Charles Bochet
fa80eb68b3
## Context Clears [Dependabot alert #1469](https://github.com/twentyhq/twenty/security/dependabot/1469) — esbuild Deno-module binary-integrity RCE (`GHSA-gv7w-rqvm-qjhr`, vulnerable `>=0.17.0 <0.28.1`, fixed in `0.28.1`). The advisory's range is much wider than the previous esbuild one (`>=0.27.3`), so it re-exposed several older transitive esbuild copies in the tree. ## Approach Prefer upgrading the parent over adding a resolution; resolutions only where the latest upstream release still pins a vulnerable esbuild **outside** the `0.28.1` range (so an upgrade can't help). **Upgraded parent (no resolution needed):** - `tsx` → `^4.22.4` across all workspaces (its `~0.28.0` esbuild now resolves to 0.28.1) - `size-limit` / `@size-limit/preset-small-lib` → `^12.1.0` in `twenty-ui` (v12 pins esbuild `^0.28.0`) **Resolutions added** (verified against npm — latest still pins vulnerable esbuild): - `@opennextjs/aws` (exact-pins 0.25.4, still 0.25.4 in latest 4.0.3) - `@lingui/cli` (`^0.25.1`, caps `<0.26`, unchanged in latest 6.3.0) - `storybook` (range tops at `^0.27.0`, caps `<0.28`, unchanged in latest 10.4.4) - `zapier-platform-cli` (exact-pins 0.25.8, latest) The three existing esbuild resolutions (`wrangler`, `@react-email/ui`, `react-email`) remain. The `//resolutions` doc in `package.json` and the `.yarnrc.yml` age-gate comment were updated to cover both advisories. ## Result Every esbuild copy in `yarn.lock` now resolves to a single `0.28.1` entry — no version `<0.28.1` remains. Lockfile change is a net reduction (dropped duplicate esbuild trees + their `@esbuild/*` platform binaries); no unrelated deps bumped. `yarn install` passes with constraint checks enabled. <!-- This is an auto-generated description by cubic. --> <a href="https://cubic.dev/pr/twentyhq/twenty/pull/21559?utm_source=github" target="_blank" rel="noopener noreferrer" data-no-image-dialog="true"><picture><source media="(prefers-color-scheme: dark)" srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source media="(prefers-color-scheme: light)" srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img alt="Review in cubic" src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a> <!-- End of auto-generated description by cubic. -->
25 lines
740 B
YAML
25 lines
740 B
YAML
enableConstraintsChecks: true
|
|
|
|
enableHardenedMode: true
|
|
|
|
enableInlineHunks: true
|
|
|
|
enableScripts: false
|
|
|
|
nodeLinker: node-modules
|
|
|
|
npmMinimalAgeGate: 3d
|
|
|
|
npmPreapprovedPackages:
|
|
- twenty-sdk
|
|
- twenty-client-sdk
|
|
# esbuild 0.28.1 (+ its @esbuild/* platform binaries) is the patched release for
|
|
# GHSA-gv7w-rqvm-qjhr (Deno-module binary-integrity RCE, >=0.17.0 <0.28.1) and the earlier
|
|
# GHSA-g7r4-m6w7-qqqr (dev-server path-traversal), both published 2026-06-11. Preapproved —
|
|
# scoped to this exact version — to bypass the 3d age gate so the security fix can land
|
|
# immediately. Safe to remove once 0.28.1 is older than npmMinimalAgeGate.
|
|
- esbuild@0.28.1
|
|
- "@esbuild/*@0.28.1"
|
|
|
|
yarnPath: .yarn/releases/yarn-4.13.0.cjs
|