mirror of
https://github.com/twentyhq/twenty.git
synced 2026-06-11 09:26:53 -04:00
9100fb1e9f
Closes 3 webpack-dev-server Dependabot alerts — [1237](https://github.com/twentyhq/twenty/security/dependabot/1237), [691](https://github.com/twentyhq/twenty/security/dependabot/691), [692](https://github.com/twentyhq/twenty/security/dependabot/692) — with a **scoped** resolution: `@electron-forge/plugin-webpack/webpack-dev-server: 5.2.4`. (These numbers are Dependabot **alert** IDs, not issue/PR numbers — written without `#` to avoid cross-linking unrelated issues, per review feedback.) ### Why a resolution (the one place it's unavoidable) webpack-dev-server is pulled **only** by `@electron-forge/plugin-webpack` (twenty-companion's build tooling), and **no electron-forge release uses webpack-dev-server 5** — not even `8.0.0-alpha.9` still pins `^4`. There is no parent-upgrade path, so a resolution is the only mechanism. ### Scoped, not global Per review feedback, the resolution targets `@electron-forge/plugin-webpack/webpack-dev-server` rather than a global override — it only forces v5 under electron-forge (the sole consumer), limiting blast radius. Verified the scoped syntax is honored: removing it reverts the lockfile to `webpack-dev-server@npm:^4.0.0`; with it, the lock pins `webpack-dev-server@npm:5.2.4` and `yarn install --immutable` passes. ### Why it's safe (constructor did NOT change v4→v5) `@electron-forge/plugin-webpack@7` calls `new WebpackDevServer(this.devServerOptions(), compiler)`. webpack-dev-server's constructor is `constructor(options, compiler)` in **both v4 and v5** (verified in `lib/Server.js:331` and `types/lib/Server.d.ts:1179`). The `(compiler, options)` → `(options, compiler)` swap happened at **v3 → v4**, not v4 → v5. The plugin passes only options unchanged in v5 (`hot`, `devMiddleware.writeToDisk`, `historyApiFallback`, `port`, `setupExitSignals`, `static`, `headers`) and uses none of the hooks v5 removed. ### Scope / verification - `yarn install --immutable` ✓; webpack-dev-server resolves to 5.2.4 only (was 4.15.2), no vulnerable copy remains. - Only exercised by `electron-forge start` (dev HMR); production `make`/`package` builds don't use it, and **twenty-companion has no CI workflow**, so this can't affect CI. - Residual manual check (not CI-covered): `yarn start:electron` in twenty-companion still boots the dev server.
87 lines
2.6 KiB
JSON
87 lines
2.6 KiB
JSON
{
|
|
"private": true,
|
|
"devDependencies": {
|
|
"@nx/jest": "22.7.5",
|
|
"@nx/js": "22.7.5",
|
|
"@nx/react": "22.7.5",
|
|
"@nx/storybook": "22.7.5",
|
|
"@nx/vite": "22.7.5",
|
|
"@nx/web": "22.7.5",
|
|
"@types/react": "^18.2.39",
|
|
"@types/react-dom": "^18.2.15",
|
|
"@yarnpkg/types": "^4.0.0",
|
|
"concurrently": "^8.2.2",
|
|
"http-server": "^14.1.1",
|
|
"nx": "22.7.5",
|
|
"oxfmt": "0.50.0",
|
|
"tsx": "^4.17.0",
|
|
"verdaccio": "^6.3.1"
|
|
},
|
|
"engines": {
|
|
"node": "^24.5.0",
|
|
"npm": "please-use-yarn",
|
|
"yarn": ">=4.0.2"
|
|
},
|
|
"license": "AGPL-3.0",
|
|
"name": "twenty",
|
|
"packageManager": "yarn@4.13.0",
|
|
"resolutions": {
|
|
"graphql": "16.8.1",
|
|
"type-fest": "4.10.1",
|
|
"typescript": "5.9.3",
|
|
"nodemailer": "8.0.10",
|
|
"graphql-redis-subscriptions/ioredis": "^5.6.0",
|
|
"@lingui/core": "5.1.2",
|
|
"@types/qs": "6.9.16",
|
|
"@opentelemetry/api": "1.9.1",
|
|
"chokidar": "^3.6.0",
|
|
"tmp": "^0.2.7",
|
|
"node-gyp": "^12.4.0",
|
|
"cacache": "^20.0.0",
|
|
"make-fetch-happen": "^15.0.0",
|
|
"@electron/rebuild/tar": "npm:^7.5.16",
|
|
"@electron/node-gyp/tar": "npm:^7.5.16",
|
|
"pacote/tar": "npm:^7.5.16",
|
|
"@angular-devkit/core": "19.2.24",
|
|
"yeoman-environment": "6.0.1",
|
|
"@electron-forge/plugin-webpack/webpack-dev-server": "5.2.4"
|
|
},
|
|
"version": "0.2.1",
|
|
"nx": {},
|
|
"scripts": {
|
|
"docs:generate": "tsx packages/twenty-docs/scripts/generate-docs-json.ts",
|
|
"docs:generate-navigation-template": "tsx packages/twenty-docs/scripts/generate-navigation-template.ts",
|
|
"docs:generate-paths": "tsx packages/twenty-docs/scripts/generate-documentation-paths.ts",
|
|
"start": "npx concurrently --kill-others 'npx nx run-many -t start -p twenty-server twenty-front' 'npx wait-on tcp:3000 && npx nx run twenty-server:worker'"
|
|
},
|
|
"workspaces": {
|
|
"packages": [
|
|
"packages/twenty-front",
|
|
"packages/twenty-server",
|
|
"packages/twenty-emails",
|
|
"packages/twenty-ui",
|
|
"packages/twenty-ui-deprecated",
|
|
"packages/twenty-utils",
|
|
"packages/twenty-zapier",
|
|
"packages/twenty-website",
|
|
"packages/twenty-docs",
|
|
"packages/twenty-e2e-testing",
|
|
"packages/twenty-shared",
|
|
"packages/twenty-sdk",
|
|
"packages/twenty-front-component-renderer",
|
|
"packages/twenty-client-sdk",
|
|
"packages/twenty-cli",
|
|
"packages/create-twenty-app",
|
|
"packages/twenty-codex-plugin",
|
|
"packages/twenty-oxlint-rules",
|
|
"packages/twenty-companion",
|
|
"packages/twenty-claude-skills"
|
|
]
|
|
},
|
|
"prettier": {
|
|
"singleQuote": true,
|
|
"trailingComma": "all",
|
|
"endOfLine": "lf"
|
|
}
|
|
}
|