chore(deps): upgrade Tier-1 deps (googleapis 173, gaxios 7, express 5, jsdom 29, date-fns 4, stripe 20) (#21570)

## What Security-driven upgrade of the biggest-drift Tier-1 dependencies (staying on latest = staying patched). Bundled because they share the lockfile and the googleapis/gaxios pair must move together. | Package | From | To | Gap | |---|---|---|---| | googleapis | 105.0.0 | **173.0.0** | 68 majors | | gaxios | 5.1.3 | **7.1.5** | 2 majors | | express | 4.22.2 | **5.2.1** | 1 major | | jsdom | 26.1.0 | **29.1.1** | 3 majors | | date-fns | 2.30.0 | **4.4.0** | 2 majors | | date-fns-tz | 2.0.0 | **3.2.0** | 1 major | | stripe | 19.3.1 | **20.4.1** | 1 major | `yarn npm audit` reports **0 high/critical** advisories before and after. ## Code changes - **gaxios v7** — `GaxiosError.code` is now `string | number` (guard the calendar network-error check by `typeof`); `GaxiosError` config/response use `URL` + `Headers`; and crucially the v7 constructor drops `response.data` unless `bodyUsed` is set — updated the synthetic gmail error mocks accordingly (production gaxios sets it, so real error parsing is unaffected). - **google-auth-library / gaxios dedup** — `googleapis-common@8.0.2` exact-pins `google-auth-library@10.5.0` + `gaxios@7.1.3` while `googleapis` pulls `^10.2.0`; the two copies made `OAuth2Client`/`GaxiosError` type-identities diverge across every gmail/calendar service. Added two singleton `resolutions` (documented inline in root `package.json`). - **express 5** — no source changes. `@nestjs/platform-express@11.1.24` already resolves `express@5.2.1` internally; the old `4.22.2` pin was the override. - **jsdom 29** — no source changes, but it now pulls ESM-only transitive deps (`@csstools/*` `.mjs`, `parse5`, `entities`, `tough-cookie`, `@exodus/bytes`). Extended the server jest `transformIgnorePatterns` allowlist and added `.mjs` to the transform/extensions so jest can load jsdom. - **stripe 20** — `Subscription` gained a required `customer_account` field; added to mocks. No runtime changes. - **date-fns v4** — `Locale` is no longer ambient (import explicitly in 5 files); per-locale entrypoints dropped the typed `default` export (the locale loader now reads the single named export); fixed the default locale import in `formatTimeZoneLabel`. ## Tests - Full suites green locally: **twenty-server 5709 passed**, **twenty-front 4937 passed**, twenty-ui / twenty-ui-deprecated green; typecheck + builds (swc + vite) + lint all pass. - Added regression tests for the two runtime behaviors these upgrades touch and that had no coverage: - `getDateFnsLocale` — named-export locale resolution (date-fns v4). - `sanitizeFile` — jsdom 29 + DOMPurify still strips `<script>`/event handlers from uploaded SVGs (security guard). ## Deliberately deferred (not in this PR) - **stripe → 21/22**: stripe **21** bundles a runtime `Decimal` type for money fields **and** jumps the pinned API version to `2026-03-25.dahlia` (changes webhook/billing payload behavior) — too risky to fold into a deps bump on billing code. stripe **22** additionally drops the node10-resolvable `types` entry, which would force a repo-wide `moduleResolution` change. Capped at the latest clean **20.x**. - **openid-client → 6**: v6 is a full functional rewrite and its passport strategy manages the OAuth `state` internally, but our SSO flow uses `state` to carry `identityProviderId` across the shared `/auth/oidc/callback`. That needs an auth-flow redesign (session-carried provider id) on Enterprise SSO code with no integration harness — it deserves its own focused PR rather than riding along here. ## Tier-1 source Originated from a dependency-drift audit; remaining Tier-1 items (date-fns done here) plus Tier-2/3 follow-ups tracked separately.  <a href="https://cubic.dev/pr/twentyhq/twenty/pull/21570?utm_source=github" target="_blank" rel="noopener noreferrer" data-no-image-dialog="true"><picture><source media="(prefers-color-scheme: dark)" srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source media="(prefers-color-scheme: light)" srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img alt="Review in cubic" src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a>
2026-06-15 10:23:42 +02:00
parent d7d4b36d5e
commit fb4608e437
23 changed files with 588 additions and 230 deletions
@@ -1,5 +1,6 @@
 import { Injectable, Logger } from '@nestjs/common';

+import { isString } from '@sniptt/guards';
 import { type GaxiosError } from 'gaxios';
 import { google, type calendar_v3 as calendarV3 } from 'googleapis';

@@ -89,7 +90,7 @@ export class GoogleCalendarGetEventsService {
      error,
    );
    if (
-      error.code &&
+      isString(error.code) &&
      [
        'ECONNRESET',
        'ENOTFOUND',
@@ -0,0 +1,52 @@
+import { GaxiosError, type GaxiosResponse } from 'gaxios';
+
+const MOCK_URL = new URL('https://gmail.googleapis.com/mocks');
+
+const createMockGaxiosResponse = <T>(
+  status: number,
+  statusText: string,
+  data: T,
+): GaxiosResponse<T> => {
+  const headers = new Headers();
+
+  const response: GaxiosResponse<T> = {
+    config: { url: MOCK_URL, headers: new Headers() },
+    data,
+    status,
+    statusText,
+    headers,
+    ok: status >= 200 && status < 300,
+    redirected: false,
+    type: 'default',
+    url: MOCK_URL.toString(),
+    body: null,
+    bodyUsed: true,
+    arrayBuffer: () => Promise.resolve(new ArrayBuffer(0)),
+    blob: () => Promise.resolve(new Blob()),
+    bytes: () => Promise.resolve(new Uint8Array()),
+    formData: () => Promise.resolve(new FormData()),
+    json: () => Promise.resolve(data),
+    text: () => Promise.resolve(''),
+    clone: () => response,
+  };
+
+  return response;
+};
+
+export const createMockGaxiosError = <T>({
+  message,
+  status,
+  statusText = '',
+  data,
+}: {
+  message: string;
+  status: number;
+  statusText?: string;
+  data: T;
+}): GaxiosError<T> => {
+  return new GaxiosError<T>(
+    message,
+    { url: MOCK_URL, headers: new Headers() },
+    createMockGaxiosResponse(status, statusText, data),
+  );
+};
@@ -1,4 +1,6 @@
-import { GaxiosError } from 'gaxios';
+import { type GaxiosError } from 'gaxios';
+
+import { createMockGaxiosError } from 'src/modules/messaging/message-import-manager/drivers/gmail/mocks/create-mock-gaxios-error.util';

 type ErrorConfig = {
  reason: string;
@@ -66,27 +68,21 @@ export const getGmailApiError = ({

  const errorMessage = message ?? config.message;

-  return new GaxiosError(
-    errorMessage,
-    { url: 'https://gmail.googleapis.com/mocks' },
-    {
-      status: code,
-      statusText: config.message,
-      data: {
-        error: {
-          code,
-          message: errorMessage,
-          errors: [
-            {
-              message: errorMessage,
-              reason: config.reason,
-            },
-          ],
-        },
+  return createMockGaxiosError({
+    message: errorMessage,
+    status: code,
+    statusText: config.message,
+    data: {
+      error: {
+        code,
+        message: errorMessage,
+        errors: [
+          {
+            message: errorMessage,
+            reason: config.reason,
+          },
+        ],
      },
-      headers: {},
-      config: { url: 'https://gmail.googleapis.com/mocks' },
-      request: { responseURL: 'https://gmail.googleapis.com/mocks' },
    },
-  );
+  });
 };
@@ -1,27 +1,22 @@
 import { GaxiosError } from 'gaxios';

+import { createMockGaxiosError } from 'src/modules/messaging/message-import-manager/drivers/gmail/mocks/create-mock-gaxios-error.util';
 import { isGmailApiError } from 'src/modules/messaging/message-import-manager/drivers/gmail/utils/is-gmail-api-error.util';

 describe('isGmailApiError', () => {
  it('should detect Gmail API error shape even when instanceof GaxiosError fails', () => {
-    const originalError = new GaxiosError(
-      'Rate limit exceeded',
-      {},
-      {
-        status: 429,
-        statusText: 'Too Many Requests',
-        headers: {},
-        config: {},
-        request: { responseURL: '' },
-        data: {
-          error: {
-            errors: [
-              { reason: 'rateLimitExceeded', message: 'Rate limit exceeded' },
-            ],
-          },
+    const originalError = createMockGaxiosError({
+      message: 'Rate limit exceeded',
+      status: 429,
+      statusText: 'Too Many Requests',
+      data: {
+        error: {
+          errors: [
+            { reason: 'rateLimitExceeded', message: 'Rate limit exceeded' },
+          ],
        },
      },
-    );
+    });

    const serialized = JSON.parse(JSON.stringify(originalError));

@@ -1,9 +1,8 @@
-import { GaxiosError } from 'gaxios';
-
 import {
  MessageImportDriverException,
  MessageImportDriverExceptionCode,
 } from 'src/modules/messaging/message-import-manager/drivers/exceptions/message-import-driver.exception';
+import { createMockGaxiosError } from 'src/modules/messaging/message-import-manager/drivers/gmail/mocks/create-mock-gaxios-error.util';
 import { getGmailApiError } from 'src/modules/messaging/message-import-manager/drivers/gmail/mocks/gmail-api-error-mocks';
 import { parseGmailApiError } from 'src/modules/messaging/message-import-manager/drivers/gmail/utils/parse-gmail-api-error.util';

@@ -125,18 +124,12 @@ describe('parseGmailApiError', () => {
  });

  it('should handle 500 OAuth internal_failure error', () => {
-    const error = new GaxiosError(
-      'internal_failure',
-      { url: 'https://oauth2.googleapis.com/token' },
-      {
-        status: 500,
-        statusText: 'Internal Server Error',
-        data: { error: 'internal_failure' },
-        headers: {},
-        config: { url: 'https://oauth2.googleapis.com/token' },
-        request: { responseURL: 'https://oauth2.googleapis.com/token' },
-      },
-    );
+    const error = createMockGaxiosError({
+      message: 'internal_failure',
+      status: 500,
+      statusText: 'Internal Server Error',
+      data: { error: 'internal_failure' },
+    });
    const exception = parseGmailApiError(error);

    expect(exception).toBeInstanceOf(MessageImportDriverException);