Charles BochetandGitHub
be39702fd2
## Summary A self-hoster reported that Trivy blocks the `twentycrm/twenty:v2.7.x` image on three fixed-critical CVEs. The reachable risk is low (none of the vulnerable code paths are exposed to attacker-controlled input in our deployment), but the findings are real and easy to clear by bumping the affected dependencies in their owning workspaces. ### CVE-2026-41242 — `protobufjs` < 7.5.5 Pulled transitively into the production image via `@opentelemetry/sdk-node`, `@opentelemetry/auto-instrumentations-node`, and `@grpc/grpc-js` → `@grpc/proto-loader`. Lockfile was on 7.5.3; this matches dismissed dependabot alert #1009 (Critical 9.4). **Fix:** add `protobufjs: ^7.5.5` as a direct dep of `twenty-server` (the workspace that exercises it via the OpenTelemetry gRPC exporters) and run `yarn dedupe protobufjs` to collapse the residual transitive 7.5.3 copy. Resolves to 7.6.0. ### CVE-2024-24790 and CVE-2025-68121 — Go stdlib in bundled binaries Present in the Go-built `bin/esbuild` shipped by `@esbuild/<platform>` packages. Two paths put esbuild into the production image: 1. `twenty-client-sdk` declares `esbuild` as a runtime dep (used by its `./generate` entry point). 2. `twenty-server` had `@lingui/vite-plugin` in `dependencies`, which pulls `@lingui/cli` as a runtime sub-dep, which bundles `esbuild@0.21.5` nested under `node_modules/@lingui/cli/node_modules/esbuild/`. **Fix:** - Bump `twenty-client-sdk`'s `esbuild` from `^0.25.0` to `^0.27.3` (resolves to 0.27.7, built with patched Go). - Move `@lingui/vite-plugin` from `dependencies` to `devDependencies` in `twenty-server`. The plugin is not imported by any source file — it was misclassified. ### Verification Ran `yarn workspaces focus --production twenty twenty-server twenty-emails twenty-shared twenty-client-sdk` (the same command the Dockerfile uses) and inventoried the resulting `node_modules`. After all three changes: - `node_modules/esbuild/` → **0.27.7 only** (Go-patched) - `node_modules/protobufjs/` → **7.6.0 only** (CVE-patched) No nested copies of either package remain in the production install. ### Follow-up worth tracking separately `esbuild` should arguably not be in `twenty-client-sdk`'s `dependencies` at all — only the `./generate` entry point uses it, and the server never imports that entry. Moving it to optional `peerDependencies` would stop shipping a Go binary into the production image entirely. Out of scope for this PR. ## Test plan - [x] `yarn install` succeeds; `protobufjs` and `esbuild` each resolve to a single version in production focus - [x] `nx build twenty-client-sdk` passes - [x] `nx typecheck twenty-server` passes - [x] `nx build twenty-server` passes - [x] Production focus install confirmed clean (`node_modules/esbuild` and `node_modules/protobufjs` both single-version, both patched) - [ ] CI green - [ ] Re-run Trivy against the resulting image; confirm the three CVEs no longer appear
63 lines
1.5 KiB
JSON
63 lines
1.5 KiB
JSON
{
|
|
"name": "twenty-client-sdk",
|
|
"version": "2.7.0",
|
|
"sideEffects": false,
|
|
"license": "AGPL-3.0",
|
|
"scripts": {
|
|
"build": "npx rimraf dist && npx vite build && tsgo -p tsconfig.lib.json --declaration --emitDeclarationOnly --noEmit false --outDir dist --rootDir src && npx tsc-alias -p tsconfig.lib.json --outDir dist"
|
|
},
|
|
"exports": {
|
|
"./core": {
|
|
"types": "./dist/core/index.d.ts",
|
|
"import": "./dist/core.mjs",
|
|
"require": "./dist/core.cjs"
|
|
},
|
|
"./metadata": {
|
|
"types": "./dist/metadata/index.d.ts",
|
|
"import": "./dist/metadata.mjs",
|
|
"require": "./dist/metadata.cjs"
|
|
},
|
|
"./generate": {
|
|
"types": "./dist/generate/index.d.ts",
|
|
"import": "./dist/generate.mjs",
|
|
"require": "./dist/generate.cjs"
|
|
}
|
|
},
|
|
"typesVersions": {
|
|
"*": {
|
|
"core": [
|
|
"dist/core/index.d.ts"
|
|
],
|
|
"metadata": [
|
|
"dist/metadata/index.d.ts"
|
|
],
|
|
"generate": [
|
|
"dist/generate/index.d.ts"
|
|
]
|
|
}
|
|
},
|
|
"files": [
|
|
"dist"
|
|
],
|
|
"dependencies": {
|
|
"@genql/cli": "^3.0.3",
|
|
"@genql/runtime": "^2.10.0",
|
|
"esbuild": "^0.27.3",
|
|
"graphql": "^16.8.1"
|
|
},
|
|
"devDependencies": {
|
|
"@typescript/native-preview": "^7.0.0-dev.20260116.1",
|
|
"tsc-alias": "^1.8.16",
|
|
"twenty-shared": "workspace:*",
|
|
"typescript": "^5.9.2",
|
|
"vite": "^7.0.0",
|
|
"vite-plugin-dts": "^4.5.4",
|
|
"vite-tsconfig-paths": "^4.2.1",
|
|
"vitest": "^4.0.18"
|
|
},
|
|
"engines": {
|
|
"node": "^24.5.0",
|
|
"yarn": "^4.0.2"
|
|
}
|
|
}
|