From 166f7ee0d22846493063c838ea686c018e27ac72 Mon Sep 17 00:00:00 2001 From: Charles Bochet Date: Thu, 11 Jun 2026 13:41:03 +0200 Subject: [PATCH] chore(deps): prune yarn resolutions down to load-bearing entries (#21446) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Context Audit of all 28 `resolutions` entries in the root package.json against yarn.lock dependency graphs and the npm registry, to remove every entry that is no longer forcing anything a normal resolution wouldn't do — resolutions are hard to maintain and silently freeze versions. Net result: **28 → 22 entries**, two small dependency bumps replace pins, and every remaining entry now has its blocker + removal condition documented in `//resolutions`. ## Removed — dead weight (re-resolution lands on the same safe versions) | Entry | Why it was dead | |---|---| | `type-fest: 4.10.1` | Stale 2024 dedup pin that semver-overrode ~16 of 19 declared ranges (forced `^0.13`/`^0.20`/`^0.21` consumers up four majors, `^5.x` consumers down one). Types-only; each parent now resolves its own compatible copy. | | `typescript: 5.9.3` | No-op: every range (`^5.9.3`, `5.9.3`, `~5.9.2`) resolves to 5.9.3 naturally. Only the electron-forge scaffolding template regains its own nested `~5.4.5` (never builds this repo). | | `node-gyp: ^12.4.0` | All requesters are Yarn-injected `node-gyp: latest` = 12.4.0 today. The tar-6-era node-gyp versions it evicted have no requesting parent left. | | `cacache: ^20.0.0` | All four parents (arborist, metavuln-calculator, make-fetch-happen 15, pacote 21) already declare `^20`. Guarded by the kept `make-fetch-happen: ^15` resolution. | | `pacote/tar: ^7.5.16` | The original target (pacote 11/15 via zapier) is gone; the only pacote left is 21.5.0 which declares `tar ^7.4.3` natively. | ## Removed — replaced by a parent upgrade - **`nodemailer: 8.0.10`** → `imapflow` 1.2.1 → **1.3.6** (ships patched nodemailer 8.0.10 exact; 1.4.0 is blocked by the 3-day npm age gate). twenty-server's own `^8.0.5` range was already safe. - **`node-ical/uuid: 11.1.1`** → `node-ical` ^0.20.1 → **^0.21.0**, which drops uuid (and axios) entirely. The uuid removal happened at 0.21.0 — not in the 0.26 rrule-temporal type overhaul that #21441 flagged as the blocker. ## Narrowed — `qs: 6.15.2` global → two scoped entries Only three lockfile entries actually request vulnerable qs ranges: `express@4.22.0` (pinned by `@mintlify/previewing`), `express@4.22.1` + `@cypress/request@3.0.10` (pinned by verdaccio 6.7.2, latest). Replaced the global pin with `express/qs` + `@cypress/request/qs`, so the 12+ healthy parents (express 4.22.2/5.x, body-parser, stripe, …) are no longer frozen and will pick up future qs releases naturally. ## Re-pinned — `graphql-redis-subscriptions/ioredis` Changed `^5.6.0` → exact `5.10.1` and documented why: this must equal the exact ioredis version pinned by twenty-server and bullmq. Without it, graphql-redis-subscriptions' `^5.3.2` resolves to a second ioredis copy and `RedisPubSub`'s publisher/subscriber types reject the server's client (caught by twenty-server typecheck during this work — bump it in lockstep with the ioredis pin). ## Kept (all load-bearing, now documented inline) graphql (singleton below msw's `^16.12.0`), @lingui/core (suite lockstep), @types/qs (6.9.17 typing-break holdback), @opentelemetry/api (NoopMeterProvider singleton, #20231), chokidar v3 (NestJS CLI fsevents, #20316), tmp (zapier-platform-cli pins 0.2.5), make-fetch-happen + the two @electron tar entries (blocked on electron-forge adopting @electron/rebuild 4), @angular-devkit/core (blocked on a fixed @nestjs/cli > 11.0.23), yeoman-environment, webpack-dev-server, next/postcss (fix only in next 16.3.0 canaries), the remaining uuid pins, and react-doc-viewer/ajv. ## Follow-ups (separate PRs) - `typeorm` 0.3.20 → 0.3.30: re-roll the 46-line patch; clears the `typeorm/uuid` resolution **and** the open high-severity GHSA-q2pj-6v73-8rgj (SQL injection in `repository.save/update`, fixed in 0.3.26). - googleapis 105 → ≥152 migration clears `googleapis-common/uuid`. ## Verification - `yarn install` clean; lockfile contains **no** vulnerable qs (≤6.15.1)/tar 6/uuid <11/nodemailer <8.0.4/postcss 8.4.31/tmp <0.2.6 entries - `npx nx typecheck twenty-server` ✓ and `npx nx typecheck twenty-front` ✓ - CalDAV + IMAP unit tests (node-ical/imapflow consumers): 9 suites, 121 tests ✓ - `yarn npm audit --all`: only pre-existing typeorm finding remains (see follow-up) --- package.json | 14 +- packages/twenty-server/package.json | 4 +- yarn.lock | 218 +++++++++++++++++++--------- 3 files changed, 157 insertions(+), 79 deletions(-) diff --git a/package.json b/package.json index c8154dac58..ca3d79b5b2 100644 --- a/package.json +++ b/package.json @@ -27,35 +27,29 @@ "packageManager": "yarn@4.13.0", "resolutions": { "graphql": "16.8.1", - "type-fest": "4.10.1", - "typescript": "5.9.3", - "nodemailer": "8.0.10", - "graphql-redis-subscriptions/ioredis": "^5.6.0", + "graphql-redis-subscriptions/ioredis": "5.10.1", "@lingui/core": "5.1.2", "@types/qs": "6.9.16", "@opentelemetry/api": "1.9.1", "chokidar": "^3.6.0", "tmp": "^0.2.7", - "node-gyp": "^12.4.0", - "cacache": "^20.0.0", "make-fetch-happen": "^15.0.0", "@electron/rebuild/tar": "npm:^7.5.16", "@electron/node-gyp/tar": "npm:^7.5.16", - "pacote/tar": "npm:^7.5.16", "@angular-devkit/core": "19.2.24", "yeoman-environment": "6.0.1", "@electron-forge/plugin-webpack/webpack-dev-server": "5.2.4", - "qs": "6.15.2", + "express/qs": "6.15.2", + "@cypress/request/qs": "6.15.2", "next/postcss": "8.5.15", "sockjs/uuid": "11.1.1", "@cypress/request/uuid": "11.1.1", "@ptc-org/nestjs-query-typeorm/uuid": "11.1.1", "typeorm/uuid": "11.1.1", - "node-ical/uuid": "11.1.1", "googleapis-common/uuid": "11.1.1", "@cyntler/react-doc-viewer/ajv": "8.20.0" }, - "//resolutions": "qs 6.15.2 -> CVE fix for verdaccio + @mintlify/previewing (pin old express 4.22.x); next/postcss 8.5.15 -> CVE fix for next, which pins old postcss 8.4.31 exact on every stable release (fix only in the 16.3.0 canary); /uuid 11.1.1 -> CVE fix scoped to parents pinning uuid <11 that can't be cleanly bumped (sockjs+wds & @ptc-org/nestjs-query-typeorm at latest; typeorm is a patch:dep ORM core; node-ical 0.26 & googleapis 173 are large breaking migrations; @cypress/request transitive). bullmq/msal-node/blocknote were bumped instead. Preserves the intentional uuid 13.x; @cyntler/react-doc-viewer/ajv 8.20.0 -> CVE fix; react-doc-viewer pins ajv ^7 (latest still does) but never imports ajv, so forcing v8 is safe; remove each once upstream ships a patched/clean version", + "//resolutions": "Each entry is load-bearing: it forces a version OUTSIDE some parent's declared range where no fixed upstream release exists; remove each once its blocker ships. graphql 16.8.1 -> singleton pin held below msw's ^16.12.0 dep and @nestjs/graphql's ^16.11.0 peer; drop after a validated repo-wide bump to latest 16.x; graphql-redis-subscriptions/ioredis 5.10.1 -> TS type-identity dedup: twenty-server passes its ioredis client into RedisPubSub, so this must equal the exact ioredis version pinned by twenty-server and bullmq (bump in lockstep); @lingui/core 5.1.2 -> lockstep with the @lingui/* 5.1.2 suite, drop in the next coordinated lingui bump; @types/qs 6.9.16 -> holdback below the 6.9.17 ParsedQs typing break (node-saml wants ^6.9.18); @opentelemetry/api 1.9.1 -> singleton guard for the NoopMeterProvider bug (#20231): ai 6.0.x pins 1.9.0 exact vs @sentry/node ^1.9.1, drop when workspace ai >=6.0.178 AND @scalar/agent-chat moves off ai 6.0.33; chokidar ^3 -> NestJS CLI watch needs fsevents on macOS, removed in chokidar 4/5 (#20316); tmp ^0.2.7 -> CVE, zapier-platform-cli 19 (latest) pins 0.2.5 and inquirer 7/8's external-editor wants ^0.0.33; make-fetch-happen ^15 + @electron/{rebuild,node-gyp}/tar ^7.5.16 -> tar CVE eviction for the @electron/rebuild 3.x toolchain (rebuild 3.x pins tar ^6, its node-gyp fork pins tar ^6.2.1 + mfh ^10), drop when electron-forge declares @electron/rebuild >=4; @angular-devkit/core 19.2.24 -> picomatch CVE, blocked on @nestjs/cli >11.0.23 fixing the dist/src output regression (repo held at 11.0.16); yeoman-environment 6.0.1 -> CVE, zapier-platform-cli 19 (latest) pins 4.4.3; webpack-dev-server 5.2.4 -> CVE, @electron-forge/plugin-webpack (incl. 8.x alphas) still declares ^4; express/qs + @cypress/request/qs 6.15.2 -> qs CVE for old express 4.22.0/4.22.1 pinned by @mintlify/previewing and verdaccio (verdaccio also pins @cypress/request 3.0.10; all other qs parents resolve safe naturally); next/postcss 8.5.15 -> postcss CVE, every stable next pins 8.4.31 exact (fix only in 16.3.0 canaries; @react-email/ui also pins next 16.2.6); /uuid 11.1.1 -> uuid CVE for parents pinning uuid <11 with no fixed release (sockjs dormant since 2021; @cypress/request 3.0.10 via verdaccio; @ptc-org/nestjs-query-typeorm at latest; typeorm 0.3.20 patch:dep -- droppable by bumping to 0.3.29+ and re-rolling the patch; googleapis 105 -> common 8 drops uuid but needs the googleapis >=152 migration). Preserves the intentional uuid 13.x; @cyntler/react-doc-viewer/ajv 8.20.0 -> CVE, upstream (latest 1.17.1) pins ajv ^7 but never imports it, forcing v8 is safe", "version": "0.2.1", "nx": {}, "scripts": { diff --git a/packages/twenty-server/package.json b/packages/twenty-server/package.json index 91f3b5fc12..7b85d67b30 100644 --- a/packages/twenty-server/package.json +++ b/packages/twenty-server/package.json @@ -113,7 +113,7 @@ "graphql-upload": "16.0.2", "graphql-yoga": "4.0.5", "html-to-text": "^9.0.5", - "imapflow": "1.2.1", + "imapflow": "1.3.6", "ioredis": "5.10.1", "jsdom": "^26.1.0", "json-schema": "0.4.0", @@ -137,7 +137,7 @@ "mrmime": "^2.0.1", "ms": "2.1.3", "nest-commander": "^3.19.1", - "node-ical": "^0.20.1", + "node-ical": "^0.21.0", "nodemailer": "^8.0.5", "openapi-types": "12.1.3", "openid-client": "^5.7.0", diff --git a/yarn.lock b/yarn.lock index df804bc1ce..64b0465bea 100644 --- a/yarn.lock +++ b/yarn.lock @@ -27050,14 +27050,14 @@ __metadata: languageName: node linkType: hard -"@zone-eu/mailsplit@npm:5.4.8": - version: 5.4.8 - resolution: "@zone-eu/mailsplit@npm:5.4.8" +"@zone-eu/mailsplit@npm:5.4.12": + version: 5.4.12 + resolution: "@zone-eu/mailsplit@npm:5.4.12" dependencies: libbase64: "npm:1.3.0" - libmime: "npm:5.3.7" + libmime: "npm:5.3.8" libqp: "npm:2.1.1" - checksum: 10c0/a054bdf50e2378c773f9c54861d27095b6f3ef4c7828576aaaa9e2173de8edb59d603e052282eebfe8c5d442efc6896a22c374daa855e9e3d55af9771b97484a + checksum: 10c0/1b16a17a79a8d183adb2a8bab554d8d14b6566ae11e1e4f425f217714f1352d69963e67b48767f31699331157a3a965d3d8ce444ce57b01857d9338a77635370 languageName: node linkType: hard @@ -28198,7 +28198,7 @@ __metadata: languageName: node linkType: hard -"axios@npm:^1.16.0, axios@npm:^1.7.7": +"axios@npm:^1.16.0": version: 1.17.0 resolution: "axios@npm:1.17.0" dependencies: @@ -29231,7 +29231,7 @@ __metadata: languageName: node linkType: hard -"cacache@npm:^20.0.0": +"cacache@npm:^20.0.0, cacache@npm:^20.0.1": version: 20.0.4 resolution: "cacache@npm:20.0.4" dependencies: @@ -37879,12 +37879,12 @@ __metadata: languageName: node linkType: hard -"iconv-lite@npm:0.7.0, iconv-lite@npm:^0.7.0, iconv-lite@npm:~0.7.0": - version: 0.7.0 - resolution: "iconv-lite@npm:0.7.0" +"iconv-lite@npm:0.7.2, iconv-lite@npm:^0.7.2": + version: 0.7.2 + resolution: "iconv-lite@npm:0.7.2" dependencies: safer-buffer: "npm:>= 2.1.2 < 3.0.0" - checksum: 10c0/2382400469071c55b6746c531eed5fa4d033e5db6690b7331fb2a5f59a30d7a9782932e92253db26df33c1cf46fa200a3fbe524a2a7c62037c762283f188ec2f + checksum: 10c0/3c228920f3bd307f56bf8363706a776f4a060eb042f131cd23855ceca962951b264d0997ab38a1ad340e1c5df8499ed26e1f4f0db6b2a2ad9befaff22f14b722 languageName: node linkType: hard @@ -37897,12 +37897,12 @@ __metadata: languageName: node linkType: hard -"iconv-lite@npm:^0.7.2": - version: 0.7.2 - resolution: "iconv-lite@npm:0.7.2" +"iconv-lite@npm:^0.7.0, iconv-lite@npm:~0.7.0": + version: 0.7.0 + resolution: "iconv-lite@npm:0.7.0" dependencies: safer-buffer: "npm:>= 2.1.2 < 3.0.0" - checksum: 10c0/3c228920f3bd307f56bf8363706a776f4a060eb042f131cd23855ceca962951b264d0997ab38a1ad340e1c5df8499ed26e1f4f0db6b2a2ad9befaff22f14b722 + checksum: 10c0/2382400469071c55b6746c531eed5fa4d033e5db6690b7331fb2a5f59a30d7a9782932e92253db26df33c1cf46fa200a3fbe524a2a7c62037c762283f188ec2f languageName: node linkType: hard @@ -37986,20 +37986,20 @@ __metadata: languageName: node linkType: hard -"imapflow@npm:1.2.1": - version: 1.2.1 - resolution: "imapflow@npm:1.2.1" +"imapflow@npm:1.3.6": + version: 1.3.6 + resolution: "imapflow@npm:1.3.6" dependencies: - "@zone-eu/mailsplit": "npm:5.4.8" + "@zone-eu/mailsplit": "npm:5.4.12" encoding-japanese: "npm:2.2.0" - iconv-lite: "npm:0.7.0" + iconv-lite: "npm:0.7.2" libbase64: "npm:1.3.0" - libmime: "npm:5.3.7" + libmime: "npm:5.3.8" libqp: "npm:2.1.1" - nodemailer: "npm:7.0.11" - pino: "npm:10.1.0" - socks: "npm:2.8.7" - checksum: 10c0/dc3bef59dc2c9a6c27938de4c53e69ed5734d91da8a79cd2552fe90942667d7456dec557f1f0f2c7f61dfc459d0495c8420d754e84fa17b6a88be9caaa553113 + nodemailer: "npm:8.0.10" + pino: "npm:10.3.1" + socks: "npm:2.8.9" + checksum: 10c0/9fd42d1f28a7761a405a3de89aae797504b500cf69c91bf5ffc4f13a7448cd7ba90ca82da92c714d09bb8d254ff6ae73b91fa40c33a3fa470424062f433f30b0 languageName: node linkType: hard @@ -38492,7 +38492,7 @@ __metadata: languageName: node linkType: hard -"ioredis@npm:5.10.1, ioredis@npm:^5.6.0": +"ioredis@npm:5.10.1": version: 5.10.1 resolution: "ioredis@npm:5.10.1" dependencies: @@ -38509,7 +38509,7 @@ __metadata: languageName: node linkType: hard -"ip-address@npm:^10.0.1, ip-address@npm:^10.1.1": +"ip-address@npm:^10.1.1": version: 10.2.0 resolution: "ip-address@npm:10.2.0" checksum: 10c0/5a00aada6e922c9c69dfc800ed5d0fa3348675ebdeed0e1575f503f27ca385b5f534363c9af7ad1daf64c1f1409388cdd3cc2e9b9b0fe1c924a431378d55075a @@ -41277,15 +41277,15 @@ __metadata: languageName: node linkType: hard -"libmime@npm:5.3.7": - version: 5.3.7 - resolution: "libmime@npm:5.3.7" +"libmime@npm:5.3.8": + version: 5.3.8 + resolution: "libmime@npm:5.3.8" dependencies: encoding-japanese: "npm:2.2.0" - iconv-lite: "npm:0.6.3" + iconv-lite: "npm:0.7.2" libbase64: "npm:1.3.0" libqp: "npm:2.1.1" - checksum: 10c0/2c8afbe287df533b983b8eb6db0e98d4eb79c833aca7aac531994168d30dd6194a90d78cefb320427183853422be1c86511ab975b1a3fc9f1fc69ce1b83bb7c0 + checksum: 10c0/4fb65f7c07a9bdb0c0ee25bb80fac94a803807f9ac15a3d6cafc2c93303500d92c8ceb6dfe0ab938c871406fc01cb69a7a457f28b2037c47c283574e8900d8c4 languageName: node linkType: hard @@ -43900,12 +43900,12 @@ __metadata: languageName: node linkType: hard -"moment-timezone@npm:^0.5.45": - version: 0.5.48 - resolution: "moment-timezone@npm:0.5.48" +"moment-timezone@npm:^0.6.0": + version: 0.6.2 + resolution: "moment-timezone@npm:0.6.2" dependencies: moment: "npm:^2.29.4" - checksum: 10c0/ab14ec9d94bc33f29ac18e5417b7f8aca0b17130b952c5cc9697b8fea839e5ece9313af5fd3c9703a05db472b1560ddbfc7ad2aa24aac9afd047d6da6c3c6033 + checksum: 10c0/dbdca171625edaa73e55e4db152b9d3fe14035766e86c20a4bf881570418ecdbc50cc2d3a84101967b229a5ac0630031b4c3a49b0ba8447a9cd458d76e383cd5 languageName: node linkType: hard @@ -44714,7 +44714,7 @@ __metadata: languageName: node linkType: hard -"node-gyp@npm:^12.4.0": +"node-gyp@npm:^12.1.0, node-gyp@npm:latest": version: 12.4.0 resolution: "node-gyp@npm:12.4.0" dependencies: @@ -44734,15 +44734,13 @@ __metadata: languageName: node linkType: hard -"node-ical@npm:^0.20.1": - version: 0.20.1 - resolution: "node-ical@npm:0.20.1" +"node-ical@npm:^0.21.0": + version: 0.21.0 + resolution: "node-ical@npm:0.21.0" dependencies: - axios: "npm:^1.7.7" - moment-timezone: "npm:^0.5.45" + moment-timezone: "npm:^0.6.0" rrule: "npm:2.8.1" - uuid: "npm:^10.0.0" - checksum: 10c0/3e95ece63f0420f96b611913e0134660120bf2e87da8b1afbc73b6db2cbe2ad20d9b76ad912fa80b20923c64f0002869d98edaa53d143aa5989d223ff12ef621 + checksum: 10c0/71c1b95a43efd60a2fd086a76ccd64b640ec8c445afcf38cf60dd051f1b8539267f8fcf059f14af823f2fe58c68fdab39e9edc5edc72797ac51590ba229ed36d languageName: node linkType: hard @@ -44789,7 +44787,7 @@ __metadata: languageName: node linkType: hard -"nodemailer@npm:8.0.10": +"nodemailer@npm:8.0.10, nodemailer@npm:^8.0.5": version: 8.0.10 resolution: "nodemailer@npm:8.0.10" checksum: 10c0/b96fd2ea7146de58141219061e094509fd0f19aac5ac86ac35d9ce9c479dbf6c12b143fa7e7050a1be539a3542eb59520c33aabf5a119c8d28fc7d151bde329f @@ -47085,6 +47083,15 @@ __metadata: languageName: node linkType: hard +"pino-abstract-transport@npm:^3.0.0": + version: 3.0.0 + resolution: "pino-abstract-transport@npm:3.0.0" + dependencies: + split2: "npm:^4.0.0" + checksum: 10c0/4486e1b9508110aaf963d07741ac98d660b974dd51d8ad42077d215118e27cda20c64da46c07c926898d52540aab7c6b9c37dc0f5355c203bb1d6a72b5bd8d6c + languageName: node + linkType: hard + "pino-std-serializers@npm:^7.0.0": version: 7.0.0 resolution: "pino-std-serializers@npm:7.0.0" @@ -47092,24 +47099,24 @@ __metadata: languageName: node linkType: hard -"pino@npm:10.1.0": - version: 10.1.0 - resolution: "pino@npm:10.1.0" +"pino@npm:10.3.1": + version: 10.3.1 + resolution: "pino@npm:10.3.1" dependencies: "@pinojs/redact": "npm:^0.4.0" atomic-sleep: "npm:^1.0.0" on-exit-leak-free: "npm:^2.1.0" - pino-abstract-transport: "npm:^2.0.0" + pino-abstract-transport: "npm:^3.0.0" pino-std-serializers: "npm:^7.0.0" process-warning: "npm:^5.0.0" quick-format-unescaped: "npm:^4.0.3" real-require: "npm:^0.2.0" safe-stable-stringify: "npm:^2.3.1" sonic-boom: "npm:^4.0.1" - thread-stream: "npm:^3.0.0" + thread-stream: "npm:^4.0.0" bin: pino: bin.js - checksum: 10c0/49c1dd80d5f99f02bde1acf2f60cef7686948a937f751f6cb368c2868c7e82e54aeabac63a34587e16019965cbf0eb6e609edf92c439a98a0a4fcb0add277eaf + checksum: 10c0/ae1c57f2baac85dd5d63a3500746d5ea1cfc4bfcbf356eaec94d42a782eeb80caa4d4614de43a036cf48e2aed46d855a7ff21b126f55a63811def52a894ef937 languageName: node linkType: hard @@ -48392,7 +48399,7 @@ __metadata: languageName: node linkType: hard -"qs@npm:6.15.2": +"qs@npm:6.15.2, qs@npm:^6.11.0, qs@npm:^6.11.1, qs@npm:^6.14.1, qs@npm:^6.15.2, qs@npm:^6.4.0, qs@npm:^6.7.0, qs@npm:~6.15.1": version: 6.15.2 resolution: "qs@npm:6.15.2" dependencies: @@ -49427,6 +49434,13 @@ __metadata: languageName: node linkType: hard +"real-require@npm:^1.0.0": + version: 1.0.0 + resolution: "real-require@npm:1.0.0" + checksum: 10c0/74d44b360b8b662d29c646f4688da462c4b10243b11d22ff9635395e81951a9c1ed349393411c4911ca6f3474c3e10e812bf4767052706abb863ba59bde0813b + languageName: node + linkType: hard + "recast@npm:^0.23.11, recast@npm:^0.23.5": version: 0.23.11 resolution: "recast@npm:0.23.11" @@ -52230,17 +52244,7 @@ __metadata: languageName: node linkType: hard -"socks@npm:2.8.7": - version: 2.8.7 - resolution: "socks@npm:2.8.7" - dependencies: - ip-address: "npm:^10.0.1" - smart-buffer: "npm:^4.2.0" - checksum: 10c0/2805a43a1c4bcf9ebf6e018268d87b32b32b06fbbc1f9282573583acc155860dc361500f89c73bfbb157caa1b4ac78059eac0ef15d1811eb0ca75e0bdadbc9d2 - languageName: node - linkType: hard - -"socks@npm:^2.8.3": +"socks@npm:2.8.9, socks@npm:^2.8.3": version: 2.8.9 resolution: "socks@npm:2.8.9" dependencies: @@ -53541,6 +53545,13 @@ __metadata: languageName: node linkType: hard +"tagged-tag@npm:^1.0.0": + version: 1.0.0 + resolution: "tagged-tag@npm:1.0.0" + checksum: 10c0/91d25c9ffb86a91f20522cefb2cbec9b64caa1febe27ad0df52f08993ff60888022d771e868e6416cf2e72dab68449d2139e8709ba009b74c6c7ecd4000048d1 + languageName: node + linkType: hard + "tailwind-merge@npm:3.5.0": version: 3.5.0 resolution: "tailwind-merge@npm:3.5.0" @@ -53903,6 +53914,15 @@ __metadata: languageName: node linkType: hard +"thread-stream@npm:^4.0.0": + version: 4.2.0 + resolution: "thread-stream@npm:4.2.0" + dependencies: + real-require: "npm:^1.0.0" + checksum: 10c0/2d55ace44785a2547b9b15c61c1d2db6d5b3712e21ddb1be23b1f5d19387ac8f153f24767bfae03b3f7c8651eb83758e1fcbb954e1077336b562d2d2cd723137 + languageName: node + linkType: hard + "three@npm:^0.183.2": version: 0.183.2 resolution: "three@npm:0.183.2" @@ -55141,7 +55161,7 @@ __metadata: graphql-upload: "npm:16.0.2" graphql-yoga: "npm:4.0.5" html-to-text: "npm:^9.0.5" - imapflow: "npm:1.2.1" + imapflow: "npm:1.3.6" ioredis: "npm:5.10.1" jest: "npm:29.7.0" jest-environment-node: "npm:^29.4.1" @@ -55167,7 +55187,7 @@ __metadata: mrmime: "npm:^2.0.1" ms: "npm:2.1.3" nest-commander: "npm:^3.19.1" - node-ical: "npm:^0.20.1" + node-ical: "npm:^0.21.0" nodemailer: "npm:^8.0.5" openapi-types: "npm:12.1.3" openid-client: "npm:^5.7.0" @@ -55532,6 +55552,50 @@ __metadata: languageName: node linkType: hard +"type-fest@npm:^0.13.1": + version: 0.13.1 + resolution: "type-fest@npm:0.13.1" + checksum: 10c0/0c0fa07ae53d4e776cf4dac30d25ad799443e9eef9226f9fddbb69242db86b08584084a99885cfa5a9dfe4c063ebdc9aa7b69da348e735baede8d43f1aeae93b + languageName: node + linkType: hard + +"type-fest@npm:^0.20.2": + version: 0.20.2 + resolution: "type-fest@npm:0.20.2" + checksum: 10c0/dea9df45ea1f0aaa4e2d3bed3f9a0bfe9e5b2592bddb92eb1bf06e50bcf98dbb78189668cd8bc31a0511d3fc25539b4cd5c704497e53e93e2d40ca764b10bfc3 + languageName: node + linkType: hard + +"type-fest@npm:^0.21.3": + version: 0.21.3 + resolution: "type-fest@npm:0.21.3" + checksum: 10c0/902bd57bfa30d51d4779b641c2bc403cdf1371fb9c91d3c058b0133694fcfdb817aef07a47f40faf79039eecbaa39ee9d3c532deff244f3a19ce68cea71a61e8 + languageName: node + linkType: hard + +"type-fest@npm:^1.0.2": + version: 1.4.0 + resolution: "type-fest@npm:1.4.0" + checksum: 10c0/a3c0f4ee28ff6ddf800d769eafafcdeab32efa38763c1a1b8daeae681920f6e345d7920bf277245235561d8117dab765cb5f829c76b713b4c9de0998a5397141 + languageName: node + linkType: hard + +"type-fest@npm:^4.18.2, type-fest@npm:^4.21.0, type-fest@npm:^4.26.1, type-fest@npm:^4.27.0, type-fest@npm:^4.31.0, type-fest@npm:^4.39.1, type-fest@npm:^4.41.0, type-fest@npm:^4.6.0": + version: 4.41.0 + resolution: "type-fest@npm:4.41.0" + checksum: 10c0/f5ca697797ed5e88d33ac8f1fec21921839871f808dc59345c9cf67345bfb958ce41bd821165dbf3ae591cedec2bf6fe8882098dfdd8dc54320b859711a2c1e4 + languageName: node + linkType: hard + +"type-fest@npm:^5.0.0, type-fest@npm:^5.2.0, type-fest@npm:^5.3.1, type-fest@npm:^5.4.1": + version: 5.7.0 + resolution: "type-fest@npm:5.7.0" + dependencies: + tagged-tag: "npm:^1.0.0" + checksum: 10c0/f71ed17b753649421e419db8cc2e140f930333a1467b1d9cca2e0e4052900fd442f2360bae73f3a6bf9340d949ac46d9a1598c709b4c8089272e7624df9c8716 + languageName: node + linkType: hard + "type-is@npm:^1.6.18, type-is@npm:~1.6.18": version: 1.6.18 resolution: "type-is@npm:1.6.18" @@ -55789,7 +55853,7 @@ __metadata: languageName: node linkType: hard -"typescript@npm:5.9.3": +"typescript@npm:5.9.3, typescript@npm:^5.9.3, typescript@npm:~5.9.2": version: 5.9.3 resolution: "typescript@npm:5.9.3" bin: @@ -55799,7 +55863,17 @@ __metadata: languageName: node linkType: hard -"typescript@patch:typescript@npm%3A5.9.3#optional!builtin": +"typescript@npm:~5.4.5": + version: 5.4.5 + resolution: "typescript@npm:5.4.5" + bin: + tsc: bin/tsc + tsserver: bin/tsserver + checksum: 10c0/2954022ada340fd3d6a9e2b8e534f65d57c92d5f3989a263754a78aba549f7e6529acc1921913560a4b816c46dce7df4a4d29f9f11a3dc0d4213bb76d043251e + languageName: node + linkType: hard + +"typescript@patch:typescript@npm%3A5.9.3#optional!builtin, typescript@patch:typescript@npm%3A^5.9.3#optional!builtin, typescript@patch:typescript@npm%3A~5.9.2#optional!builtin": version: 5.9.3 resolution: "typescript@patch:typescript@npm%3A5.9.3#optional!builtin::version=5.9.3&hash=5786d5" bin: @@ -55809,6 +55883,16 @@ __metadata: languageName: node linkType: hard +"typescript@patch:typescript@npm%3A~5.4.5#optional!builtin": + version: 5.4.5 + resolution: "typescript@patch:typescript@npm%3A5.4.5#optional!builtin::version=5.4.5&hash=5adc0c" + bin: + tsc: bin/tsc + tsserver: bin/tsserver + checksum: 10c0/db2ad2a16ca829f50427eeb1da155e7a45e598eec7b086d8b4e8ba44e5a235f758e606d681c66992230d3fc3b8995865e5fd0b22a2c95486d0b3200f83072ec9 + languageName: node + linkType: hard + "typo-js@npm:*": version: 1.3.1 resolution: "typo-js@npm:1.3.1"