vynte-infra/twenty
2
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity
Files
673edaefd82fb5388fb706efdf75d36e9eccd03a
twenty/packages/twenty-server/package.json
T
Charles BochetandGitHub be39702fd2 chore(security): bump protobufjs and esbuild to clear CVEs (#20876) 
## Summary

A self-hoster reported that Trivy blocks the `twentycrm/twenty:v2.7.x`
image on three fixed-critical CVEs. The reachable risk is low (none of
the vulnerable code paths are exposed to attacker-controlled input in
our deployment), but the findings are real and easy to clear by bumping
the affected dependencies in their owning workspaces.

### CVE-2026-41242 — `protobufjs` < 7.5.5

Pulled transitively into the production image via
`@opentelemetry/sdk-node`, `@opentelemetry/auto-instrumentations-node`,
and `@grpc/grpc-js` → `@grpc/proto-loader`. Lockfile was on 7.5.3; this
matches dismissed dependabot alert #1009 (Critical 9.4).

**Fix:** add `protobufjs: ^7.5.5` as a direct dep of `twenty-server`
(the workspace that exercises it via the OpenTelemetry gRPC exporters)
and run `yarn dedupe protobufjs` to collapse the residual transitive
7.5.3 copy. Resolves to 7.6.0.

### CVE-2024-24790 and CVE-2025-68121 — Go stdlib in bundled binaries

Present in the Go-built `bin/esbuild` shipped by `@esbuild/<platform>`
packages. Two paths put esbuild into the production image:

1. `twenty-client-sdk` declares `esbuild` as a runtime dep (used by its
`./generate` entry point).
2. `twenty-server` had `@lingui/vite-plugin` in `dependencies`, which
pulls `@lingui/cli` as a runtime sub-dep, which bundles `[email protected].5`
nested under `node_modules/@lingui/cli/node_modules/esbuild/`.

**Fix:**
- Bump `twenty-client-sdk`'s `esbuild` from `^0.25.0` to `^0.27.3`
(resolves to 0.27.7, built with patched Go).
- Move `@lingui/vite-plugin` from `dependencies` to `devDependencies` in
`twenty-server`. The plugin is not imported by any source file — it was
misclassified.

### Verification

Ran `yarn workspaces focus --production twenty twenty-server
twenty-emails twenty-shared twenty-client-sdk` (the same command the
Dockerfile uses) and inventoried the resulting `node_modules`. After all
three changes:

- `node_modules/esbuild/` → **0.27.7 only** (Go-patched)
- `node_modules/protobufjs/` → **7.6.0 only** (CVE-patched)

No nested copies of either package remain in the production install.

### Follow-up worth tracking separately

`esbuild` should arguably not be in `twenty-client-sdk`'s `dependencies`
at all — only the `./generate` entry point uses it, and the server never
imports that entry. Moving it to optional `peerDependencies` would stop
shipping a Go binary into the production image entirely. Out of scope
for this PR.

## Test plan

- [x] `yarn install` succeeds; `protobufjs` and `esbuild` each resolve
to a single version in production focus
- [x] `nx build twenty-client-sdk` passes
- [x] `nx typecheck twenty-server` passes
- [x] `nx build twenty-server` passes
- [x] Production focus install confirmed clean (`node_modules/esbuild`
and `node_modules/protobufjs` both single-version, both patched)
- [ ] CI green
- [ ] Re-run Trivy against the resulting image; confirm the three CVEs
no longer appear
2026-05-25 12:36:53 +00:00

264 lines
8.7 KiB
JSON
Raw Blame History

{
"name": "twenty-server",
"description": "",
"author": "",
"private": true,
"license": "AGPL-3.0",
"scripts": {
"nx": "NX_DEFAULT_PROJECT=twenty-server node ../../node_modules/nx/bin/nx.js",
"start:prod": "node dist/main",
"command:prod": "node dist/command/command",
"worker:prod": "node dist/queue-worker/queue-worker",
"database:init:prod": "node dist/database/scripts/setup-db.js && yarn database:migrate:prod --force --include-slow",
"database:migrate:prod": "node dist/command/command run-instance-commands",
"clickhouse:migrate:prod": "node dist/database/clickHouse/migrations/run-migrations.js",
"typeorm": "../../node_modules/typeorm/.bin/typeorm"
},
"dependencies": {
"@ai-sdk/amazon-bedrock": "^4.0.97",
"@ai-sdk/anthropic": "^3.0.72",
"@ai-sdk/azure": "^3.0.55",
"@ai-sdk/google": "^3.0.65",
"@ai-sdk/mistral": "^3.0.31",
"@ai-sdk/openai": "^3.0.54",
"@ai-sdk/openai-compatible": "^2.0.42",
"@ai-sdk/provider-utils": "^4.0.24",
"@ai-sdk/xai": "^3.0.84",
"@aws-sdk/client-lambda": "3.1001.0",
"@aws-sdk/client-s3": "3.1001.0",
"@aws-sdk/client-sesv2": "3.1001.0",
"@aws-sdk/client-sts": "3.1001.0",
"@aws-sdk/credential-providers": "3.1001.0",
"@aws-sdk/s3-request-presigner": "3.1001.0",
"@azure/msal-node": "^3.8.4",
"@babel/preset-env": "7.26.9",
"@blocknote/server-util": "^0.47.3",
"@clickhouse/client": "^1.18.1",
"@dagrejs/dagre": "^1.1.2",
"@e2b/code-interpreter": "^1.0.4",
"@envelop/core": "4.0.3",
"@envelop/on-resolve": "4.1.0",
"@esbuild-plugins/node-modules-polyfill": "^0.2.2",
"@faker-js/faker": "9.8.0",
"@file-type/pdf": "^0.2.0",
"@graphql-tools/schema": "10.0.4",
"@graphql-tools/utils": "9.2.1",
"@graphql-yoga/nestjs": "2.1.0",
"@jrmdayn/googleapis-batcher": "^0.10.1",
"@lifeomic/axios-fetch": "^3.1.0",
"@lingui/conf": "5.1.2",
"@lingui/core": "^5.1.2",
"@lingui/format-po": "5.1.2",
"@lingui/react": "5.1.2",
"@microsoft/microsoft-graph-client": "3.0.7",
"@microsoft/microsoft-graph-types": "^2.40.0",
"@nestjs/axios": "3.1.2",
"@nestjs/cache-manager": "^2.3.0",
"@nestjs/common": "11.1.16",
"@nestjs/config": "3.3.0",
"@nestjs/core": "11.1.16",
"@nestjs/event-emitter": "2.1.0",
"@nestjs/graphql": "patch:@nestjs/[email protected]#./patches/@nestjs+graphql+12.1.1.patch",
"@nestjs/jwt": "11.0.1",
"@nestjs/passport": "11.0.5",
"@nestjs/platform-express": "11.1.16",
"@nestjs/schedule": "^6.0.1",
"@nestjs/serve-static": "5.0.4",
"@nestjs/terminus": "11.0.0",
"@nestjs/typeorm": "11.0.0",
"@node-saml/node-saml": "5.1.0",
"@node-saml/passport-saml": "^5.1.0",
"@opentelemetry/api": "^1.9.0",
"@opentelemetry/auto-instrumentations-node": "^0.60.0",
"@opentelemetry/exporter-metrics-otlp-http": "^0.200.0",
"@opentelemetry/exporter-prometheus": "^0.211.0",
"@opentelemetry/sdk-metrics": "^2.0.0",
"@opentelemetry/sdk-node": "^0.202.0",
"@ptc-org/nestjs-query-core": "4.4.0",
"@ptc-org/nestjs-query-graphql": "patch:@ptc-org/[email protected]#./patches/@ptc-org+nestjs-query-graphql+4.2.0.patch",
"@ptc-org/nestjs-query-typeorm": "4.2.1-alpha.2",
"@react-email/render": "^1.2.3",
"@sentry/nestjs": "^10.51.0",
"@sentry/node": "^10.51.0",
"@sentry/profiling-node": "^10.51.0",
"@sniptt/guards": "0.2.0",
"addressparser": "1.0.1",
"ai": "6.0.97",
"apollo-server-core": "3.13.0",
"archiver": "7.0.1",
"axios": "^1.13.5",
"axios-retry": "^4.5.0",
"babel-plugin-module-resolver": "5.0.2",
"bcrypt": "^6.0.0",
"bullmq": "5.40.0",
"bytes": "3.1.2",
"cache-manager": "^5.4.0",
"cache-manager-redis-yet": "^4.1.2",
"chalk": "4.1.2",
"class-transformer": "0.5.1",
"class-validator": "0.14.0",
"class-validator-jsonschema": "^5.0.2",
"cloudflare": "^4.5.0",
"connect-redis": "^7.1.1",
"cron-parser": "5.1.1",
"dataloader": "2.2.2",
"date-fns": "2.30.0",
"deep-equal": "2.2.3",
"digest-fetch": "^3.1.1",
"dompurify": "3.3.3",
"dotenv": "16.4.5",
"exa-js": "^2.11.0",
"express": "4.22.1",
"express-session": "^1.18.2",
"file-type": "^21.3.1",
"fuse.js": "^7.1.0",
"gaxios": "5.1.3",
"google-auth-library": "8.9.0",
"googleapis": "105.0.0",
"graphql": "16.8.1",
"graphql-fields": "2.0.3",
"graphql-middleware": "^6.1.35",
"graphql-redis-subscriptions": "2.7.0",
"graphql-scalars": "1.23.0",
"graphql-subscriptions": "2.0.0",
"graphql-tag": "2.12.6",
"graphql-type-json": "0.3.2",
"graphql-upload": "16.0.2",
"graphql-yoga": "4.0.5",
"html-to-text": "^9.0.5",
"imapflow": "1.2.1",
"ioredis": "5.6.0",
"jsdom": "^26.1.0",
"json-schema": "0.4.0",
"jsonwebtoken": "9.0.2",
"libphonenumber-js": "1.11.5",
"lodash.camelcase": "4.3.0",
"lodash.chunk": "4.2.0",
"lodash.compact": "3.0.1",
"lodash.differencewith": "^4.5.0",
"lodash.groupby": "4.6.0",
"lodash.isempty": "4.4.0",
"lodash.isequal": "4.5.0",
"lodash.isobject": "3.0.2",
"lodash.kebabcase": "4.1.1",
"lodash.merge": "^4.6.2",
"lodash.omit": "4.5.0",
"lodash.omitby": "^4.6.0",
"lodash.snakecase": "4.1.1",
"lodash.uniq": "^4.5.0",
"lodash.uniqby": "^4.7.0",
"lodash.upperfirst": "4.3.1",
"mailparser": "3.9.3",
"microdiff": "1.4.0",
"mrmime": "^2.0.1",
"ms": "2.1.3",
"nest-commander": "^3.19.1",
"node-ical": "^0.20.1",
"nodemailer": "^8.0.4",
"openapi-types": "12.1.3",
"openid-client": "^5.7.0",
"otplib": "^12.0.1",
"passport": "^0.7.0",
"passport-google-oauth20": "2.0.0",
"passport-jwt": "4.0.1",
"passport-microsoft": "2.1.0",
"path-to-regexp": "^8.2.0",
"pg": "8.12.0",
"planer": "1.2.0",
"pluralize": "8.0.0",
"postal-mime": "^2.6.1",
"protobufjs": "^7.5.5",
"psl": "^1.9.0",
"react": "18.3.1",
"react-dom": "18.3.1",
"redis": "^4.7.0",
"reflect-metadata": "0.2.2",
"rxjs": "7.8.1",
"semver": "7.6.3",
"sharp": "0.32.6",
"sns-payload-validator": "^2.1.0",
"stripe": "19.3.1",
"tar": "^7.5.9",
"temporal-polyfill": "^0.3.0",
"transliteration": "2.3.5",
"tsconfig-paths": "^4.2.0",
"tsdav": "^2.2.0",
"tslib": "2.8.1",
"type-fest": "4.10.1",
"typeorm": "patch:[email protected]#./patches/typeorm+0.3.20.patch",
"unzipper": "^0.12.3",
"uuid": "9.0.1",
"vite-tsconfig-paths": "4.3.2",
"zod": "^4.1.11"
},
"devDependencies": {
"@faker-js/faker": "^9.8.0",
"@lingui/cli": "^5.1.2",
"@lingui/vite-plugin": "5.1.2",
"@nestjs/cli": "^11.0.16",
"@nestjs/devtools-integration": "^0.2.1",
"@nestjs/schematics": "^11.0.9",
"@nestjs/testing": "11.1.16",
"@swc/cli": "^0.7.10",
"@swc/core": "^1.15.11",
"@swc/jest": "^0.2.39",
"@types/addressparser": "^1.0.3",
"@types/archiver": "^6.0.0",
"@types/babel__preset-env": "7.10.0",
"@types/bcrypt": "^5.0.0",
"@types/bytes": "^3.1.1",
"@types/dompurify": "^3.0.5",
"@types/express": "^4.17.13",
"@types/express-session": "^1.18.0",
"@types/graphql-fields": "^1.3.6",
"@types/graphql-upload": "^16.0.7",
"@types/html-to-text": "^9.0.4",
"@types/jest": "^30.0.0",
"@types/lodash.chunk": "^4.2.9",
"@types/lodash.compact": "^3.0.9",
"@types/lodash.differencewith": "^4.5.9",
"@types/lodash.groupby": "^4.6.9",
"@types/lodash.isempty": "^4.4.7",
"@types/lodash.isequal": "^4.5.8",
"@types/lodash.isobject": "^3.0.7",
"@types/lodash.merge": "^4.6.9",
"@types/lodash.omit": "^4.5.9",
"@types/lodash.omitby": "^4.6.9",
"@types/lodash.snakecase": "^4.1.7",
"@types/lodash.uniq": "^4.5.9",
"@types/lodash.uniqby": "^4.7.9",
"@types/lodash.upperfirst": "^4.3.7",
"@types/mailparser": "^3.4.6",
"@types/ms": "^0.7.31",
"@types/node": "^24.0.0",
"@types/nodemailer": "^7.0.3",
"@types/openid-client": "^3.7.0",
"@types/passport-google-oauth20": "^2.0.11",
"@types/passport-jwt": "^3.0.8",
"@types/passport-microsoft": "^2.1.0",
"@types/pluralize": "^0.0.33",
"@types/psl": "^1.1.3",
"@types/react": "^18.2.39",
"@types/supertest": "^2.0.11",
"@types/tar": "^7.0.87",
"@types/unzipper": "^0",
"@types/uuid": "^9.0.2",
"@yarnpkg/types": "^4.0.0",
"jest": "29.7.0",
"jest-environment-node": "^29.4.1",
"prettier": "^3.1.1",
"rimraf": "^5.0.5",
"supertest": "^6.1.3",
"ts-jest": "^29.1.1",
"ts-node": "10.9.1",
"twenty-client-sdk": "workspace:*",
"twenty-emails": "workspace:*",
"twenty-shared": "workspace:*"
},
"engines": {
"node": "^24.5.0",
"npm": "please-use-yarn",
"yarn": "^4.0.2"
}
}
Reference in New Issue View Git Blame Copy Permalink