chore(security): move @lingui/vite-plugin to devDependencies in twenty-server

The plugin is only referenced by package.json -- no source file
imports it. It was misclassified as a runtime dep, which pulled
@lingui/cli into the production node_modules tree via "yarn workspaces
focus --production". @lingui/cli bundles esbuild 0.21.5 (vulnerable
Go binary), and that copy was shipping into the Docker image nested
at node_modules/@lingui/cli/node_modules/esbuild/.

Verified by running "yarn workspaces focus --production twenty
twenty-server twenty-emails twenty-shared twenty-client-sdk" and
inspecting the resulting node_modules: only esbuild 0.27.7 (from
twenty-client-sdk) remains.
This commit is contained in:
Charles Bochet
2026-05-24 18:45:42 +02:00
parent 0f3c54277a
commit 335d53347b
+1 -1
View File
@@ -50,7 +50,6 @@
"@lingui/core": "^5.1.2",
"@lingui/format-po": "5.1.2",
"@lingui/react": "5.1.2",
"@lingui/vite-plugin": "5.1.2",
"@microsoft/microsoft-graph-client": "3.0.7",
"@microsoft/microsoft-graph-types": "^2.40.0",
"@nestjs/axios": "3.1.2",
@@ -195,6 +194,7 @@
"devDependencies": {
"@faker-js/faker": "^9.8.0",
"@lingui/cli": "^5.1.2",
"@lingui/vite-plugin": "5.1.2",
"@nestjs/cli": "^11.0.16",
"@nestjs/devtools-integration": "^0.2.1",
"@nestjs/schematics": "^11.0.9",