≥ 3.5.7 (verify via
`deps/openssl/openssl/VERSION.dat` on the release tag — 24.16.0 is still
on 3.5.6). A dated TODO sits next to the cleanup in the Dockerfile.

### esbuild dev-server CORS CVE (Dependabot alert 174,
GHSA-67mh-4wv8-2f99)
`@lingui/cli@5.1.2` (pins `esbuild ^0.21.5`) was the last parent
resolving a vulnerable esbuild (≤ 0.24.2 lets any website send requests
to the dev server and read responses). Instead of a resolution override,
this bumps the lockstepped **lingui suite 5.1.2 → 5.9.5** (within-major;
lingui adopted `esbuild ^0.25.1` in 5.4.1), which:

- removes `esbuild@0.21.5` and all its platform packages from the
lockfile with no forced ranges;
- drops the `@lingui/core` lockstep resolution (its comment marked it
droppable on the next coordinated lingui bump — the tree now resolves a
single `@lingui/core@5.9.5`);
- `@lingui/swc-plugin` stays at `^5.11.0` (peers on `@lingui/core: 5`;
its 6.x line targets lingui 6).

**lingui 5.9.5 behavioral fallout handled here:**
- Translation functions now **throw without an active locale** (5.1.2
fell back silently). The global `i18n` singleton that backs server-side
`` t`…` `` calls only had a messages compiler set, never an activated
locale → activate the source locale in `I18nService.loadTranslations()`,
mirrored in the server jest setup (unit tests bypass Nest bootstrap).
- `msg`/`t` placeholders are now strictly typed (reject
`null`/`undefined`/`unknown`) → one server call site and 16 twenty-front
files adapted with minimal nullish-coalescing fixes that preserve
rendering.
- `.po`/compiled-catalog churn from the new extractor/compiler
(reference reordering, sorted keys — verified content-identical on
unchanged `.po` inputs) is intentionally not committed: the scheduled
i18n workflows regenerate those.

## typeorm status (pulled out)

typeorm 0.3.20 → 0.3.26 was originally in this PR but **made workspace
metadata sync intermittently lossy**: `example-app-postcard` failed
twice with a *different* field missing from the synced PostCard object
each run, and one integration shard's `DataSeedWorkspaceCommand` died
with "Could not find flat entity with universal identifier …" — versus
zero such failures on recent main. Local runs (db reset + seed, group-by
integration suite 19/19) pass, so it is a nondeterministic
CI-load-sensitive regression that needs dedicated debugging (typeorm
changed LIMIT/OFFSET 0 semantics, lazy count for `getManyAndCount`,
upsert WHERE construction, and topological-sort internals in that
range). The resolutions comment documents this as the blocker;
CVE-2025-60542 is MySQL-driver-only (`sqlstring`), so Postgres-only
Twenty is not exposed in the meantime.

## Verification

- `npx nx typecheck twenty-server` / `twenty-front` — clean (no cache)
- `npx nx test twenty-server` — full suite green
- `lingui:extract` + `lingui:compile` — clean for twenty-server /
twenty-emails / twenty-front
- `oxfmt --check` — clean for both packages
- Lockfile diff: lingui 5.9.5 entries, `esbuild@0.21.5` +
`@esbuild/*@0.21.5` platform packages removed, no typeorm changes
2026-06-11 15:11:29 +02:00

234 lines
7.7 KiB
JSON
Raw Blame History

{
"name": "twenty-server",
"description": "",
"author": "",
"private": true,
"license": "AGPL-3.0",
"scripts": {
"nx": "NX_DEFAULT_PROJECT=twenty-server node ../../node_modules/nx/bin/nx.js",
"start:prod": "node dist/main",
"command:prod": "node dist/command/command",
"worker:prod": "node dist/queue-worker/queue-worker",
"database:init:prod": "node dist/database/scripts/setup-db.js && yarn database:migrate:prod --force --include-slow",
"database:migrate:prod": "node dist/command/command run-instance-commands",
"clickhouse:migrate:prod": "node dist/database/clickHouse/migrations/run-migrations.js",
"typeorm": "../../node_modules/typeorm/.bin/typeorm"
},
"dependencies": {
"@ai-sdk/amazon-bedrock": "^4.0.97",
"@ai-sdk/anthropic": "^3.0.72",
"@ai-sdk/azure": "^3.0.55",
"@ai-sdk/google": "^3.0.65",
"@ai-sdk/mistral": "^3.0.31",
"@ai-sdk/openai": "^3.0.54",
"@ai-sdk/openai-compatible": "^2.0.42",
"@ai-sdk/provider-utils": "^4.0.24",
"@ai-sdk/xai": "^3.0.84",
"@aws-sdk/client-lambda": "3.1001.0",
"@aws-sdk/client-s3": "3.1001.0",
"@aws-sdk/client-sesv2": "3.1001.0",
"@aws-sdk/client-sts": "3.1001.0",
"@aws-sdk/credential-providers": "3.1001.0",
"@aws-sdk/s3-request-presigner": "3.1001.0",
"@azure/msal-node": "^5.2.3",
"@blocknote/server-util": "^0.51.4",
"@clickhouse/client": "^1.18.1",
"@e2b/code-interpreter": "^1.0.4",
"@envelop/core": "4.0.3",
"@faker-js/faker": "9.8.0",
"@file-type/pdf": "^0.2.0",
"@graphql-tools/schema": "10.0.4",
"@graphql-tools/utils": "9.2.1",
"@graphql-yoga/nestjs": "2.1.0",
"@jrmdayn/googleapis-batcher": "^0.10.1",
"@lifeomic/axios-fetch": "^3.1.0",
"@lingui/conf": "5.9.5",
"@lingui/core": "^5.9.5",
"@lingui/format-po": "5.9.5",
"@microsoft/microsoft-graph-client": "3.0.7",
"@microsoft/microsoft-graph-types": "^2.40.0",
"@nestjs/axios": "3.1.2",
"@nestjs/cache-manager": "^2.3.0",
"@nestjs/common": "11.1.24",
"@nestjs/config": "^4.0.4",
"@nestjs/core": "^11.1.24",
"@nestjs/event-emitter": "2.1.0",
"@nestjs/graphql": "patch:@nestjs/graphql@npm%3A13.4.2#~/.yarn/patches/@nestjs-graphql-npm-13.4.2-a41c900c19.patch",
"@nestjs/jwt": "11.0.1",
"@nestjs/passport": "11.0.5",
"@nestjs/platform-express": "11.1.24",
"@nestjs/schedule": "^6.0.1",
"@nestjs/serve-static": "5.0.5",
"@nestjs/terminus": "11.0.0",
"@nestjs/typeorm": "11.0.0",
"@node-saml/node-saml": "5.1.0",
"@node-saml/passport-saml": "^5.1.0",
"@opentelemetry/api": "^1.9.0",
"@opentelemetry/exporter-metrics-otlp-http": "^0.200.0",
"@opentelemetry/exporter-prometheus": "^0.217.0",
"@opentelemetry/sdk-metrics": "^2.0.0",
"@ptc-org/nestjs-query-core": "^9.4.0",
"@ptc-org/nestjs-query-graphql": "patch:@ptc-org/nestjs-query-graphql@npm%3A9.4.0#~/.yarn/patches/@ptc-org-nestjs-query-graphql-npm-9.4.0-8e6f7894e1.patch",
"@ptc-org/nestjs-query-typeorm": "^9.4.0",
"@react-email/render": "^1.2.3",
"@sentry/nestjs": "^10.51.0",
"@sentry/node": "^10.51.0",
"@sentry/profiling-node": "^10.51.0",
"@sniptt/guards": "0.2.0",
"addressparser": "1.0.1",
"ai": "6.0.97",
"archiver": "7.0.1",
"axios": "^1.16.0",
"axios-retry": "^4.5.0",
"bcrypt": "^6.0.0",
"bullmq": "5.78.0",
"bytes": "3.1.2",
"cache-manager": "^5.4.0",
"cache-manager-redis-yet": "^4.1.2",
"chalk": "4.1.2",
"class-transformer": "0.5.1",
"class-validator": "0.14.0",
"cloudflare": "^4.5.0",
"connect-redis": "^7.1.1",
"cron-parser": "5.1.1",
"dataloader": "2.2.2",
"date-fns": "2.30.0",
"digest-fetch": "^3.1.1",
"dompurify": "^3.4.0",
"dotenv": "16.4.5",
"email-reply-parser": "^2.3.5",
"express": "4.22.2",
"express-session": "^1.18.2",
"file-type": "^21.3.2",
"fuse.js": "^7.1.0",
"gaxios": "5.1.3",
"googleapis": "105.0.0",
"graphql": "16.8.1",
"graphql-fields": "2.0.3",
"graphql-redis-subscriptions": "2.7.0",
"graphql-scalars": "1.23.0",
"graphql-subscriptions": "2.0.0",
"graphql-tag": "2.12.6",
"graphql-type-json": "0.3.2",
"graphql-upload": "16.0.2",
"graphql-yoga": "4.0.5",
"html-to-text": "^9.0.5",
"imapflow": "1.3.6",
"ioredis": "5.10.1",
"jsdom": "^26.1.0",
"json-schema": "0.4.0",
"jsonwebtoken": "9.0.2",
"libphonenumber-js": "1.11.5",
"lodash.camelcase": "4.3.0",
"lodash.chunk": "4.2.0",
"lodash.compact": "3.0.1",
"lodash.differencewith": "^4.5.0",
"lodash.groupby": "4.6.0",
"lodash.isempty": "4.4.0",
"lodash.isequal": "4.5.0",
"lodash.isobject": "3.0.2",
"lodash.kebabcase": "4.1.1",
"lodash.merge": "^4.6.2",
"lodash.omit": "4.5.0",
"lodash.snakecase": "4.1.1",
"lodash.uniq": "^4.5.0",
"lodash.uniqby": "^4.7.0",
"microdiff": "1.4.0",
"mrmime": "^2.0.1",
"ms": "2.1.3",
"nest-commander": "^3.19.1",
"node-ical": "^0.21.0",
"nodemailer": "^8.0.5",
"openapi-types": "12.1.3",
"openid-client": "^5.7.0",
"otplib": "^12.0.1",
"passport": "^0.7.0",
"passport-google-oauth20": "2.0.0",
"passport-jwt": "4.0.1",
"passport-microsoft": "2.1.0",
"path-to-regexp": "^8.4.0",
"pg": "8.12.0",
"planer": "1.2.0",
"pluralize": "8.0.0",
"postal-mime": "^2.6.1",
"psl": "^1.9.0",
"react": "18.3.1",
"react-dom": "18.3.1",
"redis": "^4.7.0",
"reflect-metadata": "0.2.2",
"rxjs": "7.8.1",
"semver": "7.6.3",
"sns-payload-validator": "^2.1.0",
"stripe": "19.3.1",
"tar": "^7.5.9",
"temporal-polyfill": "^0.3.0",
"tsconfig-paths": "^4.2.0",
"tsdav": "^2.2.0",
"tslib": "2.8.1",
"type-fest": "4.10.1",
"typeorm": "patch:typeorm@0.3.20#./patches/typeorm+0.3.20.patch",
"unzipper": "^0.12.3",
"uuid": "^11.1.1",
"zod": "^4.1.11"
},
"devDependencies": {
"@lingui/cli": "^5.9.5",
"@nestjs/cli": "^11.0.16",
"@nestjs/schematics": "^11.0.9",
"@nestjs/testing": "11.1.24",
"@swc/cli": "^0.8.1",
"@swc/core": "^1.15.11",
"@swc/jest": "^0.2.39",
"@types/addressparser": "^1.0.3",
"@types/archiver": "^6.0.0",
"@types/aws-lambda": "^8.10.147",
"@types/bcrypt": "^5.0.0",
"@types/bytes": "^3.1.1",
"@types/express": "^4.17.13",
"@types/express-session": "^1.18.0",
"@types/graphql-fields": "^1.3.6",
"@types/graphql-upload": "^16.0.7",
"@types/html-to-text": "^9.0.4",
"@types/jest": "^30.0.0",
"@types/lodash.chunk": "^4.2.9",
"@types/lodash.compact": "^3.0.9",
"@types/lodash.differencewith": "^4.5.9",
"@types/lodash.groupby": "^4.6.9",
"@types/lodash.isempty": "^4.4.7",
"@types/lodash.isequal": "^4.5.8",
"@types/lodash.isobject": "^3.0.7",
"@types/lodash.merge": "^4.6.9",
"@types/lodash.omit": "^4.5.9",
"@types/lodash.snakecase": "^4.1.7",
"@types/lodash.uniq": "^4.5.9",
"@types/lodash.uniqby": "^4.7.9",
"@types/ms": "^0.7.31",
"@types/node": "^24.0.0",
"@types/nodemailer": "^7.0.3",
"@types/passport-google-oauth20": "^2.0.11",
"@types/passport-jwt": "^3.0.8",
"@types/passport-microsoft": "^2.1.0",
"@types/pluralize": "^0.0.33",
"@types/psl": "^1.1.3",
"@types/react": "^18.2.39",
"@types/supertest": "^2.0.11",
"@types/unzipper": "^0",
"@types/uuid": "^9.0.2",
"jest": "29.7.0",
"jest-environment-node": "^29.4.1",
"prettier": "^3.1.1",
"rimraf": "^5.0.5",
"supertest": "^6.1.3",
"ts-jest": "^29.1.1",
"ts-node": "10.9.1",
"twenty-client-sdk": "workspace:*",
"twenty-emails": "workspace:*",
"twenty-shared": "workspace:*"
},
"engines": {
"node": "^24.5.0",
"npm": "please-use-yarn",
"yarn": "^4.0.2"
}
}
Reference in New Issue View Git Blame Copy Permalink