vynte-infra/twenty
2
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

chore(security): bump protobufjs and esbuild to clear CVEs

Browse Source 
Trivy was blocking the published Docker image on three fixed-critical
CVEs in transitive deps that ship with the production server.

- CVE-2026-41242 (protobufjs < 7.5.5, pulled via @opentelemetry/* and
  @grpc/proto-loader). Add protobufjs as a direct dep of twenty-server
  at ^7.5.5; run "yarn dedupe protobufjs" to collapse the transitive
  7.5.3 copy. Resolves to 7.6.0.

- CVE-2024-24790 / CVE-2025-68121 (Go stdlib, present in the bundled
  Go binaries shipped by @esbuild/<platform>). esbuild reaches the
  production image only through twenty-client-sdk's runtime dep --
  bump that from ^0.25.0 to ^0.27.3 (resolves to 0.27.7, built with
  patched Go).

The other esbuild copies still in the lockfile (0.21.5, 0.25.x, 0.27.2)
come from react-email and @modern-js/node-bundle-require, both of
which are devDependencies of twenty-emails and do not ship in the
production Docker image.
This commit is contained in:
Charles Bochet
2026-05-24 18:28:51 +02:00
parent 85d649e831
commit 0f3c54277a
3 changed files with 321 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/twenty-client-sdk/package.json
+1 -1
View File
@@ -42,7 +42,7 @@
"dependencies": {
"@genql/cli": "^3.0.3",
"@genql/runtime": "^2.10.0",
"esbuild": "^0.25.0",
"esbuild": "^0.27.3",
"graphql": "^16.8.1"
},
"devDependencies": {
packages/twenty-server/package.json
+1
View File
@@ -168,6 +168,7 @@
"planer": "1.2.0",
"pluralize": "8.0.0",
"postal-mime": "^2.6.1",
"protobufjs": "^7.5.5",
"psl": "^1.9.0",
"react": "18.3.1",
"react-dom": "18.3.1",
yarn.lock
+319 -10
View File
@@ -5945,6 +5945,13 @@ __metadata:
languageName: node
linkType: hard
"@esbuild/aix-ppc64@npm:0.27.7":
version: 0.27.7
resolution: "@esbuild/aix-ppc64@npm:0.27.7"
conditions: os=aix & cpu=ppc64
languageName: node
linkType: hard
"@esbuild/android-arm64@npm:0.21.5":
version: 0.21.5
resolution: "@esbuild/android-arm64@npm:0.21.5"
@@ -5987,6 +5994,13 @@ __metadata:
languageName: node
linkType: hard
"@esbuild/android-arm64@npm:0.27.7":
version: 0.27.7
resolution: "@esbuild/android-arm64@npm:0.27.7"
conditions: os=android & cpu=arm64
languageName: node
linkType: hard
"@esbuild/android-arm@npm:0.21.5":
version: 0.21.5
resolution: "@esbuild/android-arm@npm:0.21.5"
@@ -6029,6 +6043,13 @@ __metadata:
languageName: node
linkType: hard
"@esbuild/android-arm@npm:0.27.7":
version: 0.27.7
resolution: "@esbuild/android-arm@npm:0.27.7"
conditions: os=android & cpu=arm
languageName: node
linkType: hard
"@esbuild/android-x64@npm:0.21.5":
version: 0.21.5
resolution: "@esbuild/android-x64@npm:0.21.5"
@@ -6071,6 +6092,13 @@ __metadata:
languageName: node
linkType: hard
"@esbuild/android-x64@npm:0.27.7":
version: 0.27.7
resolution: "@esbuild/android-x64@npm:0.27.7"
conditions: os=android & cpu=x64
languageName: node
linkType: hard
"@esbuild/darwin-arm64@npm:0.21.5":
version: 0.21.5
resolution: "@esbuild/darwin-arm64@npm:0.21.5"
@@ -6113,6 +6141,13 @@ __metadata:
languageName: node
linkType: hard
"@esbuild/darwin-arm64@npm:0.27.7":
version: 0.27.7
resolution: "@esbuild/darwin-arm64@npm:0.27.7"
conditions: os=darwin & cpu=arm64
languageName: node
linkType: hard
"@esbuild/darwin-x64@npm:0.21.5":
version: 0.21.5
resolution: "@esbuild/darwin-x64@npm:0.21.5"
@@ -6155,6 +6190,13 @@ __metadata:
languageName: node
linkType: hard
"@esbuild/darwin-x64@npm:0.27.7":
version: 0.27.7
resolution: "@esbuild/darwin-x64@npm:0.27.7"
conditions: os=darwin & cpu=x64
languageName: node
linkType: hard
"@esbuild/freebsd-arm64@npm:0.21.5":
version: 0.21.5
resolution: "@esbuild/freebsd-arm64@npm:0.21.5"
@@ -6197,6 +6239,13 @@ __metadata:
languageName: node
linkType: hard
"@esbuild/freebsd-arm64@npm:0.27.7":
version: 0.27.7
resolution: "@esbuild/freebsd-arm64@npm:0.27.7"
conditions: os=freebsd & cpu=arm64
languageName: node
linkType: hard
"@esbuild/freebsd-x64@npm:0.21.5":
version: 0.21.5
resolution: "@esbuild/freebsd-x64@npm:0.21.5"
@@ -6239,6 +6288,13 @@ __metadata:
languageName: node
linkType: hard
"@esbuild/freebsd-x64@npm:0.27.7":
version: 0.27.7
resolution: "@esbuild/freebsd-x64@npm:0.27.7"
conditions: os=freebsd & cpu=x64
languageName: node
linkType: hard
"@esbuild/linux-arm64@npm:0.21.5":
version: 0.21.5
resolution: "@esbuild/linux-arm64@npm:0.21.5"
@@ -6281,6 +6337,13 @@ __metadata:
languageName: node
linkType: hard
"@esbuild/linux-arm64@npm:0.27.7":
version: 0.27.7
resolution: "@esbuild/linux-arm64@npm:0.27.7"
conditions: os=linux & cpu=arm64
languageName: node
linkType: hard
"@esbuild/linux-arm@npm:0.21.5":
version: 0.21.5
resolution: "@esbuild/linux-arm@npm:0.21.5"
@@ -6323,6 +6386,13 @@ __metadata:
languageName: node
linkType: hard
"@esbuild/linux-arm@npm:0.27.7":
version: 0.27.7
resolution: "@esbuild/linux-arm@npm:0.27.7"
conditions: os=linux & cpu=arm
languageName: node
linkType: hard
"@esbuild/linux-ia32@npm:0.21.5":
version: 0.21.5
resolution: "@esbuild/linux-ia32@npm:0.21.5"
@@ -6365,6 +6435,13 @@ __metadata:
languageName: node
linkType: hard
"@esbuild/linux-ia32@npm:0.27.7":
version: 0.27.7
resolution: "@esbuild/linux-ia32@npm:0.27.7"
conditions: os=linux & cpu=ia32
languageName: node
linkType: hard
"@esbuild/linux-loong64@npm:0.21.5":
version: 0.21.5
resolution: "@esbuild/linux-loong64@npm:0.21.5"
@@ -6407,6 +6484,13 @@ __metadata:
languageName: node
linkType: hard
"@esbuild/linux-loong64@npm:0.27.7":
version: 0.27.7
resolution: "@esbuild/linux-loong64@npm:0.27.7"
conditions: os=linux & cpu=loong64
languageName: node
linkType: hard
"@esbuild/linux-mips64el@npm:0.21.5":
version: 0.21.5
resolution: "@esbuild/linux-mips64el@npm:0.21.5"
@@ -6449,6 +6533,13 @@ __metadata:
languageName: node
linkType: hard
"@esbuild/linux-mips64el@npm:0.27.7":
version: 0.27.7
resolution: "@esbuild/linux-mips64el@npm:0.27.7"
conditions: os=linux & cpu=mips64el
languageName: node
linkType: hard
"@esbuild/linux-ppc64@npm:0.21.5":
version: 0.21.5
resolution: "@esbuild/linux-ppc64@npm:0.21.5"
@@ -6491,6 +6582,13 @@ __metadata:
languageName: node
linkType: hard
"@esbuild/linux-ppc64@npm:0.27.7":
version: 0.27.7
resolution: "@esbuild/linux-ppc64@npm:0.27.7"
conditions: os=linux & cpu=ppc64
languageName: node
linkType: hard
"@esbuild/linux-riscv64@npm:0.21.5":
version: 0.21.5
resolution: "@esbuild/linux-riscv64@npm:0.21.5"
@@ -6533,6 +6631,13 @@ __metadata:
languageName: node
linkType: hard
"@esbuild/linux-riscv64@npm:0.27.7":
version: 0.27.7
resolution: "@esbuild/linux-riscv64@npm:0.27.7"
conditions: os=linux & cpu=riscv64
languageName: node
linkType: hard
"@esbuild/linux-s390x@npm:0.21.5":
version: 0.21.5
resolution: "@esbuild/linux-s390x@npm:0.21.5"
@@ -6575,6 +6680,13 @@ __metadata:
languageName: node
linkType: hard
"@esbuild/linux-s390x@npm:0.27.7":
version: 0.27.7
resolution: "@esbuild/linux-s390x@npm:0.27.7"
conditions: os=linux & cpu=s390x
languageName: node
linkType: hard
"@esbuild/linux-x64@npm:0.21.5":
version: 0.21.5
resolution: "@esbuild/linux-x64@npm:0.21.5"
@@ -6617,6 +6729,13 @@ __metadata:
languageName: node
linkType: hard
"@esbuild/linux-x64@npm:0.27.7":
version: 0.27.7
resolution: "@esbuild/linux-x64@npm:0.27.7"
conditions: os=linux & cpu=x64
languageName: node
linkType: hard
"@esbuild/netbsd-arm64@npm:0.25.4":
version: 0.25.4
resolution: "@esbuild/netbsd-arm64@npm:0.25.4"
@@ -6652,6 +6771,13 @@ __metadata:
languageName: node
linkType: hard
"@esbuild/netbsd-arm64@npm:0.27.7":
version: 0.27.7
resolution: "@esbuild/netbsd-arm64@npm:0.27.7"
conditions: os=netbsd & cpu=arm64
languageName: node
linkType: hard
"@esbuild/netbsd-x64@npm:0.21.5":
version: 0.21.5
resolution: "@esbuild/netbsd-x64@npm:0.21.5"
@@ -6694,6 +6820,13 @@ __metadata:
languageName: node
linkType: hard
"@esbuild/netbsd-x64@npm:0.27.7":
version: 0.27.7
resolution: "@esbuild/netbsd-x64@npm:0.27.7"
conditions: os=netbsd & cpu=x64
languageName: node
linkType: hard
"@esbuild/openbsd-arm64@npm:0.25.4":
version: 0.25.4
resolution: "@esbuild/openbsd-arm64@npm:0.25.4"
@@ -6729,6 +6862,13 @@ __metadata:
languageName: node
linkType: hard
"@esbuild/openbsd-arm64@npm:0.27.7":
version: 0.27.7
resolution: "@esbuild/openbsd-arm64@npm:0.27.7"
conditions: os=openbsd & cpu=arm64
languageName: node
linkType: hard
"@esbuild/openbsd-x64@npm:0.21.5":
version: 0.21.5
resolution: "@esbuild/openbsd-x64@npm:0.21.5"
@@ -6771,6 +6911,13 @@ __metadata:
languageName: node
linkType: hard
"@esbuild/openbsd-x64@npm:0.27.7":
version: 0.27.7
resolution: "@esbuild/openbsd-x64@npm:0.27.7"
conditions: os=openbsd & cpu=x64
languageName: node
linkType: hard
"@esbuild/openharmony-arm64@npm:0.25.8":
version: 0.25.8
resolution: "@esbuild/openharmony-arm64@npm:0.25.8"
@@ -6792,6 +6939,13 @@ __metadata:
languageName: node
linkType: hard
"@esbuild/openharmony-arm64@npm:0.27.7":
version: 0.27.7
resolution: "@esbuild/openharmony-arm64@npm:0.27.7"
conditions: os=openharmony & cpu=arm64
languageName: node
linkType: hard
"@esbuild/sunos-x64@npm:0.21.5":
version: 0.21.5
resolution: "@esbuild/sunos-x64@npm:0.21.5"
@@ -6834,6 +6988,13 @@ __metadata:
languageName: node
linkType: hard
"@esbuild/sunos-x64@npm:0.27.7":
version: 0.27.7
resolution: "@esbuild/sunos-x64@npm:0.27.7"
conditions: os=sunos & cpu=x64
languageName: node
linkType: hard
"@esbuild/win32-arm64@npm:0.21.5":
version: 0.21.5
resolution: "@esbuild/win32-arm64@npm:0.21.5"
@@ -6876,6 +7037,13 @@ __metadata:
languageName: node
linkType: hard
"@esbuild/win32-arm64@npm:0.27.7":
version: 0.27.7
resolution: "@esbuild/win32-arm64@npm:0.27.7"
conditions: os=win32 & cpu=arm64
languageName: node
linkType: hard
"@esbuild/win32-ia32@npm:0.21.5":
version: 0.21.5
resolution: "@esbuild/win32-ia32@npm:0.21.5"
@@ -6918,6 +7086,13 @@ __metadata:
languageName: node
linkType: hard
"@esbuild/win32-ia32@npm:0.27.7":
version: 0.27.7
resolution: "@esbuild/win32-ia32@npm:0.27.7"
conditions: os=win32 & cpu=ia32
languageName: node
linkType: hard
"@esbuild/win32-x64@npm:0.21.5":
version: 0.21.5
resolution: "@esbuild/win32-x64@npm:0.21.5"
@@ -6960,6 +7135,13 @@ __metadata:
languageName: node
linkType: hard
"@esbuild/win32-x64@npm:0.27.7":
version: 0.27.7
resolution: "@esbuild/win32-x64@npm:0.27.7"
conditions: os=win32 & cpu=x64
languageName: node
linkType: hard
"@faker-js/faker@npm:^9.8.0":
version: 9.8.0
resolution: "@faker-js/faker@npm:9.8.0"
@@ -16882,6 +17064,13 @@ __metadata:
languageName: node
linkType: hard
"@protobufjs/codegen@npm:^2.0.5":
version: 2.0.5
resolution: "@protobufjs/codegen@npm:2.0.5"
checksum: 10c0/1b8a2ae56ee60a56e9d205cd4b6072a1503c5069b8ebb905710f974ff0098a0d0700641c137e0a8d98dedf14423156a106a9433695cbf52574810f55000fdcab
languageName: node
linkType: hard
"@protobufjs/eventemitter@npm:^1.1.0":
version: 1.1.0
resolution: "@protobufjs/eventemitter@npm:1.1.0"
@@ -16899,6 +17088,15 @@ __metadata:
languageName: node
linkType: hard
"@protobufjs/fetch@npm:^1.1.1":
version: 1.1.1
resolution: "@protobufjs/fetch@npm:1.1.1"
dependencies:
"@protobufjs/aspromise": "npm:^1.1.1"
checksum: 10c0/a497ff5433854e8577f0427983ea39b9113b49a8120f94515291d763327061d2c3013e60e24ea436d091dafae01a0f6eb1867e3b1616045d96a31d8b3c646ed4
languageName: node
linkType: hard
"@protobufjs/float@npm:^1.0.2":
version: 1.0.2
resolution: "@protobufjs/float@npm:1.0.2"
@@ -16913,6 +17111,13 @@ __metadata:
languageName: node
linkType: hard
"@protobufjs/inquire@npm:^1.1.2":
version: 1.1.2
resolution: "@protobufjs/inquire@npm:1.1.2"
checksum: 10c0/af69597818a14cac6a00a74cd5b3fb85aa96658b9dbbae73e6d907cb154ebf470953a8c537b3e6095a43de565ec4e6c5b40227c72f4a7d762d34fbec7ac179e7
languageName: node
linkType: hard
"@protobufjs/path@npm:^1.1.2":
version: 1.1.2
resolution: "@protobufjs/path@npm:1.1.2"
@@ -16934,6 +17139,13 @@ __metadata:
languageName: node
linkType: hard
"@protobufjs/utf8@npm:^1.1.1":
version: 1.1.1
resolution: "@protobufjs/utf8@npm:1.1.1"
checksum: 10c0/641fc145f00626405e8984b6e90b9edcbcc072ffc82d0647ca3176e09c730b2d022f988e65f011a7a17e2e4d77cde7733643aa10d8ac2bfa30f134dbcad553fd
languageName: node
linkType: hard
"@ptc-org/nestjs-query-core@npm:4.2.0":
version: 4.2.0
resolution: "@ptc-org/nestjs-query-core@npm:4.2.0"
@@ -34882,6 +35094,95 @@ __metadata:
languageName: node
linkType: hard
"esbuild@npm:^0.27.3":
version: 0.27.7
resolution: "esbuild@npm:0.27.7"
dependencies:
"@esbuild/aix-ppc64": "npm:0.27.7"
"@esbuild/android-arm": "npm:0.27.7"
"@esbuild/android-arm64": "npm:0.27.7"
"@esbuild/android-x64": "npm:0.27.7"
"@esbuild/darwin-arm64": "npm:0.27.7"
"@esbuild/darwin-x64": "npm:0.27.7"
"@esbuild/freebsd-arm64": "npm:0.27.7"
"@esbuild/freebsd-x64": "npm:0.27.7"
"@esbuild/linux-arm": "npm:0.27.7"
"@esbuild/linux-arm64": "npm:0.27.7"
"@esbuild/linux-ia32": "npm:0.27.7"
"@esbuild/linux-loong64": "npm:0.27.7"
"@esbuild/linux-mips64el": "npm:0.27.7"
"@esbuild/linux-ppc64": "npm:0.27.7"
"@esbuild/linux-riscv64": "npm:0.27.7"
"@esbuild/linux-s390x": "npm:0.27.7"
"@esbuild/linux-x64": "npm:0.27.7"
"@esbuild/netbsd-arm64": "npm:0.27.7"
"@esbuild/netbsd-x64": "npm:0.27.7"
"@esbuild/openbsd-arm64": "npm:0.27.7"
"@esbuild/openbsd-x64": "npm:0.27.7"
"@esbuild/openharmony-arm64": "npm:0.27.7"
"@esbuild/sunos-x64": "npm:0.27.7"
"@esbuild/win32-arm64": "npm:0.27.7"
"@esbuild/win32-ia32": "npm:0.27.7"
"@esbuild/win32-x64": "npm:0.27.7"
dependenciesMeta:
"@esbuild/aix-ppc64":
optional: true
"@esbuild/android-arm":
optional: true
"@esbuild/android-arm64":
optional: true
"@esbuild/android-x64":
optional: true
"@esbuild/darwin-arm64":
optional: true
"@esbuild/darwin-x64":
optional: true
"@esbuild/freebsd-arm64":
optional: true
"@esbuild/freebsd-x64":
optional: true
"@esbuild/linux-arm":
optional: true
"@esbuild/linux-arm64":
optional: true
"@esbuild/linux-ia32":
optional: true
"@esbuild/linux-loong64":
optional: true
"@esbuild/linux-mips64el":
optional: true
"@esbuild/linux-ppc64":
optional: true
"@esbuild/linux-riscv64":
optional: true
"@esbuild/linux-s390x":
optional: true
"@esbuild/linux-x64":
optional: true
"@esbuild/netbsd-arm64":
optional: true
"@esbuild/netbsd-x64":
optional: true
"@esbuild/openbsd-arm64":
optional: true
"@esbuild/openbsd-x64":
optional: true
"@esbuild/openharmony-arm64":
optional: true
"@esbuild/sunos-x64":
optional: true
"@esbuild/win32-arm64":
optional: true
"@esbuild/win32-ia32":
optional: true
"@esbuild/win32-x64":
optional: true
bin:
esbuild: bin/esbuild
checksum: 10c0/ccd51f0555708bc9ff4ec9dc3ac92d3daacd45ecaac949ca8645984c5c323bf8cefe98c2df307418685e0b4ce37f9a3bdbfe8e3651fe632a0059a436195a17d4
languageName: node
linkType: hard
"escalade@npm:^3.1.1, escalade@npm:^3.2.0":
version: 3.2.0
resolution: "escalade@npm:3.2.0"
@@ -43217,6 +43518,13 @@ __metadata:
languageName: node
linkType: hard
"long@npm:^5.3.2":
version: 5.3.2
resolution: "long@npm:5.3.2"
checksum: 10c0/7130fe1cbce2dca06734b35b70d380ca3f70271c7f8852c922a7c62c86c4e35f0c39290565eca7133c625908d40e126ac57c02b1b1a4636b9457d77e1e60b981
languageName: node
linkType: hard
"longest-streak@npm:^3.0.0":
version: 3.1.0
resolution: "longest-streak@npm:3.1.0"
@@ -49510,23 +49818,23 @@ __metadata:
languageName: node
linkType: hard
"protobufjs@npm:^7.2.5, protobufjs@npm:^7.3.0":
version: 7.5.3
resolution: "protobufjs@npm:7.5.3"
"protobufjs@npm:^7.2.5, protobufjs@npm:^7.3.0, protobufjs@npm:^7.5.5":
version: 7.6.0
resolution: "protobufjs@npm:7.6.0"
dependencies:
"@protobufjs/aspromise": "npm:^1.1.2"
"@protobufjs/base64": "npm:^1.1.2"
"@protobufjs/codegen": "npm:^2.0.4"
"@protobufjs/codegen": "npm:^2.0.5"
"@protobufjs/eventemitter": "npm:^1.1.0"
"@protobufjs/fetch": "npm:^1.1.0"
"@protobufjs/fetch": "npm:^1.1.1"
"@protobufjs/float": "npm:^1.0.2"
"@protobufjs/inquire": "npm:^1.1.0"
"@protobufjs/inquire": "npm:^1.1.2"
"@protobufjs/path": "npm:^1.1.2"
"@protobufjs/pool": "npm:^1.1.0"
"@protobufjs/utf8": "npm:^1.1.0"
"@protobufjs/utf8": "npm:^1.1.1"
"@types/node": "npm:>=13.7.0"
long: "npm:^5.0.0"
checksum: 10c0/9dc131a7e7a610b8291a0b0033b313f8754ef419b57c44d27874dd4edf1afc2a9a77d7a5bc2df9a744cba014de67c92756759c73200b702a11f13360e907b0dd
long: "npm:^5.3.2"
checksum: 10c0/013339777bc29610ef141876d734aa538a7982d278930a121513171f32958b3b38411b259476d9118c56d55f67980a8f433476cfbfdd1d1c60b4a06f36d3f689
languageName: node
linkType: hard
@@ -56040,7 +56348,7 @@ __metadata:
"@genql/cli": "npm:^3.0.3"
"@genql/runtime": "npm:^2.10.0"
"@typescript/native-preview": "npm:^7.0.0-dev.20260116.1"
esbuild: "npm:^0.25.0"
esbuild: "npm:^0.27.3"
graphql: "npm:^16.8.1"
tsc-alias: "npm:^1.8.16"
twenty-shared: "workspace:*"
@@ -56617,6 +56925,7 @@ __metadata:
pluralize: "npm:8.0.0"
postal-mime: "npm:^2.6.1"
prettier: "npm:^3.1.1"
protobufjs: "npm:^7.5.5"
psl: "npm:^1.9.0"
react: "npm:18.3.1"
react-dom: "npm:18.3.1"