houseassassin/twenty
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
9,468 Commits 1 Branch 0 Tags
bb18f78f1b970ed9d89af1ac97a2cb3ce30410c6
Commit Graph

382 Commits

Author SHA1 Message Date
dependabot[bot] 0da5cf29de Bump eslint from 9.32.0 to 9.39.2 (#16736) 
Bumps [eslint](https://github.com/eslint/eslint) from 9.32.0 to 9.39.2.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/eslint/eslint/releases">eslint's
releases</a>.</em></p>
<blockquote>
<h2>v9.39.2</h2>
<h2>Bug Fixes</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/57058331946568164449c5caabe2cf206e4fb5d9"><code>5705833</code></a>
fix: warn when <code>eslint-env</code> configuration comments are found
(<a
href="https://redirect.github.com/eslint/eslint/issues/20381">#20381</a>)
(sethamus)</li>
</ul>
<h2>Build Related</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/506f1549a64aa65bdddc75c71cb62f0ab94b5a23"><code>506f154</code></a>
build: add .scss files entry to knip (<a
href="https://redirect.github.com/eslint/eslint/issues/20391">#20391</a>)
(Milos Djermanovic)</li>
</ul>
<h2>Chores</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/7ca0af7f9f89dd4a01736dae01931c45d528171b"><code>7ca0af7</code></a>
chore: upgrade to <code>@eslint/js@9.39.2</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/20394">#20394</a>)
(Francesco Trotta)</li>
<li><a
href="https://github.com/eslint/eslint/commit/c43ce24ff0ce073ec4ad691cd5a50171dfe6cf1e"><code>c43ce24</code></a>
chore: package.json update for <code>@​eslint/js</code> release
(Jenkins)</li>
<li><a
href="https://github.com/eslint/eslint/commit/4c9858e47bb9146cf20f546a562bc58a9ee3dae1"><code>4c9858e</code></a>
ci: add <code>v9.x-dev</code> branch (<a
href="https://redirect.github.com/eslint/eslint/issues/20382">#20382</a>)
(Milos Djermanovic)</li>
</ul>
<h2>v9.39.1</h2>
<h2>Bug Fixes</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/650753ee3976784343ceb40170619dab1aa9fe0d"><code>650753e</code></a>
fix: Only pass node to JS lang visitor methods (<a
href="https://redirect.github.com/eslint/eslint/issues/20283">#20283</a>)
(Nicholas C. Zakas)</li>
</ul>
<h2>Documentation</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/51b51f4f1ce82ef63264c4e45d9ef579bcd73f8e"><code>51b51f4</code></a>
docs: add a section on when to use extends vs cascading (<a
href="https://redirect.github.com/eslint/eslint/issues/20268">#20268</a>)
(Tanuj Kanti)</li>
<li><a
href="https://github.com/eslint/eslint/commit/b44d42699dcd1729b7ecb50ca70e4c1c17f551f1"><code>b44d426</code></a>
docs: Update README (GitHub Actions Bot)</li>
</ul>
<h2>Chores</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/92db329211c8da5ce8340a4d4c05ce9c12845381"><code>92db329</code></a>
chore: update <code>@eslint/js</code> version to 9.39.1 (<a
href="https://redirect.github.com/eslint/eslint/issues/20284">#20284</a>)
(Francesco Trotta)</li>
<li><a
href="https://github.com/eslint/eslint/commit/c7ebefc9eaf99b76b30b0d3cf9960807a47367c4"><code>c7ebefc</code></a>
chore: package.json update for <code>@​eslint/js</code> release
(Jenkins)</li>
<li><a
href="https://github.com/eslint/eslint/commit/61778f6ca33c0f63962a91d6a75a4fa5db9f47d2"><code>61778f6</code></a>
chore: update eslint-config-eslint dependency <code>@​eslint/js</code>
to ^9.39.0 (<a
href="https://redirect.github.com/eslint/eslint/issues/20275">#20275</a>)
(renovate[bot])</li>
<li><a
href="https://github.com/eslint/eslint/commit/d9ca2fcd9ad63331bfd329a69534e1ff04f231e8"><code>d9ca2fc</code></a>
ci: Add rangeStrategy to eslint group in renovate config (<a
href="https://redirect.github.com/eslint/eslint/issues/20266">#20266</a>)
(唯然)</li>
<li><a
href="https://github.com/eslint/eslint/commit/009e5076ff5a4bd845f55e17676e3bb88f47c280"><code>009e507</code></a>
test: fix version tests for ESLint v10 (<a
href="https://redirect.github.com/eslint/eslint/issues/20274">#20274</a>)
(Milos Djermanovic)</li>
</ul>
<h2>v9.39.0</h2>
<h2>Features</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/cc57d87a3f119e9d39c55e044e526ae067fa31ce"><code>cc57d87</code></a>
feat: update error loc to key in <code>no-dupe-class-members</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/20259">#20259</a>)
(Tanuj Kanti)</li>
<li><a
href="https://github.com/eslint/eslint/commit/126552fcf35da3ddcefa527db06dabc54c04041c"><code>126552f</code></a>
feat: update error location in <code>for-direction</code> and
<code>no-dupe-args</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/20258">#20258</a>)
(Tanuj Kanti)</li>
<li><a
href="https://github.com/eslint/eslint/commit/167d0970d3802a66910e9820f31dcd717fab0b2a"><code>167d097</code></a>
feat: update <code>complexity</code> rule to highlight only static block
header (<a
href="https://redirect.github.com/eslint/eslint/issues/20245">#20245</a>)
(jaymarvelz)</li>
</ul>
<h2>Bug Fixes</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/15f5c7c168d0698683943f51dd617f14a5e6815c"><code>15f5c7c</code></a>
fix: forward traversal <code>step.args</code> to visitors (<a
href="https://redirect.github.com/eslint/eslint/issues/20253">#20253</a>)
(jaymarvelz)</li>
<li><a
href="https://github.com/eslint/eslint/commit/5a1a534e877f7c4c992885867f923df307c3929d"><code>5a1a534</code></a>
fix: allow JSDoc comments in object-shorthand rule (<a
href="https://redirect.github.com/eslint/eslint/issues/20167">#20167</a>)
(Nitin Kumar)</li>
<li><a
href="https://github.com/eslint/eslint/commit/e86b813eb660f1a5adc8e143a70d9b683cd12362"><code>e86b813</code></a>
fix: Use more types from <code>@​eslint/core</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/20257">#20257</a>)
(Nicholas C. Zakas)</li>
<li><a
href="https://github.com/eslint/eslint/commit/927272d1f0d5683b029b729d368a96527f283323"><code>927272d</code></a>
fix: correct <code>Scope</code> typings (<a
href="https://redirect.github.com/eslint/eslint/issues/20198">#20198</a>)
(jaymarvelz)</li>
<li><a
href="https://github.com/eslint/eslint/commit/37f76d9c539bb6fc816fedb7be4486b71a58620a"><code>37f76d9</code></a>
fix: use <code>AST.Program</code> type for Program node (<a
href="https://redirect.github.com/eslint/eslint/issues/20244">#20244</a>)
(Francesco Trotta)</li>
<li><a
href="https://github.com/eslint/eslint/commit/ae07f0b3334ebd22ae2e7b09bca5973b96aa9768"><code>ae07f0b</code></a>
fix: unify timing report for concurrent linting (<a
href="https://redirect.github.com/eslint/eslint/issues/20188">#20188</a>)
(jaymarvelz)</li>
<li><a
href="https://github.com/eslint/eslint/commit/b165d471be6062f4475b972155b02654a974a0e9"><code>b165d47</code></a>
fix: correct <code>Rule</code> typings (<a
href="https://redirect.github.com/eslint/eslint/issues/20199">#20199</a>)
(jaymarvelz)</li>
<li><a
href="https://github.com/eslint/eslint/commit/fb97cda70d87286a7dbd2457f578ef578d6905e8"><code>fb97cda</code></a>
fix: improve error message for missing fix function in suggestions (<a
href="https://redirect.github.com/eslint/eslint/issues/20218">#20218</a>)
(jaymarvelz)</li>
</ul>
<h2>Documentation</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/d3e81e30ee6be5a21151b7a17ef10a714b6059c0"><code>d3e81e3</code></a>
docs: Always recommend to include a files property (<a
href="https://redirect.github.com/eslint/eslint/issues/20158">#20158</a>)
(Percy Ma)</li>
<li><a
href="https://github.com/eslint/eslint/commit/0f0385f1404dcadaba4812120b1ad02334dbd66a"><code>0f0385f</code></a>
docs: use consistent naming recommendation (<a
href="https://redirect.github.com/eslint/eslint/issues/20250">#20250</a>)
(Alex M. Spieslechner)</li>
<li><a
href="https://github.com/eslint/eslint/commit/a3b145609ac649fac837c8c0515cbb2a9321ca40"><code>a3b1456</code></a>
docs: Update README (GitHub Actions Bot)</li>
<li><a
href="https://github.com/eslint/eslint/commit/cf5f2dd58dd98084a21da04fe7b9054b9478d552"><code>cf5f2dd</code></a>
docs: fix correct tag of <code>no-useless-constructor</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/20255">#20255</a>)
(Tanuj Kanti)</li>
<li><a
href="https://github.com/eslint/eslint/commit/10b995c8e5473de8d66d3cd99d816e046f35e3ec"><code>10b995c</code></a>
docs: add TS options and examples for <code>nofunc</code> in
<code>no-use-before-define</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/20249">#20249</a>)
(Tanuj Kanti)</li>
<li><a
href="https://github.com/eslint/eslint/commit/2584187e4a305ea7a98e1a5bd4dca2a60ad132f8"><code>2584187</code></a>
docs: remove repetitive word in comment (<a
href="https://redirect.github.com/eslint/eslint/issues/20242">#20242</a>)
(reddaisyy)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/9278324aa0023d223874825b0d4b6ac75783096a"><code>9278324</code></a>
9.39.2</li>
<li><a
href="https://github.com/eslint/eslint/commit/542266ad3c58b47066d4b8ae61d419b423acee8f"><code>542266a</code></a>
Build: changelog update for 9.39.2</li>
<li><a
href="https://github.com/eslint/eslint/commit/7ca0af7f9f89dd4a01736dae01931c45d528171b"><code>7ca0af7</code></a>
chore: upgrade to <code>@eslint/js@9.39.2</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/20394">#20394</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/c43ce24ff0ce073ec4ad691cd5a50171dfe6cf1e"><code>c43ce24</code></a>
chore: package.json update for <code>@​eslint/js</code> release</li>
<li><a
href="https://github.com/eslint/eslint/commit/57058331946568164449c5caabe2cf206e4fb5d9"><code>5705833</code></a>
fix: warn when <code>eslint-env</code> configuration comments are found
(<a
href="https://redirect.github.com/eslint/eslint/issues/20381">#20381</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/506f1549a64aa65bdddc75c71cb62f0ab94b5a23"><code>506f154</code></a>
build: add .scss files entry to knip (<a
href="https://redirect.github.com/eslint/eslint/issues/20391">#20391</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/4c9858e47bb9146cf20f546a562bc58a9ee3dae1"><code>4c9858e</code></a>
ci: add <code>v9.x-dev</code> branch (<a
href="https://redirect.github.com/eslint/eslint/issues/20382">#20382</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/e2772811a8595d161870835ff04822b25a2cdf45"><code>e277281</code></a>
9.39.1</li>
<li><a
href="https://github.com/eslint/eslint/commit/4cdf397b30b2b749865ea0fcf4d30eb8ba458896"><code>4cdf397</code></a>
Build: changelog update for 9.39.1</li>
<li><a
href="https://github.com/eslint/eslint/commit/92db329211c8da5ce8340a4d4c05ce9c12845381"><code>92db329</code></a>
chore: update <code>@eslint/js</code> version to 9.39.1 (<a
href="https://redirect.github.com/eslint/eslint/issues/20284">#20284</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/eslint/eslint/compare/v9.32.0...v9.39.2">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=eslint&package-manager=npm_and_yarn&previous-version=9.32.0&new-version=9.39.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Abdullah <125115953+mabdullahabaid@users.noreply.github.com>
 2025-12-29 12:24:55 +05:00
dependabot[bot] 3278950415 build(deps-dev): bump msw-storybook-addon from 2.0.5 to 2.0.6 (#16830) 
Bumps
[msw-storybook-addon](https://github.com/mswjs/msw-storybook-addon/tree/HEAD/packages/msw-addon)
from 2.0.5 to 2.0.6.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/mswjs/msw-storybook-addon/releases">msw-storybook-addon's
releases</a>.</em></p>
<blockquote>
<h2>v2.0.6</h2>
<h4>🐛 Bug Fix</h4>
<ul>
<li>fix: add a <code>@deprecated</code> tag to the
<code>mswDecorator</code> <a
href="https://redirect.github.com/mswjs/msw-storybook-addon/pull/178">#178</a>
(<a
href="https://github.com/connorshea"><code>@​connorshea</code></a>)</li>
</ul>
<h4>Authors: 1</h4>
<ul>
<li>Connor Shea (<a
href="https://github.com/connorshea"><code>@​connorshea</code></a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/mswjs/msw-storybook-addon/blob/main/packages/msw-addon/CHANGELOG.md">msw-storybook-addon's
changelog</a>.</em></p>
<blockquote>
<h1>v2.0.6 (Fri Oct 10 2025)</h1>
<h4>🐛 Bug Fix</h4>
<ul>
<li>fix: add a <code>@deprecated</code> tag to the
<code>mswDecorator</code> <a
href="https://redirect.github.com/mswjs/msw-storybook-addon/pull/178">#178</a>
(<a
href="https://github.com/connorshea"><code>@​connorshea</code></a>)</li>
</ul>
<h4>Authors: 1</h4>
<ul>
<li>Connor Shea (<a
href="https://github.com/connorshea"><code>@​connorshea</code></a>)</li>
</ul>
<hr />
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/mswjs/msw-storybook-addon/commit/ae7ce4de01bf9665a03816f3ca4908feb5f90653"><code>ae7ce4d</code></a>
Update CHANGELOG.md [skip ci]</li>
<li><a
href="https://github.com/mswjs/msw-storybook-addon/commit/0b9594003ce8226767d51b444bad505db401c387"><code>0b95940</code></a>
fix: add a <code>@deprecated</code> tag to the <code>mswDecorator</code>
(<a
href="https://github.com/mswjs/msw-storybook-addon/tree/HEAD/packages/msw-addon/issues/178">#178</a>)</li>
<li>See full diff in <a
href="https://github.com/mswjs/msw-storybook-addon/commits/v2.0.6/packages/msw-addon">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=msw-storybook-addon&package-manager=npm_and_yarn&previous-version=2.0.5&new-version=2.0.6)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2025-12-29 12:22:47 +05:00
dependabot[bot] 3005f7ba41 build(deps): bump @opentelemetry/auto-instrumentations-node from 0.60.0 to 0.60.1 (#16828) 
Bumps
[@opentelemetry/auto-instrumentations-node](https://github.com/open-telemetry/opentelemetry-js-contrib/tree/HEAD/packages/auto-instrumentations-node)
from 0.60.0 to 0.60.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/open-telemetry/opentelemetry-js-contrib/releases"><code>@​opentelemetry/auto-instrumentations-node</code>'s
releases</a>.</em></p>
<blockquote>
<h2>instrumentation-aws-lambda: v0.60.1</h2>
<h2><a
href="https://github.com/open-telemetry/opentelemetry-js-contrib/compare/instrumentation-aws-lambda-v0.60.0...instrumentation-aws-lambda-v0.60.1">0.60.1</a>
(2025-11-24)</h2>
<h3>Dependencies</h3>
<ul>
<li>The following workspace dependencies were updated
<ul>
<li>devDependencies
<ul>
<li><code>@​opentelemetry/propagator-aws-xray</code> bumped from ^2.1.3
to ^2.1.4</li>
<li><code>@​opentelemetry/propagator-aws-xray-lambda</code> bumped from
^0.55.3 to ^0.55.4</li>
</ul>
</li>
</ul>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/open-telemetry/opentelemetry-js-contrib/blob/main/packages/auto-instrumentations-node/CHANGELOG.md"><code>@​opentelemetry/auto-instrumentations-node</code>'s
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/open-telemetry/opentelemetry-js-contrib/compare/auto-instrumentations-node-v0.60.0...auto-instrumentations-node-v0.60.1">0.60.1</a>
(2025-06-05)</h2>
<h3>Dependencies</h3>
<ul>
<li>The following workspace dependencies were updated
<ul>
<li>dependencies
<ul>
<li><code>@​opentelemetry/instrumentation-hapi</code> bumped from
^0.48.0 to ^0.49.0</li>
<li><code>@​opentelemetry/instrumentation-koa</code> bumped from ^0.50.0
to ^0.50.1</li>
<li><code>@​opentelemetry/instrumentation-mongodb</code> bumped from
^0.55.0 to ^0.55.1</li>
<li><code>@​opentelemetry/instrumentation-net</code> bumped from ^0.46.0
to ^0.46.1</li>
<li><code>@​opentelemetry/instrumentation-redis</code> bumped from
^0.49.0 to ^0.49.1</li>
<li><code>@​opentelemetry/instrumentation-restify</code> bumped from
^0.48.0 to ^0.48.1</li>
<li><code>@​opentelemetry/instrumentation-undici</code> bumped from
^0.13.0 to ^0.13.1</li>
</ul>
</li>
</ul>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/open-telemetry/opentelemetry-js-contrib/commits/auto-instrumentations-node-v0.60.1/packages/auto-instrumentations-node">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=@opentelemetry/auto-instrumentations-node&package-manager=npm_and_yarn&previous-version=0.60.0&new-version=0.60.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2025-12-29 05:40:40 +01:00
Félix Malfait 7021a51747 feat(billing): implement credit rollover from one billing period to another (#16802) 
## Summary
This PR implements credit rollover functionality for billing, allowing
unused credits from one billing period to carry over to the next (capped
at the current period's subscription tier cap).

## Changes

### New Services
- **StripeCreditGrantService**: Interacts with Stripe's Billing Credits
API to create credit grants, retrieve customer credit balances, and void
grants
- **BillingCreditRolloverService**: Contains the rollover logic -
calculates unused credits and creates new grants for the next period
- **BillingWebhookCreditGrantService**: Handles
`billing.credit_grant.created` and `billing.credit_grant.updated`
webhooks to update billing alerts

### Modified Services
- **StripeBillingAlertService**: Updated to include credit balance when
calculating usage threshold alerts
- **BillingUsageService**: Returns rollover credits to the frontend for
display
- **BillingSubscriptionService**: Queries credit balance when creating
billing alerts
- **BillingWebhookInvoiceService**: Triggers rollover processing on
`invoice.finalized` webhook

### Frontend
- Updated `SettingsBillingCreditsSection` to display base credits,
rollover credits, and total available
- Updated GraphQL query to fetch new `rolloverCredits` and
`totalGrantedCredits` fields

### Stripe SDK Upgrade
- Upgraded from v17.3.1 to v19.3.1 to get proper types for
billing.credit_grant events
- Fixed breaking changes: invoice.subscription path, subscription period
fields location, removed properties

## How it works

1. When `invoice.finalized` webhook is received for
`subscription_cycle`, the system:
   - Calculates usage from the previous period
   - Determines unused credits (tier cap - usage)
   - Caps rollover at current tier cap
   - Creates a Stripe credit grant with expiration at end of new period

2. When credit grants are created/updated/voided:
   - Billing alerts are recreated with the updated credit balance

3. The UI displays:
   - Base credits (from subscription tier)
   - Rollover credits (from previous periods)
   - Total available credits

## Edge Cases Handled
- Credit grant voided: `billing.credit_grant.updated` webhook triggers
alert update
- Credit grant expired: Stripe's `creditBalanceSummary` API excludes
expired grants
- No unused credits: Rollover service skips grant creation
- Customer ID as object: Controller extracts `.id` from expanded
customer
 2025-12-28 15:42:18 +01:00
Lucas Bordeau 0b5be7caa3 Refactored Date to Temporal in critical date zones (#16544) 
Fixes https://github.com/twentyhq/twenty/issues/16110

This PR implements Temporal to replace the legacy Date object, in all
features that are time zone sensitive. (around 80% of the app)

Here we define a few utils to handle Temporal primitives and obtain an
easier DX for timezone manipulation, front end and back end.

This PR deactivates the usage of timezone from the graph configuration,
because for now it's always UTC and is not really relevant, let's handle
that later.

Workflows code and backend only code that don't take user input are
using UTC time zone, the affected utils have not been refactored yet
because this PR is big enough.

# New way of filtering on date intervals

As we'll progressively rollup Temporal everywhere in the codebase and
remove `Date` JS object everywhere possible, we'll use the way to filter
that is recommended by Temporal.

This way of filtering on date intervals involves half-open intervals,
and is the preferred way to avoid edge-cases with DST and smallest time
increment edge-case.

## Filtering endOfX with DST edge-cases

Some day-light save time shifts involve having no existing hour, or even
day on certain days, for example Samoa Islands have no 30th of December
2011 : https://www.timeanddate.com/news/time/samoa-dateline.html, it
jumps from 29th to 31st, so filtering on `< next period start` makes it
easier to let the date library handle the strict inferior comparison,
than filtering on `≤ end of period` and trying to compute manually the
end of the period.

For example for Samoa Islands, is end of day `2011-12-29T23:59:59.999`
or is it `2011-12-30T23:59:59.999` ? If you say I don't need to know and
compute it, because I want everything strictly before
`2011-12-29T00:00:00 + start of next day (according to the library which
knows those edge-cases)`, then you have a 100% deterministic way of
computing date intervals in any timezone, for any day of any year.

Of course the Samoa example is an extreme one, but more common ones
involve DST shifts of 1 hour, which are still problematic on certain
days of the year.

## Computing the exact _end of period_

Having an open interval filtering, with `[included - included]` instead
of half-open `[included - excluded)`, forces to compute the open end of
an interval, which often involves taking an arbitrary unit like minute,
second, microsecond or nanosecond, which will lead to edge-case of
unhandled values.

For example, let's say my code computes endOfDay by setting the time to
`23:59:59.999`, if another library, API, or anything else, ends up
giving me a date-time with another time precision `23:59:59.999999999`
(down to the nanosecond), then this date-time will be filtered out,
while it should not.

The good deterministic way to avoid 100% of those complex bugs is to
create a half-open filter :

`≥ start of period` to `< start of next period` 

For example : 

`≥ 2025-01-01T00:00:00` to `< 2025-01-02T00:00:00` instead of `≥
2025-01-01T00:00:00` to `≤ 2025-01-01T23:59:59.999`

Because, `2025-01-01T00:00:00` = `2025-01-01T00:00:00.000` =
`2025-01-01T00:00:00.000000` = `2025-01-01T00:00:00.000000000` => no
risk of error in computing start of period

But `2025-01-01T23:59:59` ≠ `2025-01-01T23:59:59.999` ≠
`2025-01-01T23:59:59.999999` ≠ `2025-01-01T23:59:59.999999999` =>
existing risk of error in computing end of period

This is why an half-open interval has no risk of error in computing a
date-time interval filter.

Here is a link to this debate :
https://github.com/tc39/proposal-temporal/issues/2568

> For this reason, we recommend not calculating the exact nanosecond at
the end of the day if it's not absolutely necessary. For example, if
it's needed for <= comparisons, we recommend just changing the
comparison code. So instead of <= zdtEndOfDay your code could be <
zdtStartOfNextDay which is easier to calculate and not subject to the
issue of not knowing which unit is the right one.
>
> [Justin Grant](https://github.com/justingrant), top contributor of
Temporal

## Application to our codebase

Applying this half-open filtering paradigm to our codebase means we
would have to rename `IS_AFTER` to `IS_AFTER_OR_EQUAL` and to keep
`IS_BEFORE` (or even `IS_STRICTLY_BEFORE`) to make this half-open
interval self-explanatory everywhere in the codebase, this will avoid
any confusion.

See the relevant issue :
https://github.com/twentyhq/core-team-issues/issues/2010

In the mean time, we'll keep this operand and add this semantic in the
naming everywhere possible.

## Example with a different user timezone 

Example on a graph grouped by week in timezone Pacific/Samoa, on a
computer running on Europe/Paris :

<img width="342" height="511" alt="image"
src="https://github.com/user-attachments/assets/9e7d5121-ecc4-4233-835b-f59293fbd8c8"
/>

Then the associated data in the table view, with our **half-open
date-time filter** :

<img width="804" height="262" alt="image"
src="https://github.com/user-attachments/assets/28efe1d7-d2fc-4aec-b521-bada7f980447"
/>

And the associated SQL query result to see how DATE_TRUNC in Postgres
applies its internal start of week logic :

<img width="709" height="220" alt="image"
src="https://github.com/user-attachments/assets/4d0542e1-eaae-4b4b-afa9-5005f48ffdca"
/>

The associated SQL query without parameters to test in your SQL client :

```SQL
SELECT "opportunity"."closeDate" as "close_date", TO_CHAR(DATE_TRUNC('week', "opportunity"."closeDate", 'Pacific/Samoa') AT TIME ZONE 'Pacific/Samoa', 'YYYY-MM-DD') AS "DATE_TRUNC by week start in timezone Pacific/Samoa", "opportunity"."name" FROM "workspace_1wgvd1injqtife6y4rvfbu3h5"."opportunity" "opportunity" ORDER BY "opportunity"."closeDate" ASC NULLS LAST
```

# Date picker simplification (not in this PR)

Our DatePicker component, which is wrapping `react-datepicker` library
component, is now exposing plain dates as string instead of Date object.
The Date object is still used internally to manage the library
component, but since the date picker calendar is only manipulating plain
dates, there is no need to add timezone management to it, and no need to
expose a handleChange with Date object.

The timezone management relies on date time inputs now.

The modification has been made in a previous PR :
https://github.com/twentyhq/twenty/issues/15377 but it's good to
reference it here.

# Calendar feature refactor

Calendar feature has been refactored to rely on Temporal.PlainDate as
much as possible, while leaving some date-fns utils to avoid re-coding
them.

Since the trick is to use utils to convert back and from Date object in
exec env reliably, we can do it everywhere we need to interface legacy
Date object utils and Temporal related code.

## TimeZone is now shown on Calendar :

<img width="894" height="958" alt="image"
src="https://github.com/user-attachments/assets/231f8107-fad6-4786-b532-456692c20f1d"
/>

## Month picker has been refactored 

<img width="503" height="266" alt="image"
src="https://github.com/user-attachments/assets/cb90bc34-6c4d-436d-93bc-4b6fb00de7f5"
/>

Since the days weren't useful, the picker has been refactored to remove
the days.

# Miscellaneous 
- Fixed a bug with drag and drop edge-case with 2 items in a list.

# Improvements 

## Lots of chained operations
It would be nice to create small utils to avoid repeated chained
operations, but that is how Temporal is designed, a very small set of
primitive operations that allow to compose everything needed. Maybe
we'll have wrappers on top of Temporal in the coming years.

## Creation of Temporal objects is throwing errors

If the input is badly formatted Temporal will throw, we might want to
adopt a global strategy to avoid that.

Example : 

```ts
const newPlainDate = Temporal.PlainDate.from('bad-string'); // Will throw
```
 2025-12-23 17:40:26 +00:00
dependabot[bot] cf51baedae Bump tsx from 4.20.5 to 4.21.0 (#16738) 
Bumps [tsx](https://github.com/privatenumber/tsx) from 4.20.5 to 4.21.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/privatenumber/tsx/releases">tsx's
releases</a>.</em></p>
<blockquote>
<h2>v4.21.0</h2>
<h1><a
href="https://github.com/privatenumber/tsx/compare/v4.20.6...v4.21.0">4.21.0</a>
(2025-11-30)</h1>
<h3>Features</h3>
<ul>
<li>upgrade esbuild (<a
href="https://redirect.github.com/privatenumber/tsx/issues/748">#748</a>)
(<a
href="https://github.com/privatenumber/tsx/commit/048fb623870f22c5026ad84187b545d418d2dfe8">048fb62</a>)</li>
</ul>
<hr />
<p>This release is also available on:</p>
<ul>
<li><a href="https://www.npmjs.com/package/tsx/v/4.21.0"><code>npm
package (@​latest dist-tag)</code></a></li>
</ul>
<h2>v4.20.6</h2>
<h2><a
href="https://github.com/privatenumber/tsx/compare/v4.20.5...v4.20.6">4.20.6</a>
(2025-09-26)</h2>
<h3>Bug Fixes</h3>
<ul>
<li>properly hide relaySignal from process.listeners() (<a
href="https://redirect.github.com/privatenumber/tsx/issues/741">#741</a>)
(<a
href="https://github.com/privatenumber/tsx/commit/710a42473ebfdff362818bed4fd1f5c7a27837e2">710a424</a>)</li>
</ul>
<hr />
<p>This release is also available on:</p>
<ul>
<li><a href="https://www.npmjs.com/package/tsx/v/4.20.6"><code>npm
package (@​latest dist-tag)</code></a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/privatenumber/tsx/commit/f6284cd50575ce6e8d110f63266d66cb9cde3b88"><code>f6284cd</code></a>
ci: lock in semantic-release v24</li>
<li><a
href="https://github.com/privatenumber/tsx/commit/048fb623870f22c5026ad84187b545d418d2dfe8"><code>048fb62</code></a>
feat: upgrade esbuild (<a
href="https://redirect.github.com/privatenumber/tsx/issues/748">#748</a>)</li>
<li><a
href="https://github.com/privatenumber/tsx/commit/710a42473ebfdff362818bed4fd1f5c7a27837e2"><code>710a424</code></a>
fix: properly hide relaySignal from process.listeners() (<a
href="https://redirect.github.com/privatenumber/tsx/issues/741">#741</a>)</li>
<li><a
href="https://github.com/privatenumber/tsx/commit/20b91c44bbb00006f182fee3b0bcfc55aaec6e44"><code>20b91c4</code></a>
docs: make sponsors dynamic</li>
<li><a
href="https://github.com/privatenumber/tsx/commit/08dcd59a3a05774897a641a943702ca4b47192e0"><code>08dcd59</code></a>
chore: move vercel settings to root</li>
<li>See full diff in <a
href="https://github.com/privatenumber/tsx/compare/v4.20.5...v4.21.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=tsx&package-manager=npm_and_yarn&previous-version=4.20.5&new-version=4.21.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2025-12-22 17:35:42 +01:00
dependabot[bot] 5b69173c44 Bump ts-loader from 9.5.1 to 9.5.4 (#16737) 
Bumps [ts-loader](https://github.com/TypeStrong/ts-loader) from 9.5.1 to
9.5.4.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/TypeStrong/ts-loader/releases">ts-loader's
releases</a>.</em></p>
<blockquote>
<h2>v9.5.4</h2>
<ul>
<li><a
href="https://redirect.github.com/TypeStrong/ts-loader/pull/1676">chore:
typescript 5.9 upgrade</a> - thanks <a
href="https://github.com/johnnyreilly"><code>@​johnnyreilly</code></a></li>
</ul>
<p>Skipping 9.5.3 due to a publishing issue</p>
<h2>v9.5.3</h2>
<ul>
<li><a
href="https://redirect.github.com/TypeStrong/ts-loader/pull/1665">fix:
add more detailed error messages</a> - thanks <a
href="https://github.com/hai-x"><code>@​hai-x</code></a></li>
</ul>
<h2>v9.5.2</h2>
<ul>
<li><a
href="https://redirect.github.com/TypeStrong/ts-loader/pull/1665">fix:
add more detailed error messages</a> - thanks <a
href="https://github.com/hai-x"><code>@​hai-x</code></a></li>
</ul>
<p><em>This release is actually v9.5.2 but due to a problem with the
initial release workflow we incremented to v9.5.3</em></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/TypeStrong/ts-loader/blob/main/CHANGELOG.md">ts-loader's
changelog</a>.</em></p>
<blockquote>
<h2>9.5.4</h2>
<ul>
<li><a
href="https://redirect.github.com/TypeStrong/ts-loader/pull/1676">chore:
typescript 5.9 upgrade</a> - thanks <a
href="https://github.com/johnnyreilly"><code>@​johnnyreilly</code></a></li>
</ul>
<p>Skipping 9.5.3 due to a publishing issue</p>
<h2>9.5.2</h2>
<ul>
<li><a
href="https://redirect.github.com/TypeStrong/ts-loader/pull/1665">fix:
add more detailed error messages</a> - thanks <a
href="https://github.com/hai-x"><code>@​hai-x</code></a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/TypeStrong/ts-loader/commit/f7d022f79d1dae3c0c07ee63ec63c697eb99b32a"><code>f7d022f</code></a>
Update changelog for version 9.5.4 (<a
href="https://redirect.github.com/TypeStrong/ts-loader/issues/1677">#1677</a>)</li>
<li><a
href="https://github.com/TypeStrong/ts-loader/commit/ba825c2520383072cedd66130ab490c5e6bc8f4e"><code>ba825c2</code></a>
chore: TypeScript 5.9 upgrade (<a
href="https://redirect.github.com/TypeStrong/ts-loader/issues/1676">#1676</a>)</li>
<li><a
href="https://github.com/TypeStrong/ts-loader/commit/847a24936aa12fa18dab21ca8ec37595cadc72c6"><code>847a249</code></a>
feat: stub for 5.8 (<a
href="https://redirect.github.com/TypeStrong/ts-loader/issues/1668">#1668</a>)</li>
<li><a
href="https://github.com/TypeStrong/ts-loader/commit/0ee403558eeddfcb912c5ed9d8f6224210f6c477"><code>0ee4035</code></a>
feat: Update push.yml with workflow_dispatch</li>
<li><a
href="https://github.com/TypeStrong/ts-loader/commit/d7352989b8edda7b6ae80a89c4351c27643d4927"><code>d735298</code></a>
chore: update lockfile (<a
href="https://redirect.github.com/TypeStrong/ts-loader/issues/1666">#1666</a>)</li>
<li><a
href="https://github.com/TypeStrong/ts-loader/commit/e652315ddee8b82b38e7aa9d0ce7f179e281377e"><code>e652315</code></a>
fix: add more detailed error messages (<a
href="https://redirect.github.com/TypeStrong/ts-loader/issues/1665">#1665</a>)</li>
<li><a
href="https://github.com/TypeStrong/ts-loader/commit/36b6bf24c6ccbffce43565bc09f4b08b9ea5f5f6"><code>36b6bf2</code></a>
Upgrade TypeScript to 5.7 (<a
href="https://redirect.github.com/TypeStrong/ts-loader/issues/1661">#1661</a>)</li>
<li><a
href="https://github.com/TypeStrong/ts-loader/commit/6a4e29c729fd6727c1c625fad3a65d509c2c37eb"><code>6a4e29c</code></a>
Create SECURITY.md</li>
<li><a
href="https://github.com/TypeStrong/ts-loader/commit/5379bb1fc4c4ea53b14a2c2ba88154fedb7de11e"><code>5379bb1</code></a>
Update testpack for TypeScript 5.6 (<a
href="https://redirect.github.com/TypeStrong/ts-loader/issues/1656">#1656</a>)</li>
<li><a
href="https://github.com/TypeStrong/ts-loader/commit/95110c67b97aa8c60c86485064fb35a85def2819"><code>95110c6</code></a>
Ts 55 (<a
href="https://redirect.github.com/TypeStrong/ts-loader/issues/1651">#1651</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/TypeStrong/ts-loader/compare/v9.5.1...v9.5.4">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=ts-loader&package-manager=npm_and_yarn&previous-version=9.5.1&new-version=9.5.4)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2025-12-22 17:35:26 +01:00
Abdullah. ede261abf4 fix: storybook manager bundle may expose environment variables during build (#16747) 
Resolves [Dependabot Alert
348](https://github.com/twentyhq/twenty/security/dependabot/348).

Updated the patch version - 8.6.14 to 8.6.15.
 2025-12-22 16:53:52 +01:00
Abdullah. 869608327e feat: validator is vulnerable to incomplete filtering of one or more instances of special elements (#16748) 
Resolves [Dependabot Alert
336](https://github.com/twentyhq/twenty/security/dependabot/336).

Used `yarn up validator --recursive` since minor version upgrades are
allowed by definition of packages.
 2025-12-22 14:28:38 +01:00
neo773 abe774da15 Message folders optimization (#16479) 
- Batch Gmail API calls using `googleapis-batcher` for folder processing
  - Add concurrency limit for Microsoft Graph folder processing 
- Skip IMAP folder sync when no new messages (checks UIDVALIDITY/MODSEQ)
- Refactored `syncMessageFolders` to return folder state directly,
avoiding extra DB round-trips
- Refactored `processPendingFolderActions` to reuse state instead of
querying DB again
  - Add unique index on message folders entity

---------

Co-authored-by: Charles Bochet <charles@twenty.com>
 2025-12-19 17:04:48 +01:00
Abdullah. 936b803cba fix: auth0/node-jws improperly verifies HMAC signature (#16712) 
Resolves [Dependabot Alert
339](https://github.com/twentyhq/twenty/security/dependabot/339),
[Dependabot Alert
340](https://github.com/twentyhq/twenty/security/dependabot/340) and
[Dependabot Alert
341](https://github.com/twentyhq/twenty/security/dependabot/341).
 2025-12-19 16:27:10 +01:00
Abdullah. 964e1a5beb fix: next has a denial of service with server components (#16710) 
Resolves the following alert created as a follow up to the previously
merged PR: [Dependabot Alert
351](https://github.com/twentyhq/twenty/security/dependabot/351).
 2025-12-19 16:26:47 +01:00
Abdullah. 1e47115d0b fix: Next has a denial of service with server components (#16702) 
The alerts regarding CVE-2025-55182, CVE-2025-55183, CVE-2025-55184 are
false-positive given Twenty only imported Next 15.2.4 via `react-emails`
as a devDependency, so it should have never made it to the production
build - it was reported due to yarn.lock file containing the version.
However, in order to remove the alerts, updated react-emails to 4.0.17
(latest patch in 4.0 minor release) and Next version it imports to
15.5.9.

[Dependabot Alert
337](https://github.com/twentyhq/twenty/security/dependabot/337),
[Dependabot Alert
343](https://github.com/twentyhq/twenty/security/dependabot/343),
[Dependabot Alert
344](https://github.com/twentyhq/twenty/security/dependabot/344).

Additionally, updated Next 14.2.33 to 14.2.35 to resolve another couple
alerts reported in CVE-2025-55184.

[Dependabot Alert
345](https://github.com/twentyhq/twenty/security/dependabot/345),
[Dependabot Alert
346](https://github.com/twentyhq/twenty/security/dependabot/346).

---------

Co-authored-by: Guillim <guillim@users.noreply.github.com>
 2025-12-19 14:36:56 +00:00
Abdullah. 27ca79be7d fix: nodemailer is vulnerable to DoS through uncontrolled recursion. (#16698) 
Resolves [Dependabot Alert
331](https://github.com/twentyhq/twenty/security/dependabot/331),
[Dependabot Alert
332](https://github.com/twentyhq/twenty/security/dependabot/332),
[Dependabot Alert
349](https://github.com/twentyhq/twenty/security/dependabot/349), and
[Dependabot Alert
350](https://github.com/twentyhq/twenty/security/dependabot/350).

Updated Nodemailer and packages dependent on it to use the fixed patch
version (7.0.11).
 2025-12-19 15:12:07 +01:00
Abdullah. de907f8c81 fix: mdast-util-to-hast has unsanitized class attribute (#16699) 
Resolves [Dependabot Alert
333](https://github.com/twentyhq/twenty/security/dependabot/333).

Used yarn up in recursive mode to bump up version from 13.2.0 to 13.2.1.

---------

Co-authored-by: guillim <guigloo@msn.com>
 2025-12-19 10:12:22 +00:00
Abdul Rahman 289e8bf1d4 fix: ensure unique GraphQL schema caching per API key (#16411) 
## Description

This PR fixes an issue where the GraphQL schema was being incorrectly
cached and shared across different API keys within the same workspace.
This resulted in the `createdBy` field (Actor) from the first API key's
request being erroneously attributed to subsequent requests made by
different API keys.

## Changes

- Updated the `@graphql-yoga/nestjs` patch to include the request's
`Authorization` header in the schema cache key generation logic.
- This ensures that every unique authentication token (and thus every
unique API key) generates a distinct cache entry, preventing schema
context collisions.

Closes #15093
 2025-12-15 18:23:33 +01:00
Félix Malfait 2e104c8e76 feat(ai): add code interpreter for AI data analysis (#16559) 
## Summary

- Add code interpreter tool that enables AI to execute Python code for
data analysis, CSV processing, and chart generation
- Support for both local (development) and E2B (sandboxed production)
execution drivers
- Real-time streaming of stdout/stderr and generated files
- Frontend components for displaying code execution results with
expandable sections

## Code Quality Improvements

- Extract `getMimeType` to shared utility to reduce code duplication
between drivers
- Fix security issue: escape single quotes/backslashes in E2B driver env
variable injection
- Add `buildExecutionState` helper to reduce duplicated state object
construction
- Add `DEFAULT_CODE_INTERPRETER_TIMEOUT_MS` constant for consistency
- Fix lingui linting warning and TypeScript theme errors in frontend

## Test Plan

- [ ] Test code interpreter with local driver in development
- [ ] Test code interpreter with E2B driver in production environment
- [ ] Verify streaming output displays correctly in chat UI
- [ ] Verify generated files (charts, CSVs) are uploaded and
downloadable
- [ ] Test file upload flow (CSV, Excel) triggers code interpreter

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> Updates generated i18n catalogs for Polish and pseudo-English, adding
strings for code execution/output (code interpreter) and various UI
messages, with minor text adjustments.
> 
> - **Localization**:
> - **Generated catalogs**: Refresh `locales/generated/pl-PL.ts` and
`locales/generated/pseudo-en.ts`.
> - Add strings for code execution/output (e.g., code, copy code/output,
running/waiting states, download files, generated files, Python code
execution).
> - Include new UI texts (errors, prompts, menus) and minor text
corrections.
>   - No changes to `pt-BR`; other files unchanged functionally.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
befc13d02c21e5a6647bc1aa6daa2a89f60b7ef8. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
 2025-12-15 16:11:24 +01:00
dependabot[bot] 9fd2853315 Bump @types/unzipper from 0.10.10 to 0.10.11 (#16554) 
Bumps
[@types/unzipper](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/unzipper)
from 0.10.10 to 0.10.11.
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/unzipper">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=@types/unzipper&package-manager=npm_and_yarn&previous-version=0.10.10&new-version=0.10.11)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2025-12-15 10:25:53 +01:00
martmull 5e8fbc7c5c 1825 extensibility v1 see serverless logs using subscriptions in twnty cli or settings serverkess section (#16321) 
- Adds a log section to settings serverless functions test tab

<img width="1303" height="827" alt="image"
src="https://github.com/user-attachments/assets/2ce70558-91bc-4cfc-aced-42ac9e0226bf"
/>

- Adds a new subscription endpoint to graphql api
`serverlessFunctionLogs` that that emit function logs

- Adds a new command `twenty app logs` to `twenty-sdk` to watch logs in
terminal

<img width="1109" height="182" alt="image"
src="https://github.com/user-attachments/assets/2e874060-e99d-4978-ab9c-c91e52cb7478"
/>


<img width="1061" height="176" alt="image"
src="https://github.com/user-attachments/assets/1f533e32-7435-4d7b-89c6-d1154816a8ab"
/>

- add new version for create-twenty-app and twenty-sdk `0.1.3`
 2025-12-04 16:40:58 +01:00
neo773 e112eb4f69 Simplify IMAP implementation (#16295) 2025-12-04 14:32:41 +01:00
martmull ea79425fc0 Fix twenty sdk and create twenty app (#16282) 
As title
 2025-12-03 15:12:34 +01:00
Paul Rastoin a7c5969ede [create-twenty-app] Use vite config lib (#16273) 2025-12-03 10:47:37 +00:00
martmull 5abab1feb2 Fix yarn lock (#16242) 2025-12-02 11:35:19 +01:00
Abdullah. 1fcb8b464c fix: move vite plugins into the packages that use them (#16134) 
I was looking into [Dependabot Alert
107](https://github.com/twentyhq/twenty/security/dependabot/107) and
figured that the alert is caused by `vite-plugin-dts`, which is a
development dependency and does not make it into the production build
for it to be dangerous.

However, while at it, I also saw that some packages used plugins from
root package.json while others had them defined in their local
package.json. Therefore, I refactored to move plugins where they're
required and removed a redundant package.

Builds for the following succeed as intended:
- twenty-ui
- twenty-emails
- twenty-website
- twenty-front

Co-authored-by: Félix Malfait <felix.malfait@gmail.com>
 2025-12-01 14:44:19 +00:00
martmull f489bbdbab Fix main (#16215) 
fix yarn.lock not up to date
 2025-12-01 14:37:05 +01:00
martmull e498367e2f Merge twenty-cli into twenty-sdk (#16150) 
- Moves twenty-cli content into twenty-sdk
- add a new twenty-sdk:0.1.0 version
- this new twenty-sdk exports a cli command called 'twenty' (like
twenty-cli before)
- deprecates twenty-cli
- simplify app init command base-project
- use `twenty-sdk:0.1.0` in base project
- move the "twenty-sdk/application" barrel to "twenty-sdk"
- add `create-twenty-app` package

<img width="1512" height="919" alt="image"
src="https://github.com/user-attachments/assets/007bef45-4e71-419a-9213-cebed376adbf"
/>

<img width="1506" height="929" alt="image"
src="https://github.com/user-attachments/assets/3de2fec6-1624-4923-ae13-f4e1cf165eb5"
/>
 2025-12-01 11:44:35 +01:00
Abdullah. 46ce9eca3f fix: node-forge is vulnerable to ASN.1 OID integer truncation (#16124) 
Resolves [Dependabot Alert
328](https://github.com/twentyhq/twenty/security/dependabot/328).

Used `yarn up node-forge --recursive` to bump up the patch version from
1.3.1 to 1.3.2.
 2025-11-27 17:49:10 +05:00
Abdullah. 978c0acb90 fix: sentry's sensitive headers are leaked when sendDefaultPii is set to true (#16122) 
Resolves [Dependabot Alert
323](https://github.com/twentyhq/twenty/security/dependabot/323),
[Dependabot Alert
324](https://github.com/twentyhq/twenty/security/dependabot/324) and
[Dependabot Alert
325](https://github.com/twentyhq/twenty/security/dependabot/325).

It updates Sentry's packages on the server from 10.21.0 to 10.27.0.

I also moved @sentry/react to twenty-front package.json and updated the
version from 9.26.0 to 10.27.0 - no breaking changes were introduced in
the major upgrade in regards to the API exposed by the dependency.

Since @sentry/profiling-node was redundant in the root package.json, I
removed it - twenty-server has it already and is the only package
dependent on @sentry/profiling-node.
 2025-11-27 17:28:59 +05:00
Abdullah. afd5ccc775 fix: body-parser is vulnerable to denial of service when url encoding is used (#16126) 
Resolves [Dependabot Alert
326](https://github.com/twentyhq/twenty/security/dependabot/326).

Used `yarn up body-parser --recursive` to bump up the patch version from
2.2.0 to 2.2.1.
 2025-11-27 17:28:33 +05:00
martmull aa5d30a911 Fix twenty cli (#15997) 
As title

fixes "app add" and "app init" commands
adds tests
 2025-11-21 19:21:30 +01:00
martmull 28b8a4f7ec Fix yarn lock (#15992) 
as title
 2025-11-21 15:53:56 +01:00
Abdullah. 991bb6dbbf fix: crash in HeaderParser in dicer. (#15963) 
Resolves [Dependabot Alert
74](https://github.com/twentyhq/twenty/security/dependabot/74).

Upgraded `graphql-upload` from `13.0.0` to `16.0.2`. Type exports
changed. API remains the same.

Tested the following upload flows:
- profile picture
- workspace logo
- rich text editor (image, video, file)
- record profile picture
- file associated to record.

They all work as intended, nothing breaks.
 2025-11-21 11:09:47 +01:00
Abdullah. 9c61b625a1 Remove the redundant nx/js package from twenty-server since root has it. (#15905) 
There was an extra definition of @nx/js inside twenty-server, which was
not recognized during upgrade by the CLI. This caused two versions of
@nx/js in the repo - 22.0.3 from root and 21.3.11 from the twenty-server
package.

Removed the one inside twenty-server to maintain a single source of
truth.
 2025-11-18 17:41:45 +01:00
Abdullah. 222feb90b4 fix: update glob version to 11.1.0 (#15884) 
Some Glob CLI related alerts were generated last night. I believe
they're safe to dismiss since I do not expect us to use the Glob CLI in
production environment, and those alerts do not impact the API, but
still updating the dependency version just in case.

Not sure if this would resolve all/any of the alerts since glob is a
dependency for many other dependencies, so a good number of dependency
variants are pulled in.

The alert that confirms it's just a CLI related vulnerability:
[Dependabot Alert
307](https://github.com/twentyhq/twenty/security/dependabot/307)
 2025-11-18 17:12:53 +01:00
Abdullah. 7d74e17bfc fix: js-yaml has prototype pollution in merge (#15886) 
Resolves [Dependabot Alert
309](https://github.com/twentyhq/twenty/security/dependabot/309) and
maybe also a few others.

Bumped up the version for js-yaml to 4.1.1 and 3.14.2 across transitive
dependencies using `yarn up js-yaml --recursive`.
 2025-11-18 13:45:15 +01:00
Abdullah. d6d7f1bb20 fix: koa related dependabot alerts (#15868) 
Resolves [Dependabot Alert
256](https://github.com/twentyhq/twenty/security/dependabot/256) and
[Dependabot Alert
296](https://github.com/twentyhq/twenty/security/dependabot/296).

This is a major bump for `nx` and related packages. Used the CLI to run
nx migrations as recommended by the maintainers. Tested building,
testing and linting packages after resetting the daemon, and did not
come across a breaking issue.
 2025-11-18 13:44:45 +01:00
Baptiste Devessier e0d1f74648 Page layout conditional display (#15802) 
- Allow widgets to be hidden based on device's type conditions: desktop
or mobile
- Create two widgets for rich text fields on tasks and notes. One widget
is displayed below fields on mobile (and in the right drawer); the other
is displayed on a separate tab on desktop
- In read mode, hide tabs if they contain no visible widgets. If there
is no tab left to display, display at least the first one with no
widgets.
- In edit mode, display all tabs and all widgets.

## Demo


https://github.com/user-attachments/assets/65ef1261-3902-4432-a420-48983b763b2c

Closes https://github.com/twentyhq/core-team-issues/issues/1811
 2025-11-18 10:35:38 +01:00
Abdullah. 60ed9b53f4 fix: vercel’s AI SDK's filetype whitelists can be bypassed when uploading files (#15874) 
Resolves [Dependabot Alert
301](https://github.com/twentyhq/twenty/security/dependabot/301).

Locked the version of "ai" at 5.0.52 in order to stop it from bumping to
5.0.93 directly when the ^ is introduced since it breaks the code across
multiple files.
 2025-11-17 18:03:45 +00:00
Paul Rastoin 2a44bde848 Dynamic grql api wrapper on application sync (#15791) 
# Introduction

Important note: for the moment testing this locally will require some
hack due to latest twenty-sdk not being published.
You will need to build twenty-cli and `cd packages/twenty-cli && yarn
link`
To finally sync the app in your app folder as `cd app-folder && twenty
app sync`

close https://github.com/twentyhq/core-team-issues/issues/1863

In this PR is introduced the generate sdk programmatic call to
[genql](https://genql.dev/) exposed in a `client` barrel of `twenty-sdk`
located in this package as there's high chances that will add a codegen
layer above it at some point ?

The cli calls this method after a sync application and writes a client
in a generated folder. It will make a graql introspection query on the
whole workspace. We should later improve that and only filter by current
applicationId and its dependencies ( when twenty-standard application is
introduced )

Fully typesafe ( input, output, filters etc ) auto-completed client

## Hello-world app serverless refactor

<img width="2480" height="1326" alt="image"
src="https://github.com/user-attachments/assets/b18ea372-b21d-4560-8fbc-1dc348427a95"
/>

---------

Co-authored-by: martmull <martmull@hotmail.fr>
 2025-11-17 14:46:59 +01:00
Abdullah. c1dcda6475 fix: cookie accepts cookie name, path, and domain with out of bounds characters (#15845) 
Resolves [Dependabot Alert
143](https://github.com/twentyhq/twenty/security/dependabot/143).

Used `yarn up @bundled-es-modules/cookie --recursive` to move from
version `2.0.0` to `2.0.1` so that the underlying cookie dependency
version moves from `0.5.0` to `0.7.2`.
 2025-11-17 07:36:14 +00:00
Abdullah. 321a2bec53 fix: babel has inefficient regexp complexity in generated code with .replace when transpiling named capturing groups (#15844) 
Resolves [Dependabot Alert
199](https://github.com/twentyhq/twenty/security/dependabot/199) and
[Dependabot Alert
200](https://github.com/twentyhq/twenty/security/dependabot/200).

Used `yarn up @babel/runtime --recursive` and `yarn up
@babel/runtime-corejs3 --recursive` to move from `7.26.7` to `7.28.4`.

Changelogs do not list any breaking changes when moving between minor
versions, only improvements. The parent dependencies also allow minor
version upgrades.
 2025-11-17 08:17:25 +01:00
Abdullah. 7a68aa7f48 fix: playwright downloads and installs browsers without verifying the authenticity of the SSL certificate (#15843) 
Resolves [Dependabot Alert
293](https://github.com/twentyhq/twenty/security/dependabot/293).

Updates the playwright version used to `1.56.1`. The alert could have
also been ignored since the playwright download only happens in CI and
local environments, not the production environment. However, it's an
easy fix instead of just ignoring the alert.
 2025-11-17 08:16:56 +01:00
Abdullah. baa1a1e52f fix: babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code (#15840) 
Resolves [Dependabot Alert
95](https://github.com/twentyhq/twenty/security/dependabot/95) - babel
vulnerable to arbitrary code execution when compiling specifically
crafted malicious code.

These were the few options we had for a direct drop-in replacement.
- [x-var](https://www.npmjs.com/package/x-var?activeTab=readme)
- [cross-let](https://www.npmjs.com/package/cross-let)
- [cross-var-no-babel](https://www.npmjs.com/package/cross-var-no-babel)

x-var has the most weekly downloads among the three and it is also the
most actively maintained fork of the original cross-var package that
introduced the vulnerability. There is no syntax difference per the
documentation, but I do not have a windows machine to test.

`cross-var-no-babel` offers the most minimal changes, but is also
abandoned without a public-facing repo.
 2025-11-16 20:12:25 +01:00
Félix Malfait 5dfb66917c Upgrade NestJS from 10.x to 11.x (#15836) 
## Overview
This PR upgrades all NestJS dependencies from version 10.x to 11.x,
following the [official migration
guide](https://docs.nestjs.com/migration-guide). This builds on top of
the v9 to v10 upgrade completed in PR #15835.

## Changes

### Dependencies Updated
**Core packages (10.x → 11.x):**
- `@nestjs/common`: 10.4.16 → 11.0.8
- `@nestjs/core`: 10.4.16 → 11.0.8
- `@nestjs/platform-express`: 10.4.16 → 11.0.8
- `@nestjs/config`: 3.2.3 → 3.3.0
- `@nestjs/passport`: 10.0.3 → 11.0.0
- `@nestjs/axios`: 3.0.2 → 3.1.2
- `@nestjs/schedule`: ^3.0.0 → ^4.1.1
- `@nestjs/serve-static`: 4.0.2 → 5.0.1
- `@nestjs/cache-manager`: ^2.2.1 → ^2.3.0
- `@nestjs/jwt`: 10.2.0 → 11.0.0
- `@nestjs/typeorm`: 10.0.2 → 11.0.0
- `@nestjs/terminus`: 11.0.0 (already on v11)
- `@nestjs/event-emitter`: 2.1.0 (compatible)

**DevDependencies:**
- `@nestjs/testing`: ^10.4.16 → ^11.0.8
- `@nestjs/schematics`: ^10.1.0 → ^11.0.2
- `@nestjs/cli`: 10.3.0 → 11.0.0

### Code Changes
**Fixed: TwentyConfigModule conditional imports**
- Updated `TwentyConfigModule.forRoot()` to use spread operator for
conditional imports
- Fixes TypeScript error with NestJS 11's stricter DynamicModule type
checking

**Cleanup: Removed unused package**
- Removed `@revertdotdev/revert-react` (not being used anywhere in the
codebase)

## Breaking Changes Addressed

### 1. ✅ Reflector Type Inference
- **Impact**: None - codebase only uses `reflector.get()` method
- **Analysis**: Does not use `getAllAndMerge()` or `getAllAndOverride()`
(the methods with breaking changes)
- **Files reviewed**: feature-flag.guard.ts,
message-queue-metadata.accessor.ts,
workspace-query-hook-metadata.accessor.ts

### 2. ✅ Lifecycle Hooks Execution Order
- **Change**: Termination hooks (`OnModuleDestroy`,
`BeforeApplicationShutdown`, `OnApplicationShutdown`) now execute in
REVERSE order
- **Analysis**: Reviewed all lifecycle hook implementations
  - Redis client cleanup
  - Database connection cleanup (GlobalWorkspaceDataSource)
  - BullMQ queue/worker cleanup
  - Cache storage cleanup
- **Result**: Dependency order is safe - services using connections
clean up before the connections themselves

### 3. ✅ Middleware Registration Order
- **Change**: Global middleware now executes first regardless of import
order
- **Analysis**: Middleware is not registered as global, so execution
order remains consistent
- **Files reviewed**: app.module.ts, middleware.module.ts

## Testing

All tests passing and build successful:

**Unit Tests (283+ tests):**
- ✅ Health module: 38 tests passed
- ✅ Auth module: 115 tests passed (passport v11 integration)
- ✅ REST API: 90 tests passed (middleware and express platform)
- ✅ Feature flags: 17 tests passed (Reflector usage)
- ✅ Workspace: 23 tests passed

**Build & Quality:**
- ✅ Type checking: Passed
- ✅ Linting: Passed
- ✅ Build: 3,683 files compiled successfully

## Verification

Tested critical NestJS functionality:
- ✅ Authentication & Security (JWT, OAuth, guards)
- ✅ HTTP Platform (Express integration, REST endpoints)
- ✅ Dependency Injection (Services, factories, providers)
- ✅ Cache Management (Redis with @nestjs/cache-manager)
- ✅ GraphQL (Query runners, resolvers)
- ✅ Configuration (Environment config)
- ✅ Scheduling (Cron jobs with @nestjs/schedule v4)
- ✅ Lifecycle Hooks (Module initialization and cleanup)
- ✅ Reflector (Metadata reflection in guards)

## Related PRs
- #15835 - Upgrade NestJS from 9.x to 10.x (completed)

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> Upgrades NestJS to v11 and updates routing patterns, auth strategies,
GraphQL schema options, and build/dist paths (scripts, Docker, Nx,
migrations, assets), plus enables Devtools in development.
> 
> - **Backend (NestJS 11 upgrade)**:
> - Bump `@nestjs/*` packages (core, platform-express, jwt, passport,
typeorm, serve-static, schedule, cli/testing/schematics) to v11.
> - Update REST/route-trigger/file controllers to new wildcard syntax
(`*path`).
> - Refactor OAuth (Google/Microsoft) and SAML strategies (abstract base
+ explicit `validate`); minor typings.
>   - Enable `DevtoolsModule` in development.
> - **GraphQL**:
> - Add `buildSchemaOptions.orphanedTypes` for client-config types; keep
Yoga/Sentry setup.
> - **Build/Runtime & Config**:
> - Standardize dist layout (remove `src` in paths): update scripts,
Docker `CMD`, Nx `project.json`, render scripts, TypeORM migration
paths, asset resolution.
> - Adjust `nest-cli.json` (watchOptions, asset globs, migrations
outDir, monorepo/root).
> - Improve config module imports (spread conditional); tsconfig
excludes `node_modules`.
>   - Minor Nx default: `start` target caching disabled.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
1139fd85a97d0c72314d416d07464cc3c9942783. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
 2025-11-16 18:20:06 +01:00
Félix Malfait a2a7ff8b4b Upgrade NestJS from 9.x to 10.x (#15835) 
## Overview
This PR upgrades all NestJS dependencies from version 9.x to 10.x,
following the [official migration
guide](https://docs.nestjs.com/v10/migration-guide). This is the first
step before upgrading to NestJS 11.x in a future PR.

## Changes

### Dependencies Updated
- `@nestjs/common`: 9.4.3 → 10.4.16
- `@nestjs/core`: 9.4.3 → 10.4.16
- `@nestjs/passport`: 9.0.3 → 10.0.3
- `@nestjs/platform-express`: 9.4.3 → 10.4.16
- `@nestjs/config`: 2.3.4 → 3.2.3
- `@nestjs/event-emitter`: 2.0.4 → 2.1.0
- `@nestjs/testing`: ^9.0.0 → ^10.4.16
- `@nestjs/schematics`: ^9.0.0 → ^10.1.0

### Code Changes
- Fixed `CacheModuleOptions` import from `@nestjs/common` to
`@nestjs/cache-manager` in cache-storage.module-factory.ts

## Breaking Changes Addressed
✅ **CacheModule Migration**: Already using `@nestjs/cache-manager`
package
✅ **TypeScript Version**: Using 5.9.2 (requires 4.8+)  
✅ **Node.js Version**: Using 24.5.0 (requires 16+)  
✅ **Deprecated APIs**: All v9 deprecations removed in v10 - standard
patterns in use

## Testing
All tests passing and build successful:
- ✅ Health module: 38 tests passed
- ✅ Auth module: 115 tests passed (critical - uses @nestjs/passport)
- ✅ Admin panel: 30 tests passed
- ✅ REST API: 90 tests passed (uses @nestjs/platform-express)
- ✅ Feature flags: 17 tests passed
- ✅ Workspace: 23 tests passed
- ✅ GraphQL query runner: 17 tests passed
- ✅ **Total: 330+ tests passing**
- ✅ Build: 3,683 files compiled successfully
- ✅ Type checking: Passed
- ✅ Linting: Passed

## Verification
Tested critical NestJS functionality:
- Authentication & Security (JWT, OAuth, guards)
- HTTP Platform (Express integration, REST endpoints)
- Dependency Injection (Services, factories, providers)
- Cache Management (Redis with @nestjs/cache-manager)
- GraphQL (Query runners, resolvers)
- Configuration (Environment config)
- Event Emitters (Event-driven architecture)

## Next Steps
This upgrade positions the codebase for the next upgrade to NestJS 11.x,
which will be handled in a separate PR.

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> Upgrades NestJS to v10, fixes cache module import, and narrows CI
GraphQL generation diff to generated directories.
> 
> - **Backend**
> - **Dependencies**: Upgrade `@nestjs/common`, `@nestjs/core`,
`@nestjs/platform-express`, `@nestjs/passport`, `@nestjs/config`,
`@nestjs/event-emitter`, `@nestjs/testing`, and `@nestjs/schematics` to
v10-compatible versions in `packages/twenty-server/package.json`.
> - **Code**: Update `CacheModuleOptions` import to
`@nestjs/cache-manager` in
`src/engine/core-modules/cache-storage/cache-storage.module-factory.ts`.
> - **CI**
> - **GraphQL**: Restrict schema change detection to
`packages/twenty-front/src/generated` and
`packages/twenty-front/src/generated-metadata` in
`.github/workflows/ci-server.yaml`.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
f621230fcf06ea86585b58ea9b61d6a5064230db. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
 2025-11-15 23:06:13 +01:00
Paul Rastoin 0fdc7ba834 Twenty-shared tests parses decorator (#15765) 
## Introduction
Since we've moved some class validator instances from twenty-server to
twenty-shared tests are red because they do not know how to parse
decorators declarations

We've fixed this by explicitly installing `class-validator` in
`twenty-shared` and configuring jest swc accordingly

## Twenty-server class validator patch
I don't even know if that's something we need anymore
Seems to be a patch either fixing or introducing credit card and phone
number validation
Would prefer discussing the need or not to either before merging this as
it could introduce regression at runtime:
- Centralize the patch to be consumed in both `twenty-server` and
`twenty-shared`
- Remove the patch

We should also document every patch motivations we do as it's quite
though to iterate over a such huge one
 2025-11-13 16:06:04 +00:00
Rounak Joshi 9f594cda1c Slash Command Implementation in Advanced Text Editor (#15488) 
Part of Fixing Issue #14976 

### Pull Request Summary: SlashCommand Integration in Advanced Text
Editor

This pull request introduces **SlashCommand functionality** within the
Advanced Text Editor, specifically used in the **Workflow node** of
**Send Email body** components. The implementation leverages the
`@tiptap/suggestion` extension from the TipTap ecosystem, enabling
dynamic styling and command execution via a custom dropdown triggered by
typing `/`.

---

### Implementation Overview

#### 1. **Custom Extension & Dropdown Rendering**
- A new extension was created to handle SlashCommand interactions.
- This extension renders a **Dropdown component** that displays
available commands with relevant styles, icons etc.

#### 2. **Command Configuration**
- Each command includes:
  - Visibility and active state logic
  - Execution behavior upon selection
- All commands are initialized and configured centrally.

#### 3. **Search & Filtering**
- As users type after the `/`, the command list is **filtered based on
the query**.
- For example, typing `/car` filters and displays matching commands in
the dropdown.

#### 4. **Dropdown Lifecycle & Positioning**
- The dropdown is rendered using React lifecycle hooks provided by
`SuggestionTip`:
- `onStart`: Initializes state, sets selected command, and captures
cursor position via `DOMRect`.
- `onUpdate`, `onKeyDown`, `onExit`: Manage dropdown updates and
interactions.
- Positioning is handled via a **`useFloating` hook**, which aligns the
dropdown relative to the cursor and editor bounds.
- The dropdown is rendered in a **react-portal**, wrapped in the current
theme for consistent styling and animation.


#### 6. **State Management**
- A dedicated `SlashCommandState.ts` file manages:
  - Callback functions
  - Current command and selected item
  - Cleanup utilities for event listeners
  - Dropdown navigation (arrow keys, enter key)

#### 7. **Integration Points**
- SlashCommand functionality is now **enabled in Send Email body of the
Workflow**.
- Relevant changes have been applied to support this components in
Storybook as well.

[slash command
test.webm](https://github.com/user-attachments/assets/5c537844-8987-4ce5-9fca-b29ea93d8063)


<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> Updates Portuguese (Brazil and Portugal) generated locale files,
including a new editor hint string for “Enter text or type '/' for
commands,” plus assorted translation tweaks.
> 
> - **i18n/locales**:
> - **Portuguese (Brazil) `src/locales/generated/pt-BR.ts`**: Add new
editor hint message (`"Enter text or Type '/' for commands"`) and adjust
multiple translations/wording.
> - **Portuguese (Portugal) `src/locales/generated/pt-PT.ts`**: Add the
same editor hint message and refine numerous translations/labels.
> - No functional code changes; translation files regenerated/updated.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
b3d7407525ec08da1fcfafe1309bb4fd61654dac. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

---------

Co-authored-by: Félix Malfait <felix@twenty.com>
 2025-11-09 21:18:56 +01:00
Abdul Rahman f740bac988 add documentation i18n workflows for Crowdin (#15538) 
Co-authored-by: Félix Malfait <felix.malfait@gmail.com>
Co-authored-by: Félix Malfait <felix@twenty.com>
 2025-11-08 11:24:07 +01:00
Abdullah. 47a9b4ce9d fix: formidable relies on hexoid to prevent guessing of filenames for untrusted executable content (#15672) 
Resolves [Dependabot Alert
224](https://github.com/twentyhq/twenty/security/dependabot/224) -
formidable relies on hexoid to prevent guessing of filenames for
untrusted executable content.

Used `yarn up formidable --recursive` to upgrade the version from 2.1.2
to 2.1.5.
 2025-11-06 16:18:32 +01:00
Abdullah. da1399afcf fix: brace-expansion regular expression denial of service vulnerability (#15637) 
Resolves [Dependabot Alert
238](https://github.com/twentyhq/twenty/security/dependabot/238) -
brace-expansion regular expression denial of service vulnerability.

This alert was closed yesterday, but `yarn.lock` went back to the
previous versions somehow when an unrelated PR was reverted. Therefore,
creating a PR again.

Versions on main:
<p align="center">
<img width="470" height="385" alt="image"
src="https://github.com/user-attachments/assets/69fb6519-21c0-4f69-9412-a7b05451cf57"
/>
</p>

Updated versions in the PR:
<p align="center">
<img width="472" height="383" alt="image"
src="https://github.com/user-attachments/assets/69f2a7c4-8015-4a92-8e25-1b8953f329da"
/>
</p>
 2025-11-05 14:34:41 +01:00