https://sonarly.com/issue/41619?type=bug
Multiple runtime packages still resolve axios to vulnerable versions, leaving outbound HTTP paths exposed to recently disclosed high-severity axios CVEs. The issue is not a crash; it is a current security exposure in shipped dependency versions.
Fix: Upgraded direct axios dependency declarations to the patched range (^1.16.1) in every affected runtime package identified by the RCA:
- `packages/twenty-server/package.json` from `^1.13.5` → `^1.16.1`
- `packages/twenty-sdk/package.json` from `^1.13.5` → `^1.16.1`
- `packages/twenty-companion/package.json` from `^1.9.0` → `^1.16.1`
- `packages/twenty-website/package.json` from `^1.14.0` → `^1.16.1`
This removes the vulnerable declared version windows and aligns affected packages on the requested patched baseline.
Authored by Sonarly by autonomous analysis (run 47476).
sonarly-bot
475ffba2d7