security: close lodash CVEs (#824/#823/#385) via parent upgrades, no resolution (#21414)

Closes the remaining lodash Dependabot alerts **without any
`resolutions` override** — by upgrading the parent packages that pinned
the vulnerable lodash. Every `lodash` in the tree now resolves to
**4.18.1**.

### Closes
- **#824 — `_.template` code injection (HIGH)**
- #823 / #385 — prototype pollution in `_.unset` / `_.omit`

### What changed (4 parents pinned vulnerable lodash 4.17.x; all
upgraded, no override)
- **`@stoplight/spectral-functions`** → 1.10.2 (in-range; now uses
`lodash ^4.18.1`)
- **`zapier-platform-core`** 15.5.1 → 19.0.0 — aligns with the
already-present `zapier-platform-cli ^19` (they were mismatched). v19
tightened the `Bundle` types, so 3 call sites now type their bundle as
`Bundle<InputData>` and the test bundle includes the new `meta` fields.
- **`@graphql-codegen`** → `cli 6.3.1`, `typescript 5.0.10`,
`typescript-operations 5.1.0`, `typed-document-node 6.1.8`. These depend
on `@graphql-codegen/plugin-helpers ^6.3.0`, the release that dropped
lodash. (Stayed on the 6.x/5.x line on purpose — 7.x changes generated
output far more.)

### About the generated-file changes — they are cosmetic, not real
changes
The codegen bump touches one generated file. **Verified there is zero
semantic change:**

- Only `src/generated-metadata/graphql.ts` changes.
`src/generated/graphql.ts` (data) and `src/generated-admin/graphql.ts`
(admin) are **byte-identical**.
- Same 1,638 type declarations before and after — none added, none
removed.
- After stripping whitespace and union pipes, the file is
**byte-for-byte identical** — no type, field, or union member changed.

The entire diff is one formatting change from
`typescript-operations@5.x`: multi-member union types are now printed
multi-line with a leading `|` instead of on one line — which TypeScript
treats identically:
```ts
// before
payload?: { …ObjectMetadata… } | { …Path… } | null
// after
payload?:
    | { …ObjectMetadata… }
    | { …Path… }
   | null
```
Only metadata is affected because only its operations select GraphQL
union types. To keep generated types otherwise behavior-identical,
`defaultScalarType: 'any'` was added to the three codegen configs
(codegen 6 would otherwise default unmapped scalars to `unknown`).

### Verification
- `twenty-front` typecheck ✓, `twenty-zapier` typecheck ✓
- `yarn install --immutable` ✓ (passes the hardened 3-day age gate)
- CI green — including the `graphql:generate` freshness check, which
regenerates against the canonical schema and confirms the committed
output is exactly what codegen produces
- No `lodash@4.17.x` remains anywhere in `yarn.lock`

Supersedes #21411 (which closed these via a one-line resolution).

packages/twenty-front/codegen-admin.cjs

@@ -16,6 +16,7 @@ module.exports = {
       plugins: ['typescript', 'typescript-operations', 'typed-document-node'],
       config: {
         skipTypename: false,
+        defaultScalarType: 'any',
         scalars: {
           DateTime: 'string',
           UUID: 'string',

packages/twenty-front/codegen-metadata.cjs

@@ -45,6 +45,7 @@ module.exports = {
       plugins: ['typescript', 'typescript-operations', 'typed-document-node'],
       config: {
         skipTypename: false,
+        defaultScalarType: 'any',
         scalars: {
           DateTime: 'string',
           UUID: 'string',

packages/twenty-front/codegen.cjs

@@ -22,6 +22,7 @@ module.exports = {
       plugins: ['typescript', 'typescript-operations', 'typed-document-node'],
       config: {
         skipTypename: false,
+        defaultScalarType: 'any',
         scalars: {
           DateTime: 'string',
         },

packages/twenty-front/package.json

@@ -150,10 +150,10 @@
   "devDependencies": {
     "@babel/core": "^7.14.5",
     "@babel/preset-typescript": "^7.24.6",
-    "@graphql-codegen/cli": "^5.0.7",
-    "@graphql-codegen/typed-document-node": "^5.0.9",
-    "@graphql-codegen/typescript": "^4.1.6",
-    "@graphql-codegen/typescript-operations": "^4.6.1",
+    "@graphql-codegen/cli": "^6.3.1",
+    "@graphql-codegen/typed-document-node": "^6.1.8",
+    "@graphql-codegen/typescript": "^5.0.10",
+    "@graphql-codegen/typescript-operations": "^5.1.0",
     "@lingui/cli": "^5.1.2",
     "@lingui/swc-plugin": "^5.11.0",
     "@lingui/vite-plugin": "^5.1.2",

packages/twenty-zapier/package.json

@@ -16,7 +16,7 @@
     "@sniptt/guards": "^0.2.0",
     "dotenv": "^16.4.5",
     "libphonenumber-js": "^1.10.26",
-    "zapier-platform-core": "15.5.1",
+    "zapier-platform-core": "19.0.0",
     "zod": "^4.1.11"
   },
   "devDependencies": {

packages/twenty-zapier/src/creates/crud_record.ts

@@ -89,7 +89,7 @@ const getOperationFromDatabaseEventAction = (
   }
 };
 
-const perform = async (z: ZObject, bundle: Bundle) => {
+const perform = async (z: ZObject, bundle: Bundle<InputData>) => {
   const data = bundle.inputData;
   const operation = data.crudZapierOperation;
   const queryOperation = getOperationFromDatabaseEventAction(z, operation);

packages/twenty-zapier/src/utils/getBundleForTest.ts

@@ -23,6 +23,8 @@ export const getBundleForTest = (inputData?: InputData): Bundle => {
       isTestingAuth: false,
       limit: 1,
       page: 1,
+      timezone: null,
+      inputFields: {},
     },
   };
 };

packages/twenty-zapier/src/utils/triggers/triggers.utils.ts

@@ -5,6 +5,7 @@ import requestDb, {
   requestSchema,
 } from 'src/utils/requestDb';
 import handleQueryParams from 'src/utils/handleQueryParams';
+import { type InputData } from 'src/utils/data.types';
 
 export enum DatabaseEventAction {
   CREATED = 'created',
@@ -84,7 +85,7 @@ const getNamePluralFromNameSingular = async (
 
 export const performList = async (
   z: ZObject,
-  bundle: Bundle,
+  bundle: Bundle<InputData>,
 ): Promise<{ record: Record<string, any>; updatedFields?: string[] }[]> => {
   const nameSingular = bundle.inputData.nameSingular;
   const namePlural = await getNamePluralFromNameSingular(