From 335d53347bd84b8558c8d9c2febc95204e48198e Mon Sep 17 00:00:00 2001 From: Charles Bochet Date: Sun, 24 May 2026 18:45:42 +0200 Subject: [PATCH] chore(security): move @lingui/vite-plugin to devDependencies in twenty-server The plugin is only referenced by package.json -- no source file imports it. It was misclassified as a runtime dep, which pulled @lingui/cli into the production node_modules tree via "yarn workspaces focus --production". @lingui/cli bundles esbuild 0.21.5 (vulnerable Go binary), and that copy was shipping into the Docker image nested at node_modules/@lingui/cli/node_modules/esbuild/. Verified by running "yarn workspaces focus --production twenty twenty-server twenty-emails twenty-shared twenty-client-sdk" and inspecting the resulting node_modules: only esbuild 0.27.7 (from twenty-client-sdk) remains. --- packages/twenty-server/package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/packages/twenty-server/package.json b/packages/twenty-server/package.json index 39b8dca6f5f..e99ec524d3a 100644 --- a/packages/twenty-server/package.json +++ b/packages/twenty-server/package.json @@ -50,7 +50,6 @@ "@lingui/core": "^5.1.2", "@lingui/format-po": "5.1.2", "@lingui/react": "5.1.2", - "@lingui/vite-plugin": "5.1.2", "@microsoft/microsoft-graph-client": "3.0.7", "@microsoft/microsoft-graph-types": "^2.40.0", "@nestjs/axios": "3.1.2", @@ -195,6 +194,7 @@ "devDependencies": { "@faker-js/faker": "^9.8.0", "@lingui/cli": "^5.1.2", + "@lingui/vite-plugin": "5.1.2", "@nestjs/cli": "^11.0.16", "@nestjs/devtools-integration": "^0.2.1", "@nestjs/schematics": "^11.0.9",