houseassassin/twenty
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
13,303 Commits 1 Branch 0 Tags
7b682bced9be2e75a94db2bab09f4e19e6e85d3f
Commit Graph

733 Commits

Author SHA1 Message Date
Abdullah. be8102c4a4 fix: evict js-yaml 3.x via front-matter patch + scoped resolutions (#22312) 
## Summary

Closes the last open Dependabot alert on `main` — [alert
1504](https://github.com/twentyhq/twenty/security/dependabot/1504)
(GHSA-h67p-54hq-rp68 / CVE-2026-53550, js-yaml merge-key
quadratic-complexity DoS; medium, dev scope).

The 4.x js-yaml copies are already pinned to 4.2.0 (the seven
`@mintlify/*` + `@verdaccio/config` resolutions). The remaining
vulnerable copy was **js-yaml 3.14.2**, held by two `^3.13.1` consumers
with no fixed upstream release:
- `@istanbuljs/load-nyc-config@1.1.0` (jest coverage)
- `front-matter@4.0.2` (mintlify docs tooling — EOL, latest is 4.0.2)

## Approach

Both are forced to **js-yaml 4.2.0** via scoped resolutions, which
evicts the 3.x copy entirely:

```jsonc
"front-matter/js-yaml": "4.2.0",
"@istanbuljs/load-nyc-config/js-yaml": "4.2.0",
```

- **load-nyc-config** already calls `yaml.load` (present +
safe-by-default in 4.x), so its pin alone works.
- **front-matter** crashed on js-yaml 4.x because its default loader
called the removed `safeLoad`, so it's also **patched**
(`.yarn/patches/front-matter-npm-4.0.2-e1cc0efa69.patch`):

  ```diff
  -  var loader = allowUnsafe ? parser.load : parser.safeLoad
  +  var loader = parser.load
  ```

On 4.x `load` is already safe-by-default and there's no full/unsafe
schema, so the `allowUnsafe` ternary is dead.

**Why the version move is a separate resolution, not folded into the
patch:** a `yarn patch` only rewrites a package's *files* — it does
**not** change the resolved dependency graph. Bumping js-yaml inside the
patched `package.json` is ignored by resolution (verified:
front-matter@patch still pulled 3.14.2 until the explicit pin was
added). This is the repo's first *transitive* patch; like every other
transitive override it lives in root `resolutions`. Documented in the
`//resolutions` note.

## Verification

- js-yaml 3.x **fully evicted** — the tree resolves js-yaml to **4.2.0
only** (no `^3.13.1` descriptor remains).
- `yarn install --immutable` passes.
- front-matter parses real docs front-matter correctly on 4.2.0 (unit
smoke test).
- **`mintlify validate` passes** — the docs toolchain builds with the
patched front-matter.
 2026-06-29 20:14:17 +05:00
Abdullah. e69c3ae5ce fix(website): bump @opennextjs/cloudflare to 1.20.0 (R2 deploy on Node 24) (#22266) 
## What

The twenty-infra **"Deploy Website"** workflow has failed every run
since 06-26 — at OpenNext's R2 incremental-cache step, **not** the
build:

```
Failed to provision remote R2 bucket "twenty-website-cache-dev"
for binding "NEXT_INC_CACHE_R2_BUCKET":
Failed to check whether bucket exists: … Premature close
```

## Root cause

`@opennextjs/cloudflare`'s `ensureR2Bucket()` calls the Cloudflare SDK's
`r2.buckets.get()`. On **Node 24** (which the deploy pins) undici
truncates the **gzip-compressed** Cloudflare API response → `Premature
close`. The SDK's own retries don't help (it's systematic, not flaky),
and pre-creating the bucket doesn't help (it always `.get()`s first).

This is **pre-existing and unrelated to the multi-locale change**
(#22257): the *Build Worker* step succeeds, and the identical error
appears on 06-26 runs (two days before that merged).

## Fix

opennext **1.20.0** fixes this precisely — it passes `defaultHeaders: {
"Accept-Encoding": "identity" }` to the Cloudflare SDK client, so the
API returns **uncompressed** responses (no decompression → no premature
close). **Node 24 is kept**, and no twenty-infra change is needed — the
deploy runs `twenty`'s own `npx opennextjs-cloudflare`, so bumping the
dep here is enough.

`^1.0.0 → ^1.20.0`. **1.20.0, not the latest 1.20.1**, because the
repo's `npmMinimalAgeGate: 3d` still quarantines 1.20.1 (published
06-26); 1.20.0 (06-25) is past the gate and carries the same fix.

## Verification

- Resolved to `1.20.0`; confirmed `Accept-Encoding: identity` is in the
installed `dist/cli/utils/ensure-r2-bucket.js`.
- `nx typecheck twenty-website` green (OpenNext config API unchanged
across the bump).
- Diff is just `package.json` + `yarn.lock`.

⚠️ Full confirmation needs a **Deploy Website** run (exercises the build
+ the R2 provision step), which I can't trigger — please re-run it after
merge.
 2026-06-28 16:18:31 +00:00
Félix Malfait 538b180824 feat(dpa): self-serve Data Processing Agreement generator (#22243) 
## What

A single, region-aware DPA that serves all customers, generated
automatically from the customer's deployment. Two layers:

1. **Click-through DPA** — recorded at signup (acceptance = execution),
resolving merge fields from the deployment region. Cloud only.
2. **In-app signed-PDF generator** — Settings → Legal → Generate DPA:
preview the agreement, enter legal entity + authorized signatory,
download a PDF pre-signed by Twenty, and store the executed copy against
the workspace with its template version + timestamp. Deep-linkable at
`/dpa` (login-gated) for `twenty.com/dpa`.

## How it resolves

A typed variable matrix (`dpa-region-config.constant.ts`) maps the
deployment region to the contracting Processor entity and terms:

- **EU (default)** → Twenty.com SAS, hosting EU/Frankfurt, governing law
France, SCC section dormant.
- **US (custom)** → Twenty, Inc., hosting US, SCC section active.

Region is a deployment-wide setting (`DPA_DEPLOYMENT_REGION`, default
EU) behind a `DpaRegionService` seam so it can later become
per-workspace without touching callers. The legal text is verbatim from
the template (generated into `dpa-template.constant.ts` directly from
the source `.docx`); only the 6 merge fields are filled and the SCC
sections (7.2–7.5) stay in the document for every region per the spec —
only field values branch. Sub-processors are deferred to
trust.twenty.com (not enumerated). Billing stays decoupled (Twenty, Inc.
remains merchant of record regardless of Processor).

## UI

Standard list + create-page pattern (mirrors API keys / webhooks): a
list of executed copies (with re-download) — or the agreement preview
when none exists — and a top-right blue **Generate DPA** CTA opening a
standard create page. The "Legal" item is intentionally **not** in the
settings menu; the page is reached via the `/dpa` deep link.

## Notable implementation details

- **PDF** is rendered server-side with `@react-pdf/renderer`. The
built-in standard-14 fonts only encode ASCII and crash on the template's
curly quotes / em–en dashes / accented Latin, so Liberation Sans (OFL)
is **subset to a Latin glyph set and embedded as base64 data: URLs** —
no font files to ship or resolve at runtime (works in dev, prod-Docker
and CI).
- New `core.dpaAgreement` table via a fast instance command (FK hash
reproduced to match TypeORM).
- Self-hosted deployments (billing disabled) skip click-through
recording and stamp a prominent "not a valid agreement" banner on the
preview and PDF.

## Tests

- Unit: resolver (per-region entity/law/SCC state, EU default, no
unresolved `{{ }}`, SCC sections present in both regions, self-hosted
notice) and HTML renderer.
- Integration (`test/integration/graphql/suites/dpa`): preview has no
unresolved fields; `generateSignedDpa` renders + persists + returns a
downloadable PDF (asserted with accented input to guard the font
regression); list re-download.

## ⚠ Needs legal input before go-live (marked `TODO_CONFIRM` in
`dpa-region-config.constant.ts`)

- Registered-office addresses for Twenty.com SAS and Twenty, Inc.
- US deployment governing law (the template only specifies France).
- DPO name and the Twenty pre-signed authorized signatory name/title.

## Out of scope (flagged per spec)

Intra-group legal agreement and any Stripe/billing-entity changes. A
future e-sign provider would plug in at `DpaService.generateSignedDpa` +
the signatory input.

> Draft until the integration test passes in CI and the legal
`TODO_CONFIRM` values are supplied.

https://claude.ai/code/session_01Ahjydxx6J1souz1s1NeA9a

---
_Generated by [Claude
Code](https://claude.ai/code/session_01Ahjydxx6J1souz1s1NeA9a)_

<!-- This is an auto-generated description by cubic. -->
<a
href="https://cubic.dev/pr/twentyhq/twenty/pull/22243?utm_source=github"
target="_blank" rel="noopener noreferrer"
data-no-image-dialog="true"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source
media="(prefers-color-scheme: light)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img
alt="Review in cubic"
src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a>
<!-- End of auto-generated description by cubic. -->
 2026-06-27 17:46:38 +02:00
Félix Malfait 0e22ae0521 feat: create calendar events on Google and Microsoft accounts (#22231) 
## Context

Twenty can import calendar events and send emails, but cannot create
calendar events. This adds calendar event creation on connected
**Google** and **Microsoft** accounts, mirroring the existing email-send
architecture (`message-outbound-manager`).

## What it adds

The capability is exposed three ways, all backed by the same composer →
driver → persist pipeline:

- **GraphQL mutation** `createCalendarEvent` (metadata API)
- **AI agent tool** `create_calendar_event` (flows to MCP
automatically), gated by a new `CREATE_CALENDAR_EVENT_TOOL` permission
flag
- **Workflow builder node** "Create Calendar Event" in the **Core**
section, with a full settings form (variable interpolation supported)

CalDAV/IMAP is intentionally out of scope for now (different long pole).

## Design notes

- **Reuse over reinvention** — the created event is run through the
existing inbound formatters (`formatGoogleCalendarEvents` /
`formatMicrosoftCalendarEvents`) and persisted immediately via the
existing `CalendarSaveEventsService`, so it appears in Twenty right away
and is reconciled by the next provider sync (dedup on external id).
Persistence is best-effort.
- **OAuth scopes** — Google already requests `calendar.events`
(read+write), so no change there. Microsoft moves `Calendars.Read` →
`Calendars.ReadWrite`; existing Microsoft accounts must re-consent
(surfaced as a clear "reconnect" error via a missing-scope check).
- **Deliberate invitation semantics** — `sendInvitations` is off by
default. When off, the event is created with **no attendees** on either
provider, so creating an event never silently emails external people.
When on, attendees are attached and notified (Google `sendUpdates: all`,
Microsoft's default). This sidesteps Microsoft Graph having no
per-request suppression.
- **Timezone correctness** — Microsoft Graph interprets `dateTime` as
wall-clock in the supplied `timeZone` and ignores the offset, so the
absolute instant is converted to its wall-clock form before sending
(Google honors the offset directly). Both providers end up scheduling
the same instant.
- **Conferencing** — optional Google Meet
(`conferenceData.createRequest`, with a follow-up `events.get` to
resolve the async link) / Microsoft Teams (`isOnlineMeeting`).
- Attendees are a comma-separated string everywhere (tool input, GraphQL
DTO, workflow input), consistent with `send_email` recipients; the
composer parses to its internal list.

## Test plan

- **Unit**: 45 tests covering the composer (validation, all-day
boundaries, offset enforcement, timezone, scope checks, default-account
resolution), both provider drivers, the dispatcher, and the workflow
step-log builder.
- **Integration**: `createCalendarEvent` on the `/metadata` API fails
closed with a structured error for a non-existent account (the
auth/ownership/validation path that doesn't require provider mocking).
- **Manual**: verified the workflow node appears in the Core section,
the settings form renders and round-trips (edit → autosave → reload),
and the live mutation returns a structured failure for a bogus account.

## Open question for reviewers

The metadata mutation `createCalendarEvent` shares a name with the core
schema's auto-generated `createCalendarEvent(data:)` CRUD mutation for
the CalendarEvent object — they live on different endpoints (`/metadata`
vs `/graphql`) so there's no runtime conflict, but it's a potential
point of confusion for API consumers. Happy to rename (e.g.
`createCalendarEventOnConnectedAccount`) if preferred.

## Out of scope / follow-ups

- CalDAV/IMAP support
- Event update/delete and recurrence
- Existing Microsoft accounts need re-consent for the widened scope


<!-- This is an auto-generated description by cubic. -->
<a
href="https://cubic.dev/pr/twentyhq/twenty/pull/22231?utm_source=github"
target="_blank" rel="noopener noreferrer"
data-no-image-dialog="true"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source
media="(prefers-color-scheme: light)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img
alt="Review in cubic"
src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a>
<!-- End of auto-generated description by cubic. -->

---------

Co-authored-by: neo773 <neo773@protonmail.com>
 2026-06-27 14:05:58 +02:00
Charles Bochet fe1a8ad5f0 fix(ci): patch danger to decline gzip, fixing ERR_STREAM_PREMATURE_CLOSE on Node 24 (#22171) 
## Problem

The `danger-js` check (`twenty-utils:danger:ci`) started failing
intermittently with:

```
FetchError: Invalid response body while trying to fetch
https://api.github.com/repos/twentyhq/twenty/pulls/<n>/files: Premature close
  errno: 'ERR_STREAM_PREMATURE_CLOSE'
```

It fails before the Dangerfile even runs, while fetching PR files / diff
/ commits. The existing retry wrapper
([#22151](https://github.com/twentyhq/twenty/pull/22151)) reduced it but
can't absorb longer GitHub-API windows, so checks still go red.

## Root cause

Not "node-fetch is old" generically — a specific recent regression:

- Node **22.23.0 / 24.17.0** shipped a security fix for CVE-2026-48931
(http.Agent response-queue poisoning) that attaches a `'data'` listener
to idle keep-alive sockets.
- `node-fetch@2` misreads that listener as an unclean connection close —
but only on **gzip-encoded responses without `Content-Length`**, which
is exactly what `api.github.com` returns.
- The GitHub-hosted runners rolling into the patched Node 24.17.x in
recent weeks is why this surfaced now.

See
[danger/danger-js#1515](https://github.com/danger/danger-js/issues/1515),
[nodejs/node#63989](https://github.com/nodejs/node/issues/63989).

## Why this approach

- `node-fetch@2` can't be removed downstream — Danger imports it
directly, and it's pervasive transitively (gaxios/googleapis). Dropping
it is an upstream migration.
- We don't want to pin an old Node version.

So: bump `danger` 13.0.4 → 13.0.8 and backport
[danger/danger-js#1516](https://github.com/danger/danger-js/pull/1516)
via a yarn patch — set `compress: false` on Danger's shared `api()`
wrapper. GitHub then returns identity-encoded responses with
`Content-Length`, and node-fetch's faulty premature-close detector never
fires. Negligible bandwidth cost on these small JSON payloads; explicit
caller overrides are preserved via an `=== undefined` guard.

## Changes

- `packages/twenty-utils/package.json` — `danger` → patched 13.0.8
- `yarn.lock` — registers the `danger@patch:` resolution
- `.yarn/patches/danger-npm-13.0.8-48aba2788c.patch` — the `compress:
false` fix

## Verification

- Patch dry-run applies cleanly against pristine danger 13.0.8 source.
- Inspected yarn's materialized patched cache package — the `compress`
fix is present in the linked `distribution/api/fetch.js`.
- Confirmed the failing calls (`getPullRequestInfo` /
`getPullRequestCommits` / `getPullRequestDiff`) all route through
`this.api` → the patched wrapper.

## Lifecycle

Temporary backport. When #1516 ships in a Danger release, drop the patch
and bump to that version (flagged in a comment inside the patch). The
existing CI retry wrapper stays as defense-in-depth.

<!-- This is an auto-generated description by cubic. -->
<a
href="https://cubic.dev/pr/twentyhq/twenty/pull/22171?utm_source=github"
target="_blank" rel="noopener noreferrer"
data-no-image-dialog="true"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source
media="(prefers-color-scheme: light)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img
alt="Review in cubic"
src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a>
<!-- End of auto-generated description by cubic. -->
 2026-06-25 14:32:25 +02:00
Parship Chowdhury 6ee5413951 chore(vite): replace vite-tsconfig-paths with resolve.tsconfigPaths (#22100) 
### Summary
Migrates main monorepo packages from the `vite-tsconfig-paths` plugin to
vite’s built-in path resolution.

Vite 8 showing this warning when the plugin is detected:
> The plugin "vite-tsconfig-paths" is detected. Vite now supports
tsconfig paths resolution natively via the resolve.tsconfigPaths option.
You can remove the plugin and set resolve.tsconfigPaths: true in your
Vite config instead.

### References
- https://vite.dev/config/shared-options#resolve-tsconfigpaths
- https://vite.dev/guide/features#paths
- https://github.com/vitejs/vite/pull/21781

<!-- This is an auto-generated description by cubic. -->
<a
href="https://cubic.dev/pr/twentyhq/twenty/pull/22100?utm_source=github"
target="_blank" rel="noopener noreferrer"
data-no-image-dialog="true"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source
media="(prefers-color-scheme: light)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img
alt="Review in cubic"
src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a>
<!-- End of auto-generated description by cubic. -->

---------

Signed-off-by: Parship Chowdhury <parshipchowdhury@gmail.com>
 2026-06-24 19:03:18 +02:00
dependabot[bot] 8830ef89bd chore(deps-dev): bump @storybook/addon-docs from 10.3.4 to 10.4.6 (#22110) 
Bumps
[@storybook/addon-docs](https://github.com/storybookjs/storybook/tree/HEAD/code/addons/docs)
from 10.3.4 to 10.4.6.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/storybookjs/storybook/releases">@​storybook/addon-docs's
releases</a>.</em></p>
<blockquote>
<h2>v10.4.6</h2>
<h2>10.4.6</h2>
<ul>
<li>CSF: Allow partial globals overrides in story and meta annotations -
<a
href="https://redirect.github.com/storybookjs/storybook/pull/34985">#34985</a>,
thanks <a
href="https://github.com/TheSeydiCharyyev"><code>@​TheSeydiCharyyev</code></a>!</li>
<li>Dependencies: Upgrade esbuild - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35157">#35157</a>,
thanks <a
href="https://github.com/Kakadus"><code>@​Kakadus</code></a>!</li>
</ul>
<h2>v10.4.5</h2>
<h2>10.4.5</h2>
<ul>
<li>Core: Rework AI checklist feature gate - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35053">#35053</a>,
thanks <a
href="https://github.com/Sidnioulz"><code>@​Sidnioulz</code></a>!</li>
<li>Preview: Stop mixed CSF3+4 stories getting core annotations injected
twice - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35094">#35094</a>,
thanks <a
href="https://github.com/JReinhold"><code>@​JReinhold</code></a>!</li>
</ul>
<h2>v10.4.4</h2>
<h2>10.4.4</h2>
<ul>
<li>Telemetry: Add timeout to event-log POST to prevent build hang - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35085">#35085</a>,
thanks <a
href="https://github.com/badams"><code>@​badams</code></a>!</li>
</ul>
<h2>v10.4.3</h2>
<h2>10.4.3</h2>
<ul>
<li>Addon Docs: Fix Primary and Controls blocks not rendering in custom
MDX pages - <a
href="https://redirect.github.com/storybookjs/storybook/pull/34496">#34496</a>,
thanks <a
href="https://github.com/NYCU-Chung"><code>@​NYCU-Chung</code></a>!</li>
<li>Core: Respect !dev tag on MDX docs in sidebar - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35031">#35031</a>,
thanks <a
href="https://github.com/JReinhold"><code>@​JReinhold</code></a>!</li>
<li>React: Add support for resolving subcomponents attached as
properties of a parent component - <a
href="https://redirect.github.com/storybookjs/storybook/pull/34967">#34967</a>,
thanks <a
href="https://github.com/yatishgoel"><code>@​yatishgoel</code></a>!</li>
<li>UI: Prevent docs page scroll reset on HMR re-render - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35021">#35021</a>,
thanks <a
href="https://github.com/LongTangGithub"><code>@​LongTangGithub</code></a>!</li>
</ul>
<h2>v10.4.2</h2>
<h2>10.4.2</h2>
<ul>
<li>Bug: Fix Windows command resolution for non-Node package managers -
<a
href="https://redirect.github.com/storybookjs/storybook/pull/33534">#33534</a>,
thanks <a
href="https://github.com/copilot-swe-agent"><code>@​copilot-swe-agent</code></a>!</li>
<li>Build: Upgrade type-fest to latest version 5.6.0 - <a
href="https://redirect.github.com/storybookjs/storybook/pull/34791">#34791</a>,
thanks <a
href="https://github.com/tobiasdiez"><code>@​tobiasdiez</code></a>!</li>
<li>CSF: Fix parsing of string literal export names - <a
href="https://redirect.github.com/storybookjs/storybook/pull/34901">#34901</a>,
thanks <a
href="https://github.com/shilman"><code>@​shilman</code></a>!</li>
<li>Publish: Add npm provenance attestations - <a
href="https://redirect.github.com/storybookjs/storybook/pull/34936">#34936</a>,
thanks <a
href="https://github.com/copilot-swe-agent"><code>@​copilot-swe-agent</code></a>!</li>
</ul>
<h2>v10.4.1</h2>
<h2>10.4.1</h2>
<ul>
<li>Angular: Detect model() signal outputs (type inference + compodoc
autodocs + runtime binding) - <a
href="https://redirect.github.com/storybookjs/storybook/pull/34833">#34833</a>,
thanks <a
href="https://github.com/valentinpalkovic"><code>@​valentinpalkovic</code></a>!</li>
<li>Build: Upgrade type-fest to latest version 5.6.0 - <a
href="https://redirect.github.com/storybookjs/storybook/pull/34791">#34791</a>,
thanks <a
href="https://github.com/tobiasdiez"><code>@​tobiasdiez</code></a>!</li>
<li>CLI: Run `npx expo install --fix` after init for Expo projects - <a
href="https://redirect.github.com/storybookjs/storybook/pull/34803">#34803</a>,
thanks <a
href="https://github.com/ndelangen"><code>@​ndelangen</code></a>!</li>
<li>CLI: Support `peerDependencies` in framework detection for component
libraries - <a
href="https://redirect.github.com/storybookjs/storybook/pull/34516">#34516</a>,
thanks <a
href="https://github.com/zhyd1997"><code>@​zhyd1997</code></a>!</li>
<li>Next.js: Add useLinkStatus mock to next/link export mock - <a
href="https://redirect.github.com/storybookjs/storybook/pull/34593">#34593</a>,
thanks <a
href="https://github.com/philwolstenholme"><code>@​philwolstenholme</code></a>!</li>
<li>Vue3: Specify a specific version for non-dev dependency - <a
href="https://redirect.github.com/storybookjs/storybook/pull/34794">#34794</a>,
thanks <a
href="https://github.com/ScopeyNZ"><code>@​ScopeyNZ</code></a>!</li>
</ul>
<h2>v10.4.0</h2>
<h2>10.4.0</h2>
<blockquote>
<p><em>AI-assisted setup, change-aware review, and stronger framework
support</em></p>
</blockquote>
<p>Storybook 10.4 contains hundreds of fixes and improvements
including:</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/storybookjs/storybook/blob/next/CHANGELOG.md">@​storybook/addon-docs's
changelog</a>.</em></p>
<blockquote>
<h2>10.4.6</h2>
<ul>
<li>CSF: Allow partial globals overrides in story and meta annotations -
<a
href="https://redirect.github.com/storybookjs/storybook/pull/34985">#34985</a>,
thanks <a
href="https://github.com/TheSeydiCharyyev"><code>@​TheSeydiCharyyev</code></a>!</li>
<li>Dependencies: Upgrade esbuild - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35157">#35157</a>,
thanks <a
href="https://github.com/Kakadus"><code>@​Kakadus</code></a>!</li>
</ul>
<h2>10.4.5</h2>
<ul>
<li>Core: Rework AI checklist feature gate - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35053">#35053</a>,
thanks <a
href="https://github.com/Sidnioulz"><code>@​Sidnioulz</code></a>!</li>
<li>Preview: Stop mixed CSF3+4 stories getting core annotations injected
twice - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35094">#35094</a>,
thanks <a
href="https://github.com/JReinhold"><code>@​JReinhold</code></a>!</li>
</ul>
<h2>10.4.4</h2>
<ul>
<li>Telemetry: Add timeout to event-log POST to prevent build hang - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35085">#35085</a>,
thanks <a
href="https://github.com/badams"><code>@​badams</code></a>!</li>
</ul>
<h2>10.4.3</h2>
<ul>
<li>Addon Docs: Fix Primary and Controls blocks not rendering in custom
MDX pages - <a
href="https://redirect.github.com/storybookjs/storybook/pull/34496">#34496</a>,
thanks <a
href="https://github.com/NYCU-Chung"><code>@​NYCU-Chung</code></a>!</li>
<li>Core: Respect !dev tag on MDX docs in sidebar - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35031">#35031</a>,
thanks <a
href="https://github.com/JReinhold"><code>@​JReinhold</code></a>!</li>
<li>React: Add support for resolving subcomponents attached as
properties of a parent component - <a
href="https://redirect.github.com/storybookjs/storybook/pull/34967">#34967</a>,
thanks <a
href="https://github.com/yatishgoel"><code>@​yatishgoel</code></a>!</li>
<li>UI: Prevent docs page scroll reset on HMR re-render - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35021">#35021</a>,
thanks <a
href="https://github.com/LongTangGithub"><code>@​LongTangGithub</code></a>!</li>
</ul>
<h2>10.4.2</h2>
<ul>
<li>Bug: Fix Windows command resolution for non-Node package managers -
<a
href="https://redirect.github.com/storybookjs/storybook/pull/33534">#33534</a>,
thanks <a
href="https://github.com/copilot-swe-agent"><code>@​copilot-swe-agent</code></a>!</li>
<li>Build: Upgrade type-fest to latest version 5.6.0 - <a
href="https://redirect.github.com/storybookjs/storybook/pull/34791">#34791</a>,
thanks <a
href="https://github.com/tobiasdiez"><code>@​tobiasdiez</code></a>!</li>
<li>CSF: Fix parsing of string literal export names - <a
href="https://redirect.github.com/storybookjs/storybook/pull/34901">#34901</a>,
thanks <a
href="https://github.com/shilman"><code>@​shilman</code></a>!</li>
<li>Publish: Add npm provenance attestations - <a
href="https://redirect.github.com/storybookjs/storybook/pull/34936">#34936</a>,
thanks <a
href="https://github.com/copilot-swe-agent"><code>@​copilot-swe-agent</code></a>!</li>
</ul>
<h2>10.4.1</h2>
<ul>
<li>Angular: Detect model() signal outputs (type inference + compodoc
autodocs + runtime binding) - <a
href="https://redirect.github.com/storybookjs/storybook/pull/34833">#34833</a>,
thanks <a
href="https://github.com/valentinpalkovic"><code>@​valentinpalkovic</code></a>!</li>
<li>Build: Upgrade type-fest to latest version 5.6.0 - <a
href="https://redirect.github.com/storybookjs/storybook/pull/34791">#34791</a>,
thanks <a
href="https://github.com/tobiasdiez"><code>@​tobiasdiez</code></a>!</li>
<li>CLI: Run <code>npx expo install --fix</code> after init for Expo
projects - <a
href="https://redirect.github.com/storybookjs/storybook/pull/34803">#34803</a>,
thanks <a
href="https://github.com/ndelangen"><code>@​ndelangen</code></a>!</li>
<li>CLI: Support <code>peerDependencies</code> in framework detection
for component libraries - <a
href="https://redirect.github.com/storybookjs/storybook/pull/34516">#34516</a>,
thanks <a
href="https://github.com/zhyd1997"><code>@​zhyd1997</code></a>!</li>
<li>Next.js: Add useLinkStatus mock to next/link export mock - <a
href="https://redirect.github.com/storybookjs/storybook/pull/34593">#34593</a>,
thanks <a
href="https://github.com/philwolstenholme"><code>@​philwolstenholme</code></a>!</li>
<li>Vue3: Specify a specific version for non-dev dependency - <a
href="https://redirect.github.com/storybookjs/storybook/pull/34794">#34794</a>,
thanks <a
href="https://github.com/ScopeyNZ"><code>@​ScopeyNZ</code></a>!</li>
</ul>
<h2>10.4.0</h2>
<blockquote>
<p><em>AI-assisted setup, change-aware review, and stronger framework
support</em></p>
</blockquote>
<p>Storybook 10.4 contains hundreds of fixes and improvements
including:</p>
<ul>
<li>🤖 Agentic Setup: New CLI workflow for AI-assisted Storybook setup
and onboarding</li>
<li>🔍 Change review: Sidebar filtering to highlight new, modified, and
related stories based on git changes</li>
<li>🧭 Sidebar review tools: Status filtering, URL-persisted filters, and
clearer review signals in the sidebar</li>
<li>⚛️ TanStack React: New <code>@storybook/tanstack-react</code>
framework with routing and server function support</li>
<li>🧩 React MCP: Faster, more accurate component docgen powered by the
TypeScript Language Server</li>
<li>📱 React Native: Zero config RN project initialization</li>
<li>🤝 Sharing: Easily publish and share your local Storybook with
teammates, powered by Chromatic</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/storybookjs/storybook/commit/5496a4270da7f3a8e0203185792685cba671fdc5"><code>5496a42</code></a>
Bump version from &quot;10.4.5&quot; to &quot;10.4.6&quot; [skip
ci]</li>
<li><a
href="https://github.com/storybookjs/storybook/commit/48e7b20074222ed926d14fb6c678c2edfc86ee7b"><code>48e7b20</code></a>
Bump version from &quot;10.4.4&quot; to &quot;10.4.5&quot; [skip
ci]</li>
<li><a
href="https://github.com/storybookjs/storybook/commit/5adebe753f29d414d1e214e935c94d6e5451861f"><code>5adebe7</code></a>
Bump version from &quot;10.4.3&quot; to &quot;10.4.4&quot; [skip
ci]</li>
<li><a
href="https://github.com/storybookjs/storybook/commit/624e6187fd462e56719cbd80c1b4bfb67b68fc89"><code>624e618</code></a>
Bump version from &quot;10.4.2&quot; to &quot;10.4.3&quot; [skip
ci]</li>
<li><a
href="https://github.com/storybookjs/storybook/commit/c89882282295be3bc05b3a366916c53d7a499841"><code>c898822</code></a>
Merge pull request <a
href="https://github.com/storybookjs/storybook/tree/HEAD/code/addons/docs/issues/34496">#34496</a>
from NYCU-Chung/fix/docs-blocks-custom-mdx</li>
<li><a
href="https://github.com/storybookjs/storybook/commit/c920fd08c79c57879fa2ddb4e8538e1684c71ec2"><code>c920fd0</code></a>
Merge pull request <a
href="https://github.com/storybookjs/storybook/tree/HEAD/code/addons/docs/issues/35021">#35021</a>
from LongTangGithub/fix/docs-hmr-scroll-to-top</li>
<li><a
href="https://github.com/storybookjs/storybook/commit/1750494e9f36748b2d89335e77f23f125fc5ec78"><code>1750494</code></a>
Merge pull request <a
href="https://github.com/storybookjs/storybook/tree/HEAD/code/addons/docs/issues/35031">#35031</a>
from storybookjs/jeppe/fix-mdx-no-dev-tag</li>
<li><a
href="https://github.com/storybookjs/storybook/commit/298dea20c6370e5c670178d88a79fc9e9ff436b2"><code>298dea2</code></a>
Bump version from &quot;10.4.1&quot; to &quot;10.4.2&quot; [skip
ci]</li>
<li><a
href="https://github.com/storybookjs/storybook/commit/cc19ae1a2145e8f7cda8dc869f1b90d5346dcedb"><code>cc19ae1</code></a>
Bump version from &quot;10.4.0&quot; to &quot;10.4.1&quot; [skip
ci]</li>
<li><a
href="https://github.com/storybookjs/storybook/commit/f8c16d115cfcf0f79125b358266c37e5343bb70d"><code>f8c16d1</code></a>
Bump version from &quot;10.4.0-beta.0&quot; to &quot;10.4.0&quot; [skip
ci]</li>
<li>Additional commits viewable in <a
href="https://github.com/storybookjs/storybook/commits/v10.4.6/code/addons/docs">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=@storybook/addon-docs&package-manager=npm_and_yarn&previous-version=10.3.4&new-version=10.4.6)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

<!-- This is an auto-generated description by cubic. -->
<a
href="https://cubic.dev/pr/twentyhq/twenty/pull/22110?utm_source=github"
target="_blank" rel="noopener noreferrer"
data-no-image-dialog="true"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source
media="(prefers-color-scheme: light)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img
alt="Review in cubic"
src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a>
<!-- End of auto-generated description by cubic. -->

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Charles Bochet <charles@twenty.com>
 2026-06-24 18:37:04 +02:00
dependabot[bot] 264d0a7671 chore(deps): bump @ai-sdk/mistral from 3.0.39 to 3.0.40 (#22117) 
Bumps
[@ai-sdk/mistral](https://github.com/vercel/ai/tree/HEAD/packages/mistral)
from 3.0.39 to 3.0.40.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/vercel/ai/blob/@ai-sdk/mistral@3.0.40/packages/mistral/CHANGELOG.md">@​ai-sdk/mistral's
changelog</a>.</em></p>
<blockquote>
<h2>3.0.40</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies [779f5cd]
<ul>
<li><code>@​ai-sdk/provider-utils</code><a
href="https://github.com/4"><code>@​4</code></a>.0.30</li>
</ul>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/vercel/ai/commit/caebb44016dbd084e5bf7b7f4ab5194fd2c7c045"><code>caebb44</code></a>
Version Packages (<a
href="https://github.com/vercel/ai/tree/HEAD/packages/mistral/issues/16157">#16157</a>)</li>
<li>See full diff in <a
href="https://github.com/vercel/ai/commits/@ai-sdk/mistral@3.0.40/packages/mistral">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=@ai-sdk/mistral&package-manager=npm_and_yarn&previous-version=3.0.39&new-version=3.0.40)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

<!-- This is an auto-generated description by cubic. -->
<a
href="https://cubic.dev/pr/twentyhq/twenty/pull/22117?utm_source=github"
target="_blank" rel="noopener noreferrer"
data-no-image-dialog="true"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source
media="(prefers-color-scheme: light)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img
alt="Review in cubic"
src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a>
<!-- End of auto-generated description by cubic. -->

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-24 18:36:41 +02:00
dependabot[bot] 9574476395 chore(deps): bump @scalar/api-reference-react from 0.9.46 to 0.9.48 (#22115) 
Bumps
[@scalar/api-reference-react](https://github.com/scalar/scalar/tree/HEAD/packages/api-reference-react)
from 0.9.46 to 0.9.48.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/scalar/scalar/blob/main/packages/api-reference-react/CHANGELOG.md">@​scalar/api-reference-react's
changelog</a>.</em></p>
<blockquote>
<h2>0.9.48</h2>
<h2>0.9.47</h2>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/scalar/scalar/commits/HEAD/packages/api-reference-react">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=@scalar/api-reference-react&package-manager=npm_and_yarn&previous-version=0.9.46&new-version=0.9.48)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

<!-- This is an auto-generated description by cubic. -->
<a
href="https://cubic.dev/pr/twentyhq/twenty/pull/22115?utm_source=github"
target="_blank" rel="noopener noreferrer"
data-no-image-dialog="true"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source
media="(prefers-color-scheme: light)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img
alt="Review in cubic"
src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a>
<!-- End of auto-generated description by cubic. -->

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-24 16:19:16 +00:00
dependabot[bot] 5bb3ff4e43 chore(deps): bump @sentry/react from 10.51.0 to 10.60.0 (#22111) 
Bumps [@sentry/react](https://github.com/getsentry/sentry-javascript)
from 10.51.0 to 10.60.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/getsentry/sentry-javascript/releases">@​sentry/react's
releases</a>.</em></p>
<blockquote>
<h2>10.60.0</h2>
<h3>Other Changes</h3>
<ul>
<li>feat(cloudflare): Add R2 bucket auto-instrumentation (<a
href="https://redirect.github.com/getsentry/sentry-javascript/pull/21327">#21327</a>)</li>
<li>feat(core): Add <code>bindScopeToEmitter</code> to bind a scope to
an event emitter (<a
href="https://redirect.github.com/getsentry/sentry-javascript/pull/21594">#21594</a>)</li>
<li>feat(deps): Bump <code>@​hapi/wreck</code> from 18.1.0 to 18.1.2 (<a
href="https://redirect.github.com/getsentry/sentry-javascript/pull/21178">#21178</a>)</li>
<li>fix(browser): Ensure <code>url.full</code> and <code>http.url</code>
attributes have the same values on <code>http.client</code> spans (<a
href="https://redirect.github.com/getsentry/sentry-javascript/pull/21660">#21660</a>)</li>
<li>fix(server-utils): Avoid directly importing
<code>tracingChannel</code> for Node v18 compatibility (<a
href="https://redirect.github.com/getsentry/sentry-javascript/pull/21662">#21662</a>)</li>
<li>fix(server-utils): Remove optional <code>vite</code> peer dependency
(<a
href="https://redirect.github.com/getsentry/sentry-javascript/pull/21677">#21677</a>)</li>
</ul>
<!-- raw HTML omitted -->
<ul>
<li>chore: Add bundler-plugins to craft (<a
href="https://redirect.github.com/getsentry/sentry-javascript/pull/21701">#21701</a>)</li>
<li>chore: Cleanup unused imports of <code>@opentelemetry/core</code>
(<a
href="https://redirect.github.com/getsentry/sentry-javascript/pull/21679">#21679</a>)</li>
<li>fix(bundler-plugins): Integration with monorepo build (<a
href="https://redirect.github.com/getsentry/sentry-javascript/pull/21479">#21479</a>)</li>
<li>ref(core): Gate updateName() custom source on an OTel inference
brand (<a
href="https://redirect.github.com/getsentry/sentry-javascript/pull/21649">#21649</a>)</li>
<li>ref(core/opentelemetry): Move OTel span data inference from
<code>captureSpan</code> to <code>SentrySpanProcessor</code> (<a
href="https://redirect.github.com/getsentry/sentry-javascript/pull/21648">#21648</a>)</li>
<li>ref(node): Remove unused sql-common helper and
<code>@opentelemetry/core</code> dep (<a
href="https://redirect.github.com/getsentry/sentry-javascript/pull/21688">#21688</a>)</li>
<li>ref(node): Streamline kafkajs instrumentation (<a
href="https://redirect.github.com/getsentry/sentry-javascript/pull/21647">#21647</a>)</li>
<li>ref(node): Streamline undici (node-fetch) instrumentation (<a
href="https://redirect.github.com/getsentry/sentry-javascript/pull/21650">#21650</a>)</li>
<li>ref(vercel-edge): Drop unused
<code>@opentelemetry/semantic-conventions</code> dependency (<a
href="https://redirect.github.com/getsentry/sentry-javascript/pull/21691">#21691</a>)</li>
<li>ref(vercel-edge): Remove <code>@opentelemetry/resources</code>
dependency (<a
href="https://redirect.github.com/getsentry/sentry-javascript/pull/21690">#21690</a>)</li>
</ul>
<!-- raw HTML omitted -->
<h2>Bundle size 📦</h2>
<table>
<thead>
<tr>
<th>Path</th>
<th>Size</th>
</tr>
</thead>
<tbody>
<tr>
<td><code>@​sentry/browser</code></td>
<td>26.83 KB</td>
</tr>
<tr>
<td><code>@​sentry/browser</code> - with treeshaking flags</td>
<td>25.3 KB</td>
</tr>
<tr>
<td><code>@​sentry/browser</code> (incl. Tracing)</td>
<td>44.89 KB</td>
</tr>
<tr>
<td><code>@​sentry/browser</code> (incl. Tracing + Span Streaming)</td>
<td>46.6 KB</td>
</tr>
<tr>
<td><code>@​sentry/browser</code> (incl. Tracing, Profiling)</td>
<td>49.56 KB</td>
</tr>
<tr>
<td><code>@​sentry/browser</code> (incl. Tracing, Replay)</td>
<td>83.18 KB</td>
</tr>
<tr>
<td><code>@​sentry/browser</code> (incl. Tracing, Replay) - with
treeshaking flags</td>
<td>73.02 KB</td>
</tr>
<tr>
<td><code>@​sentry/browser</code> (incl. Tracing, Replay with
Canvas)</td>
<td>87.76 KB</td>
</tr>
<tr>
<td><code>@​sentry/browser</code> (incl. Tracing, Replay, Feedback)</td>
<td>100.12 KB</td>
</tr>
<tr>
<td><code>@​sentry/browser</code> (incl. Feedback)</td>
<td>43.61 KB</td>
</tr>
<tr>
<td><code>@​sentry/browser</code> (incl. sendFeedback)</td>
<td>31.5 KB</td>
</tr>
<tr>
<td><code>@​sentry/browser</code> (incl. FeedbackAsync)</td>
<td>36.52 KB</td>
</tr>
<tr>
<td><code>@​sentry/browser</code> (incl. Metrics)</td>
<td>27.87 KB</td>
</tr>
<tr>
<td><code>@​sentry/browser</code> (incl. Logs)</td>
<td>28.11 KB</td>
</tr>
<tr>
<td><code>@​sentry/browser</code> (incl. Metrics &amp; Logs)</td>
<td>28.78 KB</td>
</tr>
<tr>
<td><code>@​sentry/react</code></td>
<td>28.59 KB</td>
</tr>
<tr>
<td><code>@​sentry/react</code> (incl. Tracing)</td>
<td>47.14 KB</td>
</tr>
<tr>
<td><code>@​sentry/vue</code></td>
<td>31.86 KB</td>
</tr>
<tr>
<td><code>@​sentry/vue</code> (incl. Tracing)</td>
<td>46.71 KB</td>
</tr>
<tr>
<td><code>@​sentry/svelte</code></td>
<td>26.85 KB</td>
</tr>
</tbody>
</table>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/getsentry/sentry-javascript/blob/develop/CHANGELOG.md">@​sentry/react's
changelog</a>.</em></p>
<blockquote>
<h2>10.60.0</h2>
<h3>Other Changes</h3>
<ul>
<li>feat(cloudflare): Add R2 bucket auto-instrumentation (<a
href="https://redirect.github.com/getsentry/sentry-javascript/pull/21327">#21327</a>)</li>
<li>feat(core): Add <code>bindScopeToEmitter</code> to bind a scope to
an event emitter (<a
href="https://redirect.github.com/getsentry/sentry-javascript/pull/21594">#21594</a>)</li>
<li>feat(deps): Bump <code>@​hapi/wreck</code> from 18.1.0 to 18.1.2 (<a
href="https://redirect.github.com/getsentry/sentry-javascript/pull/21178">#21178</a>)</li>
<li>fix(browser): Ensure <code>url.full</code> and <code>http.url</code>
attributes have the same values on <code>http.client</code> spans (<a
href="https://redirect.github.com/getsentry/sentry-javascript/pull/21660">#21660</a>)</li>
<li>fix(server-utils): Avoid directly importing
<code>tracingChannel</code> for Node v18 compatibility (<a
href="https://redirect.github.com/getsentry/sentry-javascript/pull/21662">#21662</a>)</li>
<li>fix(server-utils): Remove optional <code>vite</code> peer dependency
(<a
href="https://redirect.github.com/getsentry/sentry-javascript/pull/21677">#21677</a>)</li>
</ul>
<!-- raw HTML omitted -->
<ul>
<li>chore: Add bundler-plugins to craft (<a
href="https://redirect.github.com/getsentry/sentry-javascript/pull/21701">#21701</a>)</li>
<li>chore: Cleanup unused imports of <code>@opentelemetry/core</code>
(<a
href="https://redirect.github.com/getsentry/sentry-javascript/pull/21679">#21679</a>)</li>
<li>fix(bundler-plugins): Integration with monorepo build (<a
href="https://redirect.github.com/getsentry/sentry-javascript/pull/21479">#21479</a>)</li>
<li>ref(core): Gate updateName() custom source on an OTel inference
brand (<a
href="https://redirect.github.com/getsentry/sentry-javascript/pull/21649">#21649</a>)</li>
<li>ref(core/opentelemetry): Move OTel span data inference from
<code>captureSpan</code> to <code>SentrySpanProcessor</code> (<a
href="https://redirect.github.com/getsentry/sentry-javascript/pull/21648">#21648</a>)</li>
<li>ref(node): Remove unused sql-common helper and
<code>@opentelemetry/core</code> dep (<a
href="https://redirect.github.com/getsentry/sentry-javascript/pull/21688">#21688</a>)</li>
<li>ref(node): Streamline kafkajs instrumentation (<a
href="https://redirect.github.com/getsentry/sentry-javascript/pull/21647">#21647</a>)</li>
<li>ref(node): Streamline undici (node-fetch) instrumentation (<a
href="https://redirect.github.com/getsentry/sentry-javascript/pull/21650">#21650</a>)</li>
<li>ref(vercel-edge): Drop unused
<code>@opentelemetry/semantic-conventions</code> dependency (<a
href="https://redirect.github.com/getsentry/sentry-javascript/pull/21691">#21691</a>)</li>
<li>ref(vercel-edge): Remove <code>@opentelemetry/resources</code>
dependency (<a
href="https://redirect.github.com/getsentry/sentry-javascript/pull/21690">#21690</a>)</li>
</ul>
<!-- raw HTML omitted -->
<h2>10.59.0</h2>
<h3>Important Changes</h3>
<ul>
<li>
<p><strong>feat(react-router): Add support for React Router v8 (<a
href="https://redirect.github.com/getsentry/sentry-javascript/pull/21633">#21633</a>)</strong></p>
<p>The SDK now supports React Router v8, in both the framework and SPA
(<code>@sentry/react</code>) modes.</p>
</li>
<li>
<p><strong>feat(react): Add version-agnostic React Router SPA exports
(<a
href="https://redirect.github.com/getsentry/sentry-javascript/pull/21633">#21633</a>)</strong></p>
<p><code>@sentry/react</code> now exports version-agnostic wrappers for
React Router v6+ SPA instrumentation.
The new exports replace the version-specific
<code>V6</code>/<code>V7</code> variants, which are now deprecated:</p>
<table>
<thead>
<tr>
<th>Deprecated</th>
<th>New</th>
</tr>
</thead>
<tbody>
<tr>
<td><code>reactRouterV6BrowserTracingIntegration</code> /
<code>V7</code></td>
<td><code>reactRouterBrowserTracingIntegration</code></td>
</tr>
<tr>
<td><code>withSentryReactRouterV6Routing</code> / <code>V7</code></td>
<td><code>wrapReactRouterRouting</code></td>
</tr>
<tr>
<td><code>wrapCreateBrowserRouterV6</code> / <code>V7</code></td>
<td><code>wrapCreateBrowserRouter</code></td>
</tr>
<tr>
<td><code>wrapCreateMemoryRouterV6</code> / <code>V7</code></td>
<td><code>wrapCreateMemoryRouter</code></td>
</tr>
<tr>
<td><code>wrapUseRoutesV6</code> / <code>V7</code></td>
<td><code>wrapUseRoutes</code></td>
</tr>
</tbody>
</table>
<p>The deprecated exports continue to work and will be removed in the
next major version.</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/getsentry/sentry-javascript/commit/4548afc27908146dca23db7a6722de714119909c"><code>4548afc</code></a>
test: Make bundler plugins tests work after release</li>
<li><a
href="https://github.com/getsentry/sentry-javascript/commit/499c327ea9240c6daa183ff76a734ce89117c230"><code>499c327</code></a>
chore: fix yarn.lock</li>
<li><a
href="https://github.com/getsentry/sentry-javascript/commit/4d26c19e7367d870e2e0758ba51def5d41637b52"><code>4d26c19</code></a>
release: 10.60.0</li>
<li><a
href="https://github.com/getsentry/sentry-javascript/commit/cc7dea46c1915b4a2a7d39e21248c938f2ed800c"><code>cc7dea4</code></a>
Merge pull request <a
href="https://redirect.github.com/getsentry/sentry-javascript/issues/21703">#21703</a>
from getsentry/prepare-release/10.60.0</li>
<li><a
href="https://github.com/getsentry/sentry-javascript/commit/bcef5d9c1cfb9d58f10fa5e9f5dfb42be1e4ff9c"><code>bcef5d9</code></a>
meta(changelog): Update changelog for 10.60.0</li>
<li><a
href="https://github.com/getsentry/sentry-javascript/commit/8285066e1cfb58493d1434f895bd43f986e4d917"><code>8285066</code></a>
chore: Add bundler-plugins to craft (<a
href="https://redirect.github.com/getsentry/sentry-javascript/issues/21701">#21701</a>)</li>
<li><a
href="https://github.com/getsentry/sentry-javascript/commit/b953c6f74d9ac83eecbae0dc65cd09fedabda7a4"><code>b953c6f</code></a>
fix(browser): Ensure <code>url.full</code> and <code>http.url</code>
attributes have the same value...</li>
<li><a
href="https://github.com/getsentry/sentry-javascript/commit/b54777a859f5e8b7bcb90ab218bef1a55d133d7a"><code>b54777a</code></a>
ref(vercel-edge): Drop unused
<code>@opentelemetry/semantic-conventions</code> dependenc...</li>
<li><a
href="https://github.com/getsentry/sentry-javascript/commit/2e29cd32769084a46a5ce66b36a49b1295741a79"><code>2e29cd3</code></a>
ref(vercel-edge): Remove <code>@opentelemetry/resources</code>
dependency (<a
href="https://redirect.github.com/getsentry/sentry-javascript/issues/21690">#21690</a>)</li>
<li><a
href="https://github.com/getsentry/sentry-javascript/commit/c5e245f869eca352e5d11833dd9b3264da448ac9"><code>c5e245f</code></a>
ref(node): Remove unusued sql-common helper and
<code>@opentelemetry/core</code> dep (<a
href="https://redirect.github.com/getsentry/sentry-javascript/issues/2">#2</a>...</li>
<li>Additional commits viewable in <a
href="https://github.com/getsentry/sentry-javascript/compare/10.51.0...10.60.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=@sentry/react&package-manager=npm_and_yarn&previous-version=10.51.0&new-version=10.60.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

<!-- This is an auto-generated description by cubic. -->
<a
href="https://cubic.dev/pr/twentyhq/twenty/pull/22111?utm_source=github"
target="_blank" rel="noopener noreferrer"
data-no-image-dialog="true"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source
media="(prefers-color-scheme: light)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img
alt="Review in cubic"
src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a>
<!-- End of auto-generated description by cubic. -->

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-24 18:03:37 +02:00
dependabot[bot] f2bed8359d chore(deps): bump @nestjs/schedule from 6.1.0 to 6.1.3 (#22112) 
Bumps [@nestjs/schedule](https://github.com/nestjs/schedule) from 6.1.0
to 6.1.3.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/nestjs/schedule/releases">@​nestjs/schedule's
releases</a>.</em></p>
<blockquote>
<h2>6.1.3</h2>
<h2>What's Changed</h2>
<ul>
<li>feat(cron): add initialDelay option to defer first job execution by
<a
href="https://github.com/kyungseopk1m"><code>@​kyungseopk1m</code></a>
in <a
href="https://redirect.github.com/nestjs/schedule/pull/2251">nestjs/schedule#2251</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/nestjs/schedule/compare/6.1.2...6.1.3">https://github.com/nestjs/schedule/compare/6.1.2...6.1.3</a></p>
<h2>Release 6.1.2</h2>
<ul>
<li>Merge pull request <a
href="https://redirect.github.com/nestjs/schedule/issues/2247">#2247</a>
from kyungseopk1m/feat/cron-initial-delay (a57ce2c)</li>
<li>chore(deps): update dependency prettier to v3.8.3 (<a
href="https://redirect.github.com/nestjs/schedule/issues/2248">#2248</a>)
(bb3490d)</li>
<li>feat(cron): add initialDelay option to defer first job execution
(1c5677f)</li>
<li>Merge pull request <a
href="https://redirect.github.com/nestjs/schedule/issues/2245">#2245</a>
from nestjs/renovate/nest-monorepo (59046bd)</li>
<li>Merge pull request <a
href="https://redirect.github.com/nestjs/schedule/issues/2246">#2246</a>
from nestjs/renovate/oxlint-monorepo (be4eee3)</li>
<li>chore(deps): update dependency oxlint to v1.60.0 (32a9ce2)</li>
<li>chore(deps): update nest monorepo to v11.1.19 (7d3844f)</li>
<li>chore: migrate to oxlint, vitest, ts6 (29de71b)</li>
<li>chore(deps): update dependency globals to v17.5.0 (<a
href="https://redirect.github.com/nestjs/schedule/issues/2244">#2244</a>)
(6c62cca)</li>
<li>chore(deps): update dependency sinon to v21.1.2 (<a
href="https://redirect.github.com/nestjs/schedule/issues/2243">#2243</a>)
(ee3b31a)</li>
<li>chore(deps): update dependency sinon to v21.1.1 (<a
href="https://redirect.github.com/nestjs/schedule/issues/2241">#2241</a>)
(eba9799)</li>
<li>Merge pull request <a
href="https://redirect.github.com/nestjs/schedule/issues/2242">#2242</a>
from nestjs/renovate/prettier-3.x (c3ad0f7)</li>
<li>chore(deps): update dependency prettier to v3.8.2 (798e2a9)</li>
<li>Merge pull request <a
href="https://redirect.github.com/nestjs/schedule/issues/2199">#2199</a>
from nestjs/renovate/cimg-node-24.x (a05354a)</li>
<li>chore(deps): update dependency typescript-eslint to v8.58.1 (<a
href="https://redirect.github.com/nestjs/schedule/issues/2240">#2240</a>)
(0367ac1)</li>
<li>chore(deps): update dependency eslint to v10.2.0 (<a
href="https://redirect.github.com/nestjs/schedule/issues/2239">#2239</a>)
(fa93e06)</li>
<li>chore(deps): update nest monorepo to v11.1.18 (<a
href="https://redirect.github.com/nestjs/schedule/issues/2238">#2238</a>)
(8cd4c02)</li>
<li>chore(deps): update dependency <code>@​types/node</code> to v24.12.2
(<a
href="https://redirect.github.com/nestjs/schedule/issues/2237">#2237</a>)
(01482df)</li>
<li>chore(deps): update dependency <code>@​types/sinon</code> to v21.0.1
(<a
href="https://redirect.github.com/nestjs/schedule/issues/2236">#2236</a>)
(f05b5bd)</li>
<li>chore(deps): update dependency ts-jest to v29.4.9 (<a
href="https://redirect.github.com/nestjs/schedule/issues/2235">#2235</a>)
(af545e6)</li>
<li>chore(deps): update dependency typescript-eslint to v8.58.0 (<a
href="https://redirect.github.com/nestjs/schedule/issues/2233">#2233</a>)
(4dad22a)</li>
<li>chore(deps): update node.js to v24.14.1 (28db9bc)</li>
<li>chore(deps): update dependency eslint to v10.1.0 (<a
href="https://redirect.github.com/nestjs/schedule/issues/2232">#2232</a>)
(413f390)</li>
<li>chore(deps): update nest monorepo to v11.1.17 (<a
href="https://redirect.github.com/nestjs/schedule/issues/2230">#2230</a>)
(46c2bc5)</li>
<li>chore(deps): update dependency typescript-eslint to v8.57.1 (<a
href="https://redirect.github.com/nestjs/schedule/issues/2231">#2231</a>)
(8fd063b)</li>
<li>chore(deps): update dependency sinon to v21.0.3 (<a
href="https://redirect.github.com/nestjs/schedule/issues/2229">#2229</a>)
(1671ad9)</li>
<li>chore(deps): update commitlint monorepo to v20.5.0 (<a
href="https://redirect.github.com/nestjs/schedule/issues/2228">#2228</a>)
(2ecd2f1)</li>
<li>chore(deps): update dependency lint-staged to v16.4.0 (<a
href="https://redirect.github.com/nestjs/schedule/issues/2227">#2227</a>)
(aa0de01)</li>
<li>chore(deps): update commitlint monorepo to v20.4.4 (<a
href="https://redirect.github.com/nestjs/schedule/issues/2226">#2226</a>)
(75034fe)</li>
<li>chore(deps): update dependency lint-staged to v16.3.3 (<a
href="https://redirect.github.com/nestjs/schedule/issues/2225">#2225</a>)
(f1c7d31)</li>
<li>chore(deps): update dependency jest to v30.3.0 (<a
href="https://redirect.github.com/nestjs/schedule/issues/2224">#2224</a>)
(1a208d4)</li>
<li>chore(deps): update dependency typescript-eslint to v8.57.0 (<a
href="https://redirect.github.com/nestjs/schedule/issues/2223">#2223</a>)
(60dd2c9)</li>
<li>chore(deps): update dependency eslint to v10.0.3 (<a
href="https://redirect.github.com/nestjs/schedule/issues/2221">#2221</a>)
(791b6ba)</li>
<li>chore(deps): update dependency <code>@​eslint/eslintrc</code> to
v3.3.5 (<a
href="https://redirect.github.com/nestjs/schedule/issues/2220">#2220</a>)
(0da1ca7)</li>
<li>chore(deps): update dependency <code>@​types/node</code> to v24.12.0
(<a
href="https://redirect.github.com/nestjs/schedule/issues/2219">#2219</a>)
(934a93e)</li>
<li>chore(deps): update nest monorepo to v11.1.16 (<a
href="https://redirect.github.com/nestjs/schedule/issues/2218">#2218</a>)
(5f44e9b)</li>
<li>chore(deps): update dependency sinon to v21.0.2 (<a
href="https://redirect.github.com/nestjs/schedule/issues/2217">#2217</a>)
(b807746)</li>
<li>chore(deps): update dependency lint-staged to v16.3.2 (<a
href="https://redirect.github.com/nestjs/schedule/issues/2216">#2216</a>)
(4ca32bd)</li>
<li>chore(deps): update commitlint monorepo to v20.4.3 (<a
href="https://redirect.github.com/nestjs/schedule/issues/2215">#2215</a>)
(d3ceb76)</li>
<li>chore(deps): update nest monorepo to v11.1.15 (<a
href="https://redirect.github.com/nestjs/schedule/issues/2214">#2214</a>)
(b084ffc)</li>
<li>chore(deps): update dependency lint-staged to v16.3.1 (<a
href="https://redirect.github.com/nestjs/schedule/issues/2213">#2213</a>)
(8a201b2)</li>
<li>chore(deps): update dependency globals to v17.4.0 (<a
href="https://redirect.github.com/nestjs/schedule/issues/2212">#2212</a>)
(6f61793)</li>
<li>chore(deps): update dependency lint-staged to v16.3.0 (<a
href="https://redirect.github.com/nestjs/schedule/issues/2211">#2211</a>)
(aa9213a)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/nestjs/schedule/commit/059f19678aac04fc4132b1aeaebd7a9ae4f34e30"><code>059f196</code></a>
Merge pull request <a
href="https://redirect.github.com/nestjs/schedule/issues/2249">#2249</a>
from nestjs/renovate/release-it-20.x</li>
<li><a
href="https://github.com/nestjs/schedule/commit/557730ee8b898a0e2b03cdd5b207e176b60f8b1e"><code>557730e</code></a>
Merge pull request <a
href="https://redirect.github.com/nestjs/schedule/issues/2251">#2251</a>
from kyungseopk1m/feat/cron-initial-delay-v2</li>
<li><a
href="https://github.com/nestjs/schedule/commit/14f5b80a16f2ce25c77a2f6de9370705b27a2acb"><code>14f5b80</code></a>
feat(cron): add initialDelay option to defer first job execution</li>
<li><a
href="https://github.com/nestjs/schedule/commit/536367da7d59609b3595d440101fc24aaefb7cb5"><code>536367d</code></a>
chore(deps): update dependency release-it to v20</li>
<li><a
href="https://github.com/nestjs/schedule/commit/57e2861f5e8cf5e9e3a709a2918f478d03e57aa5"><code>57e2861</code></a>
Merge pull request <a
href="https://redirect.github.com/nestjs/schedule/issues/2250">#2250</a>
from nestjs/revert-2247-feat/cron-initial-delay</li>
<li><a
href="https://github.com/nestjs/schedule/commit/e08f457e4bddc83801d7bf0c60aff4a821290c9f"><code>e08f457</code></a>
Revert &quot;feat(cron): add initialDelay option to defer first job
execution&quot;</li>
<li><a
href="https://github.com/nestjs/schedule/commit/3198abea06f82b658b5bc4aa1dee6018c92cf04b"><code>3198abe</code></a>
chore(): release v6.1.2</li>
<li><a
href="https://github.com/nestjs/schedule/commit/a57ce2c329b0662cffd56b16d71fb9da3b84c743"><code>a57ce2c</code></a>
Merge pull request <a
href="https://redirect.github.com/nestjs/schedule/issues/2247">#2247</a>
from kyungseopk1m/feat/cron-initial-delay</li>
<li><a
href="https://github.com/nestjs/schedule/commit/bb3490dde2c3852463f231c3c556dd6d5b3a06d7"><code>bb3490d</code></a>
chore(deps): update dependency prettier to v3.8.3 (<a
href="https://redirect.github.com/nestjs/schedule/issues/2248">#2248</a>)</li>
<li><a
href="https://github.com/nestjs/schedule/commit/1c5677f46f100b03e5ae867306f089ba3381fab0"><code>1c5677f</code></a>
feat(cron): add initialDelay option to defer first job execution</li>
<li>Additional commits viewable in <a
href="https://github.com/nestjs/schedule/compare/6.1.0...6.1.3">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=@nestjs/schedule&package-manager=npm_and_yarn&previous-version=6.1.0&new-version=6.1.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

<!-- This is an auto-generated description by cubic. -->
<a
href="https://cubic.dev/pr/twentyhq/twenty/pull/22112?utm_source=github"
target="_blank" rel="noopener noreferrer"
data-no-image-dialog="true"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source
media="(prefers-color-scheme: light)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img
alt="Review in cubic"
src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a>
<!-- End of auto-generated description by cubic. -->

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-24 18:03:13 +02:00
dependabot[bot] 6a7458f20d chore(deps): bump @e2b/code-interpreter from 2.6.0 to 2.6.1 (#22106) 
Bumps
[@e2b/code-interpreter](https://github.com/e2b-dev/code-interpreter/tree/HEAD/js)
from 2.6.0 to 2.6.1.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/e2b-dev/code-interpreter/commit/fe3e5db60ba8f1b13623289a1b17a6f7e1a18f67"><code>fe3e5db</code></a>
Throw descriptive error when sandbox is killed mid-request (<a
href="https://github.com/e2b-dev/code-interpreter/tree/HEAD/js/issues/291">#291</a>)</li>
<li><a
href="https://github.com/e2b-dev/code-interpreter/commit/efadb49cc87e06766bdb1cc6f33d3c54cd3e2607"><code>efadb49</code></a>
[skip ci] Release new versions</li>
<li>See full diff in <a
href="https://github.com/e2b-dev/code-interpreter/commits/@e2b/code-interpreter@2.6.1/js">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=@e2b/code-interpreter&package-manager=npm_and_yarn&previous-version=2.6.0&new-version=2.6.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

<!-- This is an auto-generated description by cubic. -->
<a
href="https://cubic.dev/pr/twentyhq/twenty/pull/22106?utm_source=github"
target="_blank" rel="noopener noreferrer"
data-no-image-dialog="true"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source
media="(prefers-color-scheme: light)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img
alt="Review in cubic"
src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a>
<!-- End of auto-generated description by cubic. -->

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-24 15:45:33 +00:00
dependabot[bot] e9d67a4bb3 chore(deps-dev): bump @storybook/addon-a11y from 10.4.1 to 10.4.6 (#22103) 
Bumps
[@storybook/addon-a11y](https://github.com/storybookjs/storybook/tree/HEAD/code/addons/a11y)
from 10.4.1 to 10.4.6.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/storybookjs/storybook/releases">@​storybook/addon-a11y's
releases</a>.</em></p>
<blockquote>
<h2>v10.4.6</h2>
<h2>10.4.6</h2>
<ul>
<li>CSF: Allow partial globals overrides in story and meta annotations -
<a
href="https://redirect.github.com/storybookjs/storybook/pull/34985">#34985</a>,
thanks <a
href="https://github.com/TheSeydiCharyyev"><code>@​TheSeydiCharyyev</code></a>!</li>
<li>Dependencies: Upgrade esbuild - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35157">#35157</a>,
thanks <a
href="https://github.com/Kakadus"><code>@​Kakadus</code></a>!</li>
</ul>
<h2>v10.4.5</h2>
<h2>10.4.5</h2>
<ul>
<li>Core: Rework AI checklist feature gate - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35053">#35053</a>,
thanks <a
href="https://github.com/Sidnioulz"><code>@​Sidnioulz</code></a>!</li>
<li>Preview: Stop mixed CSF3+4 stories getting core annotations injected
twice - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35094">#35094</a>,
thanks <a
href="https://github.com/JReinhold"><code>@​JReinhold</code></a>!</li>
</ul>
<h2>v10.4.4</h2>
<h2>10.4.4</h2>
<ul>
<li>Telemetry: Add timeout to event-log POST to prevent build hang - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35085">#35085</a>,
thanks <a
href="https://github.com/badams"><code>@​badams</code></a>!</li>
</ul>
<h2>v10.4.3</h2>
<h2>10.4.3</h2>
<ul>
<li>Addon Docs: Fix Primary and Controls blocks not rendering in custom
MDX pages - <a
href="https://redirect.github.com/storybookjs/storybook/pull/34496">#34496</a>,
thanks <a
href="https://github.com/NYCU-Chung"><code>@​NYCU-Chung</code></a>!</li>
<li>Core: Respect !dev tag on MDX docs in sidebar - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35031">#35031</a>,
thanks <a
href="https://github.com/JReinhold"><code>@​JReinhold</code></a>!</li>
<li>React: Add support for resolving subcomponents attached as
properties of a parent component - <a
href="https://redirect.github.com/storybookjs/storybook/pull/34967">#34967</a>,
thanks <a
href="https://github.com/yatishgoel"><code>@​yatishgoel</code></a>!</li>
<li>UI: Prevent docs page scroll reset on HMR re-render - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35021">#35021</a>,
thanks <a
href="https://github.com/LongTangGithub"><code>@​LongTangGithub</code></a>!</li>
</ul>
<h2>v10.4.2</h2>
<h2>10.4.2</h2>
<ul>
<li>Bug: Fix Windows command resolution for non-Node package managers -
<a
href="https://redirect.github.com/storybookjs/storybook/pull/33534">#33534</a>,
thanks <a
href="https://github.com/copilot-swe-agent"><code>@​copilot-swe-agent</code></a>!</li>
<li>Build: Upgrade type-fest to latest version 5.6.0 - <a
href="https://redirect.github.com/storybookjs/storybook/pull/34791">#34791</a>,
thanks <a
href="https://github.com/tobiasdiez"><code>@​tobiasdiez</code></a>!</li>
<li>CSF: Fix parsing of string literal export names - <a
href="https://redirect.github.com/storybookjs/storybook/pull/34901">#34901</a>,
thanks <a
href="https://github.com/shilman"><code>@​shilman</code></a>!</li>
<li>Publish: Add npm provenance attestations - <a
href="https://redirect.github.com/storybookjs/storybook/pull/34936">#34936</a>,
thanks <a
href="https://github.com/copilot-swe-agent"><code>@​copilot-swe-agent</code></a>!</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/storybookjs/storybook/blob/next/CHANGELOG.md">@​storybook/addon-a11y's
changelog</a>.</em></p>
<blockquote>
<h2>10.4.6</h2>
<ul>
<li>CSF: Allow partial globals overrides in story and meta annotations -
<a
href="https://redirect.github.com/storybookjs/storybook/pull/34985">#34985</a>,
thanks <a
href="https://github.com/TheSeydiCharyyev"><code>@​TheSeydiCharyyev</code></a>!</li>
<li>Dependencies: Upgrade esbuild - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35157">#35157</a>,
thanks <a
href="https://github.com/Kakadus"><code>@​Kakadus</code></a>!</li>
</ul>
<h2>10.4.5</h2>
<ul>
<li>Core: Rework AI checklist feature gate - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35053">#35053</a>,
thanks <a
href="https://github.com/Sidnioulz"><code>@​Sidnioulz</code></a>!</li>
<li>Preview: Stop mixed CSF3+4 stories getting core annotations injected
twice - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35094">#35094</a>,
thanks <a
href="https://github.com/JReinhold"><code>@​JReinhold</code></a>!</li>
</ul>
<h2>10.4.4</h2>
<ul>
<li>Telemetry: Add timeout to event-log POST to prevent build hang - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35085">#35085</a>,
thanks <a
href="https://github.com/badams"><code>@​badams</code></a>!</li>
</ul>
<h2>10.4.3</h2>
<ul>
<li>Addon Docs: Fix Primary and Controls blocks not rendering in custom
MDX pages - <a
href="https://redirect.github.com/storybookjs/storybook/pull/34496">#34496</a>,
thanks <a
href="https://github.com/NYCU-Chung"><code>@​NYCU-Chung</code></a>!</li>
<li>Core: Respect !dev tag on MDX docs in sidebar - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35031">#35031</a>,
thanks <a
href="https://github.com/JReinhold"><code>@​JReinhold</code></a>!</li>
<li>React: Add support for resolving subcomponents attached as
properties of a parent component - <a
href="https://redirect.github.com/storybookjs/storybook/pull/34967">#34967</a>,
thanks <a
href="https://github.com/yatishgoel"><code>@​yatishgoel</code></a>!</li>
<li>UI: Prevent docs page scroll reset on HMR re-render - <a
href="https://redirect.github.com/storybookjs/storybook/pull/35021">#35021</a>,
thanks <a
href="https://github.com/LongTangGithub"><code>@​LongTangGithub</code></a>!</li>
</ul>
<h2>10.4.2</h2>
<ul>
<li>Bug: Fix Windows command resolution for non-Node package managers -
<a
href="https://redirect.github.com/storybookjs/storybook/pull/33534">#33534</a>,
thanks <a
href="https://github.com/copilot-swe-agent"><code>@​copilot-swe-agent</code></a>!</li>
<li>Build: Upgrade type-fest to latest version 5.6.0 - <a
href="https://redirect.github.com/storybookjs/storybook/pull/34791">#34791</a>,
thanks <a
href="https://github.com/tobiasdiez"><code>@​tobiasdiez</code></a>!</li>
<li>CSF: Fix parsing of string literal export names - <a
href="https://redirect.github.com/storybookjs/storybook/pull/34901">#34901</a>,
thanks <a
href="https://github.com/shilman"><code>@​shilman</code></a>!</li>
<li>Publish: Add npm provenance attestations - <a
href="https://redirect.github.com/storybookjs/storybook/pull/34936">#34936</a>,
thanks <a
href="https://github.com/copilot-swe-agent"><code>@​copilot-swe-agent</code></a>!</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/storybookjs/storybook/commit/5496a4270da7f3a8e0203185792685cba671fdc5"><code>5496a42</code></a>
Bump version from &quot;10.4.5&quot; to &quot;10.4.6&quot; [skip
ci]</li>
<li><a
href="https://github.com/storybookjs/storybook/commit/48e7b20074222ed926d14fb6c678c2edfc86ee7b"><code>48e7b20</code></a>
Bump version from &quot;10.4.4&quot; to &quot;10.4.5&quot; [skip
ci]</li>
<li><a
href="https://github.com/storybookjs/storybook/commit/5adebe753f29d414d1e214e935c94d6e5451861f"><code>5adebe7</code></a>
Bump version from &quot;10.4.3&quot; to &quot;10.4.4&quot; [skip
ci]</li>
<li><a
href="https://github.com/storybookjs/storybook/commit/624e6187fd462e56719cbd80c1b4bfb67b68fc89"><code>624e618</code></a>
Bump version from &quot;10.4.2&quot; to &quot;10.4.3&quot; [skip
ci]</li>
<li><a
href="https://github.com/storybookjs/storybook/commit/298dea20c6370e5c670178d88a79fc9e9ff436b2"><code>298dea2</code></a>
Bump version from &quot;10.4.1&quot; to &quot;10.4.2&quot; [skip
ci]</li>
<li>See full diff in <a
href="https://github.com/storybookjs/storybook/commits/v10.4.6/code/addons/a11y">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=@storybook/addon-a11y&package-manager=npm_and_yarn&previous-version=10.4.1&new-version=10.4.6)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

<!-- This is an auto-generated description by cubic. -->
<a
href="https://cubic.dev/pr/twentyhq/twenty/pull/22103?utm_source=github"
target="_blank" rel="noopener noreferrer"
data-no-image-dialog="true"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source
media="(prefers-color-scheme: light)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img
alt="Review in cubic"
src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a>
<!-- End of auto-generated description by cubic. -->

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-24 15:45:11 +00:00
dependabot[bot] fef53b9915 chore(deps): bump react-error-boundary from 4.0.13 to 4.1.2 (#22105) 
Bumps
[react-error-boundary](https://github.com/bvaughn/react-error-boundary)
from 4.0.13 to 4.1.2.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/bvaughn/react-error-boundary/releases">react-error-boundary's
releases</a>.</em></p>
<blockquote>
<h2>4.1.2</h2>
<ul>
<li>Remove <code>engines</code> field from Package JSON entirely</li>
</ul>
<h2>4.1.1</h2>
<ul>
<li>Remove node constraint from engines</li>
</ul>
<h2>4.1.0</h2>
<ul>
<li>Relax fallback prop to support broader ReactNode type</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/bvaughn/react-error-boundary/commit/9688d9f80d47834011dccfa9d1f1377968a4108f"><code>9688d9f</code></a>
4.1.1 -&gt; 4.1.2</li>
<li><a
href="https://github.com/bvaughn/react-error-boundary/commit/8f48596c6702107ad0bffee105ed9eb95c30f869"><code>8f48596</code></a>
Remove engines field</li>
<li><a
href="https://github.com/bvaughn/react-error-boundary/commit/434282742a2f14190aa8c0b27d0d1292d082a914"><code>4342827</code></a>
4.1.0 -&gt; 4.1.1</li>
<li><a
href="https://github.com/bvaughn/react-error-boundary/commit/e3d6eb9962d1a6515756f7af7994302d2cb566c6"><code>e3d6eb9</code></a>
Remove node constraint from engines</li>
<li><a
href="https://github.com/bvaughn/react-error-boundary/commit/defdae05746cb6571152414661e8c78592608465"><code>defdae0</code></a>
style(types.ts): remove unused imports (<a
href="https://redirect.github.com/bvaughn/react-error-boundary/issues/200">#200</a>)</li>
<li><a
href="https://github.com/bvaughn/react-error-boundary/commit/a1e634faef0fc4fd23a731143b5ae6e2c69f8c55"><code>a1e634f</code></a>
chore(package.json): add rimraf (<a
href="https://redirect.github.com/bvaughn/react-error-boundary/issues/199">#199</a>)</li>
<li><a
href="https://github.com/bvaughn/react-error-boundary/commit/96bb33370f9b9f0c9c6f3733a90d55dd7a1c34d2"><code>96bb333</code></a>
4.0.12 -&gt; 4.1.0</li>
<li><a
href="https://github.com/bvaughn/react-error-boundary/commit/206bdbad362737480ebd39cefb945c8cec11c1ce"><code>206bdba</code></a>
Upgrade pnpm v8 -&gt; v9 (<a
href="https://redirect.github.com/bvaughn/react-error-boundary/issues/198">#198</a>)</li>
<li><a
href="https://github.com/bvaughn/react-error-boundary/commit/23167c532dd6da0b8f106ab6ff8705ff64de81eb"><code>23167c5</code></a>
Relax fallback prop to support broader ReactNode type</li>
<li><a
href="https://github.com/bvaughn/react-error-boundary/commit/4aaf9b023a20fbfda67db74bf550124e8bbfa00c"><code>4aaf9b0</code></a>
chore: update CI workflows version to v4 and node version to 20 (<a
href="https://redirect.github.com/bvaughn/react-error-boundary/issues/194">#194</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/bvaughn/react-error-boundary/compare/4.0.13...4.1.2">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=react-error-boundary&package-manager=npm_and_yarn&previous-version=4.0.13&new-version=4.1.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

<!-- This is an auto-generated description by cubic. -->
<a
href="https://cubic.dev/pr/twentyhq/twenty/pull/22105?utm_source=github"
target="_blank" rel="noopener noreferrer"
data-no-image-dialog="true"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source
media="(prefers-color-scheme: light)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img
alt="Review in cubic"
src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a>
<!-- End of auto-generated description by cubic. -->

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-24 15:45:07 +00:00
Abdullah. 20ac0a52bf fix(deps): scope js-yaml to 4.2.0 under the mintlify/verdaccio pinners (#22078) 
## Summary

Resolves [Dependabot alert
#1504](https://github.com/twentyhq/twenty/security/dependabot/1504) —
js-yaml **CVE-2026-53550 / GHSA-h67p-54hq-rp68** (quadratic-complexity
DoS in YAML merge-key handling, vulnerable `<=4.1.1`, fixed `4.2.0`) —
by lifting the vulnerable **js-yaml 4.1.1 → 4.2.0**.

## Why scoped resolutions (not a global pin)

- js-yaml 4.1.1 is held alive by **7 packages that hard-pin it exact**
(no caret, still 4.1.1 in their latest):
`@mintlify/{cli,common,prebuild,previewing,scraping,validation}` +
`@verdaccio/config`. No parent upgrade carries the fix, so each is
scoped to 4.2.0 — matching the repo's `parent/child` convention.
- The 5 alert paths (`@graphql-codegen/cli`, `@lingui/cli`,
`@lingui/vite-plugin`, `@wyw-in-js/vite`, `vite-plugin-svgr`) only
*shared* that 4.1.1 via `cosmiconfig` (`^4.1.0`) — once the exact pins
are lifted, they **dedupe onto 4.2.0 on their own**.
- Forcing 4.1.1 → 4.2.0 is a **safe minor** (same 4.x `.load` API; the
fix just bounds merge-key complexity).

## The js-yaml 3.x remnant (deliberately left)

`front-matter@4.0.2` (via mintlify) and
`@istanbuljs/load-nyc-config@1.1.0` (via storybook coverage) declare
`js-yaml ^3.13.1 → 3.14.2`. **front-matter calls the `safeLoad` API that
js-yaml 4.x removed**, so it cannot take 4.2.0 — a global pin would
break it (which is why this is scoped). That 3.x copy is left in place;
both parse only **first-party trusted YAML** (nycrc + docs
front-matter), so the merge-key DoS isn't reachable. If Dependabot still
flags that 3.x copy, it's a dismiss candidate (no safe transitive fix —
front-matter is EOL on the `safeLoad` API).

## Verification

- `yarn install --immutable` passes.
- No `js-yaml@4.1.1` remains; js-yaml is now `4.2.0` (+ the documented
`3.14.2` remnant).
- Diff is js-yaml-only; matching `"//resolutions"` doc entry included.
 2026-06-24 18:24:00 +05:00
Abdullah. b7cd6db458 fix(deps): resolve qs to 6.15.2 (dedupe caret group + scope body-parser) (#22050) 
## Summary

Closes [Dependabot alert
#1305](https://github.com/twentyhq/twenty/security/dependabot/1305) — qs
**CVE-2026-8723 / GHSA-q8mj-m7cp-5q26** (vulnerable `>=6.11.1 <=6.15.1`,
fixed `6.15.2`) — via two changes:

1. **`yarn dedupe qs`** collapses the caret-range consumers (gitbeaker,
formidable, superagent, googleapis-common, union, body-parser@2.2.2)
from `6.15.0` onto the `6.15.2` already in the tree. Clean, no
resolution.
2. A scoped **`body-parser/qs: 6.15.2`** resolution for the lone
tilde-pinned holdout.

## Why the one resolution

- After the dedupe, the only vulnerable qs left was `6.14.2`, from
**`body-parser@1.20.4`** which declares `qs ~6.14.0` (capped at 6.14.x).
- body-parser **2.x** uses `qs ^6.15.2`, but that needs **express 5** —
and the `body-parser@1.20.4` here comes from **express 4.22.x**, pulled
by `@mintlify/previewing` + verdaccio (build/dev tooling, not bumpable
to express 5).
- So a scoped `body-parser/qs: 6.15.2` is the right fix — qs `6.14 →
6.15` is a compatible minor. It's grouped with the existing `express/qs`
+ `@cypress/request/qs` entries (same CVE, same express-4.x root cause)
in both the `resolutions` block and the `"//resolutions"` doc.

## Verification

- `yarn install --immutable` passes.
- No qs in `[6.11.1, 6.15.1]` remains — all qs is now `6.15.2`.
- `qs` is build/dev tooling here (mintlify, verdaccio, gitbeaker, etc.),
not the production server runtime.
 2026-06-24 08:51:19 +02:00
Etienne 0f4c4e69a9 fix(ai-tool): make search_output a raw-text occurrence search (#22034) 
## Summary

`search_output` (the spilled-output navigation tool) was built around a
JSON-centric, line-based model that breaks for the data it actually
receives. Spilled outputs are written as compact
`JSON.stringify(output)` (single line, escaped newlines), so the tool's
line-by-line matching collapsed to at most one match, and its schema
described searching "the indented JSON representation" even though it
falls back to raw text for non-JSON. It also ran arbitrary,
model-supplied regexes through the native engine with no ReDoS
protection.

This reworks the tool into a `grep -o` style search over the raw file
bytes: it finds every occurrence of a pattern regardless of newlines and
returns a character window around each hit. It works uniformly for
compact/pretty JSON, CSV, HTML, and plain text.

## Changes

- **Occurrence-based matching** (`search-output.util.ts`): search the
raw content for every match via a global-regex `exec` loop (with a
zero-width-match guard), bounded by `offset + maxMatches`. Results are
now `{ charOffset, match, context }` with a character window around each
occurrence and a centered-ellipsis cap for very long single matches. The
line model (`split`, line numbers, line context) is removed.
- **ReDoS hardening**: matching now uses `re2` (already a dependency)
with the global flag, guaranteeing linear-time matching. Unsupported
regex features (lookahead/backreferences) and invalid patterns fall back
to escaped-literal search instead of throwing.
- **No more reserialization** (`search-output-tool.ts`): the
`JSON.stringify(JSON.parse(...))` round-trip is gone; the tool searches
the exact bytes on disk, so there is no coordinate divergence with
`extract_json_paths`.
- **API** (`search-output-tool.schema.ts`): `contextLines` →
`contextChars` (default 100, max 2000); honest descriptions reflecting
raw-text occurrence search and the regex-or-literal fallback. The result
message reports occurrence counts.
- **Cleanup**: removed unused constants
(`default-search-output-context-lines`,
`search-output-max-line-length`); added
`default-search-output-context-chars` and
`search-output-max-match-length`.

`extract_json_paths` and the spill service are untouched.

## Tradeoff

Results use character offsets/windows rather than line numbers and line
context. For an LLM extracting values from a spilled blob this is more
robust (works on single-line content); the cost is no line-based context
for genuinely line-structured content.

## Test plan

- [x] `search-output.util.spec.ts` rewritten for occurrence semantics:
multiple hits on a single newline-free line, zero-width-pattern
termination, catastrophic-backtracking pattern stays fast (RE2),
lookahead/invalid-regex literal fallback, char-window clipping, offset
pagination, long-match truncation. 12/12 pass.
- [x] `npx nx typecheck twenty-server` clean.
- [x] `npx nx lint:diff-with-main twenty-server` clean (lint + format).

## Deploy note

`re2` is a native addon. It was declared in `package.json` but never
imported/built before this PR, so its binary may be absent in some
environments (local install required `npm rebuild re2`). Confirm the
install/build pipeline (CI, Docker images) compiles native modules so
the tool doesn't throw `Cannot find module 're2.node'` at runtime.

<!-- This is an auto-generated description by cubic. -->
<a
href="https://cubic.dev/pr/twentyhq/twenty/pull/22034?utm_source=github"
target="_blank" rel="noopener noreferrer"
data-no-image-dialog="true"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source
media="(prefers-color-scheme: light)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img
alt="Review in cubic"
src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a>
<!-- End of auto-generated description by cubic. -->
 2026-06-23 17:18:46 +00:00
Abdullah. 9c9041c9f9 fix(deps): bump engine.io + socket.io-adapter to drop vulnerable ws 8.17.1 (#22044) 
## Summary

Bumps the transitive **`engine.io`** `6.6.4 → 6.6.9` and
**`socket.io-adapter`** `2.5.5 → 2.5.8` (both within socket.io's
declared ranges — socket.io is pulled by mintlify / react-email build
tooling), which declare `ws ~8.21.0` instead of `~8.17.1`, **evicting
the last vulnerable `ws@8.17.1`**. Resolves two Dependabot alerts:

- [#1502](https://github.com/twentyhq/twenty/security/dependabot/1502)
(high) — GHSA-96hv-2xvq-fx4p, ws memory-exhaustion DoS (`>=8.0.0
<8.21.0`)
- [#1238](https://github.com/twentyhq/twenty/security/dependabot/1238)
(med) — GHSA-58qx-3vcg-4xpx, ws uninitialized memory disclosure
(`>=8.0.0 <8.20.1`)

## Why a parent-bump (not a resolution)

- The only vulnerable ws left was `8.17.1`, pinned by `engine.io@6.6.4`
(`ws ~8.17.1`) and `socket.io-adapter@2.5.5` (`ws ~8.17.1`). (The
earlier koa PR already dropped the dts-plugin `ws@8.18.0`.)
- `engine.io@6.6.9` and `socket.io-adapter@2.5.8` declare `ws ~8.21.0`,
and both bumps are within socket.io's existing ranges — so `yarn up -R`
carries the fix in-range, with no `resolutions` entry to maintain.
- (The pre-existing `@nestjs/graphql/ws: 8.21.0` resolution is unrelated
and untouched.)

## Result

- ws is now `8.21.0` (plus non-vulnerable `7.5.11` / `6.2.4`); nothing
in `[8.0.0, 8.21.0)`.
- `package.json` untouched; engine.io/socket.io are build /
email-preview tooling, not the server runtime.

## Verification

- `yarn install --immutable` passes.
- No vulnerable ws remains in `yarn.lock`; diff is contained to ws /
engine.io / socket.io-adapter (+ a `debug` descriptor cleanup).
 2026-06-23 19:17:15 +02:00
Abdullah. 63e258a85c fix(deps): bump @module-federation/node to drop the koa-pinning 0.21.4 stack (#22032) 
## Summary

Bumps the transitive **`@module-federation/node`** `2.7.23 → 2.7.45`
(within `@nx/module-federation`'s declared `^2.7.21`), which
consolidates the module-federation stack onto `enhanced 2.6.0` and
**prunes the duplicate 0.21.4 sub-stack that pinned koa 3.0.3** —
resolving [Dependabot alert
#547](https://github.com/twentyhq/twenty/security/dependabot/547):
CVE-2026-27959 / GHSA-7gcc-r8m5-44qm (koa Host Header Injection via
`ctx.hostname`, vulnerable `>=3.0.0 <3.1.2`). Lockfile-only, **no
resolution**.

## Why a parent-bump (not a resolution)

- koa 3.0.3 was pinned **exactly** by
`@module-federation/dts-plugin@0.21.4`. Newer dts-plugin (2.5.1, 2.6.0)
**dropped koa entirely**.
- The old 0.21.4 stack survived only because
`@module-federation/node@2.7.23` declared `@module-federation/enhanced:
0.21.4` (a stale internal pin). `@module-federation/node@2.7.45`
declares `enhanced: 2.6.0`, and `@nx/module-federation@22.7.5` already
requires node `^2.7.21` — so 2.7.45 is in range.
- `yarn up -R @module-federation/node` therefore eliminates the
vulnerable dependency honestly, in-range, with no `resolutions` entry to
maintain.

## Result

- `koa@3.0.3` gone, and with it the entire duplicate
`@module-federation/*@0.21.4` stack — **net −678 lines** of lockfile.
- Bonus: the dts-plugin-pinned `ws@8.18.0` dropped too (the remaining
`ws@8.17.1` comes from socket.io/engine.io — a separate, upcoming fix).
- `package.json` untouched. This is **build-tooling** (module-federation
type generation), not the production server runtime.

## Verification

- `yarn install --immutable` passes.
- `koa` is absent from `yarn.lock`; no
`@module-federation/enhanced@0.21.x` remains.
- The bump stays within `@nx/module-federation`'s declared range —
recommend the CI frontend build as the runtime check for the
module-federation tooling.
 2026-06-23 17:49:54 +02:00
Raphaël Bosi 766d90af7e Remove framer-motion from twenty-ui (#22021) 
## What

Removes the `framer-motion` dependency from `twenty-ui` and replaces
every usage with pure CSS animations, reaching for Base UI primitives
where one fits:

- **Collapse/expand** (`AnimatedEaseInOut`,
`AnimatedExpandableContainer`): rebuilt on Base UI `Collapsible`
(CSS-animated `--collapsible-panel-height/width` + transition states).
Public props unchanged, so the ~28 call sites are untouched.
- **ProgressBar**: rebuilt on Base UI `Progress` (proper
`role`/`aria-valuenow`). The snackbar auto-dismiss countdown now uses a
CSS keyframe + `animation-play-state` (pause on hover), removing a
per-frame React re-render; `useProgressAnimation` is deleted.
- The remaining `Animated*` components, the circular spinner, checkmark,
and the placeholder pointer parallax move to plain CSS (SCSS modules +
the `duration()` helper + theme tokens).
- Deletes 3 unused components (`AnimatedTranslation`,
`AnimatedTextWord`, `AnimatedFadeOut`).

## Why

`twenty-ui` is a publicly published library with a size budget, so
dropping framer-motion shrinks what consumers ship. `twenty-front` keeps
its own framer-motion; that is out of scope here.

## Notes for reviewers

- A few `twenty-ui` components received framer props from `twenty-front`
call sites; those were migrated (e.g. `AnimatedLightIconButton` gained a
CSS `rotate` prop, and the `EMPTY_PLACEHOLDER_TRANSITION_PROPS` spreads
were removed).
- Behavior change: Base UI `Collapsible` animates only on open/close
transitions, so the old "animate in on first mount while already open"
case no longer plays (the `initial` prop is kept for API compatibility).

<!-- This is an auto-generated description by cubic. -->
<a
href="https://cubic.dev/pr/twentyhq/twenty/pull/22021?utm_source=github"
target="_blank" rel="noopener noreferrer"
data-no-image-dialog="true"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source
media="(prefers-color-scheme: light)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img
alt="Review in cubic"
src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a>
<!-- End of auto-generated description by cubic. -->
 2026-06-23 17:43:08 +02:00
Abdullah. 11218561d0 fix(deps): pin form-data under nx and zapier-platform-core to 4.0.6 (#22023) 
## Summary

Adds two scoped `resolutions` (`nx/form-data` +
`zapier-platform-core/form-data` → `4.0.6`) forcing the lone vulnerable
`form-data@4.0.5` up to the patched `4.0.6`, resolving [Dependabot alert
#1506](https://github.com/twentyhq/twenty/security/dependabot/1506) —
CVE-2026-12143 / GHSA-hmw2-7cc7-3qxx (CRLF injection via unescaped
multipart field names/filenames, vulnerable `>=4.0.0 <4.0.6`).

## Why scoped resolutions (not a parent-bump)

- `form-data@4.0.5` is pinned **exactly** by `nx@22.7.5` (root devDep)
and `zapier-platform-core@19.0.0` (twenty-zapier) — and **both still pin
4.0.5 in their latest release**, so no parent upgrade carries the fix.
- Every *other* form-data consumer already resolves `4.0.6` naturally
via its `^4.0.x` range, so the two scoped pins simply **dedupe**
nx/zapier's copy onto that existing 4.0.6 — no new copy introduced.
- Scoped, not global, to match the existing `express/qs` +
`@cypress/request/qs` two-entry pattern (only form-data 4.x is in the
tree).

## Changes

- `package.json`: the two `resolutions` entries **plus** a matching
`"//resolutions"` doc entry (advisory, why-no-parent-bump, scope
rationale, drop condition).

## Verification

- `yarn install --immutable` passes.
- No form-data in `[4.0.0, 4.0.6)` remains in `yarn.lock`.
 2026-06-23 19:40:54 +05:00
Raphaël Bosi 293ff4c462 Auto-generate app cover images from the app logo (#22011) 
<img width="1388" height="858" alt="image"
src="https://github.com/user-attachments/assets/59f16bf7-5908-4624-b3af-51416bbebba3"
/>


## What

When an app is built (`twenty build` / `twenty publish`), the SDK now
generates a marketplace cover image and sets it as the app's screenshot,
but only when the app declares a `logoUrl` and has no `screenshots`. The
cover composites the app's logo and the Twenty logo over the branded
halftone backdrop, matching the design reference.

## Why

Most apps ship a logo but no screenshots, so their marketplace detail
page had no hero visual. This gives them a polished cover for free, with
no per-app design work.

## Notes for reviewers

- Generation lives in the build path (`operations/build.ts`), not
`buildManifest`, so `twenty dev` and the shared manifest builder are
untouched. It is best-effort: on failure it logs a warning and the build
continues.
- The cover is written to `.twenty/output` and registered as a public
asset + screenshot, so the existing copy/checksum/serve pipeline handles
it unchanged. No app source files are modified.
- Adds `sharp` as a runtime dependency of `twenty-sdk` (a build-time
tool, like `esbuild`); it is not bundled into built apps.

<!-- This is an auto-generated description by cubic. -->
<a
href="https://cubic.dev/pr/twentyhq/twenty/pull/22011?utm_source=github"
target="_blank" rel="noopener noreferrer"
data-no-image-dialog="true"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source
media="(prefers-color-scheme: light)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img
alt="Review in cubic"
src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a>
<!-- End of auto-generated description by cubic. -->
 2026-06-23 13:41:19 +00:00
Abdullah. 558f2509c2 fix(deps): pin undici under @module-federation/dts-plugin to ^7.28.0 (#22014) 
## Summary

Adds a **scoped** `resolutions` entry pinning `undici` under
`@module-federation/dts-plugin` to `^7.28.0`, resolving **6 Dependabot
alerts** — #1523 & #1566 (high), #1522 & #1570 (medium), #1565 & #1572
(low); all `undici >=7.0.0 <7.28.0`.

## Why a scoped resolution (not a parent-bump or a global pin)

- The vulnerable `undici@7.24.7` is pinned **exactly** by the transitive
build tool `@module-federation/dts-plugin@2.5.1`. There's no parent to
bump — its parents pin it and it doesn't loosen the pin at latest — so a
committed scoped resolution (matching the existing `@nestjs/graphql/ws`,
`express/qs` pattern) is the right fix.
- A **global** `undici` resolution would be wrong: the tree also has
`undici@6.27.0` (`^6.25.0`, outside the advisory) and the latest undici
is `8.5.0`, so forcing all undici to 7.x would break the 6.x consumer.
- `^7.28.0` resolves to `7.28.0` (highest 7.x), which **dedupes** with
the `undici@7.28.0` already in the tree (via `^7.25.0`) — no new copy is
introduced.

## Result

- `undici@7.24.7` is gone; the only undici 7.x is now `7.28.0`.
`undici@6.27.0` (6.x) is untouched.
- Build-tooling dependency (module-federation type generation) — not in
the production server runtime; `undici 7.24 → 7.28` is a compatible
minor bump.

## Verification

- `yarn install --immutable` passes (lockfile consistent with CI).
- No undici in `[7.0.0, 7.28.0)` remains in `yarn.lock`.
 2026-06-23 15:27:12 +02:00
Abdullah. 6520db22ca fix(deps): bump opentelemetry suite to core 2.8.0 (+ sentry 10.59) (#22010) 
## Summary

Bumps the OpenTelemetry suite onto the **`@opentelemetry/core` 2.8.0**
wave (plus Sentry `10.51 → 10.59`, which carries the otel
instrumentation), resolving [Dependabot alert
#1510](https://github.com/twentyhq/twenty/security/dependabot/1510)
(`@opentelemetry/core < 2.8.0`).

## Why a parent-bump, not a `resolutions` entry

The vulnerable `@opentelemetry/core` is transitive, pulled in by the
otel packages we declare (`exporter-metrics-otlp-http`,
`exporter-prometheus`, `sdk-metrics`) **and** by `@sentry/*` (which
bundles `@opentelemetry/instrumentation-*`). The otel **stable**
packages pin `core` to their own exact version and are version-coupled —
forcing `core` ahead of the suite via `resolutions` risks runtime
breakage. So this bumps the declared parents instead.

## Changes

- `twenty-server/package.json`:
  - `@opentelemetry/exporter-metrics-otlp-http` `^0.200.0 → ^0.219.0`
  - `@opentelemetry/exporter-prometheus` `^0.217.0 → ^0.219.0`
  - `@opentelemetry/sdk-metrics` `^2.0.0 → ^2.8.0`
  - `@sentry/{nestjs,node,profiling-node}` `^10.51.0 → ^10.59.0`
- `yarn dedupe` collapses the remaining transitive `core@2.7.1` (caret
consumers) onto `2.8.0` — the whole stable set (`core` / `resources` /
`sdk-trace-base` / `sdk-metrics`) is now `2.8.0`.
- **`@types/pg` added as a direct devDependency.** The newer Sentry
drops the instrumentation that used to *transitively* provide
`@types/pg`; twenty-server imports `pg` directly
(`set-pg-date-type-parser.ts`), so it now declares its own types —
fixing a latent fragility the bump exposed.

## Verification

- `nx typecheck twenty-server` — **0 errors** (validates the otel/sentry
API surface we call is intact).
- `yarn install --immutable` passes.
- No `@opentelemetry/core < 2.8.0` remains.
- Lockfile churn is contained to the observability subtree (otel/sentry
+ their transitive deps; net **−615 lines**).

> Sentry resolved to `10.59.0` rather than the just-published `10.60.0`
due to the repo's `npmMinimalAgeGate`.
> Worth a quick server-boot check during review to confirm Sentry/otel
init at runtime.
 2026-06-23 17:32:41 +05:00
Raphaël Bosi 85406a58fb Use minimal babel presets for wyw to fix the website Cloudflare build (#21994) 
The website's Cloudflare build (`opennextjs-cloudflare` / Turbopack) was
failing with `_defineProperty is not a function` while linaria/wyw
evaluates `twenty-ui/dist/theme.cjs` at build time. It regressed in
#21946, whose twenty-ui build rework changed the emitted `theme.cjs` so
the theme objects ship as runtime object spreads (`{ ...THEME_COMMON
}`).

**Cause:** wyw evaluates modules in Node through `next/babel`, which
pulls in `preset-env` + `transform-runtime`. Those re-lower the runtime
spreads into `@babel/runtime` helpers imported as ESM; wyw then
`require()`s that ESM module in a CJS context where the export is not
callable, so `_defineProperty` fails.

**Fix:** wyw runs in Node and needs no downleveling, so replace
`next/babel` with minimal presets (`@babel/preset-typescript`,
`@babel/preset-react`, `@wyw-in-js/babel-preset`, plus
`@babel/plugin-transform-export-namespace-from`), matching
twenty-front's wyw config. No `@babel/runtime` helpers get injected.
Kept on the website side so twenty-ui keeps react/react-dom as peer deps
(#21946).

Note: no blocking PR check runs the website production build, so this is
best validated via the website preview build or the twenty-infra deploy.
 2026-06-23 13:25:48 +02:00
Etienne 7b45380777 feat(ai): large tool output handling + navigation tools (#21982) 
## Summary

Large tool outputs (e.g. a workflow run that serializes to ~70k tokens)
blow the chat context budget and force per-tool "raw" variants. This PR
handles oversized outputs generically in one place:

1. **Producer:** when a tool result exceeds a byte budget, it is spilled
to a `FileFolder.AgentChat` file and replaced with a compact `{ spilled,
outputRef, shape, hint }` envelope.
2. **Consumer:** two bounded, in-server navigation tools —
`extract_json_path` and `search_output` — let the model dig into the
spilled file by `fileId` without spinning up `code_interpreter`.

Together they add a fast, auditable middle tier between "truncated
inline preview" and "full code_interpreter relay," and enable an
enterprise "restricted" mode (spill + navigation, no sandbox).

## Data flow

```mermaid
flowchart TD
  exec["resolveAndExecute / hydrateToolSet closure"] --> compact[compactToolOutput]
  compact --> enabled{"spillLargeOutput enabled? (chat only)"}
  enabled -->|no| inlineRaw["inline raw (MCP, workflow, sandbox bridge)"]
  enabled -->|yes| size{"bytes > MAX_INLINE_TOOL_OUTPUT_BYTES?"}
  size -->|no| inline["inline result"]
  size -->|yes| skeleton["jsonShapeSkeleton + largeOutputHint"]
  skeleton --> write["writeFile(AgentChat)"]
  write --> envelope["return { spilled, outputRef, shape, hint }"]
  envelope --> model[Model]
  model --> nav["extract_json_path / search_output / code_interpreter (by fileId)"]
```

## Part 1 — Navigation tools (consumer)

- `extract_json_path`: extracts a sub-tree from a spilled JSON file by a
JSONPath-lite expression (dot/bracket access, array slicing,
single-level wildcard), with `maxItems`/`maxDepth` bounding. No filters
or recursive descent — those belong to `code_interpreter`.
- `search_output`: grep-like line search with context lines and
stateless `offset` pagination (`{ matches, totalMatches, hasMore }`).
- Both read from `FileFolder.AgentChat` by `fileId`, enforce their own
output byte cap, and are registered in `ActionToolProvider` (always
available; read-only).

## Part 2 — Spill producer

- Spilling slots in right after the existing `compactToolOutput` step at
the two seams in `ToolRegistryService` (`resolveAndExecute` and the
`hydrateToolSet` execute closure).
- `ToolOutputSpillService.spillIfTooLarge()` measures
`Buffer.byteLength`; over `MAX_INLINE_TOOL_OUTPUT_BYTES` (16 KB ≈ 4k
tokens) it writes the full payload and returns the envelope. Spill
failures never block the call (inline + warning).
- `jsonShapeSkeleton` computes a bounded structural map (depth 4, arrays
as `"array[N] of <type>"`, id-keyed maps collapsed, long leaves as size
markers, hard-capped at 1024 bytes) so the model knows the key paths in
one pass.
- Optional per-tool `largeOutputHint` (on the `Tool` type, threaded via
the descriptor) is used as the hint when present, else a generic hint.
The `shape` is always computed generically.

## Surfaces

Spilling is an opt-in flag (`spillLargeOutput`) mirroring
`compactOutput`:

| Surface | `spillLargeOutput` | Behavior |
| --- | --- | --- |
| AI chat / agent | `true` (in `chat-execution.service.ts`) | Spill on;
nav tools + `code_interpreter` in catalog |
| External MCP clients | unset | Raw output |
| Workflow agents | unset | Raw output |
| `code_interpreter` sandbox bridge | unset (it's an MCP call) | Raw
output |

The sandbox bridge inherits "no spill" for free via the MCP path — no
header sniffing, no `ToolContext.source` field.

## Design constraints (anti-micro-OS)

Exactly two navigation tools, no composition/piping, read-only, bounded
output. The boundary is: expressible as a single path lookup or text
search → nav tool; aggregation/correlation/transform →
`code_interpreter`.

## Notes / deviations from the plan

- `jsonShapeSkeleton` and `ToolOutputSpillService` live under the `tool`
module (not `tool-provider/output-transforms`) to avoid a `tool →
tool-provider` import cycle.
- Spill files use `{ isTemporaryFile: false, toDelete: false }` (same as
`code_interpreter`); `isTemporaryFile` here means files-field promotion,
not a TTL.

## Test plan

- [x] `extract-json-path` + `search-output` util unit tests (23 cases)
- [x] `jsonShapeSkeleton` unit tests (6) and `ToolOutputSpillService`
unit tests (4)
- [x] oxlint + oxfmt clean on changed files; `twenty-server` typecheck
clean (pre-existing unrelated errors aside)
- [ ] Manual: trigger an oversized tool result in chat, confirm the
envelope is returned and `extract_json_path` / `search_output` read the
spilled file by `fileId`

## Why no automated e2e

Spilling is chat-only and the chat path runs a live model, so the
black-box MCP integration harness can't deterministically trigger a
spill (MCP intentionally doesn't spill). The seam is small, explicit
flag-threading mirrored on `compactOutput`, covered by the unit suites.

<!-- This is an auto-generated description by cubic. -->
<a
href="https://cubic.dev/pr/twentyhq/twenty/pull/21982?utm_source=github"
target="_blank" rel="noopener noreferrer"
data-no-image-dialog="true"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source
media="(prefers-color-scheme: light)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img
alt="Review in cubic"
src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a>
<!-- End of auto-generated description by cubic. -->
 2026-06-23 10:46:06 +00:00
Abdullah. 84f4ac9082 fix(deps): dedupe esbuild to 0.28.1 (#21993) 
## Summary

Dedupes the transitive **esbuild** so the lone `^0.28.0 → 0.28.0` copy
collapses onto the existing `0.28.1`, resolving [Dependabot alert
#1438](https://github.com/twentyhq/twenty/security/dependabot/1438)
(vulnerable range `>=0.27.3 <0.28.1`).

## Details

- `esbuild@^0.28.0` was resolving to `0.28.0`; `0.28.1` is already in
the tree (via `^0.28.1` + existing scoped `esbuild` resolutions), so
`yarn dedupe esbuild` collapses the `^0.28.0` descriptor onto `0.28.1` —
**lockfile-only**, no `package.json` change and no `resolutions` entry.
- The large line count is esbuild's ~25 platform-binary subpackages
(`@esbuild/*@0.28.0`) being pruned as orphans. The diff is
**esbuild-only** (28 removed keys, all `esbuild`/`@esbuild/*`).
- Untouched: `esbuild@0.25.5` and `~0.27.0 → 0.27.2` are outside the
advisory range (`<0.27.3`).

## Verification

- `yarn install --immutable` passes (lockfile consistent with CI).
- No esbuild in `[0.27.3, 0.28.1)` remains in `yarn.lock`.
 2026-06-23 10:29:10 +02:00
Abdullah. ec3b9beae5 fix(deps): bump http-proxy-middleware to 2.0.10 (#21992) 
## Summary

Bumps the transitive **http-proxy-middleware** `2.0.9` → `2.0.10`,
resolving [Dependabot alert
#1574](https://github.com/twentyhq/twenty/security/dependabot/1574)
(vulnerable range `>=0.16.0 <2.0.10`).

## Details

- The parent's `^2.0.9` range already permits the fix, so this is a
**lockfile-only** bump (`yarn up -R http-proxy-middleware`) — no
`package.json` change and no `resolutions` entry needed.
- The unrelated `http-proxy-middleware@^3.0.5 → 3.0.7` is outside the
advisory range and untouched.
- Transitive **build-tooling** dependency — not part of the production
server runtime; patch-level security fix.

## Verification

- `yarn install --immutable` passes (lockfile consistent with CI).
- No `2.0.9` remnant remains in `yarn.lock`.
 2026-06-23 10:17:57 +02:00
Charles Bochet a884945aca fix(deps): remediate HIGH image vulns (multer, ws, nodemailer) (#21984) 
## What

Clears the HIGH-severity AWS Inspector findings on the `twenty-server`
container image. All three have stable, in-range fixes — no prereleases.

| Package | From → To | CVE | Path |
|---------|-----------|-----|------|
| multer | 2.1.1 → **2.2.0** (resolution) | CVE-2026-5038, CVE-2026-5079
(DoS) | transitive via `@nestjs/platform-express` |
| ws | 8.20.1 → **8.21.0** (resolution) | CVE-2026-48779 | pinned by
`@nestjs/graphql` (8.21.0 already in tree) |
| nodemailer | 8.0.10 → **9.0.1** | GHSA-p6gq-j5cr-w38f | nested in
`imapflow`; bumped `imapflow` 1.3.6 → 1.4.2 which depends on nodemailer
9.0.1 |

## Notes

- **multer 2.2.0 is the stable fix.** The advisories
([CVE-2026-5038](https://advisories.gitlab.com/npm/multer/CVE-2026-5038/),
[CVE-2026-5079](https://advisories.gitlab.com/npm/multer/CVE-2026-5079/))
list both `2.2.0` and `3.0.0-alpha.2` as fixed; Inspector reported only
the `3.0.0-alpha.2` prerelease, but we stay on the stable 2.x line.
- **nodemailer:** the top-level dep was already `^9.0.1`; only
`imapflow`'s nested copy was stale. imapflow 1.4.0 still ships
nodemailer 8.0.10 and 1.4.1 ships 9.0.0 (< the 9.0.1 fix), so **1.4.2 is
the minimum** that pulls the patched nodemailer.
- Lockfile-only resolution for multer/ws (they're transitive); imapflow
is a direct dep bump. yarn.lock net-shrinks from deduping.

<!-- This is an auto-generated description by cubic. -->
<a
href="https://cubic.dev/pr/twentyhq/twenty/pull/21984?utm_source=github"
target="_blank" rel="noopener noreferrer"
data-no-image-dialog="true"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source
media="(prefers-color-scheme: light)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img
alt="Review in cubic"
src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a>
<!-- End of auto-generated description by cubic. -->
 2026-06-23 00:54:46 +02:00
Raphaël Bosi 8553c574db Improve twenty-ui packaging for standalone publishing (#21946) 
Quick packaging wins to move twenty-ui closer to a standalone
publishable library.

- Move `react`/`react-dom` to `peerDependencies` (`^19.0.0`) so
consumers provide a single React and we avoid duplicate-React bugs. They
stay in `devDependencies` for the in-repo build, and `vite.config.ts`
now derives the Rollup `external` list from peer deps too so React stays
externalized instead of bundled.
- Declare `type-fest` in `dependencies`. It was a phantom dep (resolved
only via root hoisting) and its types are referenced by the emitted
json-visualizer `.d.ts`, so standalone consumers need it.
- Move build-only `glob` to `devDependencies` and add `typescript` (both
used only by `generateBarrels.ts`).
- Make `tsconfig.json` self-contained by inlining the base compiler
options, and point the Vite `cacheDir`/`optimizeDeps.exclude` at
package-local paths.

Verified: typecheck, build (React confirmed externalized in `dist`, not
inlined), dts emission, and unit tests all pass.

<!-- This is an auto-generated description by cubic. -->
<a
href="https://cubic.dev/pr/twentyhq/twenty/pull/21946?utm_source=github"
target="_blank" rel="noopener noreferrer"
data-no-image-dialog="true"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source
media="(prefers-color-scheme: light)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img
alt="Review in cubic"
src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a>
<!-- End of auto-generated description by cubic. -->
 2026-06-22 15:09:25 +00:00
Abdullah. c171c62099 chore(twenty-server): upgrade typeorm to 0.3.29 (#21957) 
## Summary

Upgrades **typeorm `0.3.26` → `0.3.29`** and adapts the twenty-orm
`update`/`upsert` overrides to typeorm's newly-added
`options.returning`. Upgrading to resolve
[this](https://github.com/twentyhq/twenty/security/dependabot/1573)
alert.

## Why

`0.3.29` is the latest release compatible with
`@ptc-org/nestjs-query-typeorm` (peers `typeorm@^0.3.15`; the `1.x` line
has no compatible release, so it's blocked until that dependency moves).

## Changes

**`chore` — bump**
- `typeorm` patch descriptor `0.3.26 → 0.3.29` + `yarn.lock`.
- Local patch carried over **unchanged** (pure rename) — both hunks
(`PickKeysByType` nullable-awareness, `DeleteResult.generatedMaps`) are
still absent upstream in `0.3.29`, so it remains load-bearing.

**`refactor` — adapt overrides**
- `0.3.29` adds `options?: UpdateOptions` (carrying `returning`) to
`EntityManager`/`Repository` `update()`. The override must accept it at
the base-mandated position, so it's added as its **own dedicated
parameter** (not hidden inside `permissionOptions`), honoring
`options.returning` with a fallback to Twenty's permission-aware
`selectedColumns` (`'*'` default).
- The same merge is applied to `upsert()`, which already received
`UpsertOptions` but was dropping its `returning` field — so both write
methods now treat the option identically.
- Internal call sites + specs updated for the new parameter slot.

## Verification

- `nx typecheck twenty-server` — **0 errors**
- twenty-orm unit tests — **191 / 191 pass**
- `oxlint` / `oxfmt` — clean
 2026-06-22 16:08:09 +02:00
Raphaël Bosi e0fadfee7c Remove jotai from twenty-ui (#21937) 
twenty-ui no longer depends on jotai, so its components work without a
consumer-provided jotai store (better practice for a shared UI library).
twenty-front keeps jotai; this is scoped to the library.

- **Avatar**: tracks image-load failure in local `useState` instead of a
global atom.
- **Icons**: the icon registry moved from a jotai atom to a React
Context. `IconsProvider` and `useIcons` keep identical signatures; the
context itself stays internal.
- Removed the unused `createState` helper, the `invalidAvatarUrlsAtomV2`
/ `iconsState` atoms, and `JotaiRootDecorator`; regenerated barrels and
dropped the `jotai` dependency.

No other package needs changes: nothing imports the removed symbols, and
`twenty-sdk` (which re-exports twenty-ui via `export *`) simply stops
surfacing the two leaked atoms on its next publish.

<!-- This is an auto-generated description by cubic. -->
<a
href="https://cubic.dev/pr/twentyhq/twenty/pull/21937?utm_source=github"
target="_blank" rel="noopener noreferrer"
data-no-image-dialog="true"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source
media="(prefers-color-scheme: light)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img
alt="Review in cubic"
src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a>
<!-- End of auto-generated description by cubic. -->
 2026-06-22 13:33:32 +02:00
Abdullah. c8813c3b6a fix(security): drop vulnerable postcss via styled-components bump (XSS) (#21932) 
## fix(security): drop vulnerable postcss via styled-components bump
(XSS)

Resolves [Dependabot Alert
#1061](https://github.com/twentyhq/twenty/security/dependabot/1061).

### What

`postcss` `< 8.5.10` is affected by **XSS via an unescaped `</style>` in
its CSS stringify output** (Moderate). Patched in `8.5.10`.

### How — parent-bump, no resolution

The only consumer of the vulnerable `postcss@8.4.49` (exact-pinned) was
`styled-components`, which **dropped the postcss dependency in 6.4.0**.
This bumps `styled-components` `6.1.15`/`6.3.12 -> 6.4.2` within the
existing `^6.1.0` / `^6.1.11` ranges (a minor bump within v6) — removing
`postcss@8.4.49` from the tree **entirely**. The remaining postcss
copies are `8.5.14` / `8.5.15` (both `>= 8.5.10`). No `resolutions`
override.

### Verification

- No `postcss < 8.5.10` resolution remains.
- `styled-components` is not imported directly in twenty-front (used via
`twenty-front-component-renderer` + `@cyntler/react-doc-viewer`);
`typecheck twenty-front-component-renderer` passes.
- Lockfile-only change (styled-components family); `yarn install
--immutable` passes.
 2026-06-22 14:02:44 +05:00
Abdullah. bb12f426fd fix(security): bump react-router to 6.30.4 via react-router-dom (open redirect) (#21931) 
## fix(security): bump react-router to 6.30.4 via react-router-dom (open
redirect)

Resolves [Dependabot Alert
#1382](https://github.com/twentyhq/twenty/security/dependabot/1382).

### What

`react-router` `>= 6.7.0, < 6.30.4` has an **open redirect**: a
same-origin redirect with a path starting `//` is reinterpreted as a
protocol-relative URL (Moderate). Patched in `6.30.4`.

### How — parent-bump, no resolution

`react-router` is exact-pinned by `react-router-dom`, which is our
**direct** dependency (`^6.4.4` in twenty-front/ui/shared).
`react-router-dom 6.30.4` pins `react-router 6.30.4`, and our range
already permits it — so this refreshes `react-router-dom 6.30.3 ->
6.30.4` within range (and its internal `@remix-run/router` 1.23.2 ->
1.23.3). No `resolutions` override.

### Verification

- No `react-router`/`react-router-dom` `< 6.30.4` resolution remains.
- Patch-level bump; `typecheck twenty-front` passes.
- Lockfile-only change (react-router family only); `yarn install
--immutable` passes.
 2026-06-22 10:55:02 +02:00
Abdullah. 6ae2170744 chore(deps): bump wrangler to 4.102.0 and drop the wrangler/esbuild resolution (#21930) 
## chore(deps): bump wrangler to 4.102.0 and drop the `wrangler/esbuild`
resolution

Removes a now-redundant `resolutions` override (resolution **cleanup**,
identified by the resolutions audit). It does not close a Dependabot
alert — esbuild stays at `0.28.1` either way — but reduces the standing
override count by one, per the `//resolutions` policy of dropping each
entry once its parent ships a fixed range.

### What

The `wrangler/esbuild: 0.28.1` resolution existed because `wrangler`
exact-pinned a vulnerable esbuild (`0.27.3`). **wrangler 4.102.0 now
ships esbuild `0.28.1` natively**, and our workspaces declare `wrangler
^4.0.0`, so it resolves to the safe version on its own.

### How — parent-bump, then drop the override

- Bumped `wrangler` within `^4.0.0` to `4.102.0` (lockfile-only).
- Removed the `wrangler/esbuild` entry from `resolutions`.
- Updated the `//resolutions` doc: moved wrangler to the "fixed by
parent-bump" list and decremented the esbuild counts (seven → six
resolutions; six → five exact-pin parents).

### Verification

- No `esbuild 0.27.3` regression (wrangler 4.102.0 pins `0.28.1`); the
remaining six esbuild resolutions are unchanged.
- `//resolutions` doc is consistent with the `resolutions` object.
- Lockfile + package.json only; `yarn install --immutable` passes.
 2026-06-22 10:26:15 +02:00
Abdullah. e90fb4b55c fix(security): bump dompurify to 3.4.11 (config/hook pollution) (#21905) 
## fix(security): bump dompurify to 3.4.11 (config/hook pollution)

Resolves [Dependabot Alert
#1520](https://github.com/twentyhq/twenty/security/dependabot/1520) and
[#1509](https://github.com/twentyhq/twenty/security/dependabot/1509).

### What

`dompurify` is affected by:
- **Permanent `ALLOWED_ATTR` pollution via `setConfig()`**
([#1520](https://github.com/twentyhq/twenty/security/dependabot/1520),
Moderate, `<= 3.4.10`)
- **Trusted Types policy survives `clearConfig()`**
([#1509](https://github.com/twentyhq/twenty/security/dependabot/1509),
Low, `< 3.4.9`)

Both patched in `3.4.11`. Bumps the direct `twenty-server` dep `^3.4.0
-> ^3.4.11`.

### Compatibility

Both advisories are about config/hook state pollution via
`setConfig`/`clearConfig`/hooks. All four of our call sites use plain
`DOMPurify(window).sanitize(...)` with **default config** — no
`setConfig`, `clearConfig`, `addHook`, `ALLOWED_ATTR`, or
`RETURN_TRUSTED_TYPE` — so we are not on the affected path, and the fix
does not change default-`sanitize` behavior.

Verification: `typecheck twenty-server` passes; the
`prepare-file-for-storage`, `create-html-to-text-converter`, and
`email-composer` suites pass (28 tests).

### Verification

- `dompurify` resolves to `3.4.11` (no `<= 3.4.10` remains).
- Lockfile + single package.json pin change; `yarn install --immutable`
passes.
 2026-06-21 15:05:17 +02:00
Abdullah. d74b6aeadf fix(security): bump nodemailer to 9.0.1 (raw-option SSRF / file read) (#21903) 
## fix(security): bump nodemailer to 9.0.1 (raw-option SSRF / file read)

Resolves [Dependabot Alert
#1518](https://github.com/twentyhq/twenty/security/dependabot/1518) and
[#1519](https://github.com/twentyhq/twenty/security/dependabot/1519).

### What

`nodemailer` `<= 9.0.0` lets the message-level `raw` option bypass
`disableFileAccess`/`disableUrlAccess`, enabling **arbitrary file read**
and **full-response SSRF** in the delivered message ([GHSA
advisory](https://github.com/twentyhq/twenty/security/dependabot/1518),
High). Patched in `9.0.1`.

### How — direct bump, no resolution

- **twenty-server:** `nodemailer ^8.0.5 -> ^9.0.1` (major bump).
- **seed-dependencies:** the application-package template `nodemailer
^8.0.5 -> ^9.0.1`; both `DEFAULT_PACKAGE_JSON_CHECKSUM` and
`DEFAULT_YARN_LOCK_CHECKSUM` regenerated to match the recomputed seed
files (the deps-layer cache key).

### Compatibility — verified nothing breaks

It is a major upgrade, so the 9.0 breaking change was checked against
the current tree. The only behavior change is **stricter TLS validation
when nodemailer fetches remote content** (attachment `href`/`path` URLs,
built-in OAuth2 token endpoints, HTTP/HTTPS proxy `CONNECT`). None of
those paths are reachable here:
- Attachments are passed as **content buffers**, never `path`/`href`.
- Gmail OAuth uses **googleapis**, not nodemailer's built-in OAuth2.
- No proxy on any transport.
- The SMTP socket TLS is governed separately (unchanged).

Verification: `typecheck twenty-server` passes (with `@types/nodemailer
^7.0.3`), and the `email-sender`, `gmail-message-outbound`, and
`imap-smtp-caldav-connection` suites pass (10 tests).

### Not covered (follow-up)

Root alert **#1521** will stay open: `imapflow@1.3.6` exact-pins
`nodemailer@8.0.10`. The clean fix is `imapflow 1.4.2` (which pins
nodemailer `9.0.1`), but it published 2026-06-19 and is **age-gated
until ~2026-06-22** — it will land then as a parent-bump (no
resolution).

### Verification

- `nodemailer` resolves to `9.0.1` for twenty-server; seed lockfile has
`9.0.1`; both seed checksums match the canonical recompute.
- `yarn install --immutable` passes.
 2026-06-21 15:05:00 +02:00
Abdullah. a658a8dbb4 fix(security): bump socks to clear vulnerable ip-address (XSS) (#21872) 2026-06-19 19:17:34 +02:00
Abdullah. 8899360ebe fix(security): refresh undici across lockfiles (6.x → 6.27.0, 7.x → 7.28.0) (#21870) 2026-06-19 19:15:47 +02:00
Abdullah. bf2ff5899e fix(security): drop vulnerable serialize-javascript via terser-webpack-plugin bump (#21871) 
## fix(security): drop vulnerable serialize-javascript via
terser-webpack-plugin bump

Resolves [Dependabot Alert
#548](https://github.com/twentyhq/twenty/security/dependabot/548) and
[#1290](https://github.com/twentyhq/twenty/security/dependabot/1290).

### What

`serialize-javascript` `< 7.0.5` is affected by:
- **RCE via `RegExp.flags` / `Date.prototype.toISOString`**
([#548](https://github.com/twentyhq/twenty/security/dependabot/548),
High)
- **CPU-exhaustion DoS via crafted array-like objects**
([#1290](https://github.com/twentyhq/twenty/security/dependabot/1290),
Moderate)

### How — parent-bump, no resolution

The only consumer of the vulnerable `serialize-javascript@^6.0.2` in the
tree was `terser-webpack-plugin`, which **removed the
`serialize-javascript` dependency in 5.4.0**. This bumps
`terser-webpack-plugin` `5.3.16 -> 5.6.1` within its existing `^5.3.16`
range — an in-range parent-bump that drops `serialize-javascript` from
the tree **entirely** (preferred over a `resolutions` override).

### Verification

- `serialize-javascript` no longer resolves anywhere in the tree (both
the vulnerable `6.0.2` and the prior `7.0.5` copies are gone).
- `terser-webpack-plugin` is dev/build tooling (webpack minification),
not imported in our source.
- Lockfile-only change (net −22 lines); `yarn install --immutable`
passes.
 2026-06-19 22:05:52 +05:00
Félix Malfait adf6eb572b feat(billing): embed Stripe Payment Element in onboarding (#21759) 
## What & why

Replaces the hosted Stripe Checkout redirect on the onboarding "Choose
your plan" step (credit-card trial) with an inline Stripe **Payment
Element**, so users never leave the app to enter card details.

## How it works

- **Frontend:** a deferred `<Elements mode="setup">` renders the Payment
Element, themed via the Appearance API. On Continue: `elements.submit()`
→ `checkoutSession` mutation creates the trialing subscription
server-side and returns its pending SetupIntent `clientSecret` →
`stripe.confirmSetup()` confirms the card (handling 3DS) → redirect to
the existing `/plan-required/payment-success`.
- **Backend:** new `BILLING_STRIPE_PUBLISHABLE_KEY` config var exposed
via `/client-config`; the card path creates the subscription with
`payment_behavior: default_incomplete` + a free trial (so Stripe
attaches a `pending_setup_intent`) and returns its client secret. The
hosted-Checkout code path is removed.
- The **no-credit-card** trial path is unchanged.
- Billing address collection is **disabled** in the Payment Element to
reduce friction; `automatic_tax` is correspondingly disabled (tax needs
an address — collect it later, e.g. at conversion / via the billing
portal).

## Required before this works
1. Set `BILLING_STRIPE_PUBLISHABLE_KEY` (`pk_…`) on the server (infra
change pending).
2. Run `nx run twenty-front:graphql:generate --configuration=metadata`
against a server exposing the updated schema (see inline note on the
hand-authored document).
3. Verify in Stripe test mode: happy path, 3DS (`4000 0025 0000 3155`),
a decline.

## Verified
typecheck (front + server), oxlint + oxfmt clean,
`client-config.service.spec` passing. Not run here: the app end-to-end /
Stripe test mode and `graphql:generate` (no server/DB in the dev
container).

I've left self-review comments inline flagging cleanup opportunities
plus a couple of architectural/tech-debt items.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_01TxCfinXq7abSrbF7aTw2cA

---
_Generated by [Claude
Code](https://claude.ai/code/session_01TxCfinXq7abSrbF7aTw2cA)_

<!-- This is an auto-generated description by cubic. -->
<a
href="https://cubic.dev/pr/twentyhq/twenty/pull/21759?utm_source=github"
target="_blank" rel="noopener noreferrer"
data-no-image-dialog="true"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source
media="(prefers-color-scheme: light)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img
alt="Review in cubic"
src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a>
<!-- End of auto-generated description by cubic. -->

---------

Co-authored-by: Claude <noreply@anthropic.com>
 2026-06-19 11:40:55 +02:00
Abdullah. 569d887d1e [Website] Cut over to the rebuilt site (#21825) 
Renaming the package so any further PRs directed to the website are
targeted to the reworked code instead of diverging. Once merged, I will
start preparing this for deployment to dev to test before releasing to
prod. Any improvements will also be applied to this package.

I avoided making significant changes to API routes so nothing breaks,
but will test it thoroughly today to confirm. That said, everything is
ported - double checked.

Big diff PR, impossible to review, but last one! No more rebuilds.
 2026-06-19 10:22:46 +02:00
Abdullah. ba7b435885 fix(security): bump webpack-dev-server resolution to 5.2.5 (HMR WS interception) (#21818) 
## fix(security): bump webpack-dev-server resolution to 5.2.5 (HMR WS
interception)

Resolves [Dependabot Alert
#1514](https://github.com/twentyhq/twenty/security/dependabot/1514).

### What

`webpack-dev-server` `< 5.2.5` is affected by
[GHSA-mx8g-39q3-5c79](https://github.com/advisories/GHSA-mx8g-39q3-5c79)
(**Moderate**) — HMR WebSocket interception via permissive user proxies.
Patched in `5.2.5`.

### How

`webpack-dev-server` is already force-resolved via a scoped
`resolutions` entry: its sole consumer `@electron-forge/plugin-webpack`
(latest 7.11.2 / 8.x alphas) still declares `webpack-dev-server ^4`, so
the resolution evicts the vulnerable 4.x line up to 5.x. The
newly-disclosed CVE affects the pinned `5.2.4`, so this **bumps the
existing scoped resolution `5.2.4 -> 5.2.5`** and updates its
`//resolutions` doc line — extending an already-documented, load-bearing
entry rather than adding a new one.

**Still-required check:** `@electron-forge/plugin-webpack` still
declares `^4`, so the resolution remains necessary (removing it would
regress to vulnerable 4.x).

### Verification

- `webpack-dev-server` resolves to a single `5.2.5` bucket; no `< 5.2.5`
remains.
- Not imported in our source (electron-forge build tooling only).
- `yarn install --immutable` passes.

Co-authored-by: Charles Bochet <charles@twenty.com>
 2026-06-19 07:17:23 +00:00
Abdullah. 2169e15162 fix(security): patch yaml across both major lines (stack overflow) (#21817) 
## fix(security): patch yaml across both major lines (stack overflow)

Resolves [Dependabot Alert
#734](https://github.com/twentyhq/twenty/security/dependabot/734) and
[#697](https://github.com/twentyhq/twenty/security/dependabot/697).

### What

`yaml` is affected by
[GHSA-48c2-rrv3-qjmp](https://github.com/advisories/GHSA-48c2-rrv3-qjmp)
(**Moderate**) — stack overflow via deeply nested YAML collections —
across two major lines:
- **2.x** (`>= 2.0.0, < 2.8.3`, patched `2.8.3`) — alert #734 (runtime).
- **1.x** (`>= 1.0.0, < 1.10.3`, patched `1.10.3`) — alert #697 (dev,
auto-dismissed).

### How

Both vulnerable copies are transitive, and `yaml` is not imported in our
source:
- **2.x:** the `2.8.1` bucket (`^2.0.0` / `^2.4.5`, via `vfile-matter` /
`@mintlify/openapi-parser`) is deduped into the safe `2.9.0` already in
the tree.
- **1.x:** the `1.10.2` bucket (`^1.10.0`, via `cosmiconfig@^7.0.0`) is
refreshed to `1.10.3`.

Both move within ranges the parents already declared — no `resolutions`
override.

### Verification

- No `yaml` `1.x < 1.10.3` or `2.x < 2.8.3` resolution remains.
- `yaml` is not imported in our source (transitive only).
- Lockfile-only change; `yarn install --immutable` passes.
 2026-06-19 08:50:17 +02:00
Abdullah. ebdf77075a fix(security): dedupe uuid to 11.1.1 (missing buffer bounds check) (#21815) 
## fix(security): dedupe uuid to 11.1.1 (missing buffer bounds check)

Resolves [Dependabot Alert
#1289](https://github.com/twentyhq/twenty/security/dependabot/1289).

### What

`uuid` `< 11.1.1` is affected by
[GHSA-w5hq-g745-h8pq](https://github.com/advisories/GHSA-w5hq-g745-h8pq)
(**Moderate**) — a missing buffer bounds check in `v3`/`v5`/`v6` when a
`buf` argument is provided. Patched in `11.1.1`.

### How

The only vulnerable copy was a transitive `11.1.0` bucket pinned via
`^11.1.0` by `typeorm@0.3.26` and `@recallai/desktop-sdk` — both ranges
already permit `11.1.1`, and a `11.1.1` bucket already existed (our own
packages resolve there). `yarn dedupe uuid` collapses the `^11.1.0`
descriptor into the existing `11.1.1` resolution, removing the
vulnerable copy. No `resolutions` override; the unrelated `13.x` bucket
is left untouched.

### Verification

- No `uuid < 11.1.1` resolution remains.
- Our packages already resolved to `11.1.1`, so compiled output is
unaffected (the change only lifts the transitive `typeorm`/`@recallai`
copy).
- Lockfile-only change (net −9 lines); `yarn install --immutable`
passes.
 2026-06-19 08:49:46 +02:00
Abdullah. 6bbd070172 fix(security): bump markdown-it to 14.2.0 (smartquotes ReDoS) (#21814) 
## fix(security): bump markdown-it to 14.2.0 (smartquotes ReDoS)

Resolves [Dependabot Alert
#1511](https://github.com/twentyhq/twenty/security/dependabot/1511).

### What

`markdown-it` `<= 14.1.1` is affected by
[GHSA-6v5v-wf23-fmfq](https://github.com/advisories/GHSA-6v5v-wf23-fmfq)
(**Moderate**) — quadratic-complexity DoS in the smartquotes rule via
`replaceAt` string operations. Patched in `14.2.0`.

### How

`markdown-it` is pulled transitively by `@graphiql/react` (`^14.1.0`)
and `prosemirror-markdown` (`^14.0.0`), both of which already permit
`14.2.0`. This refreshes the lockfile resolution `14.1.1 -> 14.2.0`
within the existing range — no `resolutions` override. It is **not**
imported in our source, and the fix is internal to the smartquotes rule
(no public API change).

### Verification

- `markdown-it` resolves to `14.2.0`; no `<= 14.1.1` copy remains.
- Diff limited to `markdown-it` + its own `linkify-it` dep bump.
- Lockfile-only change; `yarn install --immutable` passes.
 2026-06-19 08:49:27 +02:00
Abdullah. bebe03e453 fix(security): bump tar to 7.5.16 across lockfiles (PAX file smuggling) (#21813) 
## fix(security): bump tar to 7.5.16 across lockfiles (PAX file
smuggling)

Resolves [#1472 1474 1476 1479 1481 1483 1485 1487 1489 1491 1493 1496
1498 1505](https://github.com/twentyhq/twenty/security/dependabot/1472
1474 1476 1479 1481 1483 1485 1487 1489 1491 1493 1496 1498 1505).

### What

`tar` (`node-tar`) `<= 7.5.15` applies a PAX size override to
intermediary GNU long-name/long-link headers, causing a tar-parser
interpretation differential (file smuggling). Patched in `7.5.16`.

### Why these alerts

The advisory is scanned across many independent Yarn projects, so it
surfaced as one alert per lockfile: the root `yarn.lock` plus 13
`packages/twenty-apps/**` lockfiles (each pulls `tar` transitively).

### How

- Refreshed `tar` to `7.5.16` in the root and all 13 app lockfiles —
they hold `tar` via `^7.5.x` ranges that already permit it, so this is
an in-range lockfile refresh (no override) via `yarn up -R tar`.
- The root additionally had `tar@7.5.15` exact-pinned by
`@mintlify/previewing`, which has **no upstream fix** (latest `4.0.1163`
still pins `7.5.15`). Added a scoped resolution
`@mintlify/previewing/tar -> ^7.5.16`, **extending the existing scoped
tar resolutions** already used for `@electron/rebuild` and
`@electron/node-gyp`.

### Not included

`seed-dependencies/yarn.lock` (alert #1500) is intentionally excluded:
that lockfile and its checksum constants are already modified by the
open form-data PR, so its `tar` bump will follow separately to avoid a
conflict.

### Verification

- No `tar <= 7.5.15` remains across the root or any app lockfile.
- `yarn install --immutable` passes.
 2026-06-19 08:49:07 +02:00
Abdullah. e2df785aec fix(security): bump http-proxy-middleware to 3.0.7 (multipart field injection) (#21812) 
## fix(security): bump http-proxy-middleware to 3.0.7 (multipart field
injection)

Resolves [Dependabot Alert
#1517](https://github.com/twentyhq/twenty/security/dependabot/1517).

### What

`http-proxy-middleware` `3.0.4 – 3.0.6` is affected by
[GHSA-gcq2-9pq2-cxqm](https://github.com/advisories/GHSA-gcq2-9pq2-cxqm)
(**High**) — multipart/form-data field injection via unescaped CRLF in
`fixRequestBody`. Patched in `3.0.7` for the 3.x line.

### How

`http-proxy-middleware` is pulled transitively by
`@nx/module-federation` and `@nx/react` via `^3.0.5`, which already
permits `3.0.7`. This refreshes the stale lockfile resolution `3.0.5 →
3.0.7` within the existing range — no `resolutions` override needed. The
separate `2.0.9` bucket (from `webpack-dev-server`) is outside the
advisory's `>= 3.0.4` range and is left unchanged.

### Verification

- No `http-proxy-middleware` copy in the vulnerable `3.0.4 – 3.0.6`
range remains; the 3.x bucket resolves to `3.0.7`.
- Diff is limited to the resolved version + checksum.
- Lockfile-only change; `yarn install --immutable` passes.
 2026-06-19 08:48:47 +02:00
Abdullah. 2eef2f12be fix(security): bump protobufjs to 7.6.4 (DoS + property shadowing) (#21811) 
## fix(security): bump protobufjs to 7.6.4 (DoS + property shadowing)

Resolves [Dependabot Alert
#1508](https://github.com/twentyhq/twenty/security/dependabot/1508) and
[#1507](https://github.com/twentyhq/twenty/security/dependabot/1507).

### What

`protobufjs` in the 7.x line is affected by two advisories:
-
[GHSA-wcpc-wj8m-hjx6](https://github.com/advisories/GHSA-wcpc-wj8m-hjx6)
(**High**,
[#1508](https://github.com/twentyhq/twenty/security/dependabot/1508)) —
DoS through unbounded `Any` expansion during JSON conversion. Patched in
`7.6.1`.
-
[GHSA-f38q-mgvj-vph7](https://github.com/advisories/GHSA-f38q-mgvj-vph7)
(**Moderate**,
[#1507](https://github.com/twentyhq/twenty/security/dependabot/1507)) —
schema-derived names can shadow runtime-significant properties. Patched
in `7.6.3`.

### How

`protobufjs` is pulled transitively via `^7.3.0`, which already permits
the patched releases. This refreshes the stale lockfile resolution
`7.6.0 → 7.6.4` (the latest `7.x`; `>= 7.6.3` covers both advisories)
within the existing range — no `resolutions` override needed. The `8.x`
ranges in these advisories do not apply.

### Verification

- `protobufjs` resolves to a single `7.6.4` bucket (`>= 7.6.1` and `>=
7.6.3`), clearing both alerts.
- Diff is limited to the protobufjs family (`protobufjs` + its
`@protobufjs/*` utility deps).
- Lockfile-only change; `yarn install --immutable` passes.
 2026-06-19 08:48:24 +02:00
Abdullah. da49ed81e4 fix(security): bump piscina to 4.9.3 (prototype pollution → RCE) (#21810) 
## fix(security): bump piscina to 4.9.3 (prototype pollution → RCE)

Resolves [Dependabot Alert
#1515](https://github.com/twentyhq/twenty/security/dependabot/1515).

### What

`piscina` `<= 4.9.2` is affected by
[GHSA-x9g3-xrwr-cwfg](https://github.com/advisories/GHSA-x9g3-xrwr-cwfg)
/ CVE-2026-55388 — a **prototype-pollution gadget enabling RCE via
inherited `options.filename`** (High). For the 4.x line, the first
patched version is `4.9.3`.

### How

`piscina` is pulled transitively by `@swc/cli@0.8.1` via `^4.3.1`, which
already permits `4.9.3`. This refreshes the stale lockfile resolution
`4.9.2 → 4.9.3` within the existing range — no `resolutions` override
needed.

### Verification

- `piscina` resolves to a single `4.9.3` bucket; no `<= 4.9.2` copy
remains.
- Diff is limited to piscina's resolved version + checksum (its
dependency set is unchanged).
- Lockfile-only change; `yarn install --immutable` passes.
 2026-06-19 08:47:49 +02:00