mirror of
https://github.com/twentyhq/twenty.git
synced 2026-08-02 02:30:26 -04:00
3303bdd258
## Context AWS Inspector flags `curl 8.19.0` in every `prod-twenty` image, including current builds, with 2 high and 6 medium findings: - **High**: CVE-2026-6276, CVE-2026-5773 - **Medium**: CVE-2026-4873, CVE-2026-5545, CVE-2026-6253, CVE-2026-6429, CVE-2026-7009, CVE-2026-7168 These drive the Oneleet monitor "AWS ECR repository image vulnerabilities are remediated" (high severity SLA window currently open). ## Fix All 8 CVEs are fixed in Alpine 3.23's `curl 8.20.0-r0`, now available in the v3.23 main repository: - `twenty-server` runtime stage: raise the pin from `curl>=8.19.0-r0` to `curl>=8.20.0-r0` - `twenty-app-dev` stage: pin the previously unpinned `curl` to the same floor ## Verification Built the runtime apk layer locally against the pinned `node:24.18.0-alpine3.23` base: ``` curl-8.20.0-r0 libcurl-8.20.0-r0 curl 8.20.0 (aarch64-alpine-linux-musl) libcurl/8.20.0 OpenSSL/3.5.7 ... ``` Next deployed image will carry the patched curl, and the remaining findings on old images age out via the 14-day ECR lifecycle. <!-- This is an auto-generated description by cubic. --> <a href="https://cubic.dev/pr/twentyhq/twenty/pull/22994?utm_source=github" target="_blank" rel="noopener noreferrer" data-no-image-dialog="true"><picture><source media="(prefers-color-scheme: dark)" srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source media="(prefers-color-scheme: light)" srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img alt="Review in cubic" src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a> <!-- End of auto-generated description by cubic. -->
