chore(security): move @lingui/vite-plugin to devDependencies in twenty-server
The plugin is only referenced by package.json -- no source file imports it. It was misclassified as a runtime dep, which pulled @lingui/cli into the production node_modules tree via "yarn workspaces focus --production". @lingui/cli bundles esbuild 0.21.5 (vulnerable Go binary), and that copy was shipping into the Docker image nested at node_modules/@lingui/cli/node_modules/esbuild/. Verified by running "yarn workspaces focus --production twenty twenty-server twenty-emails twenty-shared twenty-client-sdk" and inspecting the resulting node_modules: only esbuild 0.27.7 (from twenty-client-sdk) remains.
This commit is contained in:
@@ -50,7 +50,6 @@
|
||||
"@lingui/core": "^5.1.2",
|
||||
"@lingui/format-po": "5.1.2",
|
||||
"@lingui/react": "5.1.2",
|
||||
"@lingui/vite-plugin": "5.1.2",
|
||||
"@microsoft/microsoft-graph-client": "3.0.7",
|
||||
"@microsoft/microsoft-graph-types": "^2.40.0",
|
||||
"@nestjs/axios": "3.1.2",
|
||||
@@ -195,6 +194,7 @@
|
||||
"devDependencies": {
|
||||
"@faker-js/faker": "^9.8.0",
|
||||
"@lingui/cli": "^5.1.2",
|
||||
"@lingui/vite-plugin": "5.1.2",
|
||||
"@nestjs/cli": "^11.0.16",
|
||||
"@nestjs/devtools-integration": "^0.2.1",
|
||||
"@nestjs/schematics": "^11.0.9",
|
||||
|
||||
Reference in New Issue
Block a user