d2e7dc0e74
security: bump vulnerable direct dependencies (axios, next, vitest, qs, dompurify, …) ( #21309 )
...
## What
Within-major version bumps of **direct** dependencies to clear a large
batch of Dependabot alerts that are breaching (or near) their SLA. No
major-version changes — all stay within the current major, so risk is
low.
| Package | From → To | Clears |
|---|---|---|
| `axios` | ^1.13.5 → ^1.16.0 | ReDoS, Proxy-Auth leak, proto-pollution
gadgets, NO_PROXY bypass, resource DoS (56 alerts) |
| `next` | 16.1.7 → ^16.2.6 | DoS, middleware/proxy bypass, SSRF, cache
poisoning, XSS (32 alerts) |
| `vitest` | 4.0.18 → ^4.1.0 | **CRITICAL** — UI server arbitrary file
read/exec (#1421 ) |
| `qs` | ^6.11.2 → ^6.15.2 | `qs.stringify` DoS |
| `dompurify` | 3.3.3 → ^3.4.0 | proto-pollution XSS + FORBID_TAGS /
SAFE_FOR_TEMPLATES bypasses |
| `@nestjs/core` | 11.1.16 → ^11.1.18 | improper output neutralization /
injection |
| `nodemailer` | 8.0.4 → 8.0.10 | SMTP command injection via CRLF
(bumped via root `resolutions`) |
| `path-to-regexp` | ^8.2.0 → ^8.4.0 | ReDoS via multiple wildcards |
| `file-type` | ^21.3.1 → ^21.3.2 | ZIP decompression-bomb DoS |
| `@opentelemetry/exporter-prometheus` | ^0.211.0 → ^0.217.0 | exporter
process crash via malformed HTTP request (#1183/#1184) |
## Notes
- Added a `next` root **resolution** so the dev-only
`@react-email/preview-server` copy (hard-pinned at `16.0.10`) is also
pulled up to the patched `16.2.x` line — otherwise that copy keeps the
Next.js alerts open.
- `@opentelemetry/exporter-prometheus` 0.217 pulled
`@opentelemetry/sdk-metrics` to 2.7.1 (compatible); `@opentelemetry/api`
stays pinned at 1.9.1.
- **Transitive-only** vulnerable packages (undici, tmp, ws,
brace-expansion, …) are handled in a **separate PR** per the
split-by-group plan.
- Breaking major bumps (electron, uuid, serialize-javascript) and
migrations (Apollo Server 3→4, simplemde) are intentionally **out of
scope** here.
2026-06-08 12:49:31 +00:00
2d6c8be7df
[Apps] Fix - app-synced object should be searchable ( #19206 )
...
## Summary
- **Make app-synced objects searchable**: `isSearchable` was hardcoded
to `false` and the `searchVector` field was missing the `GENERATED
ALWAYS AS (...)` expression, causing all records to have a `NULL` search
vector and be excluded from search results. Fixed by defaulting
`isSearchable` to `true` (configurable via the object manifest),
computing the `asExpression` from the label identifier field, and
allowing the update-field-action-handler to handle the `null` → defined
`asExpression` transition.
- **Make `isSearchable` updatable on an object**: The property had
`toCompare: false` in the entity properties configuration, so updates
via the API were silently ignored and never persisted. Fixed by setting
`toCompare: true`.
2026-04-02 17:14:37 +00:00
37908114fc
[SDK] Extract twenty-front-component-renderer outside of twenty-sdk ( 2.8MB ) (#19021 )
...
Followup https://github.com/twentyhq/twenty/pull/19010
## Dependency diagram
```
┌─────────────────────┐
│ twenty-front │
│ (React frontend) │
└─────────┬───────────┘
│ imports runtime:
│ FrontComponentRenderer
│ FrontComponentRendererWithSdkClient
│ useFrontComponentExecutionContext
▼
┌──────────────────────────────────┐ ┌─────────────────────────┐
│ twenty-front-component-renderer │────────▶│ twenty-sdk │
│ (remote-dom host + worker) │ │ (app developer SDK) │
│ │ │ │
│ imports from twenty-sdk: │ │ Public API: │
│ • types only: │ │ defineFrontComponent │
│ FrontComponentExecutionContext│ │ navigate, closeSide… │
│ NavigateFunction │ │ useFrontComponent… │
│ CloseSidePanelFunction │ │ Command components │
│ CommandConfirmation… │ │ conditional avail. │
│ OpenCommandConfirmation… │ │ │
│ EnqueueSnackbarFunction │ │ Internal only: │
│ etc. │ │ frontComponentHost… │
│ │ │ front-component-build │
│ owns locally: │ │ esbuild plugins │
│ • ALLOWED_HTML_ELEMENTS │ │ │
│ • EVENT_TO_REACT │ └────────────┬────────────┘
│ • HTML_TAG_TO_CUSTOM_ELEMENT… │ │
│ • SerializedEventData │ │ types
│ • PropertySchema │ ▼
│ • frontComponentHostComm… │ ┌─────────────────────────┐
│ (local ref to globalThis) │ │ twenty-shared │
│ • setFrontComponentExecution… │ │ (common types/utils) │
│ (local impl, same keys) │ │ AppPath, SidePanelP… │
│ │ │ EnqueueSnackbarParams │
└──────────────────────────────────┘ │ isDefined, … │
│ └─────────────────────────┘
│ also depends on
▼
twenty-shared (types)
@remote-dom/* (runtime)
@quilted/threads (runtime)
react (runtime)
```
**Key points:**
- **`twenty-front`** depends on the renderer, **not** on `twenty-sdk`
directly (for rendering)
- **`twenty-front-component-renderer`** depends on `twenty-sdk` for
**types only** (function signatures, `FrontComponentExecutionContext`).
The runtime bridge (`frontComponentHostCommunicationApi`) is shared via
`globalThis` keys, not module imports
- **`twenty-sdk`** has no dependency on the renderer — clean one-way
dependency
- The renderer owns all remote-dom infrastructure (element schemas,
event mappings, custom element tags) that was previously leaking through
the SDK's public API
- The SDK's `./build` entry point was removed entirely (unused)
2026-03-30 17:06:06 +00:00
Charles Bochet