chore(deps): upgrade Tier-1 deps (googleapis 173, gaxios 7, express 5, jsdom 29, date-fns 4, stripe 20) (#21570)

## What

Security-driven upgrade of the biggest-drift Tier-1 dependencies
(staying on latest = staying patched). Bundled because they share the
lockfile and the googleapis/gaxios pair must move together.

| Package | From | To | Gap |
|---|---|---|---|
| googleapis | 105.0.0 | **173.0.0** | 68 majors |
| gaxios | 5.1.3 | **7.1.5** | 2 majors |
| express | 4.22.2 | **5.2.1** | 1 major |
| jsdom | 26.1.0 | **29.1.1** | 3 majors |
| date-fns | 2.30.0 | **4.4.0** | 2 majors |
| date-fns-tz | 2.0.0 | **3.2.0** | 1 major |
| stripe | 19.3.1 | **20.4.1** | 1 major |

`yarn npm audit` reports **0 high/critical** advisories before and
after.

## Code changes

- **gaxios v7** — `GaxiosError.code` is now `string | number` (guard the
calendar network-error check by `typeof`); `GaxiosError` config/response
use `URL` + `Headers`; and crucially the v7 constructor drops
`response.data` unless `bodyUsed` is set — updated the synthetic gmail
error mocks accordingly (production gaxios sets it, so real error
parsing is unaffected).
- **google-auth-library / gaxios dedup** — `googleapis-common@8.0.2`
exact-pins `google-auth-library@10.5.0` + `gaxios@7.1.3` while
`googleapis` pulls `^10.2.0`; the two copies made
`OAuth2Client`/`GaxiosError` type-identities diverge across every
gmail/calendar service. Added two singleton `resolutions` (documented
inline in root `package.json`).
- **express 5** — no source changes. `@nestjs/platform-express@11.1.24`
already resolves `express@5.2.1` internally; the old `4.22.2` pin was
the override.
- **jsdom 29** — no source changes, but it now pulls ESM-only transitive
deps (`@csstools/*` `.mjs`, `parse5`, `entities`, `tough-cookie`,
`@exodus/bytes`). Extended the server jest `transformIgnorePatterns`
allowlist and added `.mjs` to the transform/extensions so jest can load
jsdom.
- **stripe 20** — `Subscription` gained a required `customer_account`
field; added to mocks. No runtime changes.
- **date-fns v4** — `Locale` is no longer ambient (import explicitly in
5 files); per-locale entrypoints dropped the typed `default` export (the
locale loader now reads the single named export); fixed the default
locale import in `formatTimeZoneLabel`.

## Tests

- Full suites green locally: **twenty-server 5709 passed**,
**twenty-front 4937 passed**, twenty-ui / twenty-ui-deprecated green;
typecheck + builds (swc + vite) + lint all pass.
- Added regression tests for the two runtime behaviors these upgrades
touch and that had no coverage:
  - `getDateFnsLocale` — named-export locale resolution (date-fns v4).
- `sanitizeFile` — jsdom 29 + DOMPurify still strips `<script>`/event
handlers from uploaded SVGs (security guard).

## Deliberately deferred (not in this PR)

- **stripe → 21/22**: stripe **21** bundles a runtime `Decimal` type for
money fields **and** jumps the pinned API version to `2026-03-25.dahlia`
(changes webhook/billing payload behavior) — too risky to fold into a
deps bump on billing code. stripe **22** additionally drops the
node10-resolvable `types` entry, which would force a repo-wide
`moduleResolution` change. Capped at the latest clean **20.x**.
- **openid-client → 6**: v6 is a full functional rewrite and its
passport strategy manages the OAuth `state` internally, but our SSO flow
uses `state` to carry `identityProviderId` across the shared
`/auth/oidc/callback`. That needs an auth-flow redesign (session-carried
provider id) on Enterprise SSO code with no integration harness — it
deserves its own focused PR rather than riding along here.

## Tier-1 source

Originated from a dependency-drift audit; remaining Tier-1 items
(date-fns done here) plus Tier-2/3 follow-ups tracked separately.


<!-- This is an auto-generated description by cubic. -->
<a
href="https://cubic.dev/pr/twentyhq/twenty/pull/21570?utm_source=github"
target="_blank" rel="noopener noreferrer"
data-no-image-dialog="true"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source
media="(prefers-color-scheme: light)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img
alt="Review in cubic"
src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a>
<!-- End of auto-generated description by cubic. -->

packages/twenty-front/src/modules/localization/utils/formatDateISOStringToDateTime.ts

@@ -1,6 +1,6 @@
 import { type DateFormat } from '@/localization/constants/DateFormat';
 import { type TimeFormat } from '@/localization/constants/TimeFormat';
-import { isValid } from 'date-fns';
+import { isValid, type Locale } from 'date-fns';
 import { formatInTimeZone } from 'date-fns-tz';
 
 export const formatDateISOStringToDateTime = ({

packages/twenty-front/src/modules/localization/utils/formatTimeZoneLabel.ts

@@ -1,5 +1,5 @@
 import { formatInTimeZone } from 'date-fns-tz';
-import defaultLocale from 'date-fns/locale/en-US';
+import { enUS as defaultLocale } from 'date-fns/locale/en-US';
 
 /**
  * Formats a IANA time zone to a select option label.

packages/twenty-front/src/modules/object-record/record-aggregate/utils/transformAggregateRawValueIntoAggregateDisplayValue.ts

@@ -1,3 +1,5 @@
+import { type Locale } from 'date-fns';
+
 import { type DateFormat } from '@/localization/constants/DateFormat';
 import { type TimeFormat } from '@/localization/constants/TimeFormat';
 import { type FieldMetadataItem } from '@/object-metadata/types/FieldMetadataItem';

packages/twenty-front/src/modules/ui/field/display/utils/__tests__/getDateFnsLocale.test.ts

@@ -0,0 +1,29 @@
+import { getDateFnsLocale } from '@/ui/field/display/utils/getDateFnsLocale';
+
+describe('getDateFnsLocale', () => {
+  it('should load the default en-US locale', async () => {
+    const locale = await getDateFnsLocale('en-US');
+
+    expect(locale).toBeDefined();
+    expect(locale?.code).toBe('en-US');
+    expect(typeof locale?.formatDistance).toBe('function');
+  });
+
+  it('should load a non-default locale (fr-FR)', async () => {
+    const locale = await getDateFnsLocale('fr-FR');
+
+    expect(locale).toBeDefined();
+    expect(locale?.code).toBe('fr');
+  });
+
+  it('should fall back to en-US for an unknown locale', async () => {
+    const locale = await getDateFnsLocale('zz-ZZ');
+
+    expect(locale?.code).toBe('en-US');
+  });
+
+  it('should fall back to en-US for nullish input', async () => {
+    expect((await getDateFnsLocale(undefined))?.code).toBe('en-US');
+    expect((await getDateFnsLocale(null))?.code).toBe('en-US');
+  });
+});

packages/twenty-front/src/modules/ui/field/display/utils/getDateFnsLocale.ts

@@ -1,3 +1,5 @@
+import { isObject } from '@sniptt/guards';
+import { type Locale } from 'date-fns';
 import { type APP_LOCALES } from 'twenty-shared/translations';
 
 type AppLocale = keyof typeof APP_LOCALES;
@@ -69,8 +71,13 @@ export const getDateFnsLocaleImport = (locale: AppLocale) => {
   }
 };
 
-export const getDateFnsLocale = async (localeString?: string | null) => {
+const isDateFnsLocale = (value: unknown): value is Locale =>
+  isObject(value) && 'code' in value && 'formatLong' in value;
+
+export const getDateFnsLocale = async (
+  localeString?: string | null,
+): Promise<Locale | undefined> => {
   return getDateFnsLocaleImport(localeString as AppLocale)
-    .then((m) => m.default as unknown as Locale)
-    .catch((_e) => undefined);
+    .then((localeModule) => Object.values(localeModule).find(isDateFnsLocale))
+    .catch(() => undefined);
 };

packages/twenty-front/src/modules/workflow/workflow-trigger/utils/getTriggerScheduleDescription.ts

@@ -1,3 +1,5 @@
+import { type Locale } from 'date-fns';
+
 import { type WorkflowCronTrigger } from '@/workflow/types/Workflow';
 import { describeCronExpression } from '@/workflow/workflow-trigger/utils/cron-to-human/describeCronExpression';
 import { convertScheduleToCronExpression } from '@/workflow/workflow-trigger/utils/cron-to-human/utils/convertScheduleToCronExpression';