From 97bb56d47102c229554ec0a5768785c8467bcbbb Mon Sep 17 00:00:00 2001 From: "Abdullah." <125115953+mabdullahabaid@users.noreply.github.com> Date: Mon, 27 Jul 2026 12:55:17 +0500 Subject: [PATCH] fix: bump tar and brace-expansion in seed-dependencies (Dependabot) (#23333) ## Summary Bumps **tar 7.5.20 -> 7.5.21** and **brace-expansion 5.0.7 -> 5.0.8** in the `application-package/constants/seed-dependencies` fixture: | Severity | Advisory | Package | Alert | |---|---|---|---| | medium | GHSA-r292-9mhp-454m | tar (`<= 7.5.20`) | [1850](https://github.com/twentyhq/twenty/security/dependabot/1850) | | high | GHSA-mh99-v99m-4gvg | brace-expansion | [1856](https://github.com/twentyhq/twenty/security/dependabot/1856) | Both are reached through caret ranges (`^7.5.4`, `^5.0.2`), so the lockfile diff comes from a plain recursive `yarn up` - no resolution, no `package.json` change. ## Checksum coupling This fixture is read at runtime by `getDefaultApplicationPackageFields` and pinned by stored constants (first 32 hex chars of SHA512). **`DEFAULT_YARN_LOCK_CHECKSUM`** is regenerated to match the new lockfile. `package.json` is byte-untouched so `DEFAULT_PACKAGE_JSON_CHECKSUM` stays as-is. Verified in order: the hash formula reproduces **both** current constants before regenerating; the new constant matches the new content; `yarn install --immutable` passes in the fixture. ## sharp deliberately excluded The third open alert here (GHSA-f88m-g3jw-g9cj, high - inherited libvips CVEs) is **not** a lockfile lift: sharp is a *direct* dependency of this fixture at `^0.34.5`, so clearing it means moving the declared range to `^0.35.0`. That changes the package set exposed to user logic functions, shifts `DEFAULT_PACKAGE_JSON_CHECKSUM` too, and sharp 0.35 raises its engines floor from Node 18 to `>=20.9.0` while Lambda layers are still advertised as NODE18-compatible. The same `^0.34.5` ceiling gates twenty-sdk and 15 app manifests, so it deserves one coordinated decision rather than a drive-by change here. --- .../constants/seed-dependencies/yarn.lock | 12 ++++++------ .../get-default-application-package-fields.util.ts | 2 +- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/packages/twenty-server/src/engine/core-modules/application/application-package/constants/seed-dependencies/yarn.lock b/packages/twenty-server/src/engine/core-modules/application/application-package/constants/seed-dependencies/yarn.lock index e6ee3796fa..24a0df44a0 100644 --- a/packages/twenty-server/src/engine/core-modules/application/application-package/constants/seed-dependencies/yarn.lock +++ b/packages/twenty-server/src/engine/core-modules/application/application-package/constants/seed-dependencies/yarn.lock @@ -696,11 +696,11 @@ __metadata: linkType: hard "brace-expansion@npm:^5.0.2": - version: 5.0.7 - resolution: "brace-expansion@npm:5.0.7" + version: 5.0.8 + resolution: "brace-expansion@npm:5.0.8" dependencies: balanced-match: "npm:^4.0.2" - checksum: 10c0/4769109c3c082de178e449a371bcad50d51ab468f644bce2dd9188efe0cf0a080ed102105d7fc8577382cedc45bad7e6443a91bf3d8102264ee8cf927dbaf205 + checksum: 10c0/73304caafd00fdc5b0168e693ac15bf25b6357dec76d1195fcd628fe2cf99c46f9c889a7ecfa3cfe236dbd2d5ce3e27a6ccc4370b46d475d0d19081e11f86019 languageName: node linkType: hard @@ -2945,15 +2945,15 @@ __metadata: linkType: hard "tar@npm:^7.5.4": - version: 7.5.20 - resolution: "tar@npm:7.5.20" + version: 7.5.21 + resolution: "tar@npm:7.5.21" dependencies: "@isaacs/fs-minipass": "npm:^4.0.0" chownr: "npm:^3.0.0" minipass: "npm:^7.1.2" minizlib: "npm:^3.1.0" yallist: "npm:^5.0.0" - checksum: 10c0/4df4335c6d958b76adf1eaced55889dec3ca1c51f450658a074af80694bb0d9c154a8e93fdf4da617372d1575b121295379993961bbe4cd4b0867c0e5689846a + checksum: 10c0/bce0e51692356078e6f6a909d5c93f5b4c099c097ffea19b1b1bf10385539a429baba26bca59aabbace68c4519d16f2f1c07afe7eaab55876a449a032480fabc languageName: node linkType: hard diff --git a/packages/twenty-server/src/engine/core-modules/application/application-package/utils/get-default-application-package-fields.util.ts b/packages/twenty-server/src/engine/core-modules/application/application-package/utils/get-default-application-package-fields.util.ts index c285beebdc..01406173fc 100644 --- a/packages/twenty-server/src/engine/core-modules/application/application-package/utils/get-default-application-package-fields.util.ts +++ b/packages/twenty-server/src/engine/core-modules/application/application-package/utils/get-default-application-package-fields.util.ts @@ -8,7 +8,7 @@ import { SEED_DEPENDENCIES_DIRNAME } from 'src/engine/core-modules/application/a // package.json: hash(JSON.stringify(JSON.parse(content))). yarn.lock: hash(content). // Both use first 32 chars of SHA512 hex digest. const DEFAULT_PACKAGE_JSON_CHECKSUM = 'c05f7f23a158d61caa123c55b455530a'; -const DEFAULT_YARN_LOCK_CHECKSUM = '04cd209282655087677b3d686af4d5f0'; +const DEFAULT_YARN_LOCK_CHECKSUM = 'f9ec681eef9a5421efa0ad44d0112042'; export type DefaultApplicationPackageFields = { packageJsonChecksum: string;