c596a5e342
Rename twenty-ui to twenty-ui-deprecated and twenty-new-ui to twenty-ui to prepare package release ( #21315 )
...
## Description
Promotes the next-gen UI library (formerly `twenty-new-ui`) to the name
**`twenty-ui`** (v0.1.0, publishable) and renames the old package to
**`twenty-ui-deprecated`**. Rewrites ~1,730 `twenty-ui` imports →
`twenty-ui-deprecated`, updates all configs/CI/Docker/deps, and migrates
twenty-front's `Toggle` to the new package (first consumer) as a
drop-in.
## Next steps
- Wire the `ui/v*` publish dispatch (`cd-deploy-tag.yaml` +
`.yarnrc.yml`), then tag `ui/v0.1.0` to publish.
- Continue migrating components from `twenty-ui-deprecated` →
`twenty-ui`.
2026-06-08 18:12:28 +02:00
d2e7dc0e74
security: bump vulnerable direct dependencies (axios, next, vitest, qs, dompurify, …) ( #21309 )
...
## What
Within-major version bumps of **direct** dependencies to clear a large
batch of Dependabot alerts that are breaching (or near) their SLA. No
major-version changes — all stay within the current major, so risk is
low.
| Package | From → To | Clears |
|---|---|---|
| `axios` | ^1.13.5 → ^1.16.0 | ReDoS, Proxy-Auth leak, proto-pollution
gadgets, NO_PROXY bypass, resource DoS (56 alerts) |
| `next` | 16.1.7 → ^16.2.6 | DoS, middleware/proxy bypass, SSRF, cache
poisoning, XSS (32 alerts) |
| `vitest` | 4.0.18 → ^4.1.0 | **CRITICAL** — UI server arbitrary file
read/exec (#1421 ) |
| `qs` | ^6.11.2 → ^6.15.2 | `qs.stringify` DoS |
| `dompurify` | 3.3.3 → ^3.4.0 | proto-pollution XSS + FORBID_TAGS /
SAFE_FOR_TEMPLATES bypasses |
| `@nestjs/core` | 11.1.16 → ^11.1.18 | improper output neutralization /
injection |
| `nodemailer` | 8.0.4 → 8.0.10 | SMTP command injection via CRLF
(bumped via root `resolutions`) |
| `path-to-regexp` | ^8.2.0 → ^8.4.0 | ReDoS via multiple wildcards |
| `file-type` | ^21.3.1 → ^21.3.2 | ZIP decompression-bomb DoS |
| `@opentelemetry/exporter-prometheus` | ^0.211.0 → ^0.217.0 | exporter
process crash via malformed HTTP request (#1183/#1184) |
## Notes
- Added a `next` root **resolution** so the dev-only
`@react-email/preview-server` copy (hard-pinned at `16.0.10`) is also
pulled up to the patched `16.2.x` line — otherwise that copy keeps the
Next.js alerts open.
- `@opentelemetry/exporter-prometheus` 0.217 pulled
`@opentelemetry/sdk-metrics` to 2.7.1 (compatible); `@opentelemetry/api`
stays pinned at 1.9.1.
- **Transitive-only** vulnerable packages (undici, tmp, ws,
brace-expansion, …) are handled in a **separate PR** per the
split-by-group plan.
- Breaking major bumps (electron, uuid, serialize-javascript) and
migrations (Apollo Server 3→4, simplemde) are intentionally **out of
scope** here.
2026-06-08 12:49:31 +00:00
6ad6fcce0f
Bump playwright ( #21113 )
...
Playwright installation is infinite looping in the ci
seems like to be a global outage
2026-06-01 18:06:55 +02:00
c8b9dace72
Fix focus in front components inputs ( #20961 )
...
Fixes https://github.com/twentyhq/twenty/issues/20714
Fixes keyboard hotkey conflicts when typing inside `<input>` /
`<textarea>` elements rendered by Front Components. Editable fields
rendered through the component renderer now properly push/pop a focus
item onto Twenty's focus stack, disabling global keyboard hotkeys while
the user is typing.
## Before
https://github.com/user-attachments/assets/2003c2cb-2698-480f-aedf-bb2f30396572
## After
https://github.com/user-attachments/assets/2c7c6cb0-ecd7-4557-a77b-4d1f264345f0
2026-05-27 16:30:49 +00:00
8a0225e974
Dispatch root package.json hoisted deps and devDeps ( #20140 )
...
# Introduction
Dispatching root package.json devDeps, prod deps
Taking care of keeping non imported module used at build/ci level in the
root package.json
## Motivation
Avoid redundant deps declaration, better scoping allow better workspace
deps granularity installation.
<img width="385" height="247" alt="image"
src="https://github.com/user-attachments/assets/9d7162ec-ba01-4f58-8563-38333733fdf0 "
/>
---------
Co-authored-by: Charles Bochet <charles@twenty.com >
2026-04-30 16:50:22 +00:00
2d6c8be7df
[Apps] Fix - app-synced object should be searchable ( #19206 )
...
## Summary
- **Make app-synced objects searchable**: `isSearchable` was hardcoded
to `false` and the `searchVector` field was missing the `GENERATED
ALWAYS AS (...)` expression, causing all records to have a `NULL` search
vector and be excluded from search results. Fixed by defaulting
`isSearchable` to `true` (configurable via the object manifest),
computing the `asExpression` from the label identifier field, and
allowing the update-field-action-handler to handle the `null` → defined
`asExpression` transition.
- **Make `isSearchable` updatable on an object**: The property had
`toCompare: false` in the entity properties configuration, so updates
via the API were silently ignored and never persisted. Fixed by setting
`toCompare: true`.
2026-04-02 17:14:37 +00:00
37908114fc
[SDK] Extract twenty-front-component-renderer outside of twenty-sdk ( 2.8MB ) (#19021 )
...
Followup https://github.com/twentyhq/twenty/pull/19010
## Dependency diagram
```
┌─────────────────────┐
│ twenty-front │
│ (React frontend) │
└─────────┬───────────┘
│ imports runtime:
│ FrontComponentRenderer
│ FrontComponentRendererWithSdkClient
│ useFrontComponentExecutionContext
▼
┌──────────────────────────────────┐ ┌─────────────────────────┐
│ twenty-front-component-renderer │────────▶│ twenty-sdk │
│ (remote-dom host + worker) │ │ (app developer SDK) │
│ │ │ │
│ imports from twenty-sdk: │ │ Public API: │
│ • types only: │ │ defineFrontComponent │
│ FrontComponentExecutionContext│ │ navigate, closeSide… │
│ NavigateFunction │ │ useFrontComponent… │
│ CloseSidePanelFunction │ │ Command components │
│ CommandConfirmation… │ │ conditional avail. │
│ OpenCommandConfirmation… │ │ │
│ EnqueueSnackbarFunction │ │ Internal only: │
│ etc. │ │ frontComponentHost… │
│ │ │ front-component-build │
│ owns locally: │ │ esbuild plugins │
│ • ALLOWED_HTML_ELEMENTS │ │ │
│ • EVENT_TO_REACT │ └────────────┬────────────┘
│ • HTML_TAG_TO_CUSTOM_ELEMENT… │ │
│ • SerializedEventData │ │ types
│ • PropertySchema │ ▼
│ • frontComponentHostComm… │ ┌─────────────────────────┐
│ (local ref to globalThis) │ │ twenty-shared │
│ • setFrontComponentExecution… │ │ (common types/utils) │
│ (local impl, same keys) │ │ AppPath, SidePanelP… │
│ │ │ EnqueueSnackbarParams │
└──────────────────────────────────┘ │ isDefined, … │
│ └─────────────────────────┘
│ also depends on
▼
twenty-shared (types)
@remote-dom/* (runtime)
@quilted/threads (runtime)
react (runtime)
```
**Key points:**
- **`twenty-front`** depends on the renderer, **not** on `twenty-sdk`
directly (for rendering)
- **`twenty-front-component-renderer`** depends on `twenty-sdk` for
**types only** (function signatures, `FrontComponentExecutionContext`).
The runtime bridge (`frontComponentHostCommunicationApi`) is shared via
`globalThis` keys, not module imports
- **`twenty-sdk`** has no dependency on the renderer — clean one-way
dependency
- The renderer owns all remote-dom infrastructure (element schemas,
event mappings, custom element tags) that was previously leaking through
the SDK's public API
- The SDK's `./build` entry point was removed entirely (unused)
2026-03-30 17:06:06 +00:00
Raphaël Bosi