Files
twenty/packages
1e47115d0b fix: Next has a denial of service with server components (#16702)
The alerts regarding CVE-2025-55182, CVE-2025-55183, CVE-2025-55184 are
false-positive given Twenty only imported Next 15.2.4 via `react-emails`
as a devDependency, so it should have never made it to the production
build - it was reported due to yarn.lock file containing the version.
However, in order to remove the alerts, updated react-emails to 4.0.17
(latest patch in 4.0 minor release) and Next version it imports to
15.5.9.

[Dependabot Alert
337](https://github.com/twentyhq/twenty/security/dependabot/337),
[Dependabot Alert
343](https://github.com/twentyhq/twenty/security/dependabot/343),
[Dependabot Alert
344](https://github.com/twentyhq/twenty/security/dependabot/344).

Additionally, updated Next 14.2.33 to 14.2.35 to resolve another couple
alerts reported in CVE-2025-55184.

[Dependabot Alert
345](https://github.com/twentyhq/twenty/security/dependabot/345),
[Dependabot Alert
346](https://github.com/twentyhq/twenty/security/dependabot/346).

---------

Co-authored-by: Guillim <guillim@users.noreply.github.com>
2025-12-19 14:36:56 +00:00
..
2025-12-18 19:22:12 +01:00
2025-12-17 08:48:17 +01:00