[Apps] Get rid of .yarn binaries in apps (#17306)

Fixes https://github.com/twentyhq/core-team-issues/issues/1956 **Problem** Within an app, the `.yarn/releases/` folder contains executable Yarn binaries that run when executing any yarn command (`.yarnrc` file indicates yarn path to be `.yarn/releases/yarn-4.9.2.cjs `.) This is a supply chain attack vector: a malicious actor could submit a PR with a compromised `yarn-4.9.2.cjs binary`, which would execute arbitrary code on developers' machines or CI systems. **Fix** Actually, thanks to Corepack, we don't need to store and execute this binary. Corepack can be seen as the manager of a package manager: in `package.json` we indicate a packageManager version like `"packageManager": "yarn@4.9.2"`, and when executing `yarn` Corepack will securely fetch the verified version from npm, avoiding the risk of executing a compromised binary committed to the repository. This was already in our app's package.json template but we were not using it! We can now - remove the folder containing the binary from our app template base-application (that is scaffolded when creating an app through cli), `.yarn/releases/`, and remove `yarnPath: .yarn/releases/yarn-4.9.2.cjs` from its .yarnrc - remove them from the community apps that were already published in the repo - add .yarn to gitignore **Tested** This has been tested and works for app created in the repo, outside the repo, and existing apps in the repo
2026-01-21 18:23:16 +01:00
parent 6aa43b68f7
commit 96aef62ae4
32 changed files with 11 additions and 10386 deletions
@@ -28,6 +28,10 @@ Create Twenty App is the official scaffolding CLI for building apps on top of [T
 npx create-twenty-app@latest my-twenty-app
 cd my-twenty-app

+# If you don't use yarn@4
+corepack enable
+yarn install
+
 # Get Help
 yarn run help

@@ -1,3 +1 @@
-yarnPath: .yarn/releases/yarn-4.9.2.cjs
-
 nodeLinker: node-modules
@@ -125,6 +125,8 @@ export class CreateAppCommand {
    console.log('');
    console.log(chalk.blue('Next steps:'));
    console.log(chalk.gray(`  cd ${dirName}`));
+    console.log(chalk.gray(`  corepack enable  # if you don't use yarn@4`));
+    console.log(chalk.gray(`  yarn install     # if you don't use yarn@4`));
    console.log(chalk.gray('  yarn auth:login  # Authenticate with Twenty'));
    console.log(chalk.gray('  yarn app:dev     # Start dev mode'));
  }
@@ -1 +1,2 @@
 generated
+
@@ -1,3 +1 @@
-yarnPath: .yarn/releases/yarn-4.9.2.cjs
-
 nodeLinker: node-modules
@@ -1,3 +1 @@
-yarnPath: .yarn/releases/yarn-4.9.2.cjs
-
 nodeLinker: node-modules
@@ -1,3 +1 @@
-yarnPath: .yarn/releases/yarn-4.9.2.cjs
-
 nodeLinker: node-modules
@@ -1,3 +1 @@
-yarnPath: .yarn/releases/yarn-4.9.2.cjs
-
 nodeLinker: node-modules
@@ -1,3 +1 @@
-yarnPath: .yarn/releases/yarn-4.9.2.cjs
-
 nodeLinker: node-modules
@@ -1,3 +1 @@
-yarnPath: .yarn/releases/yarn-4.9.2.cjs
-
 nodeLinker: node-modules
@@ -1,3 +1 @@
-yarnPath: .yarn/releases/yarn-4.9.2.cjs
-
 nodeLinker: node-modules
@@ -1,3 +1 @@
-yarnPath: .yarn/releases/yarn-4.9.2.cjs
-
 nodeLinker: node-modules
@@ -1,3 +1 @@
-yarnPath: .yarn/releases/yarn-4.9.2.cjs
-
 nodeLinker: node-modules
@@ -1,3 +1 @@
-yarnPath: .yarn/releases/yarn-4.9.2.cjs
-
 nodeLinker: node-modules
@@ -33,6 +33,10 @@ Create a new app using the official scaffolder, then authenticate and start deve
 npx create-twenty-app@latest my-twenty-app
 cd my-twenty-app

+# If you don't use yarn@4
+corepack enable
+yarn install
+
 # Authenticate using your API key (you'll be prompted)
 yarn auth:login

@@ -86,8 +90,6 @@ my-twenty-app/
  .nvmrc
  .yarnrc.yml
  .yarn/
-    releases/
-      yarn-4.9.2.cjs
    install-state.gz
  eslint.config.mjs
  tsconfig.json