chore(deps): upgrade Tier-1 deps (googleapis 173, gaxios 7, express 5, jsdom 29, date-fns 4, stripe 20) (#21570)

## What Security-driven upgrade of the biggest-drift Tier-1 dependencies (staying on latest = staying patched). Bundled because they share the lockfile and the googleapis/gaxios pair must move together. | Package | From | To | Gap | |---|---|---|---| | googleapis | 105.0.0 | **173.0.0** | 68 majors | | gaxios | 5.1.3 | **7.1.5** | 2 majors | | express | 4.22.2 | **5.2.1** | 1 major | | jsdom | 26.1.0 | **29.1.1** | 3 majors | | date-fns | 2.30.0 | **4.4.0** | 2 majors | | date-fns-tz | 2.0.0 | **3.2.0** | 1 major | | stripe | 19.3.1 | **20.4.1** | 1 major | `yarn npm audit` reports **0 high/critical** advisories before and after. ## Code changes - **gaxios v7** — `GaxiosError.code` is now `string | number` (guard the calendar network-error check by `typeof`); `GaxiosError` config/response use `URL` + `Headers`; and crucially the v7 constructor drops `response.data` unless `bodyUsed` is set — updated the synthetic gmail error mocks accordingly (production gaxios sets it, so real error parsing is unaffected). - **google-auth-library / gaxios dedup** — `googleapis-common@8.0.2` exact-pins `google-auth-library@10.5.0` + `gaxios@7.1.3` while `googleapis` pulls `^10.2.0`; the two copies made `OAuth2Client`/`GaxiosError` type-identities diverge across every gmail/calendar service. Added two singleton `resolutions` (documented inline in root `package.json`). - **express 5** — no source changes. `@nestjs/platform-express@11.1.24` already resolves `express@5.2.1` internally; the old `4.22.2` pin was the override. - **jsdom 29** — no source changes, but it now pulls ESM-only transitive deps (`@csstools/*` `.mjs`, `parse5`, `entities`, `tough-cookie`, `@exodus/bytes`). Extended the server jest `transformIgnorePatterns` allowlist and added `.mjs` to the transform/extensions so jest can load jsdom. - **stripe 20** — `Subscription` gained a required `customer_account` field; added to mocks. No runtime changes. - **date-fns v4** — `Locale` is no longer ambient (import explicitly in 5 files); per-locale entrypoints dropped the typed `default` export (the locale loader now reads the single named export); fixed the default locale import in `formatTimeZoneLabel`. ## Tests - Full suites green locally: **twenty-server 5709 passed**, **twenty-front 4937 passed**, twenty-ui / twenty-ui-deprecated green; typecheck + builds (swc + vite) + lint all pass. - Added regression tests for the two runtime behaviors these upgrades touch and that had no coverage: - `getDateFnsLocale` — named-export locale resolution (date-fns v4). - `sanitizeFile` — jsdom 29 + DOMPurify still strips `<script>`/event handlers from uploaded SVGs (security guard). ## Deliberately deferred (not in this PR) - **stripe → 21/22**: stripe **21** bundles a runtime `Decimal` type for money fields **and** jumps the pinned API version to `2026-03-25.dahlia` (changes webhook/billing payload behavior) — too risky to fold into a deps bump on billing code. stripe **22** additionally drops the node10-resolvable `types` entry, which would force a repo-wide `moduleResolution` change. Capped at the latest clean **20.x**. - **openid-client → 6**: v6 is a full functional rewrite and its passport strategy manages the OAuth `state` internally, but our SSO flow uses `state` to carry `identityProviderId` across the shared `/auth/oidc/callback`. That needs an auth-flow redesign (session-carried provider id) on Enterprise SSO code with no integration harness — it deserves its own focused PR rather than riding along here. ## Tier-1 source Originated from a dependency-drift audit; remaining Tier-1 items (date-fns done here) plus Tier-2/3 follow-ups tracked separately.  <a href="https://cubic.dev/pr/twentyhq/twenty/pull/21570?utm_source=github" target="_blank" rel="noopener noreferrer" data-no-image-dialog="true"><picture><source media="(prefers-color-scheme: dark)" srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source media="(prefers-color-scheme: light)" srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img alt="Review in cubic" src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a>
2026-06-15 10:23:42 +02:00
parent d7d4b36d5e
commit fb4608e437
23 changed files with 588 additions and 230 deletions
@@ -84,8 +84,8 @@
    "country-flag-icons": "^1.5.11",
    "cron-parser": "5.1.1",
    "d3-shape": "^3.2.0",
-    "date-fns": "^2.30.0",
-    "date-fns-tz": "^2.0.0",
+    "date-fns": "^4.4.0",
+    "date-fns-tz": "^3.2.0",
    "deep-equal": "^2.2.2",
    "file-saver": "^2.0.5",
    "framer-motion": "^11.18.0",
@@ -1,6 +1,6 @@
 import { type DateFormat } from '@/localization/constants/DateFormat';
 import { type TimeFormat } from '@/localization/constants/TimeFormat';
-import { isValid } from 'date-fns';
+import { isValid, type Locale } from 'date-fns';
 import { formatInTimeZone } from 'date-fns-tz';

 export const formatDateISOStringToDateTime = ({
@@ -1,5 +1,5 @@
 import { formatInTimeZone } from 'date-fns-tz';
-import defaultLocale from 'date-fns/locale/en-US';
+import { enUS as defaultLocale } from 'date-fns/locale/en-US';

 /**
 * Formats a IANA time zone to a select option label.
@@ -1,3 +1,5 @@
+import { type Locale } from 'date-fns';
+
 import { type DateFormat } from '@/localization/constants/DateFormat';
 import { type TimeFormat } from '@/localization/constants/TimeFormat';
 import { type FieldMetadataItem } from '@/object-metadata/types/FieldMetadataItem';
@@ -0,0 +1,29 @@
+import { getDateFnsLocale } from '@/ui/field/display/utils/getDateFnsLocale';
+
+describe('getDateFnsLocale', () => {
+  it('should load the default en-US locale', async () => {
+    const locale = await getDateFnsLocale('en-US');
+
+    expect(locale).toBeDefined();
+    expect(locale?.code).toBe('en-US');
+    expect(typeof locale?.formatDistance).toBe('function');
+  });
+
+  it('should load a non-default locale (fr-FR)', async () => {
+    const locale = await getDateFnsLocale('fr-FR');
+
+    expect(locale).toBeDefined();
+    expect(locale?.code).toBe('fr');
+  });
+
+  it('should fall back to en-US for an unknown locale', async () => {
+    const locale = await getDateFnsLocale('zz-ZZ');
+
+    expect(locale?.code).toBe('en-US');
+  });
+
+  it('should fall back to en-US for nullish input', async () => {
+    expect((await getDateFnsLocale(undefined))?.code).toBe('en-US');
+    expect((await getDateFnsLocale(null))?.code).toBe('en-US');
+  });
+});
@@ -1,3 +1,5 @@
+import { isObject } from '@sniptt/guards';
+import { type Locale } from 'date-fns';
 import { type APP_LOCALES } from 'twenty-shared/translations';

 type AppLocale = keyof typeof APP_LOCALES;
@@ -69,8 +71,13 @@ export const getDateFnsLocaleImport = (locale: AppLocale) => {
  }
 };

-export const getDateFnsLocale = async (localeString?: string | null) => {
+const isDateFnsLocale = (value: unknown): value is Locale =>
+  isObject(value) && 'code' in value && 'formatLong' in value;
+
+export const getDateFnsLocale = async (
+  localeString?: string | null,
+): Promise<Locale | undefined> => {
  return getDateFnsLocaleImport(localeString as AppLocale)
-    .then((m) => m.default as unknown as Locale)
-    .catch((_e) => undefined);
+    .then((localeModule) => Object.values(localeModule).find(isDateFnsLocale))
+    .catch(() => undefined);
 };
@@ -1,3 +1,5 @@
+import { type Locale } from 'date-fns';
+
 import { type WorkflowCronTrigger } from '@/workflow/types/Workflow';
 import { describeCronExpression } from '@/workflow/workflow-trigger/utils/cron-to-human/describeCronExpression';
 import { convertScheduleToCronExpression } from '@/workflow/workflow-trigger/utils/cron-to-human/utils/convertScheduleToCronExpression';
@@ -1,3 +1,5 @@
+import { type Locale } from 'date-fns';
+
 import { type DateFormat } from '@/localization/constants/DateFormat';
 import { formatDateISOStringToCustomUnicodeFormat } from '@/localization/utils/formatDateISOStringToCustomUnicodeFormat';
 import { formatDateISOStringToDate } from '@/localization/utils/formatDateISOStringToDate';
@@ -24,7 +24,7 @@ const jestConfig: JestConfigWithTsJest = {
  silent: false,
  errorOnDeprecated: true,
  maxConcurrency: 1,
-  moduleFileExtensions: ['js', 'json', 'ts'],
+  moduleFileExtensions: ['js', 'mjs', 'json', 'ts'],
  rootDir: '.',
  testEnvironment: 'node',
  testPathIgnorePatterns: [
@@ -37,8 +37,14 @@ const jestConfig: JestConfigWithTsJest = {
  globalTeardown: '<rootDir>/test/integration/utils/teardown-test.ts',
  testTimeout: 20000,
  maxWorkers: 1,
+  // jsdom 29 pulls ESM-only transitive deps (parse5, entities, tough-cookie,
+  // @exodus/bytes via html-encoding-sniffer, @csstools/@asamuzakjp css engine);
+  // let swc transform them (and .mjs below) so jest can require jsdom.
+  transformIgnorePatterns: [
+    '/node_modules/(?!(jsdom|html-encoding-sniffer|whatwg-encoding|@exodus|parse5|entities|tough-cookie|@csstools|@asamuzakjp)/)',
+  ],
  transform: {
-    '^.+\\.(t|j)s$': [
+    '^.+\\.(t|j|mj)s$': [
      '@swc/jest',
      {
        jsc: {
@@ -17,11 +17,15 @@ const jestConfig = {
  testEnvironment: 'node',
  setupFilesAfterEnv: ['./setupTests.ts'],
  transformIgnorePatterns: [
-    '/node_modules/(?!(file-type|@file-type|strtok3|token-types|@borewit|@tokenizer|uint8array-extras|read-next-line|digest-fetch|md5|js-sha256|js-sha512|base-64|charenc|crypt|email-reply-parser)/)',
+    // jsdom 29 pulls ESM-only transitive deps (parse5, entities, tough-cookie,
+    // @exodus/bytes via html-encoding-sniffer, @csstools/@asamuzakjp css engine).
+    // jest's CJS runtime can't load their `export` syntax, so let swc transform them.
+    '/node_modules/(?!(file-type|@file-type|strtok3|token-types|@borewit|@tokenizer|uint8array-extras|read-next-line|digest-fetch|md5|js-sha256|js-sha512|base-64|charenc|crypt|email-reply-parser|jsdom|html-encoding-sniffer|whatwg-encoding|@exodus|parse5|entities|tough-cookie|@csstools|@asamuzakjp)/)',
  ],
  testRegex: '.*\\.spec\\.ts$',
  transform: {
-    '^.+\\.(t|j)s$': [
+    // include .mjs so swc transforms ESM-only deps (e.g. jsdom's @csstools/* .mjs)
+    '^.+\\.(t|j|mj)s$': [
      '@swc/jest',
      {
        jsc: {
@@ -52,7 +56,7 @@ const jestConfig = {
    '^test/(.*)': '<rootDir>/test/$1',
    '^file-type$': require.resolve('file-type'),
  },
-  moduleFileExtensions: ['js', 'json', 'ts'],
+  moduleFileExtensions: ['js', 'mjs', 'json', 'ts'],
  modulePathIgnorePatterns: ['<rootDir>/dist'],
  fakeTimers: {
    enableGlobally: true,
@@ -92,17 +92,17 @@
    "connect-redis": "^7.1.1",
    "cron-parser": "5.1.1",
    "dataloader": "2.2.2",
-    "date-fns": "2.30.0",
+    "date-fns": "4.4.0",
    "digest-fetch": "^3.1.1",
    "dompurify": "^3.4.0",
    "dotenv": "16.4.5",
    "email-reply-parser": "^2.3.5",
-    "express": "4.22.2",
+    "express": "5.2.1",
    "express-session": "^1.18.2",
    "file-type": "^21.3.2",
    "fuse.js": "^7.1.0",
-    "gaxios": "5.1.3",
-    "googleapis": "105.0.0",
+    "gaxios": "7.1.5",
+    "googleapis": "173.0.0",
    "graphql": "16.8.1",
    "graphql-fields": "2.0.3",
    "graphql-redis-subscriptions": "2.7.0",
@@ -115,7 +115,7 @@
    "html-to-text": "^9.0.5",
    "imapflow": "1.3.6",
    "ioredis": "5.10.1",
-    "jsdom": "^26.1.0",
+    "jsdom": "^29.1.1",
    "json-schema": "0.4.0",
    "jsonwebtoken": "9.0.2",
    "libphonenumber-js": "1.11.5",
@@ -159,7 +159,7 @@
    "rxjs": "7.8.1",
    "semver": "7.6.3",
    "sns-payload-validator": "^2.1.0",
-    "stripe": "19.3.1",
+    "stripe": "20.4.1",
    "tar": "^7.5.9",
    "temporal-polyfill": "^0.3.0",
    "tsconfig-paths": "^4.2.0",
@@ -33,6 +33,7 @@ export const mockStripeSubscriptionUpdatedEventWithoutUpdatedItem: Stripe.Custom
        created: 1745007630,
        currency: 'usd',
        customer: 'cus_S9eiHiQ8lNbIkL',
+        customer_account: null,
        days_until_due: null,
        default_payment_method: null,
        default_source: null,
@@ -189,6 +190,7 @@ export const mockStripeSubscriptionUpdatedEventWithUpdatedItemOnly: Stripe.Custo
        created: 1745007630,
        currency: 'usd',
        customer: 'cus_S9eiHiQ8lNbIkL',
+        customer_account: null,
        days_until_due: null,
        default_payment_method: null,
        default_source: null,
@@ -412,6 +414,7 @@ export const mockStripeSubscriptionUpdatedEventWithDeletedItem: Stripe.CustomerS
        created: 1745007630,
        currency: 'usd',
        customer: 'cus_S9eiHiQ8lNbIkL',
+        customer_account: null,
        days_until_due: null,
        default_payment_method: null,
        default_source: null,
@@ -0,0 +1,57 @@
+import { sanitizeFile } from 'src/engine/core-modules/file/utils/sanitize-file.utils';
+
+describe('sanitizeFile', () => {
+  it('should strip <script> from an SVG string', () => {
+    const malicious =
+      '<svg xmlns="http://www.w3.org/2000/svg"><script>alert(1)</script><rect width="10" height="10"/></svg>';
+
+    const sanitized = sanitizeFile({
+      file: malicious,
+      ext: 'svg',
+      mimeType: 'image/svg+xml',
+    }) as string;
+
+    expect(sanitized).not.toContain('<script');
+    expect(sanitized).not.toContain('alert(1)');
+    expect(sanitized).toContain('rect');
+  });
+
+  it('should strip event-handler attributes from an SVG', () => {
+    const malicious =
+      '<svg xmlns="http://www.w3.org/2000/svg"><image href="x" onerror="alert(1)"/></svg>';
+
+    const sanitized = sanitizeFile({
+      file: Buffer.from(malicious, 'utf-8'),
+      ext: 'svg',
+      mimeType: 'image/svg+xml',
+    }) as string;
+
+    expect(sanitized).not.toContain('onerror');
+    expect(sanitized).not.toContain('alert(1)');
+  });
+
+  it('should sanitize when only the mime type indicates SVG', () => {
+    const malicious =
+      '<svg xmlns="http://www.w3.org/2000/svg"><script>1</script></svg>';
+
+    const sanitized = sanitizeFile({
+      file: malicious,
+      ext: 'bin',
+      mimeType: 'image/svg+xml',
+    }) as string;
+
+    expect(sanitized).not.toContain('<script');
+  });
+
+  it('should return non-SVG files unchanged', () => {
+    const file = Buffer.from('not an svg');
+
+    const result = sanitizeFile({
+      file,
+      ext: 'png',
+      mimeType: 'image/png',
+    });
+
+    expect(result).toBe(file);
+  });
+});
@@ -1,5 +1,6 @@
 import { Injectable, Logger } from '@nestjs/common';

+import { isString } from '@sniptt/guards';
 import { type GaxiosError } from 'gaxios';
 import { google, type calendar_v3 as calendarV3 } from 'googleapis';

@@ -89,7 +90,7 @@ export class GoogleCalendarGetEventsService {
      error,
    );
    if (
-      error.code &&
+      isString(error.code) &&
      [
        'ECONNRESET',
        'ENOTFOUND',
@@ -0,0 +1,52 @@
+import { GaxiosError, type GaxiosResponse } from 'gaxios';
+
+const MOCK_URL = new URL('https://gmail.googleapis.com/mocks');
+
+const createMockGaxiosResponse = <T>(
+  status: number,
+  statusText: string,
+  data: T,
+): GaxiosResponse<T> => {
+  const headers = new Headers();
+
+  const response: GaxiosResponse<T> = {
+    config: { url: MOCK_URL, headers: new Headers() },
+    data,
+    status,
+    statusText,
+    headers,
+    ok: status >= 200 && status < 300,
+    redirected: false,
+    type: 'default',
+    url: MOCK_URL.toString(),
+    body: null,
+    bodyUsed: true,
+    arrayBuffer: () => Promise.resolve(new ArrayBuffer(0)),
+    blob: () => Promise.resolve(new Blob()),
+    bytes: () => Promise.resolve(new Uint8Array()),
+    formData: () => Promise.resolve(new FormData()),
+    json: () => Promise.resolve(data),
+    text: () => Promise.resolve(''),
+    clone: () => response,
+  };
+
+  return response;
+};
+
+export const createMockGaxiosError = <T>({
+  message,
+  status,
+  statusText = '',
+  data,
+}: {
+  message: string;
+  status: number;
+  statusText?: string;
+  data: T;
+}): GaxiosError<T> => {
+  return new GaxiosError<T>(
+    message,
+    { url: MOCK_URL, headers: new Headers() },
+    createMockGaxiosResponse(status, statusText, data),
+  );
+};
@@ -1,4 +1,6 @@
-import { GaxiosError } from 'gaxios';
+import { type GaxiosError } from 'gaxios';
+
+import { createMockGaxiosError } from 'src/modules/messaging/message-import-manager/drivers/gmail/mocks/create-mock-gaxios-error.util';

 type ErrorConfig = {
  reason: string;
@@ -66,27 +68,21 @@ export const getGmailApiError = ({

  const errorMessage = message ?? config.message;

-  return new GaxiosError(
-    errorMessage,
-    { url: 'https://gmail.googleapis.com/mocks' },
-    {
-      status: code,
-      statusText: config.message,
-      data: {
-        error: {
-          code,
-          message: errorMessage,
-          errors: [
-            {
-              message: errorMessage,
-              reason: config.reason,
-            },
-          ],
-        },
+  return createMockGaxiosError({
+    message: errorMessage,
+    status: code,
+    statusText: config.message,
+    data: {
+      error: {
+        code,
+        message: errorMessage,
+        errors: [
+          {
+            message: errorMessage,
+            reason: config.reason,
+          },
+        ],
      },
-      headers: {},
-      config: { url: 'https://gmail.googleapis.com/mocks' },
-      request: { responseURL: 'https://gmail.googleapis.com/mocks' },
    },
-  );
+  });
 };
@@ -1,27 +1,22 @@
 import { GaxiosError } from 'gaxios';

+import { createMockGaxiosError } from 'src/modules/messaging/message-import-manager/drivers/gmail/mocks/create-mock-gaxios-error.util';
 import { isGmailApiError } from 'src/modules/messaging/message-import-manager/drivers/gmail/utils/is-gmail-api-error.util';

 describe('isGmailApiError', () => {
  it('should detect Gmail API error shape even when instanceof GaxiosError fails', () => {
-    const originalError = new GaxiosError(
-      'Rate limit exceeded',
-      {},
-      {
-        status: 429,
-        statusText: 'Too Many Requests',
-        headers: {},
-        config: {},
-        request: { responseURL: '' },
-        data: {
-          error: {
-            errors: [
-              { reason: 'rateLimitExceeded', message: 'Rate limit exceeded' },
-            ],
-          },
+    const originalError = createMockGaxiosError({
+      message: 'Rate limit exceeded',
+      status: 429,
+      statusText: 'Too Many Requests',
+      data: {
+        error: {
+          errors: [
+            { reason: 'rateLimitExceeded', message: 'Rate limit exceeded' },
+          ],
        },
      },
-    );
+    });

    const serialized = JSON.parse(JSON.stringify(originalError));

@@ -1,9 +1,8 @@
-import { GaxiosError } from 'gaxios';
-
 import {
  MessageImportDriverException,
  MessageImportDriverExceptionCode,
 } from 'src/modules/messaging/message-import-manager/drivers/exceptions/message-import-driver.exception';
+import { createMockGaxiosError } from 'src/modules/messaging/message-import-manager/drivers/gmail/mocks/create-mock-gaxios-error.util';
 import { getGmailApiError } from 'src/modules/messaging/message-import-manager/drivers/gmail/mocks/gmail-api-error-mocks';
 import { parseGmailApiError } from 'src/modules/messaging/message-import-manager/drivers/gmail/utils/parse-gmail-api-error.util';

@@ -125,18 +124,12 @@ describe('parseGmailApiError', () => {
  });

  it('should handle 500 OAuth internal_failure error', () => {
-    const error = new GaxiosError(
-      'internal_failure',
-      { url: 'https://oauth2.googleapis.com/token' },
-      {
-        status: 500,
-        statusText: 'Internal Server Error',
-        data: { error: 'internal_failure' },
-        headers: {},
-        config: { url: 'https://oauth2.googleapis.com/token' },
-        request: { responseURL: 'https://oauth2.googleapis.com/token' },
-      },
-    );
+    const error = createMockGaxiosError({
+      message: 'internal_failure',
+      status: 500,
+      statusText: 'Internal Server Error',
+      data: { error: 'internal_failure' },
+    });
    const exception = parseGmailApiError(error);

    expect(exception).toBeInstanceOf(MessageImportDriverException);
@@ -7,6 +7,7 @@ export const createMockStripeSubscriptionCreatedData = (
    object: 'subscription',
    id: 'sub_default',
    customer: 'cus_default1',
+    customer_account: null,
    status: 'active',
    items: {
      data: [
@@ -52,7 +52,7 @@
    "@radix-ui/colors": "^3.0.0",
    "@sniptt/guards": "^0.2.0",
    "@tabler/icons-react": "^3.31.0",
-    "date-fns": "^2.30.0",
+    "date-fns": "^4.4.0",
    "framer-motion": "^11.18.0",
    "glob": "^11.1.0",
    "jotai": "^2.17.1",
@@ -73,7 +73,7 @@
    "@sniptt/guards": "^0.2.0",
    "@tabler/icons-react": "^3.31.0",
    "clsx": "^2.1.1",
-    "date-fns": "^2.30.0",
+    "date-fns": "^4.4.0",
    "framer-motion": "^11.18.0",
    "glob": "^11.1.0",
    "jotai": "^2.17.1",