623 Commits

Author	SHA1	Message	Date
Charles Bochet	834541da6d	security: bump path-to-regexp and defu to patched versions (lockfile refresh) (#21369) ... ## What Clears two **High** Dependabot alerts (https://github.com/twentyhq/twenty/security/dependabot) from the root tree **without resolutions/overrides** — by refreshing the lockfile so the existing semver ranges pick up the already-patched releases. | Package | From → To | Requested by | Advisory | |---|---|---|---| | path-to-regexp | 8.3.0 → 8.4.2 | `router` (`^8.0.0`) | GHSA-j3q9-mxjg-w52f | | defu | 6.1.4 → 6.1.7 | `radix-vue` (`^6.1.4`) | GHSA-737v-mqg7-c878 | Only `yarn.lock` changes — no `package.json` edits, no `resolutions`. ## Why only these two I traced every vulnerable transitive back to its parent. Only `defu` and `path-to-regexp` were stuck purely on a stale lockfile (their parents' ranges already allow the patched version). The remaining root High alerts can **not** be fixed by a parent update: - **next** — latest `@react-email/preview-server` (5.2.10) still ships `next@16.1.7`, itself vulnerable - **immutable** — `@ardatan/relay-compiler@12.0.0` is terminal and pins `~3.7.6` - **minimatch / lodash / ws** — exact-pinned deep in dev tooling (api-extractor, spectral, NestJS, graphql-tools) with no fixed upstream release Those will be handled separately. ## Verification - `nx typecheck` passes for twenty-server and twenty-front	2026-06-09 16:34:46 +02:00
Charles Bochet	4305a7dc84	fix(twenty-client-sdk): make genql codegen formatter prettier-3 compatible (fixes app-sync server crash) (#21354) ... ## Problem Syncing a `twenty-sdk` app against a server (`twenty dev`) **crashes the server process**. The metadata migration completes, then the server-side `GqlTypeGenerator` regenerates typed clients via the vendored genql codegen in `twenty-client-sdk`, which throws and exits node: ``` ConfigError: Couldn't find plugin for AST format "estree". Plugins must be explicitly added to the standalone bundle. at .../packages/twenty-client-sdk/dist/generate.cjs Node.js v24.5.0 ← process exits ``` The CLI sees `ECONNRESET`; the app row still persists because the crash happens after the metadata commit. Any app sync takes the server down. ## Root cause The genql codegen formatter [`prettify.ts`](https://github.com/twentyhq/twenty/blob/main/packages/twenty-client-sdk/src/generate/genql/helpers/prettify.ts) was vendored (in #21339) targeting **prettier 2.8**: a synchronous `format()` and `prettier/parser-typescript`, which in 2.8 bundles the estree printer. `package.json` pins `prettier ^2.8.8`, but the monorepo actually resolves/bundles **prettier 3.8.3** (`^2.8.8` is silently unsatisfied — no 2.8.x is nested for this package, and the subpath imports are bundled from the hoisted 3.8.3). Under prettier 3 the estree printer must be added explicitly (`prettier/plugins/estree`) and `format()` is async — so the codegen throws. `prettier/parser-typescript` / `parser-graphql` don't even exist in prettier 3 (only `prettier/plugins/*`), so the declared `^2.8.8` was already inconsistent with what runs. ## Fix - `prettify`: switch to the prettier-3 entrypoints `prettier/plugins/{graphql,typescript,estree}`, `await` the async `format()`, and fall back to the unformatted (still valid) code on any failure so cosmetic formatting can never crash codegen again. - `RenderContext.toCode` + `clientTasks`: propagate the now-async `prettify` (await the four `toCode` call sites). - Bump the declared `prettier` dependency `^2.8.8 → ^3.8.3` to match what is actually used (only consumer; minimal lockfile diff). ## Verification (local, source server on :3000) - `twenty dev --once` now completes: `Registering application → Syncing manifest → Generating API client → ✓ Synced` with the **server staying up**. - The app integration test passes (full re-sync of 6 metadata objects + `MetadataApiClient`/`CoreApiClient` CRUD through the generated genql runtime). - `nx build twenty-client-sdk` (incl. `tsgo` typecheck) passes. Release note: this is a v2.11 blocker — without it, installing/syncing any app crashes the server.	2026-06-09 11:08:06 +02:00
Charles Bochet	1e309369bc	chore(deps): upgrade tar to v7, evict vulnerable tar@6.2.1 (CVE-2026-24842) (#21341) ... ## Summary Removes all transitive **`tar@6.2.1`** from the dependency tree, resolving [Dependabot alert #400](https://github.com/twentyhq/twenty/security/dependabot/400) ([GHSA-34x7-hfp2-rc4v](https://github.com/isaacs/node-tar/security/advisories/GHSA-34x7-hfp2-rc4v) / CVE-2026-24842 — node-tar hardlink path traversal, high/8.2). The alert had been dismissed as `no_bandwidth`, but `tar@6.2.1` was still in the lockfile. I confirmed **6.2.1 is genuinely exploitable** by running the advisory's PoC (the hardlink escaped the extraction dir to a parent-directory file); `7.5.16` blocks it. There is **no patched 6.x release** — the fix only exists in `7.5.7+`. ## Approach Upgrade the build tooling that pulled tar v6 to the majors that depend on tar v7, rather than forcing tar onto v6-era consumers: | Package | Change | Mechanism | |---|---|---| | `node-gyp` | 10.2.0 / 7.1.2 / 9.4.1 → **12.4.0** | resolution | | `cacache` | 18 → **20.0.4** | resolution | | `make-fetch-happen` | → **15.0.6** | resolution | | `mintlify` (twenty-docs) | `latest` → **^4.2.594** (`@mintlify/previewing` → tar 7.5.15) | direct dep bump | | `@electron/rebuild`, `@electron/node-gyp`, `pacote` → `tar` | → **^7.5.16** | scoped resolution | The last row covers the two subtrees with **no upstream tar-v7 release**: `@electron/rebuild` (+ electron's `node-gyp` fork) in `twenty-companion`, and `pacote@11/15` via `zapier-platform-cli` in `twenty-zapier`. All `tar` now resolves to **7.5.13 / 7.5.15 / 7.5.16**; `node_modules` verified free of tar v6. ## Validation done - `yarn install` completes cleanly (constraints pass, only pre-existing `enableScripts: false` + peer-dep warnings). - Installed `node_modules` contains zero tar v6. ## Validation still needed before merge ⚠️ - The scoped overrides force tar v7 onto packages written for the v6 API. Resolution is consistent, but **runtime not exercised** (`enableScripts: false` skips native builds at install). Please validate: - `twenty-companion` electron `make` / native rebuild - `twenty-zapier` build/push - If either breaks, drop the scoped overrides and accept those two **dev/build-only** clusters as residual — they extract only trusted archives at build time, so the CVE (which needs attacker-controlled input) isn't reachable there. - `mintlify` is pinned (not `latest`) because `.yarnrc.yml`'s `npmMinimalAgeGate: 3d` quarantines the true latest. Pinning is arguably healthier, but it's a deliberate behavior change. ## Note twenty-server's own runtime tarball extraction (`extract-tarball-securely.util.ts`) was already on patched tar **and** rejects all hardlink/symlink entries — so this PR addresses the remaining build-tooling exposure, not a live runtime hole. Large `yarn.lock` churn is expected: the node-gyp/cacache major bumps refresh npm-internals tree-wide.	2026-06-08 20:48:44 +02:00
Charles Bochet	37b986aa4b	security: vendor @genql/cli codegen to drop undici/native-fetch (#21339) ... ## What Vendors a narrowed copy of [`@genql/cli@3.0.5`](https://github.com/remorses/genql) (MIT) into `packages/twenty-client-sdk/src/generate/genql/` and repoints the two client generators at it, then removes `@genql/cli` from `twenty-client-sdk`, `twenty-sdk` and `create-twenty-app`. ## Why `@genql/cli` was used **only** to generate the typed GraphQL client from an SDL string. It is unmaintained and pulls in vulnerable/abandoned transitives — `undici@5` (**30 Dependabot alerts**), `native-fetch`, `listr`, `yargs`, etc. None of these were ever executed by Twenty: the sole consumer of `undici`/`native-fetch` is `@genql/cli`'s live-endpoint schema-introspection path, and Twenty always passes a schema string, never an endpoint. Removing the package eliminates the dependency at the source — for Twenty and for scaffolded end-user apps. ## What changed vs upstream The vendored copy (`genql/README.md` + `genql/LICENSE`) keeps the `render/` and `runtime/` trees verbatim and narrows the orchestration: - **Dropped the endpoint/introspection path** (`schema/fetchSchema.ts`) — the only `undici`/`native-fetch`/`qs` consumer. - **Dropped `listr`** — generation tasks run as plain sequential `async` functions (file contents unchanged). - **Replaced `fs-extra`/`mkdirp`/`rimraf`** with `node:fs`. - **Runtime templates are imported as `?raw`** and bundled, instead of read from `node_modules` at generation time. - **Kept `prettier@^2.8` and `@graphql-tools/*`** so the generated output is byte-for-byte identical. ## Verification - **Byte-identical output**: regenerating the metadata client from its committed schema produces a recursive-diff-clean result vs the previous `@genql/cli` output (including the copied `runtime/` folder). The core client generates and esbuild-bundles cleanly. - The public `twenty-client-sdk/generate` barrel API is unchanged (twenty-server / twenty-sdk consumers unaffected). - `undici@^5`, `native-fetch`, `@genql/cli`, `listr`, `yargs@^15` and `subscriptions-transport-ws@0.9` are gone from `yarn.lock` (net −364 lines). - `twenty-client-sdk` and `twenty-sdk` typecheck, lint and build; `twenty-client-sdk` tests pass (9/9). ## Notes - The vendored folder is excluded from `oxlint`/`oxfmt` (it is third-party code, with `@ts-nocheck` on the verbatim renderers, mirroring the generated output). - Stacks conceptually on #21334 (drops `@genql/runtime`); the two are independent and only overlap trivially in `yarn.lock`. `@genql/runtime` is intentionally left for that PR.	2026-06-08 20:46:45 +02:00
Charles Bochet	a0fb157899	fix(sdk): bump inquirer ^10 -> ^14 to drop external-editor/tmp from apps (#21340) ... The **central fix** for the `tmp` Dependabot alerts in `packages/twenty-apps/*` — so apps don't each need a per-app `resolutions` entry. ### Root cause Every app depends on `twenty-sdk`, whose inquirer chain pulls the vulnerable `tmp`: ``` twenty-sdk → inquirer ^10 → @inquirer/prompts 7.x → @inquirer/editor 4.x → external-editor → tmp@0.0.33 ``` `@inquirer/editor 5.x` dropped `external-editor` (and thus old `tmp`), and it's only reached via `@inquirer/prompts 8.x`, which requires **inquirer ≥ 13.4.3**. So `^12` isn't enough — bump to **`^14`** (latest): ``` inquirer 14 → @inquirer/prompts 8.5.2 → @inquirer/editor 5.2.2 (no external-editor) ``` ### Verified - The SDK uses the classic `inquirer.prompt([...])` API (uninstall / add / remote commands) — **typechecks cleanly under inquirer 14**. - After the bump, the SDK's subtree resolves `@inquirer/editor@5.2.2` (the lingering `external-editor` in this repo's lockfile is from *other* consumers — `nx`/`zapier` — handled separately). ### Propagation Fixes it **once** for every app using the SDK, with no per-app `package.json` additions. Existing `twenty-apps/*` clear their `tmp` alert once a new `twenty-sdk` is published and they bump to it; newly-scaffolded apps are clean immediately. (The root-workspace `tmp` from `nx`/`zapier` is handled by twenty#21338.)	2026-06-08 20:38:28 +02:00
Charles Bochet	822beb6a86	chore: force tmp >= 0.2.7 for root dev tooling (nx/zapier) (#21338) ... Resolves the **root** `tmp` Dependabot alert (`tmp < 0.2.6`, #1308). In the root workspace, `tmp` is a transitive dep of `nx` (`~0.2.1`) and `zapier-platform-cli` (exact `0.2.1`) — dev/CLI tooling that **exact-pins old tmp with no fixed parent to upgrade to** (verified: even latest `zapier-platform-cli@15.19.0` still pins `0.2.1`). So it's pinned to the patched **0.2.7** via a root `resolutions` entry — the correct tool for un-dedupe-able transitive pins. Not in the prod image. ### Why the `twenty-apps/*` alerts are not fixed here Those come from a different source — `twenty-sdk → inquirer ^10 → @inquirer/editor 4.x → external-editor → tmp@0.0.33`. Rather than add a `resolutions` block to every app's `package.json` (which doesn't scale — every newly-scaffolded app would need it), they'll be fixed **centrally** by bumping `inquirer` in `twenty-sdk` (`^10 → ^12`, which reaches `@inquirer/editor 5.x` that dropped external-editor). Separate PR — apps inherit the fix on the next SDK release with no manual additions.	2026-06-08 20:11:56 +02:00
Charles Bochet	356cec5f24	security: drop unused @genql/runtime dependency (#21334) ... ## What Removes the `@genql/runtime` dependency from `twenty-client-sdk` and `twenty-sdk`. It was declared but **never imported** in source. ## Why The genql codegen (`@genql/cli` `generate()`) inlines a **fully self-contained runtime** into every generated client — see the committed `twenty-client-sdk/src/metadata/generated/runtime/` (all relative imports) and the generated `index.ts` which imports from `./runtime`, not `@genql/runtime`. So the `@genql/runtime` package was dead weight in the dep graph. Dropping it prunes its abandoned, vulnerable transitive deps **at the source**: - `ws@^6` (old) - `subscriptions-transport-ws@0.9.x` - `isomorphic-unfetch` - `zen-observable-ts` - `graphql-query-batcher` - `lodash` None are used by Twenty — the generated client makes plain `fetch` GraphQL requests and has no `ws`-based subscriptions. ## Verification - `@genql/runtime` is gone from `node_modules` and `yarn.lock` (103 lockfile lines removed); the remaining `subscriptions-transport-ws@0.11.0` is a different, maintained version pulled by an unrelated package. - `twenty-client-sdk` and `twenty-sdk` typecheck. - `twenty-client-sdk` unit tests pass (9/9). - With `@genql/runtime` physically removed from `node_modules`, `generate()` still emits a complete, self-contained client (`index.ts` imports `./runtime`). ## Scope `@genql/cli` (the codegen, which pulls `undici`) is intentionally **not** touched here — it is still required for client generation and will be addressed separately.	2026-06-08 19:20:07 +02:00
Charles Bochet	434f5cbcd2	chore(server): bump @nestjs to 11.1.24 + serve-static 5.0.5 to clear CVEs (#21333) ... Bumps `@nestjs` packages to clear the scanner findings they pin on the prod image. All within-major bumps, past the repo's `npmMinimalAgeGate: 3d`. ## Changes | Package | From → To | Clears | |---|---|---| | `@nestjs/common` | 11.1.16 → **11.1.24** | `file-type@21.3.0` → 21.3.4 | | `@nestjs/core` | ^11.1.18 → **^11.1.24** | (path-to-regexp 8.4.2) | | `@nestjs/platform-express` | 11.1.16 → **11.1.24** | `path-to-regexp@8.3.0` → 8.4.2 | | `@nestjs/serve-static` | 5.0.4 → **5.0.5** | `path-to-regexp@8.3.0` → 8.4.2 | | `@nestjs/testing` | 11.1.16 → **11.1.24** | — | Verified in the regenerated lockfile: **`file-type@21.3.0` and `path-to-regexp@8.3.0` are gone**. `twenty-server:typecheck` passes locally. ## Not in scope - **`lodash@4.17.21`** and **`ws@8.16.0`** are pinned by **`@nestjs/graphql@12.1.1`** (and lodash also by `@nestjs/config@3.3.0`). Bumping graphql 12→13 would clear them, but it's blocked by a **316-line custom patch** implementing Twenty's multi-schema scoping (`resolverSchemaScope`, `computeReachableTypes`) welded to 12.1.1's compiled internals — a dedicated effort, not a routine bump. (Twenty uses the Yoga driver, so it's *not* an Apollo migration.) - `@nestjs/config` 3→4 alone wouldn't clear `lodash` (graphql still pins it), so deferred with the graphql work. - `path-to-regexp@0.1.12` is express 4.x's own — separate from @nestjs.	2026-06-08 19:19:42 +02:00
Raphaël Bosi	c596a5e342	Rename twenty-ui to twenty-ui-deprecated and twenty-new-ui to twenty-ui to prepare package release (#21315) ... ## Description Promotes the next-gen UI library (formerly `twenty-new-ui`) to the name **`twenty-ui`** (v0.1.0, publishable) and renames the old package to **`twenty-ui-deprecated`**. Rewrites ~1,730 `twenty-ui` imports → `twenty-ui-deprecated`, updates all configs/CI/Docker/deps, and migrates twenty-front's `Toggle` to the new package (first consumer) as a drop-in. ## Next steps - Wire the `ui/v*` publish dispatch (`cd-deploy-tag.yaml` + `.yarnrc.yml`), then tag `ui/v0.1.0` to publish. - Continue migrating components from `twenty-ui-deprecated` → `twenty-ui`.	2026-06-08 18:12:28 +02:00
Charles Bochet	a91e737e69	fix(docker): bump Node 24.16.0 (OpenSSL fix), strip unused cruft, dedupe node-forge (#21322) ... Hardens the `prod-twenty` server image. Built `--target twenty-server` and walked it to verify each change. - **Node 24.15.0 → 24.16.0** (all stages + `.nvmrc`): 24.15.0 links OpenSSL **3.5.5** (CVE-2026-31798), 24.16.0 links **3.5.6** — the proper fix (deleting headers only hid it; the binary still linked the vuln lib). - **Remove the bundled npm CLI** (`ip-address`): app uses yarn via corepack, never npm; npm still bundles `ip-address@10.1.0` and its latest 10.2.0 is itself unfixed — no upgrade path. - **Remove vendored `example/` apps** (`passport-microsoft/example` ships a `package-lock.json` for an old Express demo, never installed/run; not in our lockfile). - **node-forge → 1.4.0** (Critical CVE-2026-33606) via `yarn dedupe` — lockfile-only, no phantom dep, no root resolution. Verified on the built image: node 24.16.0 / openssl 3.5.6, npm CLI + example dirs absent, node-forge@1.4.0 only. **Not included (need CI/QA):** real deps pinned inside `@nestjs/*`/`express` (`lodash@4.17.21`, `file-type`, `path-to-regexp`, `ws`, `qs`) need parent bumps or scoped resolutions; standalone `undici@5.29.0` (5→7), `apollo-server-core@3` (EOL), `typeorm`, etc. (`axios` already patched.)	2026-06-08 18:03:21 +02:00
Charles Bochet	13e8e26d1c	security: bump uuid 9 → 11 (server, shared, front) (#21326) ... Clears the `uuid` "missing buffer bounds check in v3/v5/v6" advisory — patched in **11.1.1**. Bumps `twenty-server`, `twenty-shared`, `twenty-front` from 9 → `^11.1.1`. ### Why 11 and not 13 uuid **11.1.x still ships a CommonJS build**, so jest loads it with **no config changes**. uuid went **ESM-only at v12+**, which would otherwise force `transformIgnorePatterns` workarounds across the jest projects (and broke server/integration/storybook CI on the earlier 13 attempt). 11.1.1 is the actual patched version, so this is the minimal fix. ### Changes - `uuid` → `^11.1.1` in the three workspaces (lockfile regenerated under hardened mode) - one test (`useCreateManyRecords.test.tsx`): pin the mocked `v4` to its string-returning overload — uuid's types declare a `Uint8Array` overload that `jest.mocked` resolves to (present in v11 too, unrelated to ESM). All usages are named imports, so no source migration. typecheck passes (server/shared/front); affected specs pass. **No jest config changes.**	2026-06-08 17:42:19 +02:00
Charles Bochet	b7fefe29b7	security: bump serialize-javascript 6 → 7 (RCE) (#21325) ... Fixes the **high-severity** `serialize-javascript` RCE advisory (RegExp.flags / Date.prototype.toISOString, patched in **7.0.5**). - Bumps the direct dep in `twenty-website` `^6.0.2 → ^7.0.5`. - Only consumer is `src/lib/seo/JsonLd.tsx` (default-export API, unchanged in v7 — the major only drops old Node support). - `twenty-website` typecheck passes; lockfile regenerated under hardened mode (`--immutable --check-cache` clean).	2026-06-08 17:21:05 +02:00
Charles Bochet	f19d8ff7e9	security: bump electron 36 → 39 in twenty-companion (#21327) ... Clears the Electron advisory batch (use-after-free, IPC scoping, origin handling, ASAR integrity, …) — patched in **39.8.5+**, resolves to **39.8.10**. - `twenty-companion` is the standalone desktop companion app (electron-forge; @electron-forge 7.8 supports Electron 39). Main-process code only uses basic `require('electron')` APIs, stable across 36→39. - Lockfile + manifest only; gate-safe; hardened install clean. ⚠️ **Verification caveat:** there's no CI job that builds/tests twenty-companion, so this isn't exercised by CI, and I couldn't verify runtime locally (electron-forge packaging downloads the ~100MB Electron binary / needs a display, and the repo's `enableScripts: false` skips the binary). **Recommend a manual smoke test** (`yarn make`/`start` in twenty-companion) before relying on the bump.	2026-06-08 17:15:33 +02:00
Charles Bochet	7bff4403fc	fix: dedupe root yarn.lock to satisfy hardened immutable install (unblocks danger-js) (#21320) ... The root lockfile carries redundant standalone descriptors (`ws@8.21.0`, `postcss@8.5.15`, `nanoid@3.3.12`) left over from the transitive-dep security bump (#21310). Under `enableHardenedMode` + `yarn install --immutable --check-cache` (how CI runs it), these trip `YN0028` — which is currently **failing the danger-js check on every new PR**. A mutable install merges them into their existing descriptor groups: **2 insertions, 37 deletions, no version changes, no security downgrades**. `yarn install --immutable --check-cache` passes again afterward. This unblocks danger-js across all open PRs.	2026-06-08 16:22:21 +02:00
Charles Bochet	27b1d1578c	security: bump vulnerable transitive dependencies (postcss, fast-xml-parser, react-router, brace-expansion, …) (#21310) ... ## What Companion to the direct-dependency security PR (#21309). Bumps **transitive** vulnerable packages via `yarn up -R` (re-resolve to newest within existing ranges). **Lockfile-only — no root `package.json` / resolutions changes.** ### Cleared | Package | Fix | |---|---| | `brace-expansion` | numeric-range / zero-step DoS | | `follow-redirects` | auth header leak to cross-domain | | `diff` | ReDoS in parse/applyPatch | | `@protobufjs/utf8` | overlong UTF-8 decoding | | `lodash` | — | ## Out of scope Vulnerable copies that are **exact-pinned by third-party parents**, so they can only be fixed once those parents ship patched versions — they're not direct deps of any workspace, can't be added per-package, and a sibling dependency can't override a parent's exact pin (only a root resolution could, which we're intentionally not adding): - `postcss` ← `next`, `styled-components` - `fast-xml-parser` ← `@aws-sdk/xml-builder` - `undici`, `ws`, `tmp`, `picomatch`, `webpack-dev-server`, `ip-address`, `unhead`, `yeoman-environment`, `@tootallnate/once`, `ajv`, `react-router` (need breaking major bumps or coordinated multi-package updates; mostly dev/build tooling, not shipped runtime) > Split from the direct-deps PR (#21309) per the agreed split-by-group plan.	2026-06-08 15:11:30 +02:00
Charles Bochet	d2e7dc0e74	security: bump vulnerable direct dependencies (axios, next, vitest, qs, dompurify, …) (#21309) ... ## What Within-major version bumps of **direct** dependencies to clear a large batch of Dependabot alerts that are breaching (or near) their SLA. No major-version changes — all stay within the current major, so risk is low. | Package | From → To | Clears | |---|---|---| | `axios` | ^1.13.5 → ^1.16.0 | ReDoS, Proxy-Auth leak, proto-pollution gadgets, NO_PROXY bypass, resource DoS (56 alerts) | | `next` | 16.1.7 → ^16.2.6 | DoS, middleware/proxy bypass, SSRF, cache poisoning, XSS (32 alerts) | | `vitest` | 4.0.18 → ^4.1.0 | **CRITICAL** — UI server arbitrary file read/exec (#1421) | | `qs` | ^6.11.2 → ^6.15.2 | `qs.stringify` DoS | | `dompurify` | 3.3.3 → ^3.4.0 | proto-pollution XSS + FORBID_TAGS / SAFE_FOR_TEMPLATES bypasses | | `@nestjs/core` | 11.1.16 → ^11.1.18 | improper output neutralization / injection | | `nodemailer` | 8.0.4 → 8.0.10 | SMTP command injection via CRLF (bumped via root `resolutions`) | | `path-to-regexp` | ^8.2.0 → ^8.4.0 | ReDoS via multiple wildcards | | `file-type` | ^21.3.1 → ^21.3.2 | ZIP decompression-bomb DoS | | `@opentelemetry/exporter-prometheus` | ^0.211.0 → ^0.217.0 | exporter process crash via malformed HTTP request (#1183/#1184) | ## Notes - Added a `next` root **resolution** so the dev-only `@react-email/preview-server` copy (hard-pinned at `16.0.10`) is also pulled up to the patched `16.2.x` line — otherwise that copy keeps the Next.js alerts open. - `@opentelemetry/exporter-prometheus` 0.217 pulled `@opentelemetry/sdk-metrics` to 2.7.1 (compatible); `@opentelemetry/api` stays pinned at 1.9.1. - **Transitive-only** vulnerable packages (undici, tmp, ws, brace-expansion, …) are handled in a **separate PR** per the split-by-group plan. - Breaking major bumps (electron, uuid, serialize-javascript) and migrations (Apollo Server 3→4, simplemde) are intentionally **out of scope** here.	2026-06-08 12:49:31 +00:00
Charles Bochet	afec1f1332	chore(deps): bump @babel/plugin-transform-modules-systemjs to 7.29.7 (CVE-2026-44728) (#21306) ... ## What Bumps the transitive dev dependency `@babel/plugin-transform-modules-systemjs` from `7.25.9` → `7.29.7` (lockfile-only). ## Why Resolves Dependabot alert **#1182** — **GHSA-fv7c-fp4j-7gwp** / **CVE-2026-44728** (high severity): > `@babel/plugin-transform-modules-systemjs` generates arbitrary code when compiling malicious input. - Vulnerable range: `>= 7.12.0, <= 7.29.3` - First patched: `7.29.4` ## How It's pulled in transitively via `@babel/preset-env` with the range `^7.25.9`, which `7.29.7` satisfies — so **only `yarn.lock` changes**, no `package.json` edits needed. The diff is confined to the `@babel/*` subtree (13 helper packages updated alongside it). ## Notes - Scope is `development` only. - The alert is currently marked *dismissed* on the security tab; opening this anyway to actually remove the vulnerable version from the lockfile. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-08 13:22:27 +02:00
Raphaël Bosi	6f9b59b224	Scaffold twenty-new-ui (#21236) ... Scaffolds `twenty-new-ui`, the next-gen replacement for `twenty-ui`, on **SCSS** Modules + **Base UI** (no Linaria). - **Tooling**: Vite lib build, subpaths mirror twenty-ui, typed SCSS Modules, Storybook + axe a11y, size-limit, Nx targets. - **Theme**: single token source → nx generateTheme emits the CSS vars + accessor; parity test asserts token-for-token match with twenty-ui. Migrated a first `Toggle` component with its stories to allow @charlesBochet to wire the new pixel-diff system. --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-05 10:42:57 +00:00
Abdullah.	d3a1781a59	Use serialize-javascript for JSON-LD serialization on twenty-website (#21223) ... Our scanner flags the `dangerouslySetInnerHTML` in `JsonLd.tsx` as a potential XSS sink. Since JSON-LD must be emitted as raw `<script type="application/ld+json">` text (rendering it as a React child HTML-entity-escapes it and corrupts the JSON, and the site is statically generated so it must be in the SSG HTML for crawlers), `dangerouslySetInnerHTML` is the correct, Next.js-documented approach (the real fix is sanitizing the payload). This PR swaps our hand-rolled `JSON.stringify().replace(/</g, ...)` for [`serialize-javascript`](https://www.npmjs.com/package/serialize-javascript) in `isJSON` mode, the maintained library [Next.js explicitly recommends](https://nextjs.org/docs/app/guides/json-ld) for this, so the script-unsafe characters are escaped by a vetted serializer rather than custom code.	2026-06-04 14:38:18 +00:00
Charles Bochet	f4da7767f8	chore: remove Chromatic dependencies and configuration (#21221) ... ## Summary - Remove `chromatic` and `@chromatic-com/storybook` devDependencies from twenty-front - Remove global `chromatic` Nx target from nx.json and twenty-front project.json override - Remove commented Chromatic Storybook addon from twenty-front - Remove `CHROMATIC_PROJECT_TOKEN` from .env.example - Update README to remove Chromatic sponsor reference (image was already missing) - Update stale Chromatic comment in toSpliced.ts ## Context Visual regression testing has moved from Chromatic SaaS to self-hosted Argos at `argos.twenty-internal.com`. These are dead references that are no longer used by any CI workflow. **Note:** Story `parameters.chromatic: { disableSnapshot: true }` entries are intentionally kept — the Argos plugin reads them as a fallback. ## Test plan - Verify `yarn install` succeeds after dependency removal - Verify no workflow references `chromatic` or `nx chromatic`	2026-06-04 13:15:23 +00:00
neo773	437eed0862	fix(messaging): fix reply-quotation stripping that emptied email bodies (#21118) ... some synced messages were stored with empty bodies, others with the entire reply thread re-quoted, planer was stripping entirely quoted forwards down to nothing and not trimming inline reply history at all switched plaintext quote stripping to `email-reply-parser`, falling back to the full text when it strips everything so forwards don't end up blank. kept planer for the html path, and normalized body whitespac --------- Co-authored-by: prastoin <paul@twenty.com>	2026-06-04 12:31:53 +00:00
Paul Rastoin	3d49642d12	[AUDIT] Run knip over twenty-server (#21159) ... # Introduction Run [knip](https://knip.dev/) over twenty-server Used config: ```json { "$schema": "https://unpkg.com/knip@5/schema.json", "workspaces": { "packages/twenty-server": { "entry": [ "src/main.ts", "src/command/command.ts", "src/queue-worker/queue-worker.ts", "src/database/scripts/setup-db.ts", "src/database/scripts/truncate-db.ts", "src/database/clickHouse/migrations/run-migrations.ts", "src/database/clickHouse/seeds/run-seeds.ts", "src/instrument.ts", "lingui.config.ts", "test/integration/graphql/codegen/index.ts", "test/integration/utils/setup-test.ts", "test/integration/utils/teardown-test.ts", "scripts/**/*.ts", "**/*.spec.ts", "**/*.integration-spec.ts" ], "project": ["src/**/*.ts", "test/**/*.ts", "scripts/**/*.ts"], "ignore": [ "src/database/typeorm/**/migrations/**", "src/database/typeorm/**/*.entity.ts", "**/*.workspace-entity.ts", "**/logic-function-resource/constants/seed-project/**" ], "ignoreDependencies": ["@types/psl", "@types/aws-lambda"], "ignoreBinaries": ["nest", "lingui", "typeorm"] } } } ```	2026-06-04 10:05:22 +00:00
dependabot[bot]	f0be78e629	chore(deps-dev): bump prettier from 3.4.2 to 3.8.3 (#21205) ... Bumps [prettier](https://github.com/prettier/prettier) from 3.4.2 to 3.8.3. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/prettier/prettier/releases">prettier's releases</a>.</em></p> <blockquote> <h2>3.8.3</h2> <ul> <li>SCSS: Prevent trailing comma in <code>if()</code> function (<a href="https://redirect.github.com/prettier/prettier/pull/18471">prettier/prettier#18471</a> by <a href="https://github.com/kovsu"><code>@​kovsu</code></a>)</li> </ul> <p>🔗 <a href="https://github.com/prettier/prettier/blob/3.8.3/CHANGELOG.md#383">Changelog</a></p> <h2>3.8.2</h2> <ul> <li>Support Angular v21.2</li> </ul> <p>🔗 <a href="https://github.com/prettier/prettier/blob/main/CHANGELOG.md#382">Changelog</a></p> <h2>3.8.1</h2> <ul> <li>Include available <code>printers</code> in plugin type declarations (<a href="https://redirect.github.com/prettier/prettier/pull/18706">#18706</a> by <a href="https://github.com/porada"><code>@​porada</code></a>)</li> </ul> <p>🔗 <a href="https://github.com/prettier/prettier/blob/main/CHANGELOG.md#381">Changelog</a></p> <h2>3.8.0</h2> <ul> <li>Support Angular v21.1</li> </ul> <p><a href="https://github.com/prettier/prettier/compare/3.7.4...3.8.0">diff</a></p> <p>🔗 <a href="https://prettier.io/blog/2026/01/14/3.8.0">Release note &quot;Prettier 3.8: Support for Angular v21.1&quot;</a></p> <h2>3.7.4</h2> <h2>What's Changed</h2> <ul> <li>Fix comment in union type gets duplicated by <a href="https://github.com/fisker"><code>@​fisker</code></a> in <a href="https://redirect.github.com/prettier/prettier/pull/18393">prettier/prettier#18393</a></li> <li>Fix unstable comment print in union type by <a href="https://github.com/fisker"><code>@​fisker</code></a> in <a href="https://redirect.github.com/prettier/prettier/pull/18395">prettier/prettier#18395</a></li> <li>Avoid quote around LWC interpolations by <a href="https://github.com/kovsu"><code>@​kovsu</code></a> in <a href="https://redirect.github.com/prettier/prettier/pull/18383">prettier/prettier#18383</a></li> </ul> <p>🔗 <a href="https://github.com/prettier/prettier/blob/main/CHANGELOG.md#374">Changelog</a></p> <h2>3.7.3</h2> <h2>What's Changed</h2> <ul> <li>Fix <code>prettier.getFileInfo()</code> change that breaks VSCode extension by <a href="https://github.com/fisker"><code>@​fisker</code></a> in <a href="https://redirect.github.com/prettier/prettier/pull/18375">prettier/prettier#18375</a></li> </ul> <p>🔗 <a href="https://github.com/prettier/prettier/blob/main/CHANGELOG.md#373">Changelog</a></p> <h2>3.7.2</h2> <h2>What's Changed</h2> <ul> <li>Fix string print when switching quotes by <a href="https://github.com/fisker"><code>@​fisker</code></a> in <a href="https://redirect.github.com/prettier/prettier/pull/18351">prettier/prettier#18351</a></li> <li>Preserve quote for embedded HTML attribute values by <a href="https://github.com/kovsu"><code>@​kovsu</code></a> in <a href="https://redirect.github.com/prettier/prettier/pull/18352">prettier/prettier#18352</a></li> <li>Fix comment in empty type literal by <a href="https://github.com/fisker"><code>@​fisker</code></a> in <a href="https://redirect.github.com/prettier/prettier/pull/18364">prettier/prettier#18364</a></li> </ul> <p>🔗 <a href="https://github.com/prettier/prettier/blob/main/CHANGELOG.md#372">Changelog</a></p> <h2>3.7.1</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/prettier/prettier/blob/main/CHANGELOG.md">prettier's changelog</a>.</em></p> <blockquote> <h1>3.8.3</h1> <p><a href="https://github.com/prettier/prettier/compare/3.8.2...3.8.3">diff</a></p> <h4>SCSS: Prevent trailing comma in <code>if()</code> function (<a href="https://redirect.github.com/prettier/prettier/pull/18471">#18471</a> by <a href="https://github.com/kovsu"><code>@​kovsu</code></a>)</h4> <!-- raw HTML omitted --> <pre lang="scss"><code>// Input $value: if(sass(false): 1; else: -1); <p>// Prettier 3.8.2 $value: if( sass(false): 1; else: -1, );</p> <p>// Prettier 3.8.3 $value: if(sass(false): 1; else: -1); </code></pre></p> <h1>3.8.2</h1> <p><a href="https://github.com/prettier/prettier/compare/3.8.1...3.8.2">diff</a></p> <h4>Angular: Support Angular v21.2 (<a href="https://redirect.github.com/prettier/prettier/pull/18722">#18722</a>, <a href="https://redirect.github.com/prettier/prettier/pull/19034">#19034</a> by <a href="https://github.com/fisker"><code>@​fisker</code></a>)</h4> <p>Exhaustive typechecking with <code>@default never;</code></p> <!-- raw HTML omitted --> <pre lang="html"><code>&lt;!-- Input --&gt; @switch (foo) { @case (1) {} @default never; } <p>&lt;!-- Prettier 3.8.1 --&gt; SyntaxError: Incomplete block &quot;default never&quot;. If you meant to write the @ character, you should use the &quot;&amp;<a href="https://redirect.github.com/prettier/prettier/issues/64">#64</a>;&quot; HTML entity instead. (3:3)</p> <p>&lt;!-- Prettier 3.8.2 --&gt; <a href="https://github.com/switch"><code>@​switch</code></a> (foo) { <a href="https://github.com/case"><code>@​case</code></a> (1) {} <a href="https://github.com/default"><code>@​default</code></a> never; } </code></pre></p> <p><code>arrow function</code> and <code>instanceof</code> expressions.</p> <!-- raw HTML omitted --> <pre lang="html"><code>&lt;/tr&gt;&lt;/table&gt; </code></pre> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/prettier/prettier/commit/d7108a79ec745c04292aabf22c4c1adbd690b191"><code>d7108a7</code></a> Release 3.8.3</li> <li><a href="https://github.com/prettier/prettier/commit/177f90898170d363ef64fde663e4d13170688bfe"><code>177f908</code></a> Prevent trailing comma in SCSS <code>if()</code> function (<a href="https://redirect.github.com/prettier/prettier/issues/18471">#18471</a>)</li> <li><a href="https://github.com/prettier/prettier/commit/1cd40668c3d6f2f4cf9d87bbc9096d92361b2606"><code>1cd4066</code></a> Release <code>@​prettier/plugin-oxc</code><a href="https://github.com/0"><code>@​0</code></a>.1.4</li> <li><a href="https://github.com/prettier/prettier/commit/a8700e245038cd8cc0cf28ef06ffedbcb3fc2dfc"><code>a8700e2</code></a> Update oxc-parser to v0.125.0</li> <li><a href="https://github.com/prettier/prettier/commit/752157c78eca6f0a30e5d5cb513b682c5ecfa01e"><code>752157c</code></a> Fix tests</li> <li><a href="https://github.com/prettier/prettier/commit/053fd418e180b12fa2014260212fae831f5fc5ec"><code>053fd41</code></a> Bump Prettier dependency to 3.8.2</li> <li><a href="https://github.com/prettier/prettier/commit/904c6365ec46726fd0e21021c52ae934b7e5abc6"><code>904c636</code></a> Clean changelog_unreleased</li> <li><a href="https://github.com/prettier/prettier/commit/dc1f7fcc508d116cbf1644d69a1f0eb93e40d4a4"><code>dc1f7fc</code></a> Update dependents count</li> <li><a href="https://github.com/prettier/prettier/commit/b31557cf331a02acf83e7e29d1001b070189a0d9"><code>b31557c</code></a> Release 3.8.2</li> <li><a href="https://github.com/prettier/prettier/commit/96bbaeda0525bf758e464aed2f939d739a85c315"><code>96bbaed</code></a> Support Angular v21.2 (<a href="https://redirect.github.com/prettier/prettier/issues/18722">#18722</a>)</li> <li>Additional commits viewable in <a href="https://github.com/prettier/prettier/compare/3.4.2...3.8.3">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for prettier since your current version.</p> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-06-04 09:45:41 +02:00
dependabot[bot]	fe5337b7d0	chore(deps-dev): bump @types/passport-microsoft from 2.1.0 to 2.1.1 (#21204) ... Bumps [@types/passport-microsoft](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/passport-microsoft) from 2.1.0 to 2.1.1. <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/passport-microsoft">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-06-04 09:45:19 +02:00
dependabot[bot]	f50e471385	chore(deps): bump @mantine/hooks from 8.3.15 to 8.3.18 (#21203) ... Bumps [@mantine/hooks](https://github.com/mantinedev/mantine/tree/HEAD/packages/@mantine/hooks) from 8.3.15 to 8.3.18. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/mantinedev/mantine/releases">@​mantine/hooks's releases</a>.</em></p> <blockquote> <h2>8.3.18</h2> <p>This is the last 8.x release. You are welcome to test 9.0 alpha version and provide feedback before its release on March 31 – <a href="https://alpha.mantine.dev/changelog/9-0-0/">https://alpha.mantine.dev/changelog/9-0-0/</a></p> <ul> <li><code>[@mantine/core]</code> PasswordInput: Fix styles api props not resolving correctly in theme (<a href="https://github.com/mantinedev/mantine/tree/HEAD/packages/@mantine/hooks/issues/8716">#8716</a>)</li> </ul> <h2>8.3.17</h2> <h2>Changes</h2> <ul> <li><code>[@mantine/core]</code> Stepper: Fix Google Translate compatibility issues (<a href="https://github.com/mantinedev/mantine/tree/HEAD/packages/@mantine/hooks/issues/8744">#8744</a>)</li> <li><code>[@mantine/hooks]</code> use-list-state: Add memoization to all handlers (<a href="https://github.com/mantinedev/mantine/tree/HEAD/packages/@mantine/hooks/issues/8739">#8739</a>)</li> </ul> <h2>8.3.16</h2> <h2>What's Changed</h2> <ul> <li><code>[@mantine/modals]</code> Fix <code>onClose</code> being called multiple times (<a href="https://github.com/mantinedev/mantine/tree/HEAD/packages/@mantine/hooks/issues/8727">#8727</a>)</li> <li><code>[@mantine/core]</code> Tooltip: Fix component not throwing erro when used with string (<a href="https://github.com/mantinedev/mantine/tree/HEAD/packages/@mantine/hooks/issues/8694">#8694</a>)</li> <li><code>[@mantine/core]</code> NumberInput: Fix incorrect decimal separator parsing in <code>onPaste</code></li> <li><code>[@mantine/core]</code> AppShell: Fix <code>layout=&quot;alt&quot;</code> not working with <code>mode=&quot;static&quot;</code></li> <li><code>[@mantine/stotlight]</code> Fix actions list being rendered when nothing found message was not set (<a href="https://github.com/mantinedev/mantine/tree/HEAD/packages/@mantine/hooks/issues/8592">#8592</a>)</li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/mantinedev/mantine/compare/8.3.15...8.3.16">https://github.com/mantinedev/mantine/compare/8.3.15...8.3.16</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/mantinedev/mantine/commit/530249feb498d74d5ea849d2984c86efd072f38c"><code>530249f</code></a> [release] Version: 8.3.18</li> <li><a href="https://github.com/mantinedev/mantine/commit/bac61d6fc21be84bd80d1d9232a605c05692ae75"><code>bac61d6</code></a> [release] Version: 8.3.17</li> <li><a href="https://github.com/mantinedev/mantine/commit/6b3fdee137584aece43b88b62d8c207a58c35295"><code>6b3fdee</code></a> [refactor] Fix formatting</li> <li><a href="https://github.com/mantinedev/mantine/commit/c048f996cc1a8287bd9eaba1bb59bc6637316b90"><code>c048f99</code></a> [<code>@​mantine/hooks</code>] use-list-state: Add memoization to all handlers (<a href="https://github.com/mantinedev/mantine/tree/HEAD/packages/@mantine/hooks/issues/8739">#8739</a>)</li> <li><a href="https://github.com/mantinedev/mantine/commit/dbb8732ca3350259e0cf7b2536d0bcc885b1b587"><code>dbb8732</code></a> [release] Version: 8.3.16</li> <li>See full diff in <a href="https://github.com/mantinedev/mantine/commits/8.3.18/packages/@mantine/hooks">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-06-04 09:45:10 +02:00
Charles Bochet	e6614299c6	feat(ci): integrate Argos visual regression via vitest screenshots (#21210) ... ## Summary - Adds `@argos-ci/storybook` vitest plugin to `twenty-ui` for automatic screenshot capture during vitest storybook tests - Uploads captured screenshots (PNG, ~5MB) as a CI artifact instead of passing the full storybook build - Updates the visual regression dispatch workflow to pass `mode=argos-screenshots` to ci-privileged, which then uploads screenshots to Argos via CLI This replaces the 10-minute Storybook screenshot capture with a ~30s vitest browser-mode approach. The heavy screenshot work happens on free public runners, while ci-privileged only handles the Argos API upload (keeping secrets private). ## Architecture ``` twenty (public, free runners) ci-privileged (private) ───────────────────────────── ──────────────────────── 1. Build storybook-static 4. Download screenshots artifact 2. Vitest captures screenshots 5. `argos upload` → Argos API 3. Upload screenshots artifact 6. Poll for results 7. Post PR comment ``` ## Test plan - [x] Verified locally: vitest captures 225 screenshots in ~28s - [x] Verified `@argos-ci/cli upload` successfully creates Argos build from captured screenshots - [x] Argos diffs computed and results visible via API - [ ] CI runs end-to-end on a PR	2026-06-04 08:46:37 +02:00
Abdullah.	ccffc4a1ea	Fix axios related dependabot alerts generated against root yarn.lock (#21187) ... Fixes the following Dependabot alerts: https://github.com/twentyhq/twenty/security/dependabot?q=is%3Aopen+package%3Aaxios+manifest%3Ayarn.lock+has%3Apatch Upgraded the referenced version in root yarn.lock. Creating a separate PR for the nested ones to keep the updates isolated (e.g. /seed-dependencies/yarn.lock).	2026-06-03 23:19:42 +00:00
Rashad Karanouh	8c3a93871e	fix: update yarn.lock after removing dotenv and zod from twenty-sdk (#21174) ... ## Summary - Commit b330105470 removed `dotenv` and `zod` from `packages/twenty-sdk/package.json` dependencies but did not run `yarn install`, leaving the lockfile out of sync. - `yarn install --immutable` in CI was failing with `YN0028: The lockfile would have been modified by this install` on those two packages. - This PR just runs `yarn install` to sync the lockfile — no logic changes. ## Root cause [Failing CI run](https://github.com/twentyhq/twenty-infra/actions/runs/26883193920/job/79288298420): ``` YN0028: - dotenv: "npm:^16.4.0" YN0028: - zod: "npm:^4.1.11" YN0028: The lockfile would have been modified by this install, which is explicitly forbidden. ``` ## Changes `yarn.lock` only — removes the `dotenv@^16.4.0` range and the `twenty-sdk` metadata entries for `dotenv` and `zod`.	2026-06-03 12:23:48 +00:00
Thomas des Francs	1642be86f5	Bonapara/twenty codex plugin (#20857) ... @martmull v2.0 ;) --------- Co-authored-by: martmull <martmull@hotmail.fr> Co-authored-by: bosiraphael <raphael.bosi@gmail.com>	2026-06-02 14:39:14 +00:00
Rashad Karanouh	7e034f711f	feat(website): surface partner Categories (partnerScope) in marketplace, drop deploymentExpertise facet (#21127) ... ## What Rebinds the marketplace's expertise facet from `deploymentExpertise` (Cloud / Self-host) to **`partnerScope`** — the five partner Categories: Advisory & Discovery · Solutioning · Custom Development · Hosting & Infrastructure · Training & Adoption. Moves the card chip, the profile facts row, the dropdown filter, the `?categories=` URL param, and the API-boundary normalization onto `partnerScope`. The standalone Cloud/Self-host facet is **dropped** (hosting is now the `HOSTING` category), per the harmonization decision. ## Depends on - The app exposing `partnerScope` — companion app PR #21126. - The new `partnerScope` options + data migration — signup app PR #21040. ## Tests TDD red→green on: `filter-partners`, both API normalizers, `filter-url-helpers`, `PartnerCard`, `use-filter-state`. 53/53 pass; typecheck + lint + format clean. ## Merge order (we'll decide) Independent diff. Suggested last of the four, after the signup PRs (#21039 / #21040) and the app PR (#21126). Run `lingui:extract` once after #21039 merges so the `.po` files don't conflict twice. Deploy the app + migrate before the website ships.	2026-06-02 10:32:54 +00:00
Paul Rastoin	6ad6fcce0f	Bump playwright (#21113) ... Playwright installation is infinite looping in the ci seems like to be a global outage	2026-06-01 18:06:55 +02:00
dependabot[bot]	6d550611d2	chore(deps): bump typescript from 5.9.2 to 5.9.3 (#20991) ... Bumps [typescript](https://github.com/microsoft/TypeScript) from 5.9.2 to 5.9.3. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/microsoft/TypeScript/releases">typescript's releases</a>.</em></p> <blockquote> <h2>TypeScript 5.9.3</h2> <p>Note: this tag was recreated to point at the correct commit. The npm package contained the correct content.</p> <p>For release notes, check out the <a href="https://devblogs.microsoft.com/typescript/announcing-typescript-5-9/">release announcement</a></p> <ul> <li><a href="https://github.com/Microsoft/TypeScript/issues?utf8=%E2%9C%93&amp;q=milestone%3A%22TypeScript+5.9.0%22+is%3Aclosed+">fixed issues query for Typescript 5.9.0 (Beta)</a>.</li> <li><a href="https://github.com/Microsoft/TypeScript/issues?utf8=%E2%9C%93&amp;q=milestone%3A%22TypeScript+5.9.1%22+is%3Aclosed+">fixed issues query for Typescript 5.9.1 (RC)</a>.</li> <li><em>No specific changes for TypeScript 5.9.2 (Stable)</em></li> <li><a href="https://github.com/Microsoft/TypeScript/issues?utf8=%E2%9C%93&amp;q=milestone%3A%22TypeScript+5.9.3%22+is%3Aclosed+">fixed issues query for Typescript 5.9.3 (Stable)</a>.</li> </ul> <p>Downloads are available on:</p> <ul> <li><a href="https://www.npmjs.com/package/typescript">npm</a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/microsoft/TypeScript/commit/c63de15a992d37f0d6cec03ac7631872838602cb"><code>c63de15</code></a> Bump version to 5.9.3 and LKG</li> <li><a href="https://github.com/microsoft/TypeScript/commit/8428ca4cc8a7ecc9ac18dd0258016228814f5eaf"><code>8428ca4</code></a> 🤖 Pick PR <a href="https://redirect.github.com/microsoft/TypeScript/issues/62438">#62438</a> (Fix incorrectly ignored dts file fr...) into release-5.9 (#...</li> <li><a href="https://github.com/microsoft/TypeScript/commit/a131cac6831aa6532ea963d0cb3131b957cad980"><code>a131cac</code></a> 🤖 Pick PR <a href="https://redirect.github.com/microsoft/TypeScript/issues/62351">#62351</a> (Add missing Float16Array constructo...) into release-5.9 (#...</li> <li><a href="https://github.com/microsoft/TypeScript/commit/04243333584a5bfaeb3434c0982c6280fe87b8d5"><code>0424333</code></a> 🤖 Pick PR <a href="https://redirect.github.com/microsoft/TypeScript/issues/62423">#62423</a> (Revert PR 61928) into release-5.9 (<a href="https://redirect.github.com/microsoft/TypeScript/issues/62425">#62425</a>)</li> <li><a href="https://github.com/microsoft/TypeScript/commit/bdb641a4347af822916fb8cdb9894c9c2d2421dd"><code>bdb641a</code></a> 🤖 Pick PR <a href="https://redirect.github.com/microsoft/TypeScript/issues/62311">#62311</a> (Fix parenthesizer rules for manuall...) into release-5.9 (#...</li> <li><a href="https://github.com/microsoft/TypeScript/commit/0d9b9b92e2aca2f75c979a801abbc21bff473748"><code>0d9b9b9</code></a> 🤖 Pick PR <a href="https://redirect.github.com/microsoft/TypeScript/issues/61978">#61978</a> (Restructure CI to prepare for requi...) into release-5.9 (#...</li> <li><a href="https://github.com/microsoft/TypeScript/commit/2dce0c58af51cf9a9068365dc2f756c61b82b597"><code>2dce0c5</code></a> Intentionally regress one buggy declaration output to an older version (<a href="https://redirect.github.com/microsoft/TypeScript/issues/62163">#62163</a>)</li> <li>See full diff in <a href="https://github.com/microsoft/TypeScript/compare/v5.9.2...v5.9.3">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Félix Malfait <felix.malfait@gmail.com> Co-authored-by: Weiko <corentin@twenty.com> Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: Félix Malfait <FelixMalfait@users.noreply.github.com>	2026-05-29 08:39:35 +02:00
dependabot[bot]	64e0b76d00	chore(deps): bump js-cookie from 3.0.5 to 3.0.7 (#20992) ... Bumps [js-cookie](https://github.com/js-cookie/js-cookie) from 3.0.5 to 3.0.7. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/js-cookie/js-cookie/releases">js-cookie's releases</a>.</em></p> <blockquote> <h2>v3.0.7</h2> <ul> <li>Prevent cookie attribute injection: CVE-2026-46625 (eb3c40e)</li> <li>Add <code>Partitioned</code> attribute to readme (b994768)</li> <li>Publish to npm registry via trusted publisher exclusively (4dc71be)</li> <li>Ensure consistent behaviour for <code>get('name')</code> + <code>get()</code> (1953d30)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/js-cookie/js-cookie/commit/17bacba0171dd022728d8fdeba3203c60791bf58"><code>17bacba</code></a> Craft v3.0.7 release</li> <li><a href="https://github.com/js-cookie/js-cookie/commit/adb823cb7e95ead47f3af4d4951e589acbde2077"><code>adb823c</code></a> Fix release workflow halting at <code>git tag</code></li> <li><a href="https://github.com/js-cookie/js-cookie/commit/5f9e759b07d2752e8407a3a43fb5f879bf384c5e"><code>5f9e759</code></a> May remove Git user config from release workflow</li> <li><a href="https://github.com/js-cookie/js-cookie/commit/6ac921184c7b3b7d9431c88707f56521acd72ab4"><code>6ac9211</code></a> Fix release workflow not able to push commit + tag</li> <li><a href="https://github.com/js-cookie/js-cookie/commit/2278bc55e1804c4c2d9bd2110a9b449949a52751"><code>2278bc5</code></a> Fix missing package version bump</li> <li><a href="https://github.com/js-cookie/js-cookie/commit/eb3c40e89731e99b8970faaf35ddad249c6c0020"><code>eb3c40e</code></a> Prevent cookie attribute injection</li> <li><a href="https://github.com/js-cookie/js-cookie/commit/f6f157f430d707d2ffd0c9c9138227a6cea564e5"><code>f6f157f</code></a> Bump globals from 17.5.0 to 17.6.0</li> <li><a href="https://github.com/js-cookie/js-cookie/commit/f409d022da50a0c6fa8724f087fbc50fab9a9533"><code>f409d02</code></a> Bump eslint from 10.2.0 to 10.3.0</li> <li><a href="https://github.com/js-cookie/js-cookie/commit/a686883c03a754c04546cfc1653911a70a640b40"><code>a686883</code></a> Bump protobufjs in the npm_and_yarn group across 1 directory</li> <li><a href="https://github.com/js-cookie/js-cookie/commit/c6112d2d4f2881a12aaf89d9e2996ef6870eb6d0"><code>c6112d2</code></a> Bump <code>@​protobufjs/utf8</code> in the npm_and_yarn group across 1 directory</li> <li>Additional commits viewable in <a href="https://github.com/js-cookie/js-cookie/compare/v3.0.5...v3.0.7">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for js-cookie since your current version.</p> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Weiko <corentin@twenty.com>	2026-05-28 21:25:35 +02:00
dependabot[bot]	6566a918af	chore(deps): bump @apollo/client from 4.1.6 to 4.2.0 (#20993) ... Bumps [@apollo/client](https://github.com/apollographql/apollo-client) from 4.1.6 to 4.2.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/apollographql/apollo-client/releases">@​apollo/client's releases</a>.</em></p> <blockquote> <h2><code>@​apollo/client</code><a href="https://github.com/4"><code>@​4</code></a>.2.0</h2> <h3>Minor Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/apollographql/apollo-client/pull/13132">#13132</a> <a href="https://github.com/apollographql/apollo-client/commit/f3ce805425d10a9666218a8e109288a2d46dcab1"><code>f3ce805</code></a> Thanks <a href="https://github.com/phryneas"><code>@​phryneas</code></a>! - Introduce &quot;classic&quot; and &quot;modern&quot; method and hook signatures.</p> <p>Apollo Client 4.2 introduces two signature styles for methods and hooks. All signatures previously present are now &quot;classic&quot; signatures, and a new set of &quot;modern&quot; signatures are added alongside them.</p> <p><strong>Classic signatures</strong> are the default and are identical to the signatures before Apollo Client 4.2, preserving backward compatibility. Classic signatures still work with manually specified TypeScript generics (e.g., <code>useSuspenseQuery&lt;MyData&gt;(...)</code>). However, manually specifying generics has been discouraged for a long time—instead, we recommend using <code>TypedDocumentNode</code> to automatically infer types, which provides more accurate results without any manual annotations.</p> <p><strong>Modern signatures</strong> automatically incorporate your declared <code>defaultOptions</code> into return types, providing more accurate types. Modern signatures infer types from the document node and do not support manually passing generic type arguments; TypeScript will produce a type error if you attempt to do so.</p> <p>Methods and hooks automatically switch to modern signatures the moment any non-optional property is declared in <code>DeclareDefaultOptions</code>. The switch happens across all methods and hooks globally:</p> <pre lang="ts"><code>// apollo.d.ts import &quot;@apollo/client&quot;; declare module &quot;@apollo/client&quot; { namespace ApolloClient { namespace DeclareDefaultOptions { interface WatchQuery { errorPolicy: &quot;all&quot;; // non-optional → modern signatures activated automatically } } } } </code></pre> <p>Users can also manually switch to modern signatures without declaring any <code>defaultOptions</code>, for example when wanting accurate type inference without relying on global <code>defaultOptions</code>:</p> <pre lang="ts"><code>// apollo.d.ts import &quot;@apollo/client&quot;; declare module &quot;@apollo/client&quot; { export interface TypeOverrides { signatureStyle: &quot;modern&quot;; } } </code></pre> <p>Users can do a global <code>DeclareDefaultOptions</code> type augmentation and then manually switch back to &quot;classic&quot; for migration purposes:</p> <pre lang="ts"><code>// apollo.d.ts import &quot;@apollo/client&quot;; declare module &quot;@apollo/client&quot; { export interface TypeOverrides { signatureStyle: &quot;classic&quot;; } } </code></pre> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/apollographql/apollo-client/blob/main/CHANGELOG.md">@​apollo/client's changelog</a>.</em></p> <blockquote> <h2>4.2.0</h2> <h3>Minor Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/apollographql/apollo-client/pull/13132">#13132</a> <a href="https://github.com/apollographql/apollo-client/commit/f3ce805425d10a9666218a8e109288a2d46dcab1"><code>f3ce805</code></a> Thanks <a href="https://github.com/phryneas"><code>@​phryneas</code></a>! - Introduce &quot;classic&quot; and &quot;modern&quot; method and hook signatures.</p> <p>Apollo Client 4.2 introduces two signature styles for methods and hooks. All signatures previously present are now &quot;classic&quot; signatures, and a new set of &quot;modern&quot; signatures are added alongside them.</p> <p><strong>Classic signatures</strong> are the default and are identical to the signatures before Apollo Client 4.2, preserving backward compatibility. Classic signatures still work with manually specified TypeScript generics (e.g., <code>useSuspenseQuery&lt;MyData&gt;(...)</code>). However, manually specifying generics has been discouraged for a long time—instead, we recommend using <code>TypedDocumentNode</code> to automatically infer types, which provides more accurate results without any manual annotations.</p> <p><strong>Modern signatures</strong> automatically incorporate your declared <code>defaultOptions</code> into return types, providing more accurate types. Modern signatures infer types from the document node and do not support manually passing generic type arguments; TypeScript will produce a type error if you attempt to do so.</p> <p>Methods and hooks automatically switch to modern signatures the moment any non-optional property is declared in <code>DeclareDefaultOptions</code>. The switch happens across all methods and hooks globally:</p> <pre lang="ts"><code>// apollo.d.ts import &quot;@apollo/client&quot;; declare module &quot;@apollo/client&quot; { namespace ApolloClient { namespace DeclareDefaultOptions { interface WatchQuery { errorPolicy: &quot;all&quot;; // non-optional → modern signatures activated automatically } } } } </code></pre> <p>Users can also manually switch to modern signatures without declaring any <code>defaultOptions</code>, for example when wanting accurate type inference without relying on global <code>defaultOptions</code>:</p> <pre lang="ts"><code>// apollo.d.ts import &quot;@apollo/client&quot;; declare module &quot;@apollo/client&quot; { export interface TypeOverrides { signatureStyle: &quot;modern&quot;; } } </code></pre> <p>Users can do a global <code>DeclareDefaultOptions</code> type augmentation and then manually switch back to &quot;classic&quot; for migration purposes:</p> <pre lang="ts"><code>// apollo.d.ts import &quot;@apollo/client&quot;; declare module &quot;@apollo/client&quot; { export interface TypeOverrides { signatureStyle: &quot;classic&quot;; } } </code></pre> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/apollographql/apollo-client/commit/e010bdd239b5c10415d4b70ca791467cde12fc88"><code>e010bdd</code></a> Version Packages (<a href="https://redirect.github.com/apollographql/apollo-client/issues/13241">#13241</a>)</li> <li><a href="https://github.com/apollographql/apollo-client/commit/9c4c01a640b43bfb47bd52b25d5881c4ad7bec71"><code>9c4c01a</code></a> Release 4.2 (<a href="https://redirect.github.com/apollographql/apollo-client/issues/13129">#13129</a>)</li> <li><a href="https://github.com/apollographql/apollo-client/commit/222838e99bc6054120cc1f881bb225b1ef049de9"><code>222838e</code></a> Exit prerelease mode</li> <li><a href="https://github.com/apollographql/apollo-client/commit/7d3a533c811a8423536ceeebccc06413ded5b6a3"><code>7d3a533</code></a> Merge branch 'main' into release-4.2</li> <li><a href="https://github.com/apollographql/apollo-client/commit/f20d591bbf74cb4f0d87ec9a14b93a59fe46b039"><code>f20d591</code></a> chore(deps): update actions/create-github-app-token digest to d72941d (<a href="https://redirect.github.com/apollographql/apollo-client/issues/13239">#13239</a>)</li> <li><a href="https://github.com/apollographql/apollo-client/commit/d4a28b6142e47164c8a24bd8c05a8aa3f1ce4eee"><code>d4a28b6</code></a> chore(deps): pin dependencies (<a href="https://redirect.github.com/apollographql/apollo-client/issues/13237">#13237</a>)</li> <li><a href="https://github.com/apollographql/apollo-client/commit/c1f39cf5402b052ab92886a1857840a745aee02b"><code>c1f39cf</code></a> ci: pin Actions@SHA and disable cache on workflows with elevated OIDC permiss...</li> <li><a href="https://github.com/apollographql/apollo-client/commit/511048b7bd6253a38a6b7ebe58e9674a39c74273"><code>511048b</code></a> Event-based refetching docs (<a href="https://redirect.github.com/apollographql/apollo-client/issues/13228">#13228</a>)</li> <li><a href="https://github.com/apollographql/apollo-client/commit/d1f68f1a5fdb7c6915a72b2426cad373a0526c06"><code>d1f68f1</code></a> Version Packages (rc) (<a href="https://redirect.github.com/apollographql/apollo-client/issues/13234">#13234</a>)</li> <li><a href="https://github.com/apollographql/apollo-client/commit/f1b541fed4111028b6842727178288156582e669"><code>f1b541f</code></a> Prepare for rc release (<a href="https://redirect.github.com/apollographql/apollo-client/issues/13232">#13232</a>)</li> <li>Additional commits viewable in <a href="https://github.com/apollographql/apollo-client/compare/@apollo/client@4.1.6...@apollo/client@4.2.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-05-28 15:12:52 +02:00
Raphaël Bosi	c8b9dace72	Fix focus in front components inputs (#20961) ... Fixes https://github.com/twentyhq/twenty/issues/20714 Fixes keyboard hotkey conflicts when typing inside `<input>` / `<textarea>` elements rendered by Front Components. Editable fields rendered through the component renderer now properly push/pop a focus item onto Twenty's focus stack, disabling global keyboard hotkeys while the user is typing. ## Before https://github.com/user-attachments/assets/2003c2cb-2698-480f-aedf-bb2f30396572 ## After https://github.com/user-attachments/assets/2c7c6cb0-ecd7-4557-a77b-4d1f264345f0	2026-05-27 16:30:49 +00:00
Félix Malfait	dde6df7a26	refactor(website): replace axios with native fetch (#20967) ... ## Summary Follow-up to #20966 (Stripe fetch client). axios's default Node http adapter on workerd has the same TLS hang the Stripe SDK had — it just doesn't surface today because all three call sites are wrapped in \`unstable_cache(revalidate: 3600)\` and the cache is populated at build time, so misses are rare and the failure mode is a silent \`null\` to the layout. This swaps the three remaining axios calls in \`twenty-website\` for native \`fetch\` and removes axios from \`packages/twenty-website/package.json\`. The package is still used by other workspaces, so yarn.lock keeps the other resolution. Touched call sites: - \`src/lib/releases/fetch-latest-release-tag.ts\` (GitHub releases — runs at build time, cosmetic) - \`src/lib/community/fetch-github-star-count.ts\` (GitHub star count in menu) - \`src/lib/community/fetch-discord-member-count.ts\` (Discord member count in menu) ## Test plan - [ ] After merge + deploy: confirm GitHub star + Discord member counts render in the site menu (non-zero, formatted) - [ ] Confirm \`/releases\` shows the latest tag-gated visible release notes - [ ] No \`axios\` in worker bundle (\`grep axios .open-next/worker.js\` should be empty)	2026-05-27 16:31:39 +02:00
Charles Bochet	e72d10f550	chore(security): bump esbuild to ^0.28.0 to clear CVE-2025-68121 (CVSS 10.0) (#20902) ... ## Summary Follow-up to #20876. That PR bumped `esbuild` to `^0.27.3` to address the Go-stdlib CVEs the self-hoster reported, but only one of the two Go CVEs is actually fixed at that level. This PR closes the remaining gap. ### Why 0.27.3 wasn't enough `esbuild` ships a Go-built binary inside the `@esbuild/<platform>` packages. The vulnerability lives in the bundled Go toolchain, not in any JavaScript. Verified by reading the Go `buildinfo` section from `node_modules/@esbuild/<platform>/bin/esbuild`: - `esbuild@0.27.7` → built with **Go 1.23.8** - `esbuild@0.28.0` → built with **Go 1.26.1** CVE-2024-24790 (IPv6 zone parsing) is fixed in Go 1.21.11 / 1.22.4, so 0.27.x covers it. **CVE-2025-68121** (crypto/tls cert validation bypass via TLS session resumption, **CVSS 10.0 / Critical** per [NVD](https://nvd.nist.gov/vuln/detail/cve-2025-68121)) is fixed only in Go 1.24.13, 1.25.7, and 1.26.0-rc.3+. Go 1.23.x is past Go's support window and will not receive this fix. So `esbuild@0.27.x` still ships a Go binary that Trivy correctly flags as vulnerable. ### Reachable risk in Twenty Low. `esbuild` does not use `crypto/tls` at runtime — it reads files, parses, transforms, and writes. The vulnerable code path is dead code inside the binary, present but never executed. The scan finding is what we are clearing, not an exploitation risk. ### Fix Bump `twenty-client-sdk`'s `esbuild` from `^0.27.3` to `^0.28.0` (resolves to 0.28.0, built with Go 1.26.1). ### Verification Ran `yarn workspaces focus --production twenty twenty-server twenty-emails twenty-shared twenty-client-sdk` (the same install the Dockerfile uses) and confirmed: - `node_modules/esbuild/` resolves to `esbuild@0.28.0` (single copy) - The bundled `node_modules/@esbuild/<platform>/bin/esbuild` binary reports `go1.26.1` in its `buildinfo` ## Test plan - [x] `nx typecheck twenty-server` passes - [x] `nx build twenty-client-sdk` passes (esbuild's `build()` API is stable across 0.27 → 0.28) - [x] Production focus install shows Go 1.26.1 in the shipped binary - [ ] CI green - [ ] Re-run Trivy against the resulting image; confirm CVE-2025-68121 no longer appears	2026-05-26 09:49:25 +00:00
Charles Bochet	be39702fd2	chore(security): bump protobufjs and esbuild to clear CVEs (#20876) ... ## Summary A self-hoster reported that Trivy blocks the `twentycrm/twenty:v2.7.x` image on three fixed-critical CVEs. The reachable risk is low (none of the vulnerable code paths are exposed to attacker-controlled input in our deployment), but the findings are real and easy to clear by bumping the affected dependencies in their owning workspaces. ### CVE-2026-41242 — `protobufjs` < 7.5.5 Pulled transitively into the production image via `@opentelemetry/sdk-node`, `@opentelemetry/auto-instrumentations-node`, and `@grpc/grpc-js` → `@grpc/proto-loader`. Lockfile was on 7.5.3; this matches dismissed dependabot alert #1009 (Critical 9.4). **Fix:** add `protobufjs: ^7.5.5` as a direct dep of `twenty-server` (the workspace that exercises it via the OpenTelemetry gRPC exporters) and run `yarn dedupe protobufjs` to collapse the residual transitive 7.5.3 copy. Resolves to 7.6.0. ### CVE-2024-24790 and CVE-2025-68121 — Go stdlib in bundled binaries Present in the Go-built `bin/esbuild` shipped by `@esbuild/<platform>` packages. Two paths put esbuild into the production image: 1. `twenty-client-sdk` declares `esbuild` as a runtime dep (used by its `./generate` entry point). 2. `twenty-server` had `@lingui/vite-plugin` in `dependencies`, which pulls `@lingui/cli` as a runtime sub-dep, which bundles `esbuild@0.21.5` nested under `node_modules/@lingui/cli/node_modules/esbuild/`. **Fix:** - Bump `twenty-client-sdk`'s `esbuild` from `^0.25.0` to `^0.27.3` (resolves to 0.27.7, built with patched Go). - Move `@lingui/vite-plugin` from `dependencies` to `devDependencies` in `twenty-server`. The plugin is not imported by any source file — it was misclassified. ### Verification Ran `yarn workspaces focus --production twenty twenty-server twenty-emails twenty-shared twenty-client-sdk` (the same command the Dockerfile uses) and inventoried the resulting `node_modules`. After all three changes: - `node_modules/esbuild/` → **0.27.7 only** (Go-patched) - `node_modules/protobufjs/` → **7.6.0 only** (CVE-patched) No nested copies of either package remain in the production install. ### Follow-up worth tracking separately `esbuild` should arguably not be in `twenty-client-sdk`'s `dependencies` at all — only the `./generate` entry point uses it, and the server never imports that entry. Moving it to optional `peerDependencies` would stop shipping a Go binary into the production image entirely. Out of scope for this PR. ## Test plan - [x] `yarn install` succeeds; `protobufjs` and `esbuild` each resolve to a single version in production focus - [x] `nx build twenty-client-sdk` passes - [x] `nx typecheck twenty-server` passes - [x] `nx build twenty-server` passes - [x] Production focus install confirmed clean (`node_modules/esbuild` and `node_modules/protobufjs` both single-version, both patched) - [ ] CI green - [ ] Re-run Trivy against the resulting image; confirm the three CVEs no longer appear	2026-05-25 12:36:53 +00:00
neo773	323e66433e	lint: migrate prettier to oxfmt (#20783) ... Most changes are `implements` being unwrapped this is not a oxfmt regression Prettier in 3.7 (we're on 3.1) changed this behaviour prettier blog [post](https://prettier.io/blog/2025/11/27/3.7.0#change-18094) This unifies our linting tooling --------- Co-authored-by: github-actions <github-actions@twenty.com> Co-authored-by: Charles Bochet <charles@twenty.com>	2026-05-22 00:21:33 +02:00
Charles Bochet	a6a08439f7	chore(deps): bump @xmldom/xmldom to 0.8.13 (security) (#20798) ... ## Summary - Re-resolves the transitive `@xmldom/xmldom` dependency to `0.8.13` to fix four high-severity Dependabot alerts. - yarn.lock-only change: all four upstream consumers (`@node-saml/node-saml`, `plist`, `xml-crypto`, `xml-encryption`) accept `^0.8.x`, so the previous `0.8.10` / `0.8.11` entries collapse onto a single `0.8.13` resolution. No `package.json` change needed. ## Alerts fixed - XML node injection through unvalidated comment serialization (high) - XML node injection through unvalidated processing instruction serialization (high) - XML injection through unvalidated DocumentType serialization (high) - Uncontrolled recursion in XML serialization leads to DoS (high) All four advisories are patched in `0.8.13`, the latest release in the `0.8.x` line.	2026-05-21 11:17:41 +00:00
dependabot[bot]	b792f7654b	chore(deps): bump tinyglobby from 0.2.15 to 0.2.16 (#20788) ... Bumps [tinyglobby](https://github.com/SuperchupuDev/tinyglobby) from 0.2.15 to 0.2.16. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/SuperchupuDev/tinyglobby/releases">tinyglobby's releases</a>.</em></p> <blockquote> <h2>0.2.16</h2> <h2>Fixed</h2> <ul> <li>Upgraded <code>picomatch</code> to 4.0.4, mitigating any potential exposure to <a href="https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj">CVE-2026-33671</a> and <a href="https://github.com/micromatch/picomatch/security/advisories/GHSA-3v7f-55p6-f55p">CVE-2026-33672</a></li> </ul> <h2>Changed</h2> <ul> <li>Overhauled and optimized most internals by <a href="https://github.com/Torathion"><code>@​Torathion</code></a></li> <li>Ignore patterns are no longer compiled twice by <a href="https://github.com/webpro"><code>@​webpro</code></a></li> </ul> <p>Consider <a href="https://github.com/sponsors/SuperchupuDev">sponsoring</a> if you'd like to support the development of this project and the goal of reaching a lighter and faster ecosystem</p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/SuperchupuDev/tinyglobby/blob/main/CHANGELOG.md">tinyglobby's changelog</a>.</em></p> <blockquote> <h3><a href="https://github.com/SuperchupuDev/tinyglobby/compare/0.2.15...0.2.16">0.2.16</a></h3> <h4>Fixed</h4> <ul> <li>Upgraded <code>picomatch</code> to 4.0.4, mitigating any potential exposure to <a href="https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj">CVE-2026-33671</a> and <a href="https://github.com/micromatch/picomatch/security/advisories/GHSA-3v7f-55p6-f55p">CVE-2026-33672</a></li> </ul> <h4>Changed</h4> <ul> <li>Overhauled and optimized most internals by <a href="https://github.com/Torathion">Torathion</a></li> <li>Ignore patterns are no longer compiled twice by <a href="https://github.com/webpro">webpro</a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/SuperchupuDev/tinyglobby/commit/577920259c91f5603fab3dbfa599a83bbb14a27a"><code>5779202</code></a> release 0.2.16</li> <li><a href="https://github.com/SuperchupuDev/tinyglobby/commit/071954f97f4d2b573ecd92aecb48220867b3c776"><code>071954f</code></a> bump deps once more</li> <li><a href="https://github.com/SuperchupuDev/tinyglobby/commit/e541dde000158e69b44e8b5a03789d136d88ae0d"><code>e541dde</code></a> do not import the whole <code>fs</code> module</li> <li><a href="https://github.com/SuperchupuDev/tinyglobby/commit/2381b766d3447e078b3112e533ada07621f60526"><code>2381b76</code></a> fix root being too broad</li> <li><a href="https://github.com/SuperchupuDev/tinyglobby/commit/0addeb9a78cab5fd93ac6dad217f75930cfbfda2"><code>0addeb9</code></a> chore(deps): update all non-major dependencies (<a href="https://redirect.github.com/SuperchupuDev/tinyglobby/issues/191">#191</a>)</li> <li><a href="https://github.com/SuperchupuDev/tinyglobby/commit/91ac26cc3bda60378d188565ce4f05e884aa4f31"><code>91ac26c</code></a> chore(deps): update pnpm/action-setup action to v5 (<a href="https://redirect.github.com/SuperchupuDev/tinyglobby/issues/192">#192</a>)</li> <li><a href="https://github.com/SuperchupuDev/tinyglobby/commit/c50558e944bf71dbfeb392f8693fada87f520a70"><code>c50558e</code></a> upgrade picomatch (and everything else)</li> <li><a href="https://github.com/SuperchupuDev/tinyglobby/commit/618517544e95f8167f1722902558dd78dcd34fe6"><code>6185175</code></a> chore(deps): update dependency picomatch to v4.0.4 [security] (<a href="https://redirect.github.com/SuperchupuDev/tinyglobby/issues/193">#193</a>)</li> <li><a href="https://github.com/SuperchupuDev/tinyglobby/commit/49c2b9356c4977f1f531de651f90b420a06c64f6"><code>49c2b93</code></a> enable pnpm <code>trustPolicy</code></li> <li><a href="https://github.com/SuperchupuDev/tinyglobby/commit/bc825c476a5a429e58e06d11364cd68707b4cdd1"><code>bc825c4</code></a> chore(deps): update all non-major dependencies (<a href="https://redirect.github.com/SuperchupuDev/tinyglobby/issues/181">#181</a>)</li> <li>Additional commits viewable in <a href="https://github.com/SuperchupuDev/tinyglobby/compare/0.2.15...0.2.16">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-05-21 05:47:58 +00:00
dependabot[bot]	42ad3cbd1a	chore(deps): bump linkify-react from 4.3.2 to 4.3.3 (#20789) ... Bumps [linkify-react](https://github.com/nfrasser/linkifyjs/tree/HEAD/packages/linkify-react) from 4.3.2 to 4.3.3. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/nfrasser/linkifyjs/releases">linkify-react's releases</a>.</em></p> <blockquote> <h2>v4.3.3</h2> <h2>What's Changed</h2> <ul> <li>Fix parsing bugs with some special encoded URLs</li> <li>Parsed emails should not include port numbers</li> <li>Exact version requirement for interfaces and plugins to avoid incompatibility issues with older versions of linkify core</li> <li>Support for jQuery 4</li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/nfrasser/linkifyjs/compare/v4.3.2...v4.3.3">https://github.com/nfrasser/linkifyjs/compare/v4.3.2...v4.3.3</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/nfrasser/linkifyjs/blob/main/CHANGELOG.md">linkify-react's changelog</a>.</em></p> <blockquote> <h2>v4.3.3</h2> <ul> <li>Fix parsing bugs with some special encoded URLs</li> <li>Parsed emails should not include port numbers</li> <li>Exact version requirement for interfaces and plugins to avoid incompatibility issues with older versions of linkify core</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/nfrasser/linkifyjs/commit/7fffcc6b48f7dbf8e98fca493e1c997a659fe651"><code>7fffcc6</code></a> v4.3.3</li> <li><a href="https://github.com/nfrasser/linkifyjs/commit/2cb8352d78c7449cd8c7ee489a647d3422640a25"><code>2cb8352</code></a> Update dependencies (<a href="https://github.com/nfrasser/linkifyjs/tree/HEAD/packages/linkify-react/issues/529">#529</a>)</li> <li>See full diff in <a href="https://github.com/nfrasser/linkifyjs/commits/v4.3.3/packages/linkify-react">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for linkify-react since your current version.</p> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-05-21 05:47:35 +00:00
dependabot[bot]	e1378dd4cf	chore(deps): bump @azure/msal-node from 3.8.4 to 3.8.10 (#20787) ... Bumps [@azure/msal-node](https://github.com/AzureAD/microsoft-authentication-library-for-js) from 3.8.4 to 3.8.10. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/AzureAD/microsoft-authentication-library-for-js/releases">@​azure/msal-node's releases</a>.</em></p> <blockquote> <h2><code>@​azure/msal-node</code> v3.8.10</h2> <h2>3.8.10</h2> <p>Wed, 18 Mar 2026 20:48:29 GMT</p> <h3>Patches</h3> <ul> <li>Bump <code>@​azure/msal-common</code> to v15.17.0 (beachball)</li> <li>Bump eslint-config-msal to v0.0.0 (beachball)</li> <li>Bump rollup-msal to v0.0.0 (beachball)</li> </ul> <h2><code>@​azure/msal-node</code> v3.8.9</h2> <h2>3.8.9</h2> <p>Fri, 13 Mar 2026 04:32:07 GMT</p> <h3>Patches</h3> <ul> <li>Bump <code>@​azure/msal-common</code> to v15.16.1 (beachball)</li> <li>Bump eslint-config-msal to v0.0.0 (beachball)</li> <li>Bump rollup-msal to v0.0.0 (beachball)</li> </ul> <h2><code>@​azure/msal-node</code> v3.8.8</h2> <h2>3.8.8</h2> <p>Mon, 23 Feb 2026 16:28:24 GMT</p> <h3>Patches</h3> <ul> <li>Bump <code>@​azure/msal-common</code> to v15.15.0 (beachball)</li> <li>Bump eslint-config-msal to v0.0.0 (beachball)</li> <li>Bump rollup-msal to v0.0.0 (beachball)</li> </ul> <h2><code>@​azure/msal-node</code> v3.8.7</h2> <h2>3.8.7</h2> <p>Tue, 10 Feb 2026 22:19:29 GMT</p> <h3>Patches</h3> <ul> <li>Bump <code>@​azure/msal-common</code> to v15.14.2 (beachball)</li> <li>Bump eslint-config-msal to v0.0.0 (beachball)</li> <li>Bump rollup-msal to v0.0.0 (beachball)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/AzureAD/microsoft-authentication-library-for-js/commit/74c792ec34cd83a3470c4d878b403af0fa2884f0"><code>74c792e</code></a> [v4] Add missing client capabilities in platform broker flows (<a href="https://redirect.github.com/AzureAD/microsoft-authentication-library-for-js/issues/8429">#8429</a>)</li> <li><a href="https://github.com/AzureAD/microsoft-authentication-library-for-js/commit/e096fc85e22fcb941646b3f5d9f264b90dffd0ad"><code>e096fc8</code></a> [v4] Post-release PR (<a href="https://redirect.github.com/AzureAD/microsoft-authentication-library-for-js/issues/8425">#8425</a>)</li> <li><a href="https://github.com/AzureAD/microsoft-authentication-library-for-js/commit/23cd31c1fbcfa569dd9135830f5168ec71678a19"><code>23cd31c</code></a> [v4] Add support for client data telemetry with CLI_DATA parameter (<a href="https://redirect.github.com/AzureAD/microsoft-authentication-library-for-js/issues/8378">#8378</a>)</li> <li><a href="https://github.com/AzureAD/microsoft-authentication-library-for-js/commit/eb893e565a4f7de5b9c957b37bb4f975302f1713"><code>eb893e5</code></a> Track online/offline status change (<a href="https://redirect.github.com/AzureAD/microsoft-authentication-library-for-js/issues/8410">#8410</a>)</li> <li><a href="https://github.com/AzureAD/microsoft-authentication-library-for-js/commit/d221f4e6dbc439e771a90f1648c8f5db09b4d88b"><code>d221f4e</code></a> [v4] Respect claims of the brokered application (<a href="https://redirect.github.com/AzureAD/microsoft-authentication-library-for-js/issues/8409">#8409</a>)</li> <li><a href="https://github.com/AzureAD/microsoft-authentication-library-for-js/commit/73df97e5c505010f6b9681749df28a328e4e3894"><code>73df97e</code></a> Common partial release resolution (<a href="https://redirect.github.com/AzureAD/microsoft-authentication-library-for-js/issues/8397">#8397</a>)</li> <li><a href="https://github.com/AzureAD/microsoft-authentication-library-for-js/commit/ee5e7abd5d9a6cfb6ada9b3ac36e15a81f7ba3a8"><code>ee5e7ab</code></a> monitor_window_timeout telemetry (<a href="https://redirect.github.com/AzureAD/microsoft-authentication-library-for-js/issues/8380">#8380</a>)</li> <li><a href="https://github.com/AzureAD/microsoft-authentication-library-for-js/commit/2be7888051cc12e7447487e84c826159dad3ed42"><code>2be7888</code></a> Rename dev to v4-lts changes (<a href="https://redirect.github.com/AzureAD/microsoft-authentication-library-for-js/issues/8364">#8364</a>)</li> <li><a href="https://github.com/AzureAD/microsoft-authentication-library-for-js/commit/4486b7e4bfedc414f7f5f1a7786be30484318206"><code>4486b7e</code></a> Fix JSON object conversion in PlatformDOMRequest v4 (<a href="https://redirect.github.com/AzureAD/microsoft-authentication-library-for-js/issues/8350">#8350</a>)</li> <li><a href="https://github.com/AzureAD/microsoft-authentication-library-for-js/commit/3e5d58b71e232b5978edcf0bd4c05f5948b8a747"><code>3e5d58b</code></a> Post-release PR (<a href="https://redirect.github.com/AzureAD/microsoft-authentication-library-for-js/issues/8354">#8354</a>)</li> <li>Additional commits viewable in <a href="https://github.com/AzureAD/microsoft-authentication-library-for-js/compare/msal-node-v3.8.4...msal-node-v3.8.10">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-05-21 05:06:59 +00:00
dependabot[bot]	5e1b23a28b	chore(deps): bump @recallai/desktop-sdk from 2.0.8 to 2.0.15 (#20785) ... Bumps @recallai/desktop-sdk from 2.0.8 to 2.0.15. [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-05-21 05:04:13 +00:00
Félix Malfait	658bdf3e57	chore(website): rename twenty-website-new → twenty-website (#20745) ... ## Summary Follow-up to the Cloudflare/OpenNext migration (#20741). Now that the legacy `twenty-website` package was already removed in #20270, the `-new` suffix on the marketing site package is no longer meaningful. ## What changes - **Directory rename**: `git mv packages/twenty-website-new packages/twenty-website` (1213 files moved, no content change) - **Package + nx config**: `package.json` and `project.json` name fields updated, `sourceRoot` repointed - **Source refs**: `load-local-articles.ts` and `load-local-release-notes.ts` had a hardcoded `'twenty-website-new'` segment in their monorepo-root fallback path; `app/[locale]/releases/page.tsx` had display strings showing where to add content - **External refs**: root `package.json` workspaces, root `CLAUDE.md` / `README.md`, `twenty-sdk` + `create-twenty-app` READMEs, `.vscode/twenty.code-workspace`, `.cursor/rules/changelog-process.mdc`, Crowdin config + the three `website-i18n-*` CI workflows + `ci-website.yaml` - **Docker cleanup**: `packages/twenty-docker/twenty-website-new/Dockerfile` deleted; the two Makefile targets (`prod-website-new-build` / `prod-website-new-run`) that referenced it removed — EKS deploy was retired in the Cloudflare migration - **`yarn.lock`** regenerated against the new workspace path ## What's deliberately not in this PR The dev hostname `website-new.twenty-main.com` in `wrangler.jsonc` stays for now. Migrating it to `website.twenty-main.com` needs coordinated DNS deletion (current CNAME points at the legacy Docusaurus NLB and serves 503s) and removal of the matching legacy `website` Helm chart in `twenty-infra`. Flagged as a separate cleanup. Companion infra PR: https://github.com/twentyhq/twenty-infra/pull/682 (workflow paths + Terraform ECR + docs) ## Test plan - [x] `yarn install --immutable` resolves clean against the new path - [x] `npx nx typecheck twenty-website` passes - [x] `npx nx lint twenty-website` passes - [ ] CI on this PR confirms the same on a fresh checkout - [ ] After merge: trigger `Deploy Website` workflow against `environment=dev` to confirm the renamed working-directory deploys correctly	2026-05-19 23:42:09 +02:00
Félix Malfait	24a836cc7d	feat(website-new): add Cloudflare Workers deployment via OpenNext (#20741) ... ## Summary - Adds `@opennextjs/cloudflare` adapter so `packages/twenty-website-new` can deploy to Cloudflare Workers - Two environments (`dev` / `prod`) wired via `wrangler.jsonc` env blocks - Existing Docker / EKS build path is untouched in this PR — the cutover happens in the paired infra PR Pairs with: https://github.com/twentyhq/twenty-infra/pull/__ (to be opened, will swap CI + decommission Helm/ArgoCD) ## Files added - `packages/twenty-website-new/wrangler.jsonc` — Worker config, `nodejs_compat` flag, R2 incremental cache, Cloudflare `IMAGES` binding, env-specific routes (`website-new.twenty-main.com` for dev; `twenty.com` + `www.twenty.com` for prod) - `packages/twenty-website-new/open-next.config.ts` — minimal config using `r2IncrementalCache` - `packages/twenty-website-new/.dev.vars.example` — local secrets template (`STRIPE_SECRET_KEY`, `ENTERPRISE_JWT_PRIVATE_KEY`) - `packages/twenty-website-new/public/_headers` — immutable cache headers for `/_next/static/*` ## Files modified - `packages/twenty-website-new/package.json` — adds `@opennextjs/cloudflare`, `wrangler` to devDeps; adds `preview`, `deploy:dev`, `deploy:prod`, `cf-typegen` scripts - `packages/twenty-website-new/next.config.ts` — calls `initOpenNextCloudflareForDev()` (no-op outside `next dev`); preserves Linaria CommonJS export - `packages/twenty-website-new/.gitignore` — ignores `.open-next/`, `.wrangler/`, `.dev.vars`, generated `cloudflare-env.d.ts` ## Compatibility notes - `enterprise-jwt.ts` uses Node `crypto` + `Buffer` — works on Workers with the `nodejs_compat` flag (compat date 2025-01-15, well past the 2024-09-23 minimum) - `sharp` stays as a build-time dep (Next/Image asset processing); runtime image optimization routes through the Cloudflare `IMAGES` binding - Linaria runs at build time, unaffected - Stripe SDK is HTTP-based, fine on Workers ## One-time CF setup required before this PR is useful The infra PR adds GitHub Actions wiring, but the Cloudflare account itself needs: - R2 buckets: `twenty-website-cache-dev`, `twenty-website-cache-prod` - Worker secrets per env (via `wrangler secret put --env <dev|prod>`): `STRIPE_SECRET_KEY`, `ENTERPRISE_JWT_PRIVATE_KEY` - An API token with `Workers Scripts:Edit`, `Workers R2 Storage:Edit`, `Zone DNS:Edit` on the `twenty.com` zone — stored as `CLOUDFLARE_API_TOKEN` + `CLOUDFLARE_ACCOUNT_ID` in the infra repo's GitHub secrets - The Cloudflare Images subscription enabled on the account (binding is configured; \$5/mo + per-transformation pricing) ## Follow-up (out of scope) - Rename `packages/twenty-website-new` → `packages/twenty-website` and delete the legacy `packages/twenty-website` (mechanical, separate PR to keep this diff reviewable) - Remove `packages/twenty-docker/twenty-website-new/` once the EKS deploy is fully retired ## Test plan - [ ] `yarn install` resolves new devDeps cleanly - [ ] `cd packages/twenty-website-new && npx next build` still succeeds (Linaria path untouched) - [ ] `yarn preview` builds the Worker locally and serves on http://localhost:8788 - [ ] Smoke: `/`, `/pricing`, an enterprise-key-signing flow (needs `.dev.vars` populated) - [ ] After CF resources are provisioned: `yarn deploy:dev` succeeds and `website-new.twenty-main.com` serves the new Worker	2026-05-19 23:23:54 +02:00
dependabot[bot]	91b2390ee8	chore(deps-dev): bump vite-plugin-svgr from 4.3.0 to 4.5.0 (#20561) ... Bumps [vite-plugin-svgr](https://github.com/pd4d10/vite-plugin-svgr) from 4.3.0 to 4.5.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/pd4d10/vite-plugin-svgr/releases">vite-plugin-svgr's releases</a>.</em></p> <blockquote> <h2>v4.5.0</h2> <p><em>No significant changes</em></p> <h5>    <a href="https://github.com/pd4d10/vite-plugin-svgr/compare/v4.4.0...v4.5.0">View changes on GitHub</a></h5> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/pd4d10/vite-plugin-svgr/commit/d1f8887202a6edd119053c665f0679419df70025"><code>d1f8887</code></a> 4.5.0</li> <li><a href="https://github.com/pd4d10/vite-plugin-svgr/commit/b326999d5a2546227bb4b2d2cdcf6092392f4d11"><code>b326999</code></a> ci: fix npm publish</li> <li><a href="https://github.com/pd4d10/vite-plugin-svgr/commit/79300b869297ab2063a730f33ec6f7984b8acbe8"><code>79300b8</code></a> 4.4.0</li> <li><a href="https://github.com/pd4d10/vite-plugin-svgr/commit/b7d3c36dd658a6b8344b82307f36dc3acb0d1479"><code>b7d3c36</code></a> chore: update deps</li> <li><a href="https://github.com/pd4d10/vite-plugin-svgr/commit/6f9d9af421ec891c1594b5511d4865cea6c8f79a"><code>6f9d9af</code></a> feat: support rolldown-vite via <code>transformWithOxc</code> (<a href="https://redirect.github.com/pd4d10/vite-plugin-svgr/issues/130">#130</a>)</li> <li><a href="https://github.com/pd4d10/vite-plugin-svgr/commit/cef5adead59da0abfc0b81edf4b2022b193e4607"><code>cef5ade</code></a> ci: fix release note</li> <li>See full diff in <a href="https://github.com/pd4d10/vite-plugin-svgr/compare/v4.3.0...v4.5.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-05-14 07:04:39 +00:00
dependabot[bot]	b36345a699	chore(deps-dev): bump @mui/material from 7.3.8 to 7.3.11 (#20562) ... Bumps [@mui/material](https://github.com/mui/material-ui/tree/HEAD/packages/mui-material) from 7.3.8 to 7.3.11. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/mui/material-ui/releases">@​mui/material's releases</a>.</em></p> <blockquote> <h2>v7.3.11</h2> <p>A big thanks to the 5 contributors who made this release possible.</p> <h3><code>@mui/material@7.3.11</code></h3> <ul> <li>[autocomplete] Fix highlight sync and scroll preservation (<a href="https://github.com/mui/material-ui/tree/HEAD/packages/mui-material/issues/48350">#48350</a>) <a href="https://github.com/mj12albert"><code>@​mj12albert</code></a></li> <li>[autocomplete] Fix popper rendering issues (<a href="https://github.com/mui/material-ui/tree/HEAD/packages/mui-material/issues/48343">#48343</a>) <a href="https://github.com/mj12albert"><code>@​mj12albert</code></a></li> <li>[autocomplete] Improve highlight tracking and selection state (<a href="https://github.com/mui/material-ui/tree/HEAD/packages/mui-material/issues/48318">#48318</a>) <a href="https://github.com/mj12albert"><code>@​mj12albert</code></a></li> <li>[button] Fix <code>startIcon</code> alignment (<a href="https://github.com/mui/material-ui/tree/HEAD/packages/mui-material/issues/48339">#48339</a>) <a href="https://github.com/mj12albert"><code>@​mj12albert</code></a></li> <li>[button] Remove duplicated className entries (<a href="https://github.com/mui/material-ui/tree/HEAD/packages/mui-material/issues/48284">#48284</a>) <a href="https://github.com/silviuaavram"><code>@​silviuaavram</code></a></li> <li>[checkbox] Set <code>aria-checked=mixed</code> when indeterminate (<a href="https://github.com/mui/material-ui/tree/HEAD/packages/mui-material/issues/48286">#48286</a>) <a href="https://github.com/mj12albert"><code>@​mj12albert</code></a></li> <li>[dialog][drawer][focus trap] Fix initial focus target (<a href="https://github.com/mui/material-ui/tree/HEAD/packages/mui-material/issues/48324">#48324</a>) <a href="https://github.com/mj12albert"><code>@​mj12albert</code></a></li> <li>[drawer] Fix transition jump (<a href="https://github.com/mui/material-ui/tree/HEAD/packages/mui-material/issues/48340">#48340</a>) <a href="https://github.com/mj12albert"><code>@​mj12albert</code></a></li> <li>[input] Fix layout shift with display: flex (<a href="https://github.com/mui/material-ui/tree/HEAD/packages/mui-material/issues/48359">#48359</a>) <a href="https://github.com/oliviertassinari"><code>@​oliviertassinari</code></a></li> <li>[inputs] Fix autofocus in SSR environment (<a href="https://github.com/mui/material-ui/tree/HEAD/packages/mui-material/issues/48307">#48307</a>) <a href="https://github.com/mj12albert"><code>@​mj12albert</code></a></li> <li>[popper] Persist positioning styles when popperOptions changes reference (<a href="https://github.com/mui/material-ui/tree/HEAD/packages/mui-material/issues/48302">#48302</a>) <a href="https://github.com/mj12albert"><code>@​mj12albert</code></a></li> <li>[switch] Fix incorrect <code>role</code> with <code>slotProps.input</code> (<a href="https://github.com/mui/material-ui/tree/HEAD/packages/mui-material/issues/48472">#48472</a>) <a href="https://github.com/mj12albert"><code>@​mj12albert</code></a></li> <li>[utils] Add shadow dom utils (<a href="https://github.com/mui/material-ui/tree/HEAD/packages/mui-material/issues/48309">#48309</a>) <a href="https://github.com/mj12albert"><code>@​mj12albert</code></a></li> </ul> <h3>Docs</h3> <ul> <li>[docs] Update banner to announce v9 (<a href="https://github.com/mui/material-ui/tree/HEAD/packages/mui-material/issues/48299">#48299</a>) <a href="https://github.com/siriwatknp"><code>@​siriwatknp</code></a></li> <li>[docs] Add v9 in the versions select in v7.mui.com (<a href="https://github.com/mui/material-ui/tree/HEAD/packages/mui-material/issues/48233">#48233</a>) <a href="https://github.com/alexfauquette"><code>@​alexfauquette</code></a></li> </ul> <h3>Core</h3> <ul> <li>[internal] Update some host-reference entries (<a href="https://github.com/mui/material-ui/tree/HEAD/packages/mui-material/issues/48225">#48225</a>) <a href="https://github.com/silviuaavram"><code>@​silviuaavram</code></a></li> </ul> <p>All contributors of this release in alphabetical order: <a href="https://github.com/alexfauquette"><code>@​alexfauquette</code></a>, <a href="https://github.com/mj12albert"><code>@​mj12albert</code></a>, <a href="https://github.com/oliviertassinari"><code>@​oliviertassinari</code></a>, <a href="https://github.com/silviuaavram"><code>@​silviuaavram</code></a>, <a href="https://github.com/siriwatknp"><code>@​siriwatknp</code></a></p> <h2>v7.3.10</h2> <p>A big thanks to the 15 contributors who made this release possible. A few highlights ✨:</p> <ul> <li>📖 Added the Menubar component page to the docs.</li> </ul> <h3><code>@mui/material@7.3.10</code></h3> <ul> <li>[alert][dialog] Accessibility improvements (<a href="https://github.com/mui/material-ui/tree/HEAD/packages/mui-material/issues/48161">#48161</a>) <a href="https://github.com/silviuaavram"><code>@​silviuaavram</code></a></li> <li>[autocomplete] Add <code>root</code> slot (<a href="https://github.com/mui/material-ui/tree/HEAD/packages/mui-material/issues/47916">#47916</a>) <a href="https://github.com/GerardasB"><code>@​GerardasB</code></a></li> <li>[autocomplete] Fix helper text focusing input when clicked (<a href="https://github.com/mui/material-ui/tree/HEAD/packages/mui-material/issues/48162">#48162</a>) <a href="https://github.com/mj12albert"><code>@​mj12albert</code></a></li> <li>[autocomplete] Fix popup reopening on window focus regain with openOnFocus (<a href="https://github.com/mui/material-ui/tree/HEAD/packages/mui-material/issues/47914">#47914</a>) <a href="https://github.com/aman44444"><code>@​aman44444</code></a></li> <li>[autocomplete] Optimize selected option lookup (<a href="https://github.com/mui/material-ui/tree/HEAD/packages/mui-material/issues/48027">#48027</a>) <a href="https://github.com/anchmelev"><code>@​anchmelev</code></a></li> <li>[autocomplete] Support full slots for clearIndicator and popupIndicator (<a href="https://github.com/mui/material-ui/tree/HEAD/packages/mui-material/issues/47913">#47913</a>) <a href="https://github.com/silviuaavram"><code>@​silviuaavram</code></a></li> <li>[button-base] Fix native button detection (<a href="https://github.com/mui/material-ui/tree/HEAD/packages/mui-material/issues/47994">#47994</a>) <a href="https://github.com/mj12albert"><code>@​mj12albert</code></a></li> <li>[input] Fix high contrast cutoff on first character (<a href="https://github.com/mui/material-ui/tree/HEAD/packages/mui-material/issues/48160">#48160</a>) <a href="https://github.com/silviuaavram"><code>@​silviuaavram</code></a></li> <li>[list item text][card header] Revert cleanup of duplicated CSS rules (<a href="https://github.com/mui/material-ui/tree/HEAD/packages/mui-material/issues/47938">#47938</a>) <a href="https://github.com/sai6855"><code>@​sai6855</code></a></li> <li>[popper] Add missing classes export (<a href="https://github.com/mui/material-ui/tree/HEAD/packages/mui-material/issues/48033">#48033</a>) <a href="https://github.com/mj12albert"><code>@​mj12albert</code></a></li> <li>[select] Fix focus visible always set on menu item (<a href="https://github.com/mui/material-ui/tree/HEAD/packages/mui-material/issues/48022">#48022</a>) <a href="https://github.com/silviuaavram"><code>@​silviuaavram</code></a></li> <li>[slider] Accept readonly array for the value prop (<a href="https://github.com/mui/material-ui/tree/HEAD/packages/mui-material/issues/47961">#47961</a>) <a href="https://github.com/pcorpet"><code>@​pcorpet</code></a></li> <li>[switch] Add border to make it visible in high contrast mode (<a href="https://github.com/mui/material-ui/tree/HEAD/packages/mui-material/issues/48210">#48210</a>) <a href="https://github.com/silviuaavram"><code>@​silviuaavram</code></a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/mui/material-ui/blob/v7.3.11/CHANGELOG.md">@​mui/material's changelog</a>.</em></p> <blockquote> <h2>7.3.11</h2> <!-- raw HTML omitted --> <p><em>May 6, 2026</em></p> <p>A big thanks to the 5 contributors who made this release possible.</p> <h3><code>@mui/material@7.3.11</code></h3> <ul> <li>[autocomplete] Fix highlight sync and scroll preservation (<a href="https://github.com/mui/material-ui/tree/HEAD/packages/mui-material/issues/48350">#48350</a>) <a href="https://github.com/mj12albert"><code>@​mj12albert</code></a></li> <li>[autocomplete] Fix popper rendering issues (<a href="https://github.com/mui/material-ui/tree/HEAD/packages/mui-material/issues/48343">#48343</a>) <a href="https://github.com/mj12albert"><code>@​mj12albert</code></a></li> <li>[autocomplete] Improve highlight tracking and selection state (<a href="https://github.com/mui/material-ui/tree/HEAD/packages/mui-material/issues/48318">#48318</a>) <a href="https://github.com/mj12albert"><code>@​mj12albert</code></a></li> <li>[button] Fix <code>startIcon</code> alignment (<a href="https://github.com/mui/material-ui/tree/HEAD/packages/mui-material/issues/48339">#48339</a>) <a href="https://github.com/mj12albert"><code>@​mj12albert</code></a></li> <li>[button] Remove duplicated className entries (<a href="https://github.com/mui/material-ui/tree/HEAD/packages/mui-material/issues/48284">#48284</a>) <a href="https://github.com/silviuaavram"><code>@​silviuaavram</code></a></li> <li>[checkbox] Set <code>aria-checked=mixed</code> when indeterminate (<a href="https://github.com/mui/material-ui/tree/HEAD/packages/mui-material/issues/48286">#48286</a>) <a href="https://github.com/mj12albert"><code>@​mj12albert</code></a></li> <li>[dialog][drawer][focus trap] Fix initial focus target (<a href="https://github.com/mui/material-ui/tree/HEAD/packages/mui-material/issues/48324">#48324</a>) <a href="https://github.com/mj12albert"><code>@​mj12albert</code></a></li> <li>[drawer] Fix transition jump (<a href="https://github.com/mui/material-ui/tree/HEAD/packages/mui-material/issues/48340">#48340</a>) <a href="https://github.com/mj12albert"><code>@​mj12albert</code></a></li> <li>[input] Fix layout shift with display: flex (<a href="https://github.com/mui/material-ui/tree/HEAD/packages/mui-material/issues/48359">#48359</a>) <a href="https://github.com/oliviertassinari"><code>@​oliviertassinari</code></a></li> <li>[inputs] Fix autofocus in SSR environment (<a href="https://github.com/mui/material-ui/tree/HEAD/packages/mui-material/issues/48307">#48307</a>) <a href="https://github.com/mj12albert"><code>@​mj12albert</code></a></li> <li>[popper] Persist positioning styles when popperOptions changes reference (<a href="https://github.com/mui/material-ui/tree/HEAD/packages/mui-material/issues/48302">#48302</a>) <a href="https://github.com/mj12albert"><code>@​mj12albert</code></a></li> <li>[switch] Fix incorrect <code>role</code> with <code>slotProps.input</code> (<a href="https://github.com/mui/material-ui/tree/HEAD/packages/mui-material/issues/48472">#48472</a>) <a href="https://github.com/mj12albert"><code>@​mj12albert</code></a></li> <li>[utils] Add shadow dom utils (<a href="https://github.com/mui/material-ui/tree/HEAD/packages/mui-material/issues/48309">#48309</a>) <a href="https://github.com/mj12albert"><code>@​mj12albert</code></a></li> </ul> <h3>Docs</h3> <ul> <li>[docs] Update banner to announce v9 (<a href="https://github.com/mui/material-ui/tree/HEAD/packages/mui-material/issues/48299">#48299</a>) <a href="https://github.com/siriwatknp"><code>@​siriwatknp</code></a></li> <li>[docs] Add v9 in the versions select in v7.mui.com (<a href="https://github.com/mui/material-ui/tree/HEAD/packages/mui-material/issues/48233">#48233</a>) <a href="https://github.com/alexfauquette"><code>@​alexfauquette</code></a></li> </ul> <h3>Core</h3> <ul> <li>[internal] Update some host-reference entries (<a href="https://github.com/mui/material-ui/tree/HEAD/packages/mui-material/issues/48225">#48225</a>) <a href="https://github.com/silviuaavram"><code>@​silviuaavram</code></a></li> </ul> <p>All contributors of this release in alphabetical order: <a href="https://github.com/alexfauquette"><code>@​alexfauquette</code></a>, <a href="https://github.com/mj12albert"><code>@​mj12albert</code></a>, <a href="https://github.com/oliviertassinari"><code>@​oliviertassinari</code></a>, <a href="https://github.com/silviuaavram"><code>@​silviuaavram</code></a>, <a href="https://github.com/siriwatknp"><code>@​siriwatknp</code></a></p> <h2>7.3.10</h2> <!-- raw HTML omitted --> <p><em>Apr 8, 2026</em></p> <p>A big thanks to the 15 contributors who made this release possible. A few highlights ✨:</p> <ul> <li>📖 Added the Menubar component page to the docs.</li> </ul> <h3><code>@mui/material@7.3.10</code></h3> <ul> <li>[alert][dialog] Accessibility improvements (<a href="https://github.com/mui/material-ui/tree/HEAD/packages/mui-material/issues/48161">#48161</a>) <a href="https://github.com/silviuaavram"><code>@​silviuaavram</code></a></li> <li>[autocomplete] Add <code>root</code> slot (<a href="https://github.com/mui/material-ui/tree/HEAD/packages/mui-material/issues/47916">#47916</a>) <a href="https://github.com/GerardasB"><code>@​GerardasB</code></a></li> <li>[autocomplete] Fix helper text focusing input when clicked (<a href="https://github.com/mui/material-ui/tree/HEAD/packages/mui-material/issues/48162">#48162</a>) <a href="https://github.com/mj12albert"><code>@​mj12albert</code></a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/mui/material-ui/commit/6ddda377e979d1783b2cc00226098fde4509bb2e"><code>6ddda37</code></a> [release] v7.3.11 (<a href="https://github.com/mui/material-ui/tree/HEAD/packages/mui-material/issues/48478">#48478</a>)</li> <li><a href="https://github.com/mui/material-ui/commit/a2c7fa0eaeec48767ef7728a1d418609e0bf44ea"><code>a2c7fa0</code></a> [switch] Fix incorrect <code>role</code> with <code>slotProps.input</code> (<a href="https://github.com/mj12albert"><code>@​mj12albert</code></a>) (<a href="https://github.com/mui/material-ui/tree/HEAD/packages/mui-material/issues/48472">#48472</a>)</li> <li><a href="https://github.com/mui/material-ui/commit/c3628bd4930e9089fdf41cba78fc2b5798a2bc76"><code>c3628bd</code></a> [input] Fix layout shift with display: flex (<a href="https://github.com/oliviertassinari"><code>@​oliviertassinari</code></a>) (<a href="https://github.com/mui/material-ui/tree/HEAD/packages/mui-material/issues/48359">#48359</a>)</li> <li><a href="https://github.com/mui/material-ui/commit/290c89694eae625cf4ad20f874098f0b8889ceb4"><code>290c896</code></a> [autocomplete] Fix highlight sync and scroll preservation (<a href="https://github.com/mj12albert"><code>@​mj12albert</code></a>) (<a href="https://github.com/mui/material-ui/tree/HEAD/packages/mui-material/issues/48350">#48350</a>)</li> <li><a href="https://github.com/mui/material-ui/commit/6e172b760815dc3dc8254f58e0dcd793fe690979"><code>6e172b7</code></a> [autocomplete] Fix popper rendering issues (<a href="https://github.com/mj12albert"><code>@​mj12albert</code></a>) (<a href="https://github.com/mui/material-ui/tree/HEAD/packages/mui-material/issues/48343">#48343</a>)</li> <li><a href="https://github.com/mui/material-ui/commit/3f2323ce5e780134dcbe75802cf5ab5035822dd4"><code>3f2323c</code></a> [drawer] Fix transition jump (<a href="https://github.com/mj12albert"><code>@​mj12albert</code></a>) (<a href="https://github.com/mui/material-ui/tree/HEAD/packages/mui-material/issues/48340">#48340</a>)</li> <li><a href="https://github.com/mui/material-ui/commit/1afbdfebd521eb96c2bd4d43ec1f9b2f48960a00"><code>1afbdfe</code></a> [button] Fix <code>startIcon</code> alignment (<a href="https://github.com/mj12albert"><code>@​mj12albert</code></a>) (<a href="https://github.com/mui/material-ui/tree/HEAD/packages/mui-material/issues/48339">#48339</a>)</li> <li><a href="https://github.com/mui/material-ui/commit/dcef24179ffd7a08f47e4c6b656cd58181c34fdc"><code>dcef241</code></a> [dialog][drawer][focus trap] Fix initial focus target (<a href="https://github.com/mj12albert"><code>@​mj12albert</code></a>) (<a href="https://github.com/mui/material-ui/tree/HEAD/packages/mui-material/issues/48324">#48324</a>)</li> <li><a href="https://github.com/mui/material-ui/commit/4b0275ea82d1807324eb04034db50501eac1f802"><code>4b0275e</code></a> [autocomplete] Improve highlight tracking and selection state (<a href="https://github.com/mj12albert"><code>@​mj12albert</code></a>) (...</li> <li><a href="https://github.com/mui/material-ui/commit/47e41decac18a891f329f854b0d22e2585fa95be"><code>47e41de</code></a> [internal] Update some host-reference entries (<a href="https://github.com/mui/material-ui/tree/HEAD/packages/mui-material/issues/48225">#48225</a>)</li> <li>Additional commits viewable in <a href="https://github.com/mui/material-ui/commits/v7.3.11/packages/mui-material">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-05-14 07:04:10 +00:00
dependabot[bot]	8edc76d3d0	chore(deps): bump react-dropzone from 14.2.3 to 14.4.1 (#20560) ... Bumps [react-dropzone](https://github.com/react-dropzone/react-dropzone) from 14.2.3 to 14.4.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/react-dropzone/react-dropzone/releases">react-dropzone's releases</a>.</em></p> <blockquote> <h2>v14.4.1</h2> <h2><a href="https://github.com/react-dropzone/react-dropzone/compare/v14.4.0...v14.4.1">14.4.1</a> (2026-02-10)</h2> <h3>Bug Fixes</h3> <ul> <li>prevent tarball from being included in published package (<a href="https://github.com/react-dropzone/react-dropzone/commit/7919a235412ee5a224e76b9e9bef25fdb5e8ff0b">7919a23</a>)</li> </ul> <h2>v14.4.0</h2> <h1><a href="https://github.com/react-dropzone/react-dropzone/compare/v14.3.8...v14.4.0">14.4.0</a> (2026-01-29)</h1> <h3>Bug Fixes</h3> <ul> <li>accept files with empty type during drag events (<a href="https://github.com/react-dropzone/react-dropzone/commit/eaa8ba54963480afbba50415b1dd792514fefac1">eaa8ba5</a>)</li> <li>correct dragLeave filter logic and add dragend test (<a href="https://github.com/react-dropzone/react-dropzone/commit/273aff4a151aba05ddd473cbc49dc3db59132f2f">273aff4</a>)</li> </ul> <h3>Features</h3> <ul> <li>add isDragGlobal state for document-level drag detection (<a href="https://github.com/react-dropzone/react-dropzone/commit/f0874b0ad8e94dbf662b16bc82d0aa2b082ec8ee">f0874b0</a>)</li> </ul> <h2>v14.3.8</h2> <h2><a href="https://github.com/react-dropzone/react-dropzone/compare/v14.3.7...v14.3.8">14.3.8</a> (2025-02-24)</h2> <h3>Bug Fixes</h3> <ul> <li><strong>event_type:</strong> 🎨 Update drop event type to include FileSystemFileHandle (<a href="https://github.com/react-dropzone/react-dropzone/commit/d6911c991e077151e302b599b92269432ab0472b">d6911c9</a>)</li> </ul> <h2>v14.3.7</h2> <h2><a href="https://github.com/react-dropzone/react-dropzone/compare/v14.3.6...v14.3.7">14.3.7</a> (2025-02-24)</h2> <h3>Bug Fixes</h3> <ul> <li>make ESM build compatible with native Node.js (<a href="https://github.com/react-dropzone/react-dropzone/commit/201687900724b45ec98d26cde3626a1c6687c9e1">2016879</a>)</li> </ul> <h2>v14.3.6</h2> <h2><a href="https://github.com/react-dropzone/react-dropzone/compare/v14.3.5...v14.3.6">14.3.6</a> (2025-02-23)</h2> <h3>Bug Fixes</h3> <ul> <li><strong>types:</strong> fix React 19 incompatible JSX type import (<a href="https://github.com/react-dropzone/react-dropzone/commit/356d9d5cb604c47e393f332f3dfe0e8d12c58d95">356d9d5</a>)</li> </ul> <h2>v14.3.5</h2> <h2><a href="https://github.com/react-dropzone/react-dropzone/compare/v14.3.4...v14.3.5">14.3.5</a> (2024-11-04)</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/react-dropzone/react-dropzone/commit/9247d71a4dd6d9f36f177fee31c90a327a34d297"><code>9247d71</code></a> chore: add *.tgz to .gitignore</li> <li><a href="https://github.com/react-dropzone/react-dropzone/commit/7919a235412ee5a224e76b9e9bef25fdb5e8ff0b"><code>7919a23</code></a> fix: prevent tarball from being included in published package</li> <li><a href="https://github.com/react-dropzone/react-dropzone/commit/e2ae36d0c910e64ea7e269e741f26c909f758000"><code>e2ae36d</code></a> build: remove <code>@​semantic-release/git</code></li> <li><a href="https://github.com/react-dropzone/react-dropzone/commit/84ff2d6671f95c925cb3e5c4b785fabd1a13c9fc"><code>84ff2d6</code></a> build: update deps for semantic-release and node version</li> <li><a href="https://github.com/react-dropzone/react-dropzone/commit/65095ea5c15b34724793ad38248bf10cd3fef147"><code>65095ea</code></a> build: add --ignore-engines flag to test workflow for Node 18 compatibility</li> <li><a href="https://github.com/react-dropzone/react-dropzone/commit/d70ea9632b70770b8d5b68d214f9532842120005"><code>d70ea96</code></a> build: enable passwordless publishing with NPM trusted publishers</li> <li><a href="https://github.com/react-dropzone/react-dropzone/commit/2c2c56ee46aefaaa3e81778d822dca4eb2e3c7f7"><code>2c2c56e</code></a> build: add full git history fetch and build step to release workflow</li> <li><a href="https://github.com/react-dropzone/react-dropzone/commit/a9e97413c8a7684d5495ba4c869a8c629e210c59"><code>a9e9741</code></a> build: add semantic-release configuration with trusted publishing support</li> <li><a href="https://github.com/react-dropzone/react-dropzone/commit/1455f4cc0a3c389a056532027017e92874d41fba"><code>1455f4c</code></a> build: Update checkout action to version 4 in release workflow</li> <li><a href="https://github.com/react-dropzone/react-dropzone/commit/f4e67064ebc9310ac0e6e04d6f04cc7c4b4da057"><code>f4e6706</code></a> build: Update Node.js setup action to version 4</li> <li>Additional commits viewable in <a href="https://github.com/react-dropzone/react-dropzone/compare/v14.2.3...v14.4.1">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for react-dropzone since your current version.</p> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-05-14 06:13:10 +00:00
martmull	0cc2194399	Simplify create-twenty-app command (#20512) ... ## Simplify `create-twenty-app` for zero-interaction use Makes `npx create-twenty-app@latest my-app` a fully non-interactive, single-command experience suitable for automated environments (Codex, Claude plugins). ### Changes - **Remove all interactive prompts** — app name, display name, description, and scaffold confirmation are now derived from CLI args with sensible defaults. `inquirer` dependency removed entirely. - **Replace OAuth with API key auth** — use the seeded dev API key (`DEV_API_KEY`) to authenticate against the Docker instance as `tim@apple.dev`, eliminating the browser-based OAuth flow. - **Docker-first with early validation** — check Docker is installed before scaffolding; if missing, print the install URL and exit. Detect alternative runtimes (Podman, nerdctl). - **Parallel image pull** — `docker pull` runs in the background during scaffold + dependency install, saving 10-30s on typical runs. - **Always pull latest image** — ensures the dev server is up-to-date on every run. - **Stop detecting port 3000** — only check port 2020 (Docker instance). - **Update CLI flags** — remove `--skip-local-instance` and `--yes`; add `--skip-docker`. - **Update CI workflows and docs** — align e2e workflows, package README, and template README/cd.yml with the new flow.	2026-05-13 16:44:27 +00:00