Abdullah.andGitHub
9d951757d8
Fixes [Dependabot Alert 216](https://github.com/twentyhq/twenty/security/dependabot/216) - authorization bypass in next.js middleware. Updated `react-email` version from `4.0.3` to `4.0.4`. This bumps up Next.js to a safer version for the mentioned critical alert. However, even the latest `react-email` package has not upgraded to Next.js 15.4.7 - the recommended version by dependabot. Since `react-email` is a devDependency used to preview email templates during development, it never gets inserted into the production build. Therefore, I marking the following alerts as `vulnerable code is never used` with a comment that it never makes it to the production build. <p align="center"> <img width="1142" height="342" alt="image" src="https://github.com/user-attachments/assets/50976fd3-b49c-4ee7-ac26-89f505783d55" /> </p> The only other place where we have next imported is twenty-website, which uses the safe version `14.2.33`. <p align="center"> <img width="421" height="92" alt="image" src="https://github.com/user-attachments/assets/fe1e20dc-7483-44f7-bf26-78f7131ccf46" /> </p>
42 lines
896 B
JSON
42 lines
896 B
JSON
{
|
|
"name": "twenty-emails",
|
|
"description": "",
|
|
"author": "",
|
|
"private": true,
|
|
"license": "AGPL-3.0",
|
|
"main": "./dist/index.js",
|
|
"scripts": {
|
|
"build": "npx vite build"
|
|
},
|
|
"dependencies": {
|
|
"@lingui/core": "^5.1.2",
|
|
"@lingui/react": "^5.1.2",
|
|
"twenty-shared": "workspace:*"
|
|
},
|
|
"peerDependencies": {
|
|
"react": "^18.2.0 || ^19.0.0",
|
|
"react-dom": "^18.2.0 || ^19.0.0"
|
|
},
|
|
"devDependencies": {
|
|
"@lingui/cli": "^5.1.2",
|
|
"@lingui/swc-plugin": "^5.6.0",
|
|
"@lingui/vite-plugin": "^5.1.2",
|
|
"@tiptap/core": "^3.4.2",
|
|
"@types/react": "^19",
|
|
"@types/react-dom": "^19",
|
|
"react-email": "4.0.4"
|
|
},
|
|
"exports": {
|
|
".": {
|
|
"types": "./dist/index.d.ts",
|
|
"import": "./dist/index.mjs",
|
|
"require": "./dist/index.js"
|
|
}
|
|
},
|
|
"engines": {
|
|
"node": "^24.5.0",
|
|
"npm": "please-use-yarn",
|
|
"yarn": "^4.0.2"
|
|
}
|
|
}
|