Charles Bochet
e72d10f550
## Summary Follow-up to #20876. That PR bumped `esbuild` to `^0.27.3` to address the Go-stdlib CVEs the self-hoster reported, but only one of the two Go CVEs is actually fixed at that level. This PR closes the remaining gap. ### Why 0.27.3 wasn't enough `esbuild` ships a Go-built binary inside the `@esbuild/<platform>` packages. The vulnerability lives in the bundled Go toolchain, not in any JavaScript. Verified by reading the Go `buildinfo` section from `node_modules/@esbuild/<platform>/bin/esbuild`: - `esbuild@0.27.7` → built with **Go 1.23.8** - `esbuild@0.28.0` → built with **Go 1.26.1** CVE-2024-24790 (IPv6 zone parsing) is fixed in Go 1.21.11 / 1.22.4, so 0.27.x covers it. **CVE-2025-68121** (crypto/tls cert validation bypass via TLS session resumption, **CVSS 10.0 / Critical** per [NVD](https://nvd.nist.gov/vuln/detail/cve-2025-68121)) is fixed only in Go 1.24.13, 1.25.7, and 1.26.0-rc.3+. Go 1.23.x is past Go's support window and will not receive this fix. So `esbuild@0.27.x` still ships a Go binary that Trivy correctly flags as vulnerable. ### Reachable risk in Twenty Low. `esbuild` does not use `crypto/tls` at runtime — it reads files, parses, transforms, and writes. The vulnerable code path is dead code inside the binary, present but never executed. The scan finding is what we are clearing, not an exploitation risk. ### Fix Bump `twenty-client-sdk`'s `esbuild` from `^0.27.3` to `^0.28.0` (resolves to 0.28.0, built with Go 1.26.1). ### Verification Ran `yarn workspaces focus --production twenty twenty-server twenty-emails twenty-shared twenty-client-sdk` (the same install the Dockerfile uses) and confirmed: - `node_modules/esbuild/` resolves to `esbuild@0.28.0` (single copy) - The bundled `node_modules/@esbuild/<platform>/bin/esbuild` binary reports `go1.26.1` in its `buildinfo` ## Test plan - [x] `nx typecheck twenty-server` passes - [x] `nx build twenty-client-sdk` passes (esbuild's `build()` API is stable across 0.27 → 0.28) - [x] Production focus install shows Go 1.26.1 in the shipped binary - [ ] CI green - [ ] Re-run Trivy against the resulting image; confirm CVE-2025-68121 no longer appears
63 lines
1.5 KiB
JSON
63 lines
1.5 KiB
JSON
{
|
|
"name": "twenty-client-sdk",
|
|
"version": "2.8.0",
|
|
"sideEffects": false,
|
|
"license": "AGPL-3.0",
|
|
"scripts": {
|
|
"build": "npx rimraf dist && npx vite build && tsgo -p tsconfig.lib.json --declaration --emitDeclarationOnly --noEmit false --outDir dist --rootDir src && npx tsc-alias -p tsconfig.lib.json --outDir dist"
|
|
},
|
|
"exports": {
|
|
"./core": {
|
|
"types": "./dist/core/index.d.ts",
|
|
"import": "./dist/core.mjs",
|
|
"require": "./dist/core.cjs"
|
|
},
|
|
"./metadata": {
|
|
"types": "./dist/metadata/index.d.ts",
|
|
"import": "./dist/metadata.mjs",
|
|
"require": "./dist/metadata.cjs"
|
|
},
|
|
"./generate": {
|
|
"types": "./dist/generate/index.d.ts",
|
|
"import": "./dist/generate.mjs",
|
|
"require": "./dist/generate.cjs"
|
|
}
|
|
},
|
|
"typesVersions": {
|
|
"*": {
|
|
"core": [
|
|
"dist/core/index.d.ts"
|
|
],
|
|
"metadata": [
|
|
"dist/metadata/index.d.ts"
|
|
],
|
|
"generate": [
|
|
"dist/generate/index.d.ts"
|
|
]
|
|
}
|
|
},
|
|
"files": [
|
|
"dist"
|
|
],
|
|
"dependencies": {
|
|
"@genql/cli": "^3.0.3",
|
|
"@genql/runtime": "^2.10.0",
|
|
"esbuild": "^0.28.0",
|
|
"graphql": "^16.8.1"
|
|
},
|
|
"devDependencies": {
|
|
"@typescript/native-preview": "^7.0.0-dev.20260116.1",
|
|
"tsc-alias": "^1.8.16",
|
|
"twenty-shared": "workspace:*",
|
|
"typescript": "^5.9.2",
|
|
"vite": "^7.0.0",
|
|
"vite-plugin-dts": "^4.5.4",
|
|
"vite-tsconfig-paths": "^4.2.1",
|
|
"vitest": "^4.0.18"
|
|
},
|
|
"engines": {
|
|
"node": "^24.5.0",
|
|
"yarn": "^4.0.2"
|
|
}
|
|
}
|