Abdullah.andGitHub
9d951757d8
Fixes [Dependabot Alert 216](https://github.com/twentyhq/twenty/security/dependabot/216) - authorization bypass in next.js middleware. Updated `react-email` version from `4.0.3` to `4.0.4`. This bumps up Next.js to a safer version for the mentioned critical alert. However, even the latest `react-email` package has not upgraded to Next.js 15.4.7 - the recommended version by dependabot. Since `react-email` is a devDependency used to preview email templates during development, it never gets inserted into the production build. Therefore, I marking the following alerts as `vulnerable code is never used` with a comment that it never makes it to the production build. <p align="center"> <img width="1142" height="342" alt="image" src="https://github.com/user-attachments/assets/50976fd3-b49c-4ee7-ac26-89f505783d55" /> </p> The only other place where we have next imported is twenty-website, which uses the safe version `14.2.33`. <p align="center"> <img width="421" height="92" alt="image" src="https://github.com/user-attachments/assets/fe1e20dc-7483-44f7-bf26-78f7131ccf46" /> </p>