Charles Bochet
d2e7dc0e74
## What Within-major version bumps of **direct** dependencies to clear a large batch of Dependabot alerts that are breaching (or near) their SLA. No major-version changes — all stay within the current major, so risk is low. | Package | From → To | Clears | |---|---|---| | `axios` | ^1.13.5 → ^1.16.0 | ReDoS, Proxy-Auth leak, proto-pollution gadgets, NO_PROXY bypass, resource DoS (56 alerts) | | `next` | 16.1.7 → ^16.2.6 | DoS, middleware/proxy bypass, SSRF, cache poisoning, XSS (32 alerts) | | `vitest` | 4.0.18 → ^4.1.0 | **CRITICAL** — UI server arbitrary file read/exec (#1421) | | `qs` | ^6.11.2 → ^6.15.2 | `qs.stringify` DoS | | `dompurify` | 3.3.3 → ^3.4.0 | proto-pollution XSS + FORBID_TAGS / SAFE_FOR_TEMPLATES bypasses | | `@nestjs/core` | 11.1.16 → ^11.1.18 | improper output neutralization / injection | | `nodemailer` | 8.0.4 → 8.0.10 | SMTP command injection via CRLF (bumped via root `resolutions`) | | `path-to-regexp` | ^8.2.0 → ^8.4.0 | ReDoS via multiple wildcards | | `file-type` | ^21.3.1 → ^21.3.2 | ZIP decompression-bomb DoS | | `@opentelemetry/exporter-prometheus` | ^0.211.0 → ^0.217.0 | exporter process crash via malformed HTTP request (#1183/#1184) | ## Notes - Added a `next` root **resolution** so the dev-only `@react-email/preview-server` copy (hard-pinned at `16.0.10`) is also pulled up to the patched `16.2.x` line — otherwise that copy keeps the Next.js alerts open. - `@opentelemetry/exporter-prometheus` 0.217 pulled `@opentelemetry/sdk-metrics` to 2.7.1 (compatible); `@opentelemetry/api` stays pinned at 1.9.1. - **Transitive-only** vulnerable packages (undici, tmp, ws, brace-expansion, …) are handled in a **separate PR** per the split-by-group plan. - Breaking major bumps (electron, uuid, serialize-javascript) and migrations (Apollo Server 3→4, simplemde) are intentionally **out of scope** here.
151 lines
3.9 KiB
JSON
151 lines
3.9 KiB
JSON
{
|
|
"name": "twenty-sdk",
|
|
"version": "2.11.0",
|
|
"sideEffects": false,
|
|
"bin": {
|
|
"twenty": "dist/cli.cjs"
|
|
},
|
|
"files": [
|
|
"dist",
|
|
"README.md",
|
|
"CHANGELOG.md",
|
|
"package.json"
|
|
],
|
|
"scripts": {
|
|
"build": "npx rimraf dist && npx vite build"
|
|
},
|
|
"keywords": [
|
|
"twenty",
|
|
"cli",
|
|
"sdk",
|
|
"crm",
|
|
"application",
|
|
"development"
|
|
],
|
|
"exports": {
|
|
"./billing": {
|
|
"types": "./dist/billing/index.d.ts",
|
|
"import": "./dist/billing/index.mjs",
|
|
"require": "./dist/billing/index.cjs"
|
|
},
|
|
"./define": {
|
|
"types": "./dist/define/index.d.ts",
|
|
"import": "./dist/define/index.mjs",
|
|
"require": "./dist/define/index.cjs"
|
|
},
|
|
"./front-component": {
|
|
"types": "./dist/front-component/index.d.ts",
|
|
"import": "./dist/front-component/index.mjs",
|
|
"require": "./dist/front-component/index.cjs"
|
|
},
|
|
"./logic-function": {
|
|
"types": "./dist/logic-function/index.d.ts",
|
|
"import": "./dist/logic-function/index.mjs",
|
|
"require": "./dist/logic-function/index.cjs"
|
|
},
|
|
"./utils": {
|
|
"types": "./dist/utils/index.d.ts",
|
|
"import": "./dist/utils/index.mjs",
|
|
"require": "./dist/utils/index.cjs"
|
|
},
|
|
"./ui": {
|
|
"types": "./dist/ui/index.d.ts",
|
|
"import": "./dist/ui/index.mjs",
|
|
"require": "./dist/ui/index.cjs"
|
|
},
|
|
"./cli": {
|
|
"types": "./dist/cli/operations/index.d.ts",
|
|
"import": "./dist/operations.mjs",
|
|
"require": "./dist/operations.cjs"
|
|
},
|
|
"./front-component-renderer": {
|
|
"types": "./dist/front-component-renderer/index.d.ts",
|
|
"import": "./dist/front-component-renderer.mjs",
|
|
"require": "./dist/front-component-renderer.cjs"
|
|
},
|
|
"./front-component-renderer/build": {
|
|
"types": "./dist/front-component-renderer/build/index.d.ts",
|
|
"import": "./dist/front-component-renderer/build.mjs",
|
|
"require": "./dist/front-component-renderer/build.cjs"
|
|
}
|
|
},
|
|
"license": "AGPL-3.0",
|
|
"dependencies": {
|
|
"@genql/runtime": "^2.10.0",
|
|
"@sniptt/guards": "^0.2.0",
|
|
"axios": "^1.16.0",
|
|
"chalk": "^5.3.0",
|
|
"chokidar": "^4.0.0",
|
|
"commander": "^12.0.0",
|
|
"esbuild": "^0.25.0",
|
|
"graphql": "^16.8.1",
|
|
"graphql-sse": "^2.5.4",
|
|
"ink": "^6.8.0",
|
|
"inquirer": "^10.0.0",
|
|
"jsonc-parser": "^3.2.0",
|
|
"preact": "^10.28.3",
|
|
"react": "^19.0.0",
|
|
"react-dom": "^19.0.0",
|
|
"tinyglobby": "^0.2.15",
|
|
"twenty-client-sdk": "workspace:*",
|
|
"typescript": "^5.9.3",
|
|
"uuid": "^13.0.0"
|
|
},
|
|
"devDependencies": {
|
|
"@genql/cli": "^3.0.3",
|
|
"@prettier/sync": "^0.5.2",
|
|
"@types/inquirer": "^9.0.0",
|
|
"@types/node": "^24.0.0",
|
|
"@types/react": "^19.0.0",
|
|
"@types/react-dom": "^19.0.0",
|
|
"@typescript/native-preview": "^7.0.0-dev.20260116.1",
|
|
"@vitest/coverage-v8": "^4.0.18",
|
|
"prettier": "^3.1.1",
|
|
"rollup-plugin-dts": "^6.4.1",
|
|
"ts-morph": "^25.0.0",
|
|
"tsc-alias": "^1.8.16",
|
|
"tsx": "^4.7.0",
|
|
"twenty-shared": "workspace:*",
|
|
"twenty-ui": "workspace:*",
|
|
"vite": "^7.0.0",
|
|
"vite-plugin-dts": "^4.5.4",
|
|
"vite-tsconfig-paths": "^4.2.1",
|
|
"wait-on": "^7.2.0"
|
|
},
|
|
"engines": {
|
|
"node": "^24.5.0",
|
|
"yarn": "^4.0.2"
|
|
},
|
|
"typesVersions": {
|
|
"*": {
|
|
"billing": [
|
|
"dist/billing/index.d.ts"
|
|
],
|
|
"define": [
|
|
"dist/define/index.d.ts"
|
|
],
|
|
"front-component": [
|
|
"dist/front-component/index.d.ts"
|
|
],
|
|
"logic-function": [
|
|
"dist/logic-function/index.d.ts"
|
|
],
|
|
"utils": [
|
|
"dist/utils/index.d.ts"
|
|
],
|
|
"cli": [
|
|
"dist/cli/operations/index.d.ts"
|
|
],
|
|
"ui": [
|
|
"dist/ui/index.d.ts"
|
|
],
|
|
"front-component-renderer": [
|
|
"dist/front-component-renderer/index.d.ts"
|
|
],
|
|
"front-component-renderer/build": [
|
|
"dist/front-component-renderer/build/index.d.ts"
|
|
]
|
|
}
|
|
}
|
|
}
|