security: clear all High minimatch Dependabot alerts via parent bumps (#21373)

## What

Clears **all 14 High `minimatch` ReDoS alerts** (GHSA-7r86-cg39-jmmj,
GHSA-23c5-xmqv-rm74, GHSA-3ppc-4f35-3m26) in the root tree — **by
bumping the actual parent dev tools, with no `resolutions`/overrides**.
Each parent that pinned a vulnerable minimatch is upgraded so the
patched version resolves naturally.

| Vulnerable minimatch | Pinned by | Fix |
|---|---|---|
| 10.0.3 | `@microsoft/api-extractor` 7.55.1 | → 7.58.7 (in-range
refresh) → minimatch 10.2.3 |
| 3.1.2 | `@stoplight/spectral-core` 1.20.0 | → 1.23.0 (in-range
refresh) → minimatch ^3.1.4 |
| 3.0.8 | `vite-plugin-dts` 3.8.1 → api-extractor 7.43.0 | bump to
`^4.5.4` (already used elsewhere here) → minimatch 10.2.3 |
| 4.2.3 | `graphql-config` 4.5.0 via `@graphql-codegen/cli` ^3.3.1 |
bump cli to `^5.0.7` → graphql-config 5.1.6 → minimatch ^10 |
| 9.0.3 | `zapier-platform-cli` ^15.4.1 | bump to `^19.0.0` |
| 7.4.6 | `verdaccio` 6.5.2 → `@verdaccio/core` 8.0.0-next | refresh to
6.7.2 → core 8.1.1 → minimatch 7.4.9 |

All six are **build/test tooling** — the ReDoS exposure is build-time,
never shipped to users.

## Verification

- ✅ Every resolved `minimatch` in `yarn.lock` is now ≥ its patched floor
(3.1.5 / 7.4.9 / 9.0.9 / 10.2.3+). No `resolutions` added.
- ✅ `nx build`: twenty-shared, twenty-ui, twenty-ui-deprecated,
twenty-emails (validates vite-plugin-dts v4)
- ✅ twenty-zapier: typecheck + build + `zapier validate` (35/35 checks
pass; cli 19 + core 15.5.1)
- ✅ twenty-front: typecheck; `graphql:generate` with codegen cli 5
produces **byte-identical** output (no generated-file changes in this
PR)
- ✅ `yarn install --immutable` clean

## Notes

- The large `yarn.lock` diff is expected: major bumps to codegen (3→5),
zapier-cli (15→19), and vite-plugin-dts (3→4) cascade through dev-tree
transitives (net −1244 lines after dedup).
- `zapier-platform-core` (runtime) intentionally left at 15.5.1 — only
the CLI (dev tool) carried the vulnerable minimatch; `zapier validate`
flags only a non-blocking "consider upgrading core" suggestion.
- codegen plugins (`typescript`/`typescript-operations`) left at v3:
they run fine under cli 5 and produce identical output, so the minimal
change is just the cli bump.

packages/twenty-emails/package.json

@@ -30,7 +30,7 @@
     "@vitejs/plugin-react-swc": "4.2.3",
     "react-email": "5.1.0",
     "tsc-alias": "^1.8.16",
-    "vite-plugin-dts": "3.8.1"
+    "vite-plugin-dts": "^4.5.4"
   },
   "exports": {
     ".": {

packages/twenty-front/package.json

@@ -150,7 +150,7 @@
   "devDependencies": {
     "@babel/core": "^7.14.5",
     "@babel/preset-typescript": "^7.24.6",
-    "@graphql-codegen/cli": "^3.3.1",
+    "@graphql-codegen/cli": "^5.0.7",
     "@graphql-codegen/typed-document-node": "^5.0.9",
     "@graphql-codegen/typescript": "^3.0.4",
     "@graphql-codegen/typescript-operations": "^3.0.4",

packages/twenty-shared/package.json

@@ -39,7 +39,7 @@
     "tsx": "^4.19.3",
     "typescript": "^5.9.3",
     "vite": "^7.0.0",
-    "vite-plugin-dts": "3.8.1",
+    "vite-plugin-dts": "^4.5.4",
     "vite-tsconfig-paths": "^4.2.1"
   },
   "dependencies": {

packages/twenty-ui-deprecated/package.json

@@ -42,7 +42,7 @@
     "ts-jest": "^29.1.1",
     "tsx": "^4.19.3",
     "vite-plugin-checker": "^0.10.2",
-    "vite-plugin-dts": "3.8.1",
+    "vite-plugin-dts": "^4.5.4",
     "vite-plugin-svgr": "^4.3.0"
   },
   "dependencies": {

packages/twenty-ui/package.json

@@ -40,7 +40,7 @@
     "ts-jest": "^29.1.1",
     "tsx": "^4.19.3",
     "vite-plugin-checker": "^0.10.2",
-    "vite-plugin-dts": "3.8.1",
+    "vite-plugin-dts": "^4.5.4",
     "vite-plugin-sass-dts": "^1.3.31",
     "vite-plugin-svgr": "^4.3.0",
     "vite-tsconfig-paths": "^4.2.1",

packages/twenty-zapier/package.json

@@ -29,6 +29,6 @@
     "vite": "^7.0.0",
     "vite-plugin-dts": "^4.5.4",
     "vite-tsconfig-paths": "^4.2.1",
-    "zapier-platform-cli": "^15.4.1"
+    "zapier-platform-cli": "^19.0.0"
   }
 }

packages/twenty-zapier/project.json

@@ -37,7 +37,7 @@
       "executor": "nx:run-commands",
       "options": {
         "cwd": "{projectRoot}",
-        "commands": ["zapier validate"]
+        "commands": ["zapier-platform validate"]
       },
       "dependsOn": ["build"]
     },
@@ -45,7 +45,7 @@
       "executor": "nx:run-commands",
       "options": {
         "cwd": "{projectRoot}",
-        "commands": ["zapier versions"]
+        "commands": ["zapier-platform versions"]
       },
       "dependsOn": ["build"]
     },
@@ -68,7 +68,7 @@
       "executor": "nx:run-commands",
       "options": {
         "cwd": "{projectRoot}",
-        "commands": ["zapier push --disable-dependency-detection"]
+        "commands": ["zapier-platform push --disable-dependency-detection"]
       },
       "dependsOn": ["build"]
     },
@@ -76,7 +76,7 @@
       "executor": "nx:run-commands",
       "options": {
         "cwd": "{projectRoot}",
-        "commands": ["zapier promote"]
+        "commands": ["zapier-platform promote"]
       },
       "dependsOn": ["build"]
     }