fea2b8736fef4bbdfd095773ffab5e5e1351da45
729 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Charles Bochet
|
fe1a8ad5f0 |
fix(ci): patch danger to decline gzip, fixing ERR_STREAM_PREMATURE_CLOSE on Node 24 (#22171)
## Problem The `danger-js` check (`twenty-utils:danger:ci`) started failing intermittently with: ``` FetchError: Invalid response body while trying to fetch https://api.github.com/repos/twentyhq/twenty/pulls/<n>/files: Premature close errno: 'ERR_STREAM_PREMATURE_CLOSE' ``` It fails before the Dangerfile even runs, while fetching PR files / diff / commits. The existing retry wrapper ([#22151](https://github.com/twentyhq/twenty/pull/22151)) reduced it but can't absorb longer GitHub-API windows, so checks still go red. ## Root cause Not "node-fetch is old" generically — a specific recent regression: - Node **22.23.0 / 24.17.0** shipped a security fix for CVE-2026-48931 (http.Agent response-queue poisoning) that attaches a `'data'` listener to idle keep-alive sockets. - `node-fetch@2` misreads that listener as an unclean connection close — but only on **gzip-encoded responses without `Content-Length`**, which is exactly what `api.github.com` returns. - The GitHub-hosted runners rolling into the patched Node 24.17.x in recent weeks is why this surfaced now. See [danger/danger-js#1515](https://github.com/danger/danger-js/issues/1515), [nodejs/node#63989](https://github.com/nodejs/node/issues/63989). ## Why this approach - `node-fetch@2` can't be removed downstream — Danger imports it directly, and it's pervasive transitively (gaxios/googleapis). Dropping it is an upstream migration. - We don't want to pin an old Node version. So: bump `danger` 13.0.4 → 13.0.8 and backport [danger/danger-js#1516](https://github.com/danger/danger-js/pull/1516) via a yarn patch — set `compress: false` on Danger's shared `api()` wrapper. GitHub then returns identity-encoded responses with `Content-Length`, and node-fetch's faulty premature-close detector never fires. Negligible bandwidth cost on these small JSON payloads; explicit caller overrides are preserved via an `=== undefined` guard. ## Changes - `packages/twenty-utils/package.json` — `danger` → patched 13.0.8 - `yarn.lock` — registers the `danger@patch:` resolution - `.yarn/patches/danger-npm-13.0.8-48aba2788c.patch` — the `compress: false` fix ## Verification - Patch dry-run applies cleanly against pristine danger 13.0.8 source. - Inspected yarn's materialized patched cache package — the `compress` fix is present in the linked `distribution/api/fetch.js`. - Confirmed the failing calls (`getPullRequestInfo` / `getPullRequestCommits` / `getPullRequestDiff`) all route through `this.api` → the patched wrapper. ## Lifecycle Temporary backport. When #1516 ships in a Danger release, drop the patch and bump to that version (flagged in a comment inside the patch). The existing CI retry wrapper stays as defense-in-depth. <!-- This is an auto-generated description by cubic. --> <a href="https://cubic.dev/pr/twentyhq/twenty/pull/22171?utm_source=github" target="_blank" rel="noopener noreferrer" data-no-image-dialog="true"><picture><source media="(prefers-color-scheme: dark)" srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source media="(prefers-color-scheme: light)" srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img alt="Review in cubic" src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a> <!-- End of auto-generated description by cubic. --> |
||
|
Parship Chowdhury
|
6ee5413951 |
chore(vite): replace vite-tsconfig-paths with resolve.tsconfigPaths (#22100)
### Summary Migrates main monorepo packages from the `vite-tsconfig-paths` plugin to vite’s built-in path resolution. Vite 8 showing this warning when the plugin is detected: > The plugin "vite-tsconfig-paths" is detected. Vite now supports tsconfig paths resolution natively via the resolve.tsconfigPaths option. You can remove the plugin and set resolve.tsconfigPaths: true in your Vite config instead. ### References - https://vite.dev/config/shared-options#resolve-tsconfigpaths - https://vite.dev/guide/features#paths - https://github.com/vitejs/vite/pull/21781 <!-- This is an auto-generated description by cubic. --> <a href="https://cubic.dev/pr/twentyhq/twenty/pull/22100?utm_source=github" target="_blank" rel="noopener noreferrer" data-no-image-dialog="true"><picture><source media="(prefers-color-scheme: dark)" srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source media="(prefers-color-scheme: light)" srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img alt="Review in cubic" src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a> <!-- End of auto-generated description by cubic. --> --------- Signed-off-by: Parship Chowdhury <parshipchowdhury@gmail.com> |
||
|
dependabot[bot]
|
8830ef89bd |
chore(deps-dev): bump @storybook/addon-docs from 10.3.4 to 10.4.6 (#22110)
Bumps [@storybook/addon-docs](https://github.com/storybookjs/storybook/tree/HEAD/code/addons/docs) from 10.3.4 to 10.4.6. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/storybookjs/storybook/releases">@storybook/addon-docs's releases</a>.</em></p> <blockquote> <h2>v10.4.6</h2> <h2>10.4.6</h2> <ul> <li>CSF: Allow partial globals overrides in story and meta annotations - <a href="https://redirect.github.com/storybookjs/storybook/pull/34985">#34985</a>, thanks <a href="https://github.com/TheSeydiCharyyev"><code>@TheSeydiCharyyev</code></a>!</li> <li>Dependencies: Upgrade esbuild - <a href="https://redirect.github.com/storybookjs/storybook/pull/35157">#35157</a>, thanks <a href="https://github.com/Kakadus"><code>@Kakadus</code></a>!</li> </ul> <h2>v10.4.5</h2> <h2>10.4.5</h2> <ul> <li>Core: Rework AI checklist feature gate - <a href="https://redirect.github.com/storybookjs/storybook/pull/35053">#35053</a>, thanks <a href="https://github.com/Sidnioulz"><code>@Sidnioulz</code></a>!</li> <li>Preview: Stop mixed CSF3+4 stories getting core annotations injected twice - <a href="https://redirect.github.com/storybookjs/storybook/pull/35094">#35094</a>, thanks <a href="https://github.com/JReinhold"><code>@JReinhold</code></a>!</li> </ul> <h2>v10.4.4</h2> <h2>10.4.4</h2> <ul> <li>Telemetry: Add timeout to event-log POST to prevent build hang - <a href="https://redirect.github.com/storybookjs/storybook/pull/35085">#35085</a>, thanks <a href="https://github.com/badams"><code>@badams</code></a>!</li> </ul> <h2>v10.4.3</h2> <h2>10.4.3</h2> <ul> <li>Addon Docs: Fix Primary and Controls blocks not rendering in custom MDX pages - <a href="https://redirect.github.com/storybookjs/storybook/pull/34496">#34496</a>, thanks <a href="https://github.com/NYCU-Chung"><code>@NYCU-Chung</code></a>!</li> <li>Core: Respect !dev tag on MDX docs in sidebar - <a href="https://redirect.github.com/storybookjs/storybook/pull/35031">#35031</a>, thanks <a href="https://github.com/JReinhold"><code>@JReinhold</code></a>!</li> <li>React: Add support for resolving subcomponents attached as properties of a parent component - <a href="https://redirect.github.com/storybookjs/storybook/pull/34967">#34967</a>, thanks <a href="https://github.com/yatishgoel"><code>@yatishgoel</code></a>!</li> <li>UI: Prevent docs page scroll reset on HMR re-render - <a href="https://redirect.github.com/storybookjs/storybook/pull/35021">#35021</a>, thanks <a href="https://github.com/LongTangGithub"><code>@LongTangGithub</code></a>!</li> </ul> <h2>v10.4.2</h2> <h2>10.4.2</h2> <ul> <li>Bug: Fix Windows command resolution for non-Node package managers - <a href="https://redirect.github.com/storybookjs/storybook/pull/33534">#33534</a>, thanks <a href="https://github.com/copilot-swe-agent"><code>@copilot-swe-agent</code></a>!</li> <li>Build: Upgrade type-fest to latest version 5.6.0 - <a href="https://redirect.github.com/storybookjs/storybook/pull/34791">#34791</a>, thanks <a href="https://github.com/tobiasdiez"><code>@tobiasdiez</code></a>!</li> <li>CSF: Fix parsing of string literal export names - <a href="https://redirect.github.com/storybookjs/storybook/pull/34901">#34901</a>, thanks <a href="https://github.com/shilman"><code>@shilman</code></a>!</li> <li>Publish: Add npm provenance attestations - <a href="https://redirect.github.com/storybookjs/storybook/pull/34936">#34936</a>, thanks <a href="https://github.com/copilot-swe-agent"><code>@copilot-swe-agent</code></a>!</li> </ul> <h2>v10.4.1</h2> <h2>10.4.1</h2> <ul> <li>Angular: Detect model() signal outputs (type inference + compodoc autodocs + runtime binding) - <a href="https://redirect.github.com/storybookjs/storybook/pull/34833">#34833</a>, thanks <a href="https://github.com/valentinpalkovic"><code>@valentinpalkovic</code></a>!</li> <li>Build: Upgrade type-fest to latest version 5.6.0 - <a href="https://redirect.github.com/storybookjs/storybook/pull/34791">#34791</a>, thanks <a href="https://github.com/tobiasdiez"><code>@tobiasdiez</code></a>!</li> <li>CLI: Run `npx expo install --fix` after init for Expo projects - <a href="https://redirect.github.com/storybookjs/storybook/pull/34803">#34803</a>, thanks <a href="https://github.com/ndelangen"><code>@ndelangen</code></a>!</li> <li>CLI: Support `peerDependencies` in framework detection for component libraries - <a href="https://redirect.github.com/storybookjs/storybook/pull/34516">#34516</a>, thanks <a href="https://github.com/zhyd1997"><code>@zhyd1997</code></a>!</li> <li>Next.js: Add useLinkStatus mock to next/link export mock - <a href="https://redirect.github.com/storybookjs/storybook/pull/34593">#34593</a>, thanks <a href="https://github.com/philwolstenholme"><code>@philwolstenholme</code></a>!</li> <li>Vue3: Specify a specific version for non-dev dependency - <a href="https://redirect.github.com/storybookjs/storybook/pull/34794">#34794</a>, thanks <a href="https://github.com/ScopeyNZ"><code>@ScopeyNZ</code></a>!</li> </ul> <h2>v10.4.0</h2> <h2>10.4.0</h2> <blockquote> <p><em>AI-assisted setup, change-aware review, and stronger framework support</em></p> </blockquote> <p>Storybook 10.4 contains hundreds of fixes and improvements including:</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/storybookjs/storybook/blob/next/CHANGELOG.md">@storybook/addon-docs's changelog</a>.</em></p> <blockquote> <h2>10.4.6</h2> <ul> <li>CSF: Allow partial globals overrides in story and meta annotations - <a href="https://redirect.github.com/storybookjs/storybook/pull/34985">#34985</a>, thanks <a href="https://github.com/TheSeydiCharyyev"><code>@TheSeydiCharyyev</code></a>!</li> <li>Dependencies: Upgrade esbuild - <a href="https://redirect.github.com/storybookjs/storybook/pull/35157">#35157</a>, thanks <a href="https://github.com/Kakadus"><code>@Kakadus</code></a>!</li> </ul> <h2>10.4.5</h2> <ul> <li>Core: Rework AI checklist feature gate - <a href="https://redirect.github.com/storybookjs/storybook/pull/35053">#35053</a>, thanks <a href="https://github.com/Sidnioulz"><code>@Sidnioulz</code></a>!</li> <li>Preview: Stop mixed CSF3+4 stories getting core annotations injected twice - <a href="https://redirect.github.com/storybookjs/storybook/pull/35094">#35094</a>, thanks <a href="https://github.com/JReinhold"><code>@JReinhold</code></a>!</li> </ul> <h2>10.4.4</h2> <ul> <li>Telemetry: Add timeout to event-log POST to prevent build hang - <a href="https://redirect.github.com/storybookjs/storybook/pull/35085">#35085</a>, thanks <a href="https://github.com/badams"><code>@badams</code></a>!</li> </ul> <h2>10.4.3</h2> <ul> <li>Addon Docs: Fix Primary and Controls blocks not rendering in custom MDX pages - <a href="https://redirect.github.com/storybookjs/storybook/pull/34496">#34496</a>, thanks <a href="https://github.com/NYCU-Chung"><code>@NYCU-Chung</code></a>!</li> <li>Core: Respect !dev tag on MDX docs in sidebar - <a href="https://redirect.github.com/storybookjs/storybook/pull/35031">#35031</a>, thanks <a href="https://github.com/JReinhold"><code>@JReinhold</code></a>!</li> <li>React: Add support for resolving subcomponents attached as properties of a parent component - <a href="https://redirect.github.com/storybookjs/storybook/pull/34967">#34967</a>, thanks <a href="https://github.com/yatishgoel"><code>@yatishgoel</code></a>!</li> <li>UI: Prevent docs page scroll reset on HMR re-render - <a href="https://redirect.github.com/storybookjs/storybook/pull/35021">#35021</a>, thanks <a href="https://github.com/LongTangGithub"><code>@LongTangGithub</code></a>!</li> </ul> <h2>10.4.2</h2> <ul> <li>Bug: Fix Windows command resolution for non-Node package managers - <a href="https://redirect.github.com/storybookjs/storybook/pull/33534">#33534</a>, thanks <a href="https://github.com/copilot-swe-agent"><code>@copilot-swe-agent</code></a>!</li> <li>Build: Upgrade type-fest to latest version 5.6.0 - <a href="https://redirect.github.com/storybookjs/storybook/pull/34791">#34791</a>, thanks <a href="https://github.com/tobiasdiez"><code>@tobiasdiez</code></a>!</li> <li>CSF: Fix parsing of string literal export names - <a href="https://redirect.github.com/storybookjs/storybook/pull/34901">#34901</a>, thanks <a href="https://github.com/shilman"><code>@shilman</code></a>!</li> <li>Publish: Add npm provenance attestations - <a href="https://redirect.github.com/storybookjs/storybook/pull/34936">#34936</a>, thanks <a href="https://github.com/copilot-swe-agent"><code>@copilot-swe-agent</code></a>!</li> </ul> <h2>10.4.1</h2> <ul> <li>Angular: Detect model() signal outputs (type inference + compodoc autodocs + runtime binding) - <a href="https://redirect.github.com/storybookjs/storybook/pull/34833">#34833</a>, thanks <a href="https://github.com/valentinpalkovic"><code>@valentinpalkovic</code></a>!</li> <li>Build: Upgrade type-fest to latest version 5.6.0 - <a href="https://redirect.github.com/storybookjs/storybook/pull/34791">#34791</a>, thanks <a href="https://github.com/tobiasdiez"><code>@tobiasdiez</code></a>!</li> <li>CLI: Run <code>npx expo install --fix</code> after init for Expo projects - <a href="https://redirect.github.com/storybookjs/storybook/pull/34803">#34803</a>, thanks <a href="https://github.com/ndelangen"><code>@ndelangen</code></a>!</li> <li>CLI: Support <code>peerDependencies</code> in framework detection for component libraries - <a href="https://redirect.github.com/storybookjs/storybook/pull/34516">#34516</a>, thanks <a href="https://github.com/zhyd1997"><code>@zhyd1997</code></a>!</li> <li>Next.js: Add useLinkStatus mock to next/link export mock - <a href="https://redirect.github.com/storybookjs/storybook/pull/34593">#34593</a>, thanks <a href="https://github.com/philwolstenholme"><code>@philwolstenholme</code></a>!</li> <li>Vue3: Specify a specific version for non-dev dependency - <a href="https://redirect.github.com/storybookjs/storybook/pull/34794">#34794</a>, thanks <a href="https://github.com/ScopeyNZ"><code>@ScopeyNZ</code></a>!</li> </ul> <h2>10.4.0</h2> <blockquote> <p><em>AI-assisted setup, change-aware review, and stronger framework support</em></p> </blockquote> <p>Storybook 10.4 contains hundreds of fixes and improvements including:</p> <ul> <li>🤖 Agentic Setup: New CLI workflow for AI-assisted Storybook setup and onboarding</li> <li>🔍 Change review: Sidebar filtering to highlight new, modified, and related stories based on git changes</li> <li>🧭 Sidebar review tools: Status filtering, URL-persisted filters, and clearer review signals in the sidebar</li> <li>⚛️ TanStack React: New <code>@storybook/tanstack-react</code> framework with routing and server function support</li> <li>🧩 React MCP: Faster, more accurate component docgen powered by the TypeScript Language Server</li> <li>📱 React Native: Zero config RN project initialization</li> <li>🤝 Sharing: Easily publish and share your local Storybook with teammates, powered by Chromatic</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/storybookjs/storybook/commit/5496a4270da7f3a8e0203185792685cba671fdc5"><code>5496a42</code></a> Bump version from "10.4.5" to "10.4.6" [skip ci]</li> <li><a href="https://github.com/storybookjs/storybook/commit/48e7b20074222ed926d14fb6c678c2edfc86ee7b"><code>48e7b20</code></a> Bump version from "10.4.4" to "10.4.5" [skip ci]</li> <li><a href="https://github.com/storybookjs/storybook/commit/5adebe753f29d414d1e214e935c94d6e5451861f"><code>5adebe7</code></a> Bump version from "10.4.3" to "10.4.4" [skip ci]</li> <li><a href="https://github.com/storybookjs/storybook/commit/624e6187fd462e56719cbd80c1b4bfb67b68fc89"><code>624e618</code></a> Bump version from "10.4.2" to "10.4.3" [skip ci]</li> <li><a href="https://github.com/storybookjs/storybook/commit/c89882282295be3bc05b3a366916c53d7a499841"><code>c898822</code></a> Merge pull request <a href="https://github.com/storybookjs/storybook/tree/HEAD/code/addons/docs/issues/34496">#34496</a> from NYCU-Chung/fix/docs-blocks-custom-mdx</li> <li><a href="https://github.com/storybookjs/storybook/commit/c920fd08c79c57879fa2ddb4e8538e1684c71ec2"><code>c920fd0</code></a> Merge pull request <a href="https://github.com/storybookjs/storybook/tree/HEAD/code/addons/docs/issues/35021">#35021</a> from LongTangGithub/fix/docs-hmr-scroll-to-top</li> <li><a href="https://github.com/storybookjs/storybook/commit/1750494e9f36748b2d89335e77f23f125fc5ec78"><code>1750494</code></a> Merge pull request <a href="https://github.com/storybookjs/storybook/tree/HEAD/code/addons/docs/issues/35031">#35031</a> from storybookjs/jeppe/fix-mdx-no-dev-tag</li> <li><a href="https://github.com/storybookjs/storybook/commit/298dea20c6370e5c670178d88a79fc9e9ff436b2"><code>298dea2</code></a> Bump version from "10.4.1" to "10.4.2" [skip ci]</li> <li><a href="https://github.com/storybookjs/storybook/commit/cc19ae1a2145e8f7cda8dc869f1b90d5346dcedb"><code>cc19ae1</code></a> Bump version from "10.4.0" to "10.4.1" [skip ci]</li> <li><a href="https://github.com/storybookjs/storybook/commit/f8c16d115cfcf0f79125b358266c37e5343bb70d"><code>f8c16d1</code></a> Bump version from "10.4.0-beta.0" to "10.4.0" [skip ci]</li> <li>Additional commits viewable in <a href="https://github.com/storybookjs/storybook/commits/v10.4.6/code/addons/docs">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> <!-- This is an auto-generated description by cubic. --> <a href="https://cubic.dev/pr/twentyhq/twenty/pull/22110?utm_source=github" target="_blank" rel="noopener noreferrer" data-no-image-dialog="true"><picture><source media="(prefers-color-scheme: dark)" srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source media="(prefers-color-scheme: light)" srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img alt="Review in cubic" src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a> <!-- End of auto-generated description by cubic. --> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Charles Bochet <charles@twenty.com> |
||
|
dependabot[bot]
|
264d0a7671 |
chore(deps): bump @ai-sdk/mistral from 3.0.39 to 3.0.40 (#22117)
Bumps [@ai-sdk/mistral](https://github.com/vercel/ai/tree/HEAD/packages/mistral) from 3.0.39 to 3.0.40. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/vercel/ai/blob/@ai-sdk/mistral@3.0.40/packages/mistral/CHANGELOG.md">@ai-sdk/mistral's changelog</a>.</em></p> <blockquote> <h2>3.0.40</h2> <h3>Patch Changes</h3> <ul> <li>Updated dependencies [779f5cd] <ul> <li><code>@ai-sdk/provider-utils</code><a href="https://github.com/4"><code>@4</code></a>.0.30</li> </ul> </li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vercel/ai/commit/caebb44016dbd084e5bf7b7f4ab5194fd2c7c045"><code>caebb44</code></a> Version Packages (<a href="https://github.com/vercel/ai/tree/HEAD/packages/mistral/issues/16157">#16157</a>)</li> <li>See full diff in <a href="https://github.com/vercel/ai/commits/@ai-sdk/mistral@3.0.40/packages/mistral">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> <!-- This is an auto-generated description by cubic. --> <a href="https://cubic.dev/pr/twentyhq/twenty/pull/22117?utm_source=github" target="_blank" rel="noopener noreferrer" data-no-image-dialog="true"><picture><source media="(prefers-color-scheme: dark)" srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source media="(prefers-color-scheme: light)" srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img alt="Review in cubic" src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a> <!-- End of auto-generated description by cubic. --> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
9574476395 |
chore(deps): bump @scalar/api-reference-react from 0.9.46 to 0.9.48 (#22115)
Bumps [@scalar/api-reference-react](https://github.com/scalar/scalar/tree/HEAD/packages/api-reference-react) from 0.9.46 to 0.9.48. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/scalar/scalar/blob/main/packages/api-reference-react/CHANGELOG.md">@scalar/api-reference-react's changelog</a>.</em></p> <blockquote> <h2>0.9.48</h2> <h2>0.9.47</h2> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/scalar/scalar/commits/HEAD/packages/api-reference-react">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> <!-- This is an auto-generated description by cubic. --> <a href="https://cubic.dev/pr/twentyhq/twenty/pull/22115?utm_source=github" target="_blank" rel="noopener noreferrer" data-no-image-dialog="true"><picture><source media="(prefers-color-scheme: dark)" srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source media="(prefers-color-scheme: light)" srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img alt="Review in cubic" src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a> <!-- End of auto-generated description by cubic. --> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
5bb3ff4e43 |
chore(deps): bump @sentry/react from 10.51.0 to 10.60.0 (#22111)
Bumps [@sentry/react](https://github.com/getsentry/sentry-javascript) from 10.51.0 to 10.60.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/getsentry/sentry-javascript/releases">@sentry/react's releases</a>.</em></p> <blockquote> <h2>10.60.0</h2> <h3>Other Changes</h3> <ul> <li>feat(cloudflare): Add R2 bucket auto-instrumentation (<a href="https://redirect.github.com/getsentry/sentry-javascript/pull/21327">#21327</a>)</li> <li>feat(core): Add <code>bindScopeToEmitter</code> to bind a scope to an event emitter (<a href="https://redirect.github.com/getsentry/sentry-javascript/pull/21594">#21594</a>)</li> <li>feat(deps): Bump <code>@hapi/wreck</code> from 18.1.0 to 18.1.2 (<a href="https://redirect.github.com/getsentry/sentry-javascript/pull/21178">#21178</a>)</li> <li>fix(browser): Ensure <code>url.full</code> and <code>http.url</code> attributes have the same values on <code>http.client</code> spans (<a href="https://redirect.github.com/getsentry/sentry-javascript/pull/21660">#21660</a>)</li> <li>fix(server-utils): Avoid directly importing <code>tracingChannel</code> for Node v18 compatibility (<a href="https://redirect.github.com/getsentry/sentry-javascript/pull/21662">#21662</a>)</li> <li>fix(server-utils): Remove optional <code>vite</code> peer dependency (<a href="https://redirect.github.com/getsentry/sentry-javascript/pull/21677">#21677</a>)</li> </ul> <!-- raw HTML omitted --> <ul> <li>chore: Add bundler-plugins to craft (<a href="https://redirect.github.com/getsentry/sentry-javascript/pull/21701">#21701</a>)</li> <li>chore: Cleanup unused imports of <code>@opentelemetry/core</code> (<a href="https://redirect.github.com/getsentry/sentry-javascript/pull/21679">#21679</a>)</li> <li>fix(bundler-plugins): Integration with monorepo build (<a href="https://redirect.github.com/getsentry/sentry-javascript/pull/21479">#21479</a>)</li> <li>ref(core): Gate updateName() custom source on an OTel inference brand (<a href="https://redirect.github.com/getsentry/sentry-javascript/pull/21649">#21649</a>)</li> <li>ref(core/opentelemetry): Move OTel span data inference from <code>captureSpan</code> to <code>SentrySpanProcessor</code> (<a href="https://redirect.github.com/getsentry/sentry-javascript/pull/21648">#21648</a>)</li> <li>ref(node): Remove unused sql-common helper and <code>@opentelemetry/core</code> dep (<a href="https://redirect.github.com/getsentry/sentry-javascript/pull/21688">#21688</a>)</li> <li>ref(node): Streamline kafkajs instrumentation (<a href="https://redirect.github.com/getsentry/sentry-javascript/pull/21647">#21647</a>)</li> <li>ref(node): Streamline undici (node-fetch) instrumentation (<a href="https://redirect.github.com/getsentry/sentry-javascript/pull/21650">#21650</a>)</li> <li>ref(vercel-edge): Drop unused <code>@opentelemetry/semantic-conventions</code> dependency (<a href="https://redirect.github.com/getsentry/sentry-javascript/pull/21691">#21691</a>)</li> <li>ref(vercel-edge): Remove <code>@opentelemetry/resources</code> dependency (<a href="https://redirect.github.com/getsentry/sentry-javascript/pull/21690">#21690</a>)</li> </ul> <!-- raw HTML omitted --> <h2>Bundle size 📦</h2> <table> <thead> <tr> <th>Path</th> <th>Size</th> </tr> </thead> <tbody> <tr> <td><code>@sentry/browser</code></td> <td>26.83 KB</td> </tr> <tr> <td><code>@sentry/browser</code> - with treeshaking flags</td> <td>25.3 KB</td> </tr> <tr> <td><code>@sentry/browser</code> (incl. Tracing)</td> <td>44.89 KB</td> </tr> <tr> <td><code>@sentry/browser</code> (incl. Tracing + Span Streaming)</td> <td>46.6 KB</td> </tr> <tr> <td><code>@sentry/browser</code> (incl. Tracing, Profiling)</td> <td>49.56 KB</td> </tr> <tr> <td><code>@sentry/browser</code> (incl. Tracing, Replay)</td> <td>83.18 KB</td> </tr> <tr> <td><code>@sentry/browser</code> (incl. Tracing, Replay) - with treeshaking flags</td> <td>73.02 KB</td> </tr> <tr> <td><code>@sentry/browser</code> (incl. Tracing, Replay with Canvas)</td> <td>87.76 KB</td> </tr> <tr> <td><code>@sentry/browser</code> (incl. Tracing, Replay, Feedback)</td> <td>100.12 KB</td> </tr> <tr> <td><code>@sentry/browser</code> (incl. Feedback)</td> <td>43.61 KB</td> </tr> <tr> <td><code>@sentry/browser</code> (incl. sendFeedback)</td> <td>31.5 KB</td> </tr> <tr> <td><code>@sentry/browser</code> (incl. FeedbackAsync)</td> <td>36.52 KB</td> </tr> <tr> <td><code>@sentry/browser</code> (incl. Metrics)</td> <td>27.87 KB</td> </tr> <tr> <td><code>@sentry/browser</code> (incl. Logs)</td> <td>28.11 KB</td> </tr> <tr> <td><code>@sentry/browser</code> (incl. Metrics & Logs)</td> <td>28.78 KB</td> </tr> <tr> <td><code>@sentry/react</code></td> <td>28.59 KB</td> </tr> <tr> <td><code>@sentry/react</code> (incl. Tracing)</td> <td>47.14 KB</td> </tr> <tr> <td><code>@sentry/vue</code></td> <td>31.86 KB</td> </tr> <tr> <td><code>@sentry/vue</code> (incl. Tracing)</td> <td>46.71 KB</td> </tr> <tr> <td><code>@sentry/svelte</code></td> <td>26.85 KB</td> </tr> </tbody> </table> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/getsentry/sentry-javascript/blob/develop/CHANGELOG.md">@sentry/react's changelog</a>.</em></p> <blockquote> <h2>10.60.0</h2> <h3>Other Changes</h3> <ul> <li>feat(cloudflare): Add R2 bucket auto-instrumentation (<a href="https://redirect.github.com/getsentry/sentry-javascript/pull/21327">#21327</a>)</li> <li>feat(core): Add <code>bindScopeToEmitter</code> to bind a scope to an event emitter (<a href="https://redirect.github.com/getsentry/sentry-javascript/pull/21594">#21594</a>)</li> <li>feat(deps): Bump <code>@hapi/wreck</code> from 18.1.0 to 18.1.2 (<a href="https://redirect.github.com/getsentry/sentry-javascript/pull/21178">#21178</a>)</li> <li>fix(browser): Ensure <code>url.full</code> and <code>http.url</code> attributes have the same values on <code>http.client</code> spans (<a href="https://redirect.github.com/getsentry/sentry-javascript/pull/21660">#21660</a>)</li> <li>fix(server-utils): Avoid directly importing <code>tracingChannel</code> for Node v18 compatibility (<a href="https://redirect.github.com/getsentry/sentry-javascript/pull/21662">#21662</a>)</li> <li>fix(server-utils): Remove optional <code>vite</code> peer dependency (<a href="https://redirect.github.com/getsentry/sentry-javascript/pull/21677">#21677</a>)</li> </ul> <!-- raw HTML omitted --> <ul> <li>chore: Add bundler-plugins to craft (<a href="https://redirect.github.com/getsentry/sentry-javascript/pull/21701">#21701</a>)</li> <li>chore: Cleanup unused imports of <code>@opentelemetry/core</code> (<a href="https://redirect.github.com/getsentry/sentry-javascript/pull/21679">#21679</a>)</li> <li>fix(bundler-plugins): Integration with monorepo build (<a href="https://redirect.github.com/getsentry/sentry-javascript/pull/21479">#21479</a>)</li> <li>ref(core): Gate updateName() custom source on an OTel inference brand (<a href="https://redirect.github.com/getsentry/sentry-javascript/pull/21649">#21649</a>)</li> <li>ref(core/opentelemetry): Move OTel span data inference from <code>captureSpan</code> to <code>SentrySpanProcessor</code> (<a href="https://redirect.github.com/getsentry/sentry-javascript/pull/21648">#21648</a>)</li> <li>ref(node): Remove unused sql-common helper and <code>@opentelemetry/core</code> dep (<a href="https://redirect.github.com/getsentry/sentry-javascript/pull/21688">#21688</a>)</li> <li>ref(node): Streamline kafkajs instrumentation (<a href="https://redirect.github.com/getsentry/sentry-javascript/pull/21647">#21647</a>)</li> <li>ref(node): Streamline undici (node-fetch) instrumentation (<a href="https://redirect.github.com/getsentry/sentry-javascript/pull/21650">#21650</a>)</li> <li>ref(vercel-edge): Drop unused <code>@opentelemetry/semantic-conventions</code> dependency (<a href="https://redirect.github.com/getsentry/sentry-javascript/pull/21691">#21691</a>)</li> <li>ref(vercel-edge): Remove <code>@opentelemetry/resources</code> dependency (<a href="https://redirect.github.com/getsentry/sentry-javascript/pull/21690">#21690</a>)</li> </ul> <!-- raw HTML omitted --> <h2>10.59.0</h2> <h3>Important Changes</h3> <ul> <li> <p><strong>feat(react-router): Add support for React Router v8 (<a href="https://redirect.github.com/getsentry/sentry-javascript/pull/21633">#21633</a>)</strong></p> <p>The SDK now supports React Router v8, in both the framework and SPA (<code>@sentry/react</code>) modes.</p> </li> <li> <p><strong>feat(react): Add version-agnostic React Router SPA exports (<a href="https://redirect.github.com/getsentry/sentry-javascript/pull/21633">#21633</a>)</strong></p> <p><code>@sentry/react</code> now exports version-agnostic wrappers for React Router v6+ SPA instrumentation. The new exports replace the version-specific <code>V6</code>/<code>V7</code> variants, which are now deprecated:</p> <table> <thead> <tr> <th>Deprecated</th> <th>New</th> </tr> </thead> <tbody> <tr> <td><code>reactRouterV6BrowserTracingIntegration</code> / <code>V7</code></td> <td><code>reactRouterBrowserTracingIntegration</code></td> </tr> <tr> <td><code>withSentryReactRouterV6Routing</code> / <code>V7</code></td> <td><code>wrapReactRouterRouting</code></td> </tr> <tr> <td><code>wrapCreateBrowserRouterV6</code> / <code>V7</code></td> <td><code>wrapCreateBrowserRouter</code></td> </tr> <tr> <td><code>wrapCreateMemoryRouterV6</code> / <code>V7</code></td> <td><code>wrapCreateMemoryRouter</code></td> </tr> <tr> <td><code>wrapUseRoutesV6</code> / <code>V7</code></td> <td><code>wrapUseRoutes</code></td> </tr> </tbody> </table> <p>The deprecated exports continue to work and will be removed in the next major version.</p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/getsentry/sentry-javascript/commit/4548afc27908146dca23db7a6722de714119909c"><code>4548afc</code></a> test: Make bundler plugins tests work after release</li> <li><a href="https://github.com/getsentry/sentry-javascript/commit/499c327ea9240c6daa183ff76a734ce89117c230"><code>499c327</code></a> chore: fix yarn.lock</li> <li><a href="https://github.com/getsentry/sentry-javascript/commit/4d26c19e7367d870e2e0758ba51def5d41637b52"><code>4d26c19</code></a> release: 10.60.0</li> <li><a href="https://github.com/getsentry/sentry-javascript/commit/cc7dea46c1915b4a2a7d39e21248c938f2ed800c"><code>cc7dea4</code></a> Merge pull request <a href="https://redirect.github.com/getsentry/sentry-javascript/issues/21703">#21703</a> from getsentry/prepare-release/10.60.0</li> <li><a href="https://github.com/getsentry/sentry-javascript/commit/bcef5d9c1cfb9d58f10fa5e9f5dfb42be1e4ff9c"><code>bcef5d9</code></a> meta(changelog): Update changelog for 10.60.0</li> <li><a href="https://github.com/getsentry/sentry-javascript/commit/8285066e1cfb58493d1434f895bd43f986e4d917"><code>8285066</code></a> chore: Add bundler-plugins to craft (<a href="https://redirect.github.com/getsentry/sentry-javascript/issues/21701">#21701</a>)</li> <li><a href="https://github.com/getsentry/sentry-javascript/commit/b953c6f74d9ac83eecbae0dc65cd09fedabda7a4"><code>b953c6f</code></a> fix(browser): Ensure <code>url.full</code> and <code>http.url</code> attributes have the same value...</li> <li><a href="https://github.com/getsentry/sentry-javascript/commit/b54777a859f5e8b7bcb90ab218bef1a55d133d7a"><code>b54777a</code></a> ref(vercel-edge): Drop unused <code>@opentelemetry/semantic-conventions</code> dependenc...</li> <li><a href="https://github.com/getsentry/sentry-javascript/commit/2e29cd32769084a46a5ce66b36a49b1295741a79"><code>2e29cd3</code></a> ref(vercel-edge): Remove <code>@opentelemetry/resources</code> dependency (<a href="https://redirect.github.com/getsentry/sentry-javascript/issues/21690">#21690</a>)</li> <li><a href="https://github.com/getsentry/sentry-javascript/commit/c5e245f869eca352e5d11833dd9b3264da448ac9"><code>c5e245f</code></a> ref(node): Remove unusued sql-common helper and <code>@opentelemetry/core</code> dep (<a href="https://redirect.github.com/getsentry/sentry-javascript/issues/2">#2</a>...</li> <li>Additional commits viewable in <a href="https://github.com/getsentry/sentry-javascript/compare/10.51.0...10.60.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> <!-- This is an auto-generated description by cubic. --> <a href="https://cubic.dev/pr/twentyhq/twenty/pull/22111?utm_source=github" target="_blank" rel="noopener noreferrer" data-no-image-dialog="true"><picture><source media="(prefers-color-scheme: dark)" srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source media="(prefers-color-scheme: light)" srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img alt="Review in cubic" src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a> <!-- End of auto-generated description by cubic. --> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
f2bed8359d |
chore(deps): bump @nestjs/schedule from 6.1.0 to 6.1.3 (#22112)
Bumps [@nestjs/schedule](https://github.com/nestjs/schedule) from 6.1.0 to 6.1.3. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/nestjs/schedule/releases">@nestjs/schedule's releases</a>.</em></p> <blockquote> <h2>6.1.3</h2> <h2>What's Changed</h2> <ul> <li>feat(cron): add initialDelay option to defer first job execution by <a href="https://github.com/kyungseopk1m"><code>@kyungseopk1m</code></a> in <a href="https://redirect.github.com/nestjs/schedule/pull/2251">nestjs/schedule#2251</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/nestjs/schedule/compare/6.1.2...6.1.3">https://github.com/nestjs/schedule/compare/6.1.2...6.1.3</a></p> <h2>Release 6.1.2</h2> <ul> <li>Merge pull request <a href="https://redirect.github.com/nestjs/schedule/issues/2247">#2247</a> from kyungseopk1m/feat/cron-initial-delay (a57ce2c)</li> <li>chore(deps): update dependency prettier to v3.8.3 (<a href="https://redirect.github.com/nestjs/schedule/issues/2248">#2248</a>) (bb3490d)</li> <li>feat(cron): add initialDelay option to defer first job execution (1c5677f)</li> <li>Merge pull request <a href="https://redirect.github.com/nestjs/schedule/issues/2245">#2245</a> from nestjs/renovate/nest-monorepo (59046bd)</li> <li>Merge pull request <a href="https://redirect.github.com/nestjs/schedule/issues/2246">#2246</a> from nestjs/renovate/oxlint-monorepo (be4eee3)</li> <li>chore(deps): update dependency oxlint to v1.60.0 (32a9ce2)</li> <li>chore(deps): update nest monorepo to v11.1.19 (7d3844f)</li> <li>chore: migrate to oxlint, vitest, ts6 (29de71b)</li> <li>chore(deps): update dependency globals to v17.5.0 (<a href="https://redirect.github.com/nestjs/schedule/issues/2244">#2244</a>) (6c62cca)</li> <li>chore(deps): update dependency sinon to v21.1.2 (<a href="https://redirect.github.com/nestjs/schedule/issues/2243">#2243</a>) (ee3b31a)</li> <li>chore(deps): update dependency sinon to v21.1.1 (<a href="https://redirect.github.com/nestjs/schedule/issues/2241">#2241</a>) (eba9799)</li> <li>Merge pull request <a href="https://redirect.github.com/nestjs/schedule/issues/2242">#2242</a> from nestjs/renovate/prettier-3.x (c3ad0f7)</li> <li>chore(deps): update dependency prettier to v3.8.2 (798e2a9)</li> <li>Merge pull request <a href="https://redirect.github.com/nestjs/schedule/issues/2199">#2199</a> from nestjs/renovate/cimg-node-24.x (a05354a)</li> <li>chore(deps): update dependency typescript-eslint to v8.58.1 (<a href="https://redirect.github.com/nestjs/schedule/issues/2240">#2240</a>) (0367ac1)</li> <li>chore(deps): update dependency eslint to v10.2.0 (<a href="https://redirect.github.com/nestjs/schedule/issues/2239">#2239</a>) (fa93e06)</li> <li>chore(deps): update nest monorepo to v11.1.18 (<a href="https://redirect.github.com/nestjs/schedule/issues/2238">#2238</a>) (8cd4c02)</li> <li>chore(deps): update dependency <code>@types/node</code> to v24.12.2 (<a href="https://redirect.github.com/nestjs/schedule/issues/2237">#2237</a>) (01482df)</li> <li>chore(deps): update dependency <code>@types/sinon</code> to v21.0.1 (<a href="https://redirect.github.com/nestjs/schedule/issues/2236">#2236</a>) (f05b5bd)</li> <li>chore(deps): update dependency ts-jest to v29.4.9 (<a href="https://redirect.github.com/nestjs/schedule/issues/2235">#2235</a>) (af545e6)</li> <li>chore(deps): update dependency typescript-eslint to v8.58.0 (<a href="https://redirect.github.com/nestjs/schedule/issues/2233">#2233</a>) (4dad22a)</li> <li>chore(deps): update node.js to v24.14.1 (28db9bc)</li> <li>chore(deps): update dependency eslint to v10.1.0 (<a href="https://redirect.github.com/nestjs/schedule/issues/2232">#2232</a>) (413f390)</li> <li>chore(deps): update nest monorepo to v11.1.17 (<a href="https://redirect.github.com/nestjs/schedule/issues/2230">#2230</a>) (46c2bc5)</li> <li>chore(deps): update dependency typescript-eslint to v8.57.1 (<a href="https://redirect.github.com/nestjs/schedule/issues/2231">#2231</a>) (8fd063b)</li> <li>chore(deps): update dependency sinon to v21.0.3 (<a href="https://redirect.github.com/nestjs/schedule/issues/2229">#2229</a>) (1671ad9)</li> <li>chore(deps): update commitlint monorepo to v20.5.0 (<a href="https://redirect.github.com/nestjs/schedule/issues/2228">#2228</a>) (2ecd2f1)</li> <li>chore(deps): update dependency lint-staged to v16.4.0 (<a href="https://redirect.github.com/nestjs/schedule/issues/2227">#2227</a>) (aa0de01)</li> <li>chore(deps): update commitlint monorepo to v20.4.4 (<a href="https://redirect.github.com/nestjs/schedule/issues/2226">#2226</a>) (75034fe)</li> <li>chore(deps): update dependency lint-staged to v16.3.3 (<a href="https://redirect.github.com/nestjs/schedule/issues/2225">#2225</a>) (f1c7d31)</li> <li>chore(deps): update dependency jest to v30.3.0 (<a href="https://redirect.github.com/nestjs/schedule/issues/2224">#2224</a>) (1a208d4)</li> <li>chore(deps): update dependency typescript-eslint to v8.57.0 (<a href="https://redirect.github.com/nestjs/schedule/issues/2223">#2223</a>) (60dd2c9)</li> <li>chore(deps): update dependency eslint to v10.0.3 (<a href="https://redirect.github.com/nestjs/schedule/issues/2221">#2221</a>) (791b6ba)</li> <li>chore(deps): update dependency <code>@eslint/eslintrc</code> to v3.3.5 (<a href="https://redirect.github.com/nestjs/schedule/issues/2220">#2220</a>) (0da1ca7)</li> <li>chore(deps): update dependency <code>@types/node</code> to v24.12.0 (<a href="https://redirect.github.com/nestjs/schedule/issues/2219">#2219</a>) (934a93e)</li> <li>chore(deps): update nest monorepo to v11.1.16 (<a href="https://redirect.github.com/nestjs/schedule/issues/2218">#2218</a>) (5f44e9b)</li> <li>chore(deps): update dependency sinon to v21.0.2 (<a href="https://redirect.github.com/nestjs/schedule/issues/2217">#2217</a>) (b807746)</li> <li>chore(deps): update dependency lint-staged to v16.3.2 (<a href="https://redirect.github.com/nestjs/schedule/issues/2216">#2216</a>) (4ca32bd)</li> <li>chore(deps): update commitlint monorepo to v20.4.3 (<a href="https://redirect.github.com/nestjs/schedule/issues/2215">#2215</a>) (d3ceb76)</li> <li>chore(deps): update nest monorepo to v11.1.15 (<a href="https://redirect.github.com/nestjs/schedule/issues/2214">#2214</a>) (b084ffc)</li> <li>chore(deps): update dependency lint-staged to v16.3.1 (<a href="https://redirect.github.com/nestjs/schedule/issues/2213">#2213</a>) (8a201b2)</li> <li>chore(deps): update dependency globals to v17.4.0 (<a href="https://redirect.github.com/nestjs/schedule/issues/2212">#2212</a>) (6f61793)</li> <li>chore(deps): update dependency lint-staged to v16.3.0 (<a href="https://redirect.github.com/nestjs/schedule/issues/2211">#2211</a>) (aa9213a)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/nestjs/schedule/commit/059f19678aac04fc4132b1aeaebd7a9ae4f34e30"><code>059f196</code></a> Merge pull request <a href="https://redirect.github.com/nestjs/schedule/issues/2249">#2249</a> from nestjs/renovate/release-it-20.x</li> <li><a href="https://github.com/nestjs/schedule/commit/557730ee8b898a0e2b03cdd5b207e176b60f8b1e"><code>557730e</code></a> Merge pull request <a href="https://redirect.github.com/nestjs/schedule/issues/2251">#2251</a> from kyungseopk1m/feat/cron-initial-delay-v2</li> <li><a href="https://github.com/nestjs/schedule/commit/14f5b80a16f2ce25c77a2f6de9370705b27a2acb"><code>14f5b80</code></a> feat(cron): add initialDelay option to defer first job execution</li> <li><a href="https://github.com/nestjs/schedule/commit/536367da7d59609b3595d440101fc24aaefb7cb5"><code>536367d</code></a> chore(deps): update dependency release-it to v20</li> <li><a href="https://github.com/nestjs/schedule/commit/57e2861f5e8cf5e9e3a709a2918f478d03e57aa5"><code>57e2861</code></a> Merge pull request <a href="https://redirect.github.com/nestjs/schedule/issues/2250">#2250</a> from nestjs/revert-2247-feat/cron-initial-delay</li> <li><a href="https://github.com/nestjs/schedule/commit/e08f457e4bddc83801d7bf0c60aff4a821290c9f"><code>e08f457</code></a> Revert "feat(cron): add initialDelay option to defer first job execution"</li> <li><a href="https://github.com/nestjs/schedule/commit/3198abea06f82b658b5bc4aa1dee6018c92cf04b"><code>3198abe</code></a> chore(): release v6.1.2</li> <li><a href="https://github.com/nestjs/schedule/commit/a57ce2c329b0662cffd56b16d71fb9da3b84c743"><code>a57ce2c</code></a> Merge pull request <a href="https://redirect.github.com/nestjs/schedule/issues/2247">#2247</a> from kyungseopk1m/feat/cron-initial-delay</li> <li><a href="https://github.com/nestjs/schedule/commit/bb3490dde2c3852463f231c3c556dd6d5b3a06d7"><code>bb3490d</code></a> chore(deps): update dependency prettier to v3.8.3 (<a href="https://redirect.github.com/nestjs/schedule/issues/2248">#2248</a>)</li> <li><a href="https://github.com/nestjs/schedule/commit/1c5677f46f100b03e5ae867306f089ba3381fab0"><code>1c5677f</code></a> feat(cron): add initialDelay option to defer first job execution</li> <li>Additional commits viewable in <a href="https://github.com/nestjs/schedule/compare/6.1.0...6.1.3">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> <!-- This is an auto-generated description by cubic. --> <a href="https://cubic.dev/pr/twentyhq/twenty/pull/22112?utm_source=github" target="_blank" rel="noopener noreferrer" data-no-image-dialog="true"><picture><source media="(prefers-color-scheme: dark)" srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source media="(prefers-color-scheme: light)" srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img alt="Review in cubic" src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a> <!-- End of auto-generated description by cubic. --> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
6a7458f20d |
chore(deps): bump @e2b/code-interpreter from 2.6.0 to 2.6.1 (#22106)
Bumps [@e2b/code-interpreter](https://github.com/e2b-dev/code-interpreter/tree/HEAD/js) from 2.6.0 to 2.6.1. <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/e2b-dev/code-interpreter/commit/fe3e5db60ba8f1b13623289a1b17a6f7e1a18f67"><code>fe3e5db</code></a> Throw descriptive error when sandbox is killed mid-request (<a href="https://github.com/e2b-dev/code-interpreter/tree/HEAD/js/issues/291">#291</a>)</li> <li><a href="https://github.com/e2b-dev/code-interpreter/commit/efadb49cc87e06766bdb1cc6f33d3c54cd3e2607"><code>efadb49</code></a> [skip ci] Release new versions</li> <li>See full diff in <a href="https://github.com/e2b-dev/code-interpreter/commits/@e2b/code-interpreter@2.6.1/js">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> <!-- This is an auto-generated description by cubic. --> <a href="https://cubic.dev/pr/twentyhq/twenty/pull/22106?utm_source=github" target="_blank" rel="noopener noreferrer" data-no-image-dialog="true"><picture><source media="(prefers-color-scheme: dark)" srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source media="(prefers-color-scheme: light)" srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img alt="Review in cubic" src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a> <!-- End of auto-generated description by cubic. --> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
e9d67a4bb3 |
chore(deps-dev): bump @storybook/addon-a11y from 10.4.1 to 10.4.6 (#22103)
Bumps [@storybook/addon-a11y](https://github.com/storybookjs/storybook/tree/HEAD/code/addons/a11y) from 10.4.1 to 10.4.6. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/storybookjs/storybook/releases">@storybook/addon-a11y's releases</a>.</em></p> <blockquote> <h2>v10.4.6</h2> <h2>10.4.6</h2> <ul> <li>CSF: Allow partial globals overrides in story and meta annotations - <a href="https://redirect.github.com/storybookjs/storybook/pull/34985">#34985</a>, thanks <a href="https://github.com/TheSeydiCharyyev"><code>@TheSeydiCharyyev</code></a>!</li> <li>Dependencies: Upgrade esbuild - <a href="https://redirect.github.com/storybookjs/storybook/pull/35157">#35157</a>, thanks <a href="https://github.com/Kakadus"><code>@Kakadus</code></a>!</li> </ul> <h2>v10.4.5</h2> <h2>10.4.5</h2> <ul> <li>Core: Rework AI checklist feature gate - <a href="https://redirect.github.com/storybookjs/storybook/pull/35053">#35053</a>, thanks <a href="https://github.com/Sidnioulz"><code>@Sidnioulz</code></a>!</li> <li>Preview: Stop mixed CSF3+4 stories getting core annotations injected twice - <a href="https://redirect.github.com/storybookjs/storybook/pull/35094">#35094</a>, thanks <a href="https://github.com/JReinhold"><code>@JReinhold</code></a>!</li> </ul> <h2>v10.4.4</h2> <h2>10.4.4</h2> <ul> <li>Telemetry: Add timeout to event-log POST to prevent build hang - <a href="https://redirect.github.com/storybookjs/storybook/pull/35085">#35085</a>, thanks <a href="https://github.com/badams"><code>@badams</code></a>!</li> </ul> <h2>v10.4.3</h2> <h2>10.4.3</h2> <ul> <li>Addon Docs: Fix Primary and Controls blocks not rendering in custom MDX pages - <a href="https://redirect.github.com/storybookjs/storybook/pull/34496">#34496</a>, thanks <a href="https://github.com/NYCU-Chung"><code>@NYCU-Chung</code></a>!</li> <li>Core: Respect !dev tag on MDX docs in sidebar - <a href="https://redirect.github.com/storybookjs/storybook/pull/35031">#35031</a>, thanks <a href="https://github.com/JReinhold"><code>@JReinhold</code></a>!</li> <li>React: Add support for resolving subcomponents attached as properties of a parent component - <a href="https://redirect.github.com/storybookjs/storybook/pull/34967">#34967</a>, thanks <a href="https://github.com/yatishgoel"><code>@yatishgoel</code></a>!</li> <li>UI: Prevent docs page scroll reset on HMR re-render - <a href="https://redirect.github.com/storybookjs/storybook/pull/35021">#35021</a>, thanks <a href="https://github.com/LongTangGithub"><code>@LongTangGithub</code></a>!</li> </ul> <h2>v10.4.2</h2> <h2>10.4.2</h2> <ul> <li>Bug: Fix Windows command resolution for non-Node package managers - <a href="https://redirect.github.com/storybookjs/storybook/pull/33534">#33534</a>, thanks <a href="https://github.com/copilot-swe-agent"><code>@copilot-swe-agent</code></a>!</li> <li>Build: Upgrade type-fest to latest version 5.6.0 - <a href="https://redirect.github.com/storybookjs/storybook/pull/34791">#34791</a>, thanks <a href="https://github.com/tobiasdiez"><code>@tobiasdiez</code></a>!</li> <li>CSF: Fix parsing of string literal export names - <a href="https://redirect.github.com/storybookjs/storybook/pull/34901">#34901</a>, thanks <a href="https://github.com/shilman"><code>@shilman</code></a>!</li> <li>Publish: Add npm provenance attestations - <a href="https://redirect.github.com/storybookjs/storybook/pull/34936">#34936</a>, thanks <a href="https://github.com/copilot-swe-agent"><code>@copilot-swe-agent</code></a>!</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/storybookjs/storybook/blob/next/CHANGELOG.md">@storybook/addon-a11y's changelog</a>.</em></p> <blockquote> <h2>10.4.6</h2> <ul> <li>CSF: Allow partial globals overrides in story and meta annotations - <a href="https://redirect.github.com/storybookjs/storybook/pull/34985">#34985</a>, thanks <a href="https://github.com/TheSeydiCharyyev"><code>@TheSeydiCharyyev</code></a>!</li> <li>Dependencies: Upgrade esbuild - <a href="https://redirect.github.com/storybookjs/storybook/pull/35157">#35157</a>, thanks <a href="https://github.com/Kakadus"><code>@Kakadus</code></a>!</li> </ul> <h2>10.4.5</h2> <ul> <li>Core: Rework AI checklist feature gate - <a href="https://redirect.github.com/storybookjs/storybook/pull/35053">#35053</a>, thanks <a href="https://github.com/Sidnioulz"><code>@Sidnioulz</code></a>!</li> <li>Preview: Stop mixed CSF3+4 stories getting core annotations injected twice - <a href="https://redirect.github.com/storybookjs/storybook/pull/35094">#35094</a>, thanks <a href="https://github.com/JReinhold"><code>@JReinhold</code></a>!</li> </ul> <h2>10.4.4</h2> <ul> <li>Telemetry: Add timeout to event-log POST to prevent build hang - <a href="https://redirect.github.com/storybookjs/storybook/pull/35085">#35085</a>, thanks <a href="https://github.com/badams"><code>@badams</code></a>!</li> </ul> <h2>10.4.3</h2> <ul> <li>Addon Docs: Fix Primary and Controls blocks not rendering in custom MDX pages - <a href="https://redirect.github.com/storybookjs/storybook/pull/34496">#34496</a>, thanks <a href="https://github.com/NYCU-Chung"><code>@NYCU-Chung</code></a>!</li> <li>Core: Respect !dev tag on MDX docs in sidebar - <a href="https://redirect.github.com/storybookjs/storybook/pull/35031">#35031</a>, thanks <a href="https://github.com/JReinhold"><code>@JReinhold</code></a>!</li> <li>React: Add support for resolving subcomponents attached as properties of a parent component - <a href="https://redirect.github.com/storybookjs/storybook/pull/34967">#34967</a>, thanks <a href="https://github.com/yatishgoel"><code>@yatishgoel</code></a>!</li> <li>UI: Prevent docs page scroll reset on HMR re-render - <a href="https://redirect.github.com/storybookjs/storybook/pull/35021">#35021</a>, thanks <a href="https://github.com/LongTangGithub"><code>@LongTangGithub</code></a>!</li> </ul> <h2>10.4.2</h2> <ul> <li>Bug: Fix Windows command resolution for non-Node package managers - <a href="https://redirect.github.com/storybookjs/storybook/pull/33534">#33534</a>, thanks <a href="https://github.com/copilot-swe-agent"><code>@copilot-swe-agent</code></a>!</li> <li>Build: Upgrade type-fest to latest version 5.6.0 - <a href="https://redirect.github.com/storybookjs/storybook/pull/34791">#34791</a>, thanks <a href="https://github.com/tobiasdiez"><code>@tobiasdiez</code></a>!</li> <li>CSF: Fix parsing of string literal export names - <a href="https://redirect.github.com/storybookjs/storybook/pull/34901">#34901</a>, thanks <a href="https://github.com/shilman"><code>@shilman</code></a>!</li> <li>Publish: Add npm provenance attestations - <a href="https://redirect.github.com/storybookjs/storybook/pull/34936">#34936</a>, thanks <a href="https://github.com/copilot-swe-agent"><code>@copilot-swe-agent</code></a>!</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/storybookjs/storybook/commit/5496a4270da7f3a8e0203185792685cba671fdc5"><code>5496a42</code></a> Bump version from "10.4.5" to "10.4.6" [skip ci]</li> <li><a href="https://github.com/storybookjs/storybook/commit/48e7b20074222ed926d14fb6c678c2edfc86ee7b"><code>48e7b20</code></a> Bump version from "10.4.4" to "10.4.5" [skip ci]</li> <li><a href="https://github.com/storybookjs/storybook/commit/5adebe753f29d414d1e214e935c94d6e5451861f"><code>5adebe7</code></a> Bump version from "10.4.3" to "10.4.4" [skip ci]</li> <li><a href="https://github.com/storybookjs/storybook/commit/624e6187fd462e56719cbd80c1b4bfb67b68fc89"><code>624e618</code></a> Bump version from "10.4.2" to "10.4.3" [skip ci]</li> <li><a href="https://github.com/storybookjs/storybook/commit/298dea20c6370e5c670178d88a79fc9e9ff436b2"><code>298dea2</code></a> Bump version from "10.4.1" to "10.4.2" [skip ci]</li> <li>See full diff in <a href="https://github.com/storybookjs/storybook/commits/v10.4.6/code/addons/a11y">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> <!-- This is an auto-generated description by cubic. --> <a href="https://cubic.dev/pr/twentyhq/twenty/pull/22103?utm_source=github" target="_blank" rel="noopener noreferrer" data-no-image-dialog="true"><picture><source media="(prefers-color-scheme: dark)" srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source media="(prefers-color-scheme: light)" srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img alt="Review in cubic" src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a> <!-- End of auto-generated description by cubic. --> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
fef53b9915 |
chore(deps): bump react-error-boundary from 4.0.13 to 4.1.2 (#22105)
Bumps [react-error-boundary](https://github.com/bvaughn/react-error-boundary) from 4.0.13 to 4.1.2. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/bvaughn/react-error-boundary/releases">react-error-boundary's releases</a>.</em></p> <blockquote> <h2>4.1.2</h2> <ul> <li>Remove <code>engines</code> field from Package JSON entirely</li> </ul> <h2>4.1.1</h2> <ul> <li>Remove node constraint from engines</li> </ul> <h2>4.1.0</h2> <ul> <li>Relax fallback prop to support broader ReactNode type</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/bvaughn/react-error-boundary/commit/9688d9f80d47834011dccfa9d1f1377968a4108f"><code>9688d9f</code></a> 4.1.1 -> 4.1.2</li> <li><a href="https://github.com/bvaughn/react-error-boundary/commit/8f48596c6702107ad0bffee105ed9eb95c30f869"><code>8f48596</code></a> Remove engines field</li> <li><a href="https://github.com/bvaughn/react-error-boundary/commit/434282742a2f14190aa8c0b27d0d1292d082a914"><code>4342827</code></a> 4.1.0 -> 4.1.1</li> <li><a href="https://github.com/bvaughn/react-error-boundary/commit/e3d6eb9962d1a6515756f7af7994302d2cb566c6"><code>e3d6eb9</code></a> Remove node constraint from engines</li> <li><a href="https://github.com/bvaughn/react-error-boundary/commit/defdae05746cb6571152414661e8c78592608465"><code>defdae0</code></a> style(types.ts): remove unused imports (<a href="https://redirect.github.com/bvaughn/react-error-boundary/issues/200">#200</a>)</li> <li><a href="https://github.com/bvaughn/react-error-boundary/commit/a1e634faef0fc4fd23a731143b5ae6e2c69f8c55"><code>a1e634f</code></a> chore(package.json): add rimraf (<a href="https://redirect.github.com/bvaughn/react-error-boundary/issues/199">#199</a>)</li> <li><a href="https://github.com/bvaughn/react-error-boundary/commit/96bb33370f9b9f0c9c6f3733a90d55dd7a1c34d2"><code>96bb333</code></a> 4.0.12 -> 4.1.0</li> <li><a href="https://github.com/bvaughn/react-error-boundary/commit/206bdbad362737480ebd39cefb945c8cec11c1ce"><code>206bdba</code></a> Upgrade pnpm v8 -> v9 (<a href="https://redirect.github.com/bvaughn/react-error-boundary/issues/198">#198</a>)</li> <li><a href="https://github.com/bvaughn/react-error-boundary/commit/23167c532dd6da0b8f106ab6ff8705ff64de81eb"><code>23167c5</code></a> Relax fallback prop to support broader ReactNode type</li> <li><a href="https://github.com/bvaughn/react-error-boundary/commit/4aaf9b023a20fbfda67db74bf550124e8bbfa00c"><code>4aaf9b0</code></a> chore: update CI workflows version to v4 and node version to 20 (<a href="https://redirect.github.com/bvaughn/react-error-boundary/issues/194">#194</a>)</li> <li>Additional commits viewable in <a href="https://github.com/bvaughn/react-error-boundary/compare/4.0.13...4.1.2">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> <!-- This is an auto-generated description by cubic. --> <a href="https://cubic.dev/pr/twentyhq/twenty/pull/22105?utm_source=github" target="_blank" rel="noopener noreferrer" data-no-image-dialog="true"><picture><source media="(prefers-color-scheme: dark)" srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source media="(prefers-color-scheme: light)" srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img alt="Review in cubic" src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a> <!-- End of auto-generated description by cubic. --> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
Abdullah.
|
20ac0a52bf |
fix(deps): scope js-yaml to 4.2.0 under the mintlify/verdaccio pinners (#22078)
## Summary Resolves [Dependabot alert #1504](https://github.com/twentyhq/twenty/security/dependabot/1504) — js-yaml **CVE-2026-53550 / GHSA-h67p-54hq-rp68** (quadratic-complexity DoS in YAML merge-key handling, vulnerable `<=4.1.1`, fixed `4.2.0`) — by lifting the vulnerable **js-yaml 4.1.1 → 4.2.0**. ## Why scoped resolutions (not a global pin) - js-yaml 4.1.1 is held alive by **7 packages that hard-pin it exact** (no caret, still 4.1.1 in their latest): `@mintlify/{cli,common,prebuild,previewing,scraping,validation}` + `@verdaccio/config`. No parent upgrade carries the fix, so each is scoped to 4.2.0 — matching the repo's `parent/child` convention. - The 5 alert paths (`@graphql-codegen/cli`, `@lingui/cli`, `@lingui/vite-plugin`, `@wyw-in-js/vite`, `vite-plugin-svgr`) only *shared* that 4.1.1 via `cosmiconfig` (`^4.1.0`) — once the exact pins are lifted, they **dedupe onto 4.2.0 on their own**. - Forcing 4.1.1 → 4.2.0 is a **safe minor** (same 4.x `.load` API; the fix just bounds merge-key complexity). ## The js-yaml 3.x remnant (deliberately left) `front-matter@4.0.2` (via mintlify) and `@istanbuljs/load-nyc-config@1.1.0` (via storybook coverage) declare `js-yaml ^3.13.1 → 3.14.2`. **front-matter calls the `safeLoad` API that js-yaml 4.x removed**, so it cannot take 4.2.0 — a global pin would break it (which is why this is scoped). That 3.x copy is left in place; both parse only **first-party trusted YAML** (nycrc + docs front-matter), so the merge-key DoS isn't reachable. If Dependabot still flags that 3.x copy, it's a dismiss candidate (no safe transitive fix — front-matter is EOL on the `safeLoad` API). ## Verification - `yarn install --immutable` passes. - No `js-yaml@4.1.1` remains; js-yaml is now `4.2.0` (+ the documented `3.14.2` remnant). - Diff is js-yaml-only; matching `"//resolutions"` doc entry included. |
||
|
Abdullah.
|
b7cd6db458 |
fix(deps): resolve qs to 6.15.2 (dedupe caret group + scope body-parser) (#22050)
## Summary Closes [Dependabot alert #1305](https://github.com/twentyhq/twenty/security/dependabot/1305) — qs **CVE-2026-8723 / GHSA-q8mj-m7cp-5q26** (vulnerable `>=6.11.1 <=6.15.1`, fixed `6.15.2`) — via two changes: 1. **`yarn dedupe qs`** collapses the caret-range consumers (gitbeaker, formidable, superagent, googleapis-common, union, body-parser@2.2.2) from `6.15.0` onto the `6.15.2` already in the tree. Clean, no resolution. 2. A scoped **`body-parser/qs: 6.15.2`** resolution for the lone tilde-pinned holdout. ## Why the one resolution - After the dedupe, the only vulnerable qs left was `6.14.2`, from **`body-parser@1.20.4`** which declares `qs ~6.14.0` (capped at 6.14.x). - body-parser **2.x** uses `qs ^6.15.2`, but that needs **express 5** — and the `body-parser@1.20.4` here comes from **express 4.22.x**, pulled by `@mintlify/previewing` + verdaccio (build/dev tooling, not bumpable to express 5). - So a scoped `body-parser/qs: 6.15.2` is the right fix — qs `6.14 → 6.15` is a compatible minor. It's grouped with the existing `express/qs` + `@cypress/request/qs` entries (same CVE, same express-4.x root cause) in both the `resolutions` block and the `"//resolutions"` doc. ## Verification - `yarn install --immutable` passes. - No qs in `[6.11.1, 6.15.1]` remains — all qs is now `6.15.2`. - `qs` is build/dev tooling here (mintlify, verdaccio, gitbeaker, etc.), not the production server runtime. |
||
|
Etienne
|
0f4c4e69a9 |
fix(ai-tool): make search_output a raw-text occurrence search (#22034)
## Summary
`search_output` (the spilled-output navigation tool) was built around a
JSON-centric, line-based model that breaks for the data it actually
receives. Spilled outputs are written as compact
`JSON.stringify(output)` (single line, escaped newlines), so the tool's
line-by-line matching collapsed to at most one match, and its schema
described searching "the indented JSON representation" even though it
falls back to raw text for non-JSON. It also ran arbitrary,
model-supplied regexes through the native engine with no ReDoS
protection.
This reworks the tool into a `grep -o` style search over the raw file
bytes: it finds every occurrence of a pattern regardless of newlines and
returns a character window around each hit. It works uniformly for
compact/pretty JSON, CSV, HTML, and plain text.
## Changes
- **Occurrence-based matching** (`search-output.util.ts`): search the
raw content for every match via a global-regex `exec` loop (with a
zero-width-match guard), bounded by `offset + maxMatches`. Results are
now `{ charOffset, match, context }` with a character window around each
occurrence and a centered-ellipsis cap for very long single matches. The
line model (`split`, line numbers, line context) is removed.
- **ReDoS hardening**: matching now uses `re2` (already a dependency)
with the global flag, guaranteeing linear-time matching. Unsupported
regex features (lookahead/backreferences) and invalid patterns fall back
to escaped-literal search instead of throwing.
- **No more reserialization** (`search-output-tool.ts`): the
`JSON.stringify(JSON.parse(...))` round-trip is gone; the tool searches
the exact bytes on disk, so there is no coordinate divergence with
`extract_json_paths`.
- **API** (`search-output-tool.schema.ts`): `contextLines` →
`contextChars` (default 100, max 2000); honest descriptions reflecting
raw-text occurrence search and the regex-or-literal fallback. The result
message reports occurrence counts.
- **Cleanup**: removed unused constants
(`default-search-output-context-lines`,
`search-output-max-line-length`); added
`default-search-output-context-chars` and
`search-output-max-match-length`.
`extract_json_paths` and the spill service are untouched.
## Tradeoff
Results use character offsets/windows rather than line numbers and line
context. For an LLM extracting values from a spilled blob this is more
robust (works on single-line content); the cost is no line-based context
for genuinely line-structured content.
## Test plan
- [x] `search-output.util.spec.ts` rewritten for occurrence semantics:
multiple hits on a single newline-free line, zero-width-pattern
termination, catastrophic-backtracking pattern stays fast (RE2),
lookahead/invalid-regex literal fallback, char-window clipping, offset
pagination, long-match truncation. 12/12 pass.
- [x] `npx nx typecheck twenty-server` clean.
- [x] `npx nx lint:diff-with-main twenty-server` clean (lint + format).
## Deploy note
`re2` is a native addon. It was declared in `package.json` but never
imported/built before this PR, so its binary may be absent in some
environments (local install required `npm rebuild re2`). Confirm the
install/build pipeline (CI, Docker images) compiles native modules so
the tool doesn't throw `Cannot find module 're2.node'` at runtime.
<!-- This is an auto-generated description by cubic. -->
<a
href="https://cubic.dev/pr/twentyhq/twenty/pull/22034?utm_source=github"
target="_blank" rel="noopener noreferrer"
data-no-image-dialog="true"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source
media="(prefers-color-scheme: light)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img
alt="Review in cubic"
src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a>
<!-- End of auto-generated description by cubic. -->
|
||
|
Abdullah.
|
9c9041c9f9 |
fix(deps): bump engine.io + socket.io-adapter to drop vulnerable ws 8.17.1 (#22044)
## Summary Bumps the transitive **`engine.io`** `6.6.4 → 6.6.9` and **`socket.io-adapter`** `2.5.5 → 2.5.8` (both within socket.io's declared ranges — socket.io is pulled by mintlify / react-email build tooling), which declare `ws ~8.21.0` instead of `~8.17.1`, **evicting the last vulnerable `ws@8.17.1`**. Resolves two Dependabot alerts: - [#1502](https://github.com/twentyhq/twenty/security/dependabot/1502) (high) — GHSA-96hv-2xvq-fx4p, ws memory-exhaustion DoS (`>=8.0.0 <8.21.0`) - [#1238](https://github.com/twentyhq/twenty/security/dependabot/1238) (med) — GHSA-58qx-3vcg-4xpx, ws uninitialized memory disclosure (`>=8.0.0 <8.20.1`) ## Why a parent-bump (not a resolution) - The only vulnerable ws left was `8.17.1`, pinned by `engine.io@6.6.4` (`ws ~8.17.1`) and `socket.io-adapter@2.5.5` (`ws ~8.17.1`). (The earlier koa PR already dropped the dts-plugin `ws@8.18.0`.) - `engine.io@6.6.9` and `socket.io-adapter@2.5.8` declare `ws ~8.21.0`, and both bumps are within socket.io's existing ranges — so `yarn up -R` carries the fix in-range, with no `resolutions` entry to maintain. - (The pre-existing `@nestjs/graphql/ws: 8.21.0` resolution is unrelated and untouched.) ## Result - ws is now `8.21.0` (plus non-vulnerable `7.5.11` / `6.2.4`); nothing in `[8.0.0, 8.21.0)`. - `package.json` untouched; engine.io/socket.io are build / email-preview tooling, not the server runtime. ## Verification - `yarn install --immutable` passes. - No vulnerable ws remains in `yarn.lock`; diff is contained to ws / engine.io / socket.io-adapter (+ a `debug` descriptor cleanup). |
||
|
Abdullah.
|
63e258a85c |
fix(deps): bump @module-federation/node to drop the koa-pinning 0.21.4 stack (#22032)
## Summary Bumps the transitive **`@module-federation/node`** `2.7.23 → 2.7.45` (within `@nx/module-federation`'s declared `^2.7.21`), which consolidates the module-federation stack onto `enhanced 2.6.0` and **prunes the duplicate 0.21.4 sub-stack that pinned koa 3.0.3** — resolving [Dependabot alert #547](https://github.com/twentyhq/twenty/security/dependabot/547): CVE-2026-27959 / GHSA-7gcc-r8m5-44qm (koa Host Header Injection via `ctx.hostname`, vulnerable `>=3.0.0 <3.1.2`). Lockfile-only, **no resolution**. ## Why a parent-bump (not a resolution) - koa 3.0.3 was pinned **exactly** by `@module-federation/dts-plugin@0.21.4`. Newer dts-plugin (2.5.1, 2.6.0) **dropped koa entirely**. - The old 0.21.4 stack survived only because `@module-federation/node@2.7.23` declared `@module-federation/enhanced: 0.21.4` (a stale internal pin). `@module-federation/node@2.7.45` declares `enhanced: 2.6.0`, and `@nx/module-federation@22.7.5` already requires node `^2.7.21` — so 2.7.45 is in range. - `yarn up -R @module-federation/node` therefore eliminates the vulnerable dependency honestly, in-range, with no `resolutions` entry to maintain. ## Result - `koa@3.0.3` gone, and with it the entire duplicate `@module-federation/*@0.21.4` stack — **net −678 lines** of lockfile. - Bonus: the dts-plugin-pinned `ws@8.18.0` dropped too (the remaining `ws@8.17.1` comes from socket.io/engine.io — a separate, upcoming fix). - `package.json` untouched. This is **build-tooling** (module-federation type generation), not the production server runtime. ## Verification - `yarn install --immutable` passes. - `koa` is absent from `yarn.lock`; no `@module-federation/enhanced@0.21.x` remains. - The bump stays within `@nx/module-federation`'s declared range — recommend the CI frontend build as the runtime check for the module-federation tooling. |
||
|
Raphaël Bosi
|
766d90af7e |
Remove framer-motion from twenty-ui (#22021)
## What Removes the `framer-motion` dependency from `twenty-ui` and replaces every usage with pure CSS animations, reaching for Base UI primitives where one fits: - **Collapse/expand** (`AnimatedEaseInOut`, `AnimatedExpandableContainer`): rebuilt on Base UI `Collapsible` (CSS-animated `--collapsible-panel-height/width` + transition states). Public props unchanged, so the ~28 call sites are untouched. - **ProgressBar**: rebuilt on Base UI `Progress` (proper `role`/`aria-valuenow`). The snackbar auto-dismiss countdown now uses a CSS keyframe + `animation-play-state` (pause on hover), removing a per-frame React re-render; `useProgressAnimation` is deleted. - The remaining `Animated*` components, the circular spinner, checkmark, and the placeholder pointer parallax move to plain CSS (SCSS modules + the `duration()` helper + theme tokens). - Deletes 3 unused components (`AnimatedTranslation`, `AnimatedTextWord`, `AnimatedFadeOut`). ## Why `twenty-ui` is a publicly published library with a size budget, so dropping framer-motion shrinks what consumers ship. `twenty-front` keeps its own framer-motion; that is out of scope here. ## Notes for reviewers - A few `twenty-ui` components received framer props from `twenty-front` call sites; those were migrated (e.g. `AnimatedLightIconButton` gained a CSS `rotate` prop, and the `EMPTY_PLACEHOLDER_TRANSITION_PROPS` spreads were removed). - Behavior change: Base UI `Collapsible` animates only on open/close transitions, so the old "animate in on first mount while already open" case no longer plays (the `initial` prop is kept for API compatibility). <!-- This is an auto-generated description by cubic. --> <a href="https://cubic.dev/pr/twentyhq/twenty/pull/22021?utm_source=github" target="_blank" rel="noopener noreferrer" data-no-image-dialog="true"><picture><source media="(prefers-color-scheme: dark)" srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source media="(prefers-color-scheme: light)" srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img alt="Review in cubic" src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a> <!-- End of auto-generated description by cubic. --> |
||
|
Abdullah.
|
11218561d0 |
fix(deps): pin form-data under nx and zapier-platform-core to 4.0.6 (#22023)
## Summary Adds two scoped `resolutions` (`nx/form-data` + `zapier-platform-core/form-data` → `4.0.6`) forcing the lone vulnerable `form-data@4.0.5` up to the patched `4.0.6`, resolving [Dependabot alert #1506](https://github.com/twentyhq/twenty/security/dependabot/1506) — CVE-2026-12143 / GHSA-hmw2-7cc7-3qxx (CRLF injection via unescaped multipart field names/filenames, vulnerable `>=4.0.0 <4.0.6`). ## Why scoped resolutions (not a parent-bump) - `form-data@4.0.5` is pinned **exactly** by `nx@22.7.5` (root devDep) and `zapier-platform-core@19.0.0` (twenty-zapier) — and **both still pin 4.0.5 in their latest release**, so no parent upgrade carries the fix. - Every *other* form-data consumer already resolves `4.0.6` naturally via its `^4.0.x` range, so the two scoped pins simply **dedupe** nx/zapier's copy onto that existing 4.0.6 — no new copy introduced. - Scoped, not global, to match the existing `express/qs` + `@cypress/request/qs` two-entry pattern (only form-data 4.x is in the tree). ## Changes - `package.json`: the two `resolutions` entries **plus** a matching `"//resolutions"` doc entry (advisory, why-no-parent-bump, scope rationale, drop condition). ## Verification - `yarn install --immutable` passes. - No form-data in `[4.0.0, 4.0.6)` remains in `yarn.lock`. |
||
|
Raphaël Bosi
|
293ff4c462 |
Auto-generate app cover images from the app logo (#22011)
<img width="1388" height="858" alt="image" src="https://github.com/user-attachments/assets/59f16bf7-5908-4624-b3af-51416bbebba3" /> ## What When an app is built (`twenty build` / `twenty publish`), the SDK now generates a marketplace cover image and sets it as the app's screenshot, but only when the app declares a `logoUrl` and has no `screenshots`. The cover composites the app's logo and the Twenty logo over the branded halftone backdrop, matching the design reference. ## Why Most apps ship a logo but no screenshots, so their marketplace detail page had no hero visual. This gives them a polished cover for free, with no per-app design work. ## Notes for reviewers - Generation lives in the build path (`operations/build.ts`), not `buildManifest`, so `twenty dev` and the shared manifest builder are untouched. It is best-effort: on failure it logs a warning and the build continues. - The cover is written to `.twenty/output` and registered as a public asset + screenshot, so the existing copy/checksum/serve pipeline handles it unchanged. No app source files are modified. - Adds `sharp` as a runtime dependency of `twenty-sdk` (a build-time tool, like `esbuild`); it is not bundled into built apps. <!-- This is an auto-generated description by cubic. --> <a href="https://cubic.dev/pr/twentyhq/twenty/pull/22011?utm_source=github" target="_blank" rel="noopener noreferrer" data-no-image-dialog="true"><picture><source media="(prefers-color-scheme: dark)" srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source media="(prefers-color-scheme: light)" srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img alt="Review in cubic" src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a> <!-- End of auto-generated description by cubic. --> |
||
|
Abdullah.
|
558f2509c2 |
fix(deps): pin undici under @module-federation/dts-plugin to ^7.28.0 (#22014)
## Summary Adds a **scoped** `resolutions` entry pinning `undici` under `@module-federation/dts-plugin` to `^7.28.0`, resolving **6 Dependabot alerts** — #1523 & #1566 (high), #1522 & #1570 (medium), #1565 & #1572 (low); all `undici >=7.0.0 <7.28.0`. ## Why a scoped resolution (not a parent-bump or a global pin) - The vulnerable `undici@7.24.7` is pinned **exactly** by the transitive build tool `@module-federation/dts-plugin@2.5.1`. There's no parent to bump — its parents pin it and it doesn't loosen the pin at latest — so a committed scoped resolution (matching the existing `@nestjs/graphql/ws`, `express/qs` pattern) is the right fix. - A **global** `undici` resolution would be wrong: the tree also has `undici@6.27.0` (`^6.25.0`, outside the advisory) and the latest undici is `8.5.0`, so forcing all undici to 7.x would break the 6.x consumer. - `^7.28.0` resolves to `7.28.0` (highest 7.x), which **dedupes** with the `undici@7.28.0` already in the tree (via `^7.25.0`) — no new copy is introduced. ## Result - `undici@7.24.7` is gone; the only undici 7.x is now `7.28.0`. `undici@6.27.0` (6.x) is untouched. - Build-tooling dependency (module-federation type generation) — not in the production server runtime; `undici 7.24 → 7.28` is a compatible minor bump. ## Verification - `yarn install --immutable` passes (lockfile consistent with CI). - No undici in `[7.0.0, 7.28.0)` remains in `yarn.lock`. |
||
|
Abdullah.
|
6520db22ca |
fix(deps): bump opentelemetry suite to core 2.8.0 (+ sentry 10.59) (#22010)
## Summary Bumps the OpenTelemetry suite onto the **`@opentelemetry/core` 2.8.0** wave (plus Sentry `10.51 → 10.59`, which carries the otel instrumentation), resolving [Dependabot alert #1510](https://github.com/twentyhq/twenty/security/dependabot/1510) (`@opentelemetry/core < 2.8.0`). ## Why a parent-bump, not a `resolutions` entry The vulnerable `@opentelemetry/core` is transitive, pulled in by the otel packages we declare (`exporter-metrics-otlp-http`, `exporter-prometheus`, `sdk-metrics`) **and** by `@sentry/*` (which bundles `@opentelemetry/instrumentation-*`). The otel **stable** packages pin `core` to their own exact version and are version-coupled — forcing `core` ahead of the suite via `resolutions` risks runtime breakage. So this bumps the declared parents instead. ## Changes - `twenty-server/package.json`: - `@opentelemetry/exporter-metrics-otlp-http` `^0.200.0 → ^0.219.0` - `@opentelemetry/exporter-prometheus` `^0.217.0 → ^0.219.0` - `@opentelemetry/sdk-metrics` `^2.0.0 → ^2.8.0` - `@sentry/{nestjs,node,profiling-node}` `^10.51.0 → ^10.59.0` - `yarn dedupe` collapses the remaining transitive `core@2.7.1` (caret consumers) onto `2.8.0` — the whole stable set (`core` / `resources` / `sdk-trace-base` / `sdk-metrics`) is now `2.8.0`. - **`@types/pg` added as a direct devDependency.** The newer Sentry drops the instrumentation that used to *transitively* provide `@types/pg`; twenty-server imports `pg` directly (`set-pg-date-type-parser.ts`), so it now declares its own types — fixing a latent fragility the bump exposed. ## Verification - `nx typecheck twenty-server` — **0 errors** (validates the otel/sentry API surface we call is intact). - `yarn install --immutable` passes. - No `@opentelemetry/core < 2.8.0` remains. - Lockfile churn is contained to the observability subtree (otel/sentry + their transitive deps; net **−615 lines**). > Sentry resolved to `10.59.0` rather than the just-published `10.60.0` due to the repo's `npmMinimalAgeGate`. > Worth a quick server-boot check during review to confirm Sentry/otel init at runtime. |
||
|
Raphaël Bosi
|
85406a58fb |
Use minimal babel presets for wyw to fix the website Cloudflare build (#21994)
The website's Cloudflare build (`opennextjs-cloudflare` / Turbopack) was failing with `_defineProperty is not a function` while linaria/wyw evaluates `twenty-ui/dist/theme.cjs` at build time. It regressed in #21946, whose twenty-ui build rework changed the emitted `theme.cjs` so the theme objects ship as runtime object spreads (`{ ...THEME_COMMON }`). **Cause:** wyw evaluates modules in Node through `next/babel`, which pulls in `preset-env` + `transform-runtime`. Those re-lower the runtime spreads into `@babel/runtime` helpers imported as ESM; wyw then `require()`s that ESM module in a CJS context where the export is not callable, so `_defineProperty` fails. **Fix:** wyw runs in Node and needs no downleveling, so replace `next/babel` with minimal presets (`@babel/preset-typescript`, `@babel/preset-react`, `@wyw-in-js/babel-preset`, plus `@babel/plugin-transform-export-namespace-from`), matching twenty-front's wyw config. No `@babel/runtime` helpers get injected. Kept on the website side so twenty-ui keeps react/react-dom as peer deps (#21946). Note: no blocking PR check runs the website production build, so this is best validated via the website preview build or the twenty-infra deploy. |
||
|
Etienne
|
7b45380777 |
feat(ai): large tool output handling + navigation tools (#21982)
## Summary
Large tool outputs (e.g. a workflow run that serializes to ~70k tokens)
blow the chat context budget and force per-tool "raw" variants. This PR
handles oversized outputs generically in one place:
1. **Producer:** when a tool result exceeds a byte budget, it is spilled
to a `FileFolder.AgentChat` file and replaced with a compact `{ spilled,
outputRef, shape, hint }` envelope.
2. **Consumer:** two bounded, in-server navigation tools —
`extract_json_path` and `search_output` — let the model dig into the
spilled file by `fileId` without spinning up `code_interpreter`.
Together they add a fast, auditable middle tier between "truncated
inline preview" and "full code_interpreter relay," and enable an
enterprise "restricted" mode (spill + navigation, no sandbox).
## Data flow
```mermaid
flowchart TD
exec["resolveAndExecute / hydrateToolSet closure"] --> compact[compactToolOutput]
compact --> enabled{"spillLargeOutput enabled? (chat only)"}
enabled -->|no| inlineRaw["inline raw (MCP, workflow, sandbox bridge)"]
enabled -->|yes| size{"bytes > MAX_INLINE_TOOL_OUTPUT_BYTES?"}
size -->|no| inline["inline result"]
size -->|yes| skeleton["jsonShapeSkeleton + largeOutputHint"]
skeleton --> write["writeFile(AgentChat)"]
write --> envelope["return { spilled, outputRef, shape, hint }"]
envelope --> model[Model]
model --> nav["extract_json_path / search_output / code_interpreter (by fileId)"]
```
## Part 1 — Navigation tools (consumer)
- `extract_json_path`: extracts a sub-tree from a spilled JSON file by a
JSONPath-lite expression (dot/bracket access, array slicing,
single-level wildcard), with `maxItems`/`maxDepth` bounding. No filters
or recursive descent — those belong to `code_interpreter`.
- `search_output`: grep-like line search with context lines and
stateless `offset` pagination (`{ matches, totalMatches, hasMore }`).
- Both read from `FileFolder.AgentChat` by `fileId`, enforce their own
output byte cap, and are registered in `ActionToolProvider` (always
available; read-only).
## Part 2 — Spill producer
- Spilling slots in right after the existing `compactToolOutput` step at
the two seams in `ToolRegistryService` (`resolveAndExecute` and the
`hydrateToolSet` execute closure).
- `ToolOutputSpillService.spillIfTooLarge()` measures
`Buffer.byteLength`; over `MAX_INLINE_TOOL_OUTPUT_BYTES` (16 KB ≈ 4k
tokens) it writes the full payload and returns the envelope. Spill
failures never block the call (inline + warning).
- `jsonShapeSkeleton` computes a bounded structural map (depth 4, arrays
as `"array[N] of <type>"`, id-keyed maps collapsed, long leaves as size
markers, hard-capped at 1024 bytes) so the model knows the key paths in
one pass.
- Optional per-tool `largeOutputHint` (on the `Tool` type, threaded via
the descriptor) is used as the hint when present, else a generic hint.
The `shape` is always computed generically.
## Surfaces
Spilling is an opt-in flag (`spillLargeOutput`) mirroring
`compactOutput`:
| Surface | `spillLargeOutput` | Behavior |
| --- | --- | --- |
| AI chat / agent | `true` (in `chat-execution.service.ts`) | Spill on;
nav tools + `code_interpreter` in catalog |
| External MCP clients | unset | Raw output |
| Workflow agents | unset | Raw output |
| `code_interpreter` sandbox bridge | unset (it's an MCP call) | Raw
output |
The sandbox bridge inherits "no spill" for free via the MCP path — no
header sniffing, no `ToolContext.source` field.
## Design constraints (anti-micro-OS)
Exactly two navigation tools, no composition/piping, read-only, bounded
output. The boundary is: expressible as a single path lookup or text
search → nav tool; aggregation/correlation/transform →
`code_interpreter`.
## Notes / deviations from the plan
- `jsonShapeSkeleton` and `ToolOutputSpillService` live under the `tool`
module (not `tool-provider/output-transforms`) to avoid a `tool →
tool-provider` import cycle.
- Spill files use `{ isTemporaryFile: false, toDelete: false }` (same as
`code_interpreter`); `isTemporaryFile` here means files-field promotion,
not a TTL.
## Test plan
- [x] `extract-json-path` + `search-output` util unit tests (23 cases)
- [x] `jsonShapeSkeleton` unit tests (6) and `ToolOutputSpillService`
unit tests (4)
- [x] oxlint + oxfmt clean on changed files; `twenty-server` typecheck
clean (pre-existing unrelated errors aside)
- [ ] Manual: trigger an oversized tool result in chat, confirm the
envelope is returned and `extract_json_path` / `search_output` read the
spilled file by `fileId`
## Why no automated e2e
Spilling is chat-only and the chat path runs a live model, so the
black-box MCP integration harness can't deterministically trigger a
spill (MCP intentionally doesn't spill). The seam is small, explicit
flag-threading mirrored on `compactOutput`, covered by the unit suites.
<!-- This is an auto-generated description by cubic. -->
<a
href="https://cubic.dev/pr/twentyhq/twenty/pull/21982?utm_source=github"
target="_blank" rel="noopener noreferrer"
data-no-image-dialog="true"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source
media="(prefers-color-scheme: light)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img
alt="Review in cubic"
src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a>
<!-- End of auto-generated description by cubic. -->
|
||
|
Abdullah.
|
84f4ac9082 |
fix(deps): dedupe esbuild to 0.28.1 (#21993)
## Summary Dedupes the transitive **esbuild** so the lone `^0.28.0 → 0.28.0` copy collapses onto the existing `0.28.1`, resolving [Dependabot alert #1438](https://github.com/twentyhq/twenty/security/dependabot/1438) (vulnerable range `>=0.27.3 <0.28.1`). ## Details - `esbuild@^0.28.0` was resolving to `0.28.0`; `0.28.1` is already in the tree (via `^0.28.1` + existing scoped `esbuild` resolutions), so `yarn dedupe esbuild` collapses the `^0.28.0` descriptor onto `0.28.1` — **lockfile-only**, no `package.json` change and no `resolutions` entry. - The large line count is esbuild's ~25 platform-binary subpackages (`@esbuild/*@0.28.0`) being pruned as orphans. The diff is **esbuild-only** (28 removed keys, all `esbuild`/`@esbuild/*`). - Untouched: `esbuild@0.25.5` and `~0.27.0 → 0.27.2` are outside the advisory range (`<0.27.3`). ## Verification - `yarn install --immutable` passes (lockfile consistent with CI). - No esbuild in `[0.27.3, 0.28.1)` remains in `yarn.lock`. |
||
|
Abdullah.
|
ec3b9beae5 |
fix(deps): bump http-proxy-middleware to 2.0.10 (#21992)
## Summary Bumps the transitive **http-proxy-middleware** `2.0.9` → `2.0.10`, resolving [Dependabot alert #1574](https://github.com/twentyhq/twenty/security/dependabot/1574) (vulnerable range `>=0.16.0 <2.0.10`). ## Details - The parent's `^2.0.9` range already permits the fix, so this is a **lockfile-only** bump (`yarn up -R http-proxy-middleware`) — no `package.json` change and no `resolutions` entry needed. - The unrelated `http-proxy-middleware@^3.0.5 → 3.0.7` is outside the advisory range and untouched. - Transitive **build-tooling** dependency — not part of the production server runtime; patch-level security fix. ## Verification - `yarn install --immutable` passes (lockfile consistent with CI). - No `2.0.9` remnant remains in `yarn.lock`. |
||
|
Charles Bochet
|
a884945aca |
fix(deps): remediate HIGH image vulns (multer, ws, nodemailer) (#21984)
## What Clears the HIGH-severity AWS Inspector findings on the `twenty-server` container image. All three have stable, in-range fixes — no prereleases. | Package | From → To | CVE | Path | |---------|-----------|-----|------| | multer | 2.1.1 → **2.2.0** (resolution) | CVE-2026-5038, CVE-2026-5079 (DoS) | transitive via `@nestjs/platform-express` | | ws | 8.20.1 → **8.21.0** (resolution) | CVE-2026-48779 | pinned by `@nestjs/graphql` (8.21.0 already in tree) | | nodemailer | 8.0.10 → **9.0.1** | GHSA-p6gq-j5cr-w38f | nested in `imapflow`; bumped `imapflow` 1.3.6 → 1.4.2 which depends on nodemailer 9.0.1 | ## Notes - **multer 2.2.0 is the stable fix.** The advisories ([CVE-2026-5038](https://advisories.gitlab.com/npm/multer/CVE-2026-5038/), [CVE-2026-5079](https://advisories.gitlab.com/npm/multer/CVE-2026-5079/)) list both `2.2.0` and `3.0.0-alpha.2` as fixed; Inspector reported only the `3.0.0-alpha.2` prerelease, but we stay on the stable 2.x line. - **nodemailer:** the top-level dep was already `^9.0.1`; only `imapflow`'s nested copy was stale. imapflow 1.4.0 still ships nodemailer 8.0.10 and 1.4.1 ships 9.0.0 (< the 9.0.1 fix), so **1.4.2 is the minimum** that pulls the patched nodemailer. - Lockfile-only resolution for multer/ws (they're transitive); imapflow is a direct dep bump. yarn.lock net-shrinks from deduping. <!-- This is an auto-generated description by cubic. --> <a href="https://cubic.dev/pr/twentyhq/twenty/pull/21984?utm_source=github" target="_blank" rel="noopener noreferrer" data-no-image-dialog="true"><picture><source media="(prefers-color-scheme: dark)" srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source media="(prefers-color-scheme: light)" srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img alt="Review in cubic" src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a> <!-- End of auto-generated description by cubic. --> |
||
|
Raphaël Bosi
|
8553c574db |
Improve twenty-ui packaging for standalone publishing (#21946)
Quick packaging wins to move twenty-ui closer to a standalone publishable library. - Move `react`/`react-dom` to `peerDependencies` (`^19.0.0`) so consumers provide a single React and we avoid duplicate-React bugs. They stay in `devDependencies` for the in-repo build, and `vite.config.ts` now derives the Rollup `external` list from peer deps too so React stays externalized instead of bundled. - Declare `type-fest` in `dependencies`. It was a phantom dep (resolved only via root hoisting) and its types are referenced by the emitted json-visualizer `.d.ts`, so standalone consumers need it. - Move build-only `glob` to `devDependencies` and add `typescript` (both used only by `generateBarrels.ts`). - Make `tsconfig.json` self-contained by inlining the base compiler options, and point the Vite `cacheDir`/`optimizeDeps.exclude` at package-local paths. Verified: typecheck, build (React confirmed externalized in `dist`, not inlined), dts emission, and unit tests all pass. <!-- This is an auto-generated description by cubic. --> <a href="https://cubic.dev/pr/twentyhq/twenty/pull/21946?utm_source=github" target="_blank" rel="noopener noreferrer" data-no-image-dialog="true"><picture><source media="(prefers-color-scheme: dark)" srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source media="(prefers-color-scheme: light)" srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img alt="Review in cubic" src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a> <!-- End of auto-generated description by cubic. --> |
||
|
Abdullah.
|
c171c62099 |
chore(twenty-server): upgrade typeorm to 0.3.29 (#21957)
## Summary Upgrades **typeorm `0.3.26` → `0.3.29`** and adapts the twenty-orm `update`/`upsert` overrides to typeorm's newly-added `options.returning`. Upgrading to resolve [this](https://github.com/twentyhq/twenty/security/dependabot/1573) alert. ## Why `0.3.29` is the latest release compatible with `@ptc-org/nestjs-query-typeorm` (peers `typeorm@^0.3.15`; the `1.x` line has no compatible release, so it's blocked until that dependency moves). ## Changes **`chore` — bump** - `typeorm` patch descriptor `0.3.26 → 0.3.29` + `yarn.lock`. - Local patch carried over **unchanged** (pure rename) — both hunks (`PickKeysByType` nullable-awareness, `DeleteResult.generatedMaps`) are still absent upstream in `0.3.29`, so it remains load-bearing. **`refactor` — adapt overrides** - `0.3.29` adds `options?: UpdateOptions` (carrying `returning`) to `EntityManager`/`Repository` `update()`. The override must accept it at the base-mandated position, so it's added as its **own dedicated parameter** (not hidden inside `permissionOptions`), honoring `options.returning` with a fallback to Twenty's permission-aware `selectedColumns` (`'*'` default). - The same merge is applied to `upsert()`, which already received `UpsertOptions` but was dropping its `returning` field — so both write methods now treat the option identically. - Internal call sites + specs updated for the new parameter slot. ## Verification - `nx typecheck twenty-server` — **0 errors** - twenty-orm unit tests — **191 / 191 pass** - `oxlint` / `oxfmt` — clean |
||
|
Raphaël Bosi
|
e0fadfee7c |
Remove jotai from twenty-ui (#21937)
twenty-ui no longer depends on jotai, so its components work without a consumer-provided jotai store (better practice for a shared UI library). twenty-front keeps jotai; this is scoped to the library. - **Avatar**: tracks image-load failure in local `useState` instead of a global atom. - **Icons**: the icon registry moved from a jotai atom to a React Context. `IconsProvider` and `useIcons` keep identical signatures; the context itself stays internal. - Removed the unused `createState` helper, the `invalidAvatarUrlsAtomV2` / `iconsState` atoms, and `JotaiRootDecorator`; regenerated barrels and dropped the `jotai` dependency. No other package needs changes: nothing imports the removed symbols, and `twenty-sdk` (which re-exports twenty-ui via `export *`) simply stops surfacing the two leaked atoms on its next publish. <!-- This is an auto-generated description by cubic. --> <a href="https://cubic.dev/pr/twentyhq/twenty/pull/21937?utm_source=github" target="_blank" rel="noopener noreferrer" data-no-image-dialog="true"><picture><source media="(prefers-color-scheme: dark)" srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source media="(prefers-color-scheme: light)" srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img alt="Review in cubic" src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a> <!-- End of auto-generated description by cubic. --> |
||
|
Abdullah.
|
c8813c3b6a |
fix(security): drop vulnerable postcss via styled-components bump (XSS) (#21932)
## fix(security): drop vulnerable postcss via styled-components bump (XSS) Resolves [Dependabot Alert #1061](https://github.com/twentyhq/twenty/security/dependabot/1061). ### What `postcss` `< 8.5.10` is affected by **XSS via an unescaped `</style>` in its CSS stringify output** (Moderate). Patched in `8.5.10`. ### How — parent-bump, no resolution The only consumer of the vulnerable `postcss@8.4.49` (exact-pinned) was `styled-components`, which **dropped the postcss dependency in 6.4.0**. This bumps `styled-components` `6.1.15`/`6.3.12 -> 6.4.2` within the existing `^6.1.0` / `^6.1.11` ranges (a minor bump within v6) — removing `postcss@8.4.49` from the tree **entirely**. The remaining postcss copies are `8.5.14` / `8.5.15` (both `>= 8.5.10`). No `resolutions` override. ### Verification - No `postcss < 8.5.10` resolution remains. - `styled-components` is not imported directly in twenty-front (used via `twenty-front-component-renderer` + `@cyntler/react-doc-viewer`); `typecheck twenty-front-component-renderer` passes. - Lockfile-only change (styled-components family); `yarn install --immutable` passes. |
||
|
Abdullah.
|
bb12f426fd |
fix(security): bump react-router to 6.30.4 via react-router-dom (open redirect) (#21931)
## fix(security): bump react-router to 6.30.4 via react-router-dom (open redirect) Resolves [Dependabot Alert #1382](https://github.com/twentyhq/twenty/security/dependabot/1382). ### What `react-router` `>= 6.7.0, < 6.30.4` has an **open redirect**: a same-origin redirect with a path starting `//` is reinterpreted as a protocol-relative URL (Moderate). Patched in `6.30.4`. ### How — parent-bump, no resolution `react-router` is exact-pinned by `react-router-dom`, which is our **direct** dependency (`^6.4.4` in twenty-front/ui/shared). `react-router-dom 6.30.4` pins `react-router 6.30.4`, and our range already permits it — so this refreshes `react-router-dom 6.30.3 -> 6.30.4` within range (and its internal `@remix-run/router` 1.23.2 -> 1.23.3). No `resolutions` override. ### Verification - No `react-router`/`react-router-dom` `< 6.30.4` resolution remains. - Patch-level bump; `typecheck twenty-front` passes. - Lockfile-only change (react-router family only); `yarn install --immutable` passes. |
||
|
Abdullah.
|
6ae2170744 |
chore(deps): bump wrangler to 4.102.0 and drop the wrangler/esbuild resolution (#21930)
## chore(deps): bump wrangler to 4.102.0 and drop the `wrangler/esbuild` resolution Removes a now-redundant `resolutions` override (resolution **cleanup**, identified by the resolutions audit). It does not close a Dependabot alert — esbuild stays at `0.28.1` either way — but reduces the standing override count by one, per the `//resolutions` policy of dropping each entry once its parent ships a fixed range. ### What The `wrangler/esbuild: 0.28.1` resolution existed because `wrangler` exact-pinned a vulnerable esbuild (`0.27.3`). **wrangler 4.102.0 now ships esbuild `0.28.1` natively**, and our workspaces declare `wrangler ^4.0.0`, so it resolves to the safe version on its own. ### How — parent-bump, then drop the override - Bumped `wrangler` within `^4.0.0` to `4.102.0` (lockfile-only). - Removed the `wrangler/esbuild` entry from `resolutions`. - Updated the `//resolutions` doc: moved wrangler to the "fixed by parent-bump" list and decremented the esbuild counts (seven → six resolutions; six → five exact-pin parents). ### Verification - No `esbuild 0.27.3` regression (wrangler 4.102.0 pins `0.28.1`); the remaining six esbuild resolutions are unchanged. - `//resolutions` doc is consistent with the `resolutions` object. - Lockfile + package.json only; `yarn install --immutable` passes. |
||
|
Abdullah.
|
e90fb4b55c |
fix(security): bump dompurify to 3.4.11 (config/hook pollution) (#21905)
## fix(security): bump dompurify to 3.4.11 (config/hook pollution) Resolves [Dependabot Alert #1520](https://github.com/twentyhq/twenty/security/dependabot/1520) and [#1509](https://github.com/twentyhq/twenty/security/dependabot/1509). ### What `dompurify` is affected by: - **Permanent `ALLOWED_ATTR` pollution via `setConfig()`** ([#1520](https://github.com/twentyhq/twenty/security/dependabot/1520), Moderate, `<= 3.4.10`) - **Trusted Types policy survives `clearConfig()`** ([#1509](https://github.com/twentyhq/twenty/security/dependabot/1509), Low, `< 3.4.9`) Both patched in `3.4.11`. Bumps the direct `twenty-server` dep `^3.4.0 -> ^3.4.11`. ### Compatibility Both advisories are about config/hook state pollution via `setConfig`/`clearConfig`/hooks. All four of our call sites use plain `DOMPurify(window).sanitize(...)` with **default config** — no `setConfig`, `clearConfig`, `addHook`, `ALLOWED_ATTR`, or `RETURN_TRUSTED_TYPE` — so we are not on the affected path, and the fix does not change default-`sanitize` behavior. Verification: `typecheck twenty-server` passes; the `prepare-file-for-storage`, `create-html-to-text-converter`, and `email-composer` suites pass (28 tests). ### Verification - `dompurify` resolves to `3.4.11` (no `<= 3.4.10` remains). - Lockfile + single package.json pin change; `yarn install --immutable` passes. |
||
|
Abdullah.
|
d74b6aeadf |
fix(security): bump nodemailer to 9.0.1 (raw-option SSRF / file read) (#21903)
## fix(security): bump nodemailer to 9.0.1 (raw-option SSRF / file read) Resolves [Dependabot Alert #1518](https://github.com/twentyhq/twenty/security/dependabot/1518) and [#1519](https://github.com/twentyhq/twenty/security/dependabot/1519). ### What `nodemailer` `<= 9.0.0` lets the message-level `raw` option bypass `disableFileAccess`/`disableUrlAccess`, enabling **arbitrary file read** and **full-response SSRF** in the delivered message ([GHSA advisory](https://github.com/twentyhq/twenty/security/dependabot/1518), High). Patched in `9.0.1`. ### How — direct bump, no resolution - **twenty-server:** `nodemailer ^8.0.5 -> ^9.0.1` (major bump). - **seed-dependencies:** the application-package template `nodemailer ^8.0.5 -> ^9.0.1`; both `DEFAULT_PACKAGE_JSON_CHECKSUM` and `DEFAULT_YARN_LOCK_CHECKSUM` regenerated to match the recomputed seed files (the deps-layer cache key). ### Compatibility — verified nothing breaks It is a major upgrade, so the 9.0 breaking change was checked against the current tree. The only behavior change is **stricter TLS validation when nodemailer fetches remote content** (attachment `href`/`path` URLs, built-in OAuth2 token endpoints, HTTP/HTTPS proxy `CONNECT`). None of those paths are reachable here: - Attachments are passed as **content buffers**, never `path`/`href`. - Gmail OAuth uses **googleapis**, not nodemailer's built-in OAuth2. - No proxy on any transport. - The SMTP socket TLS is governed separately (unchanged). Verification: `typecheck twenty-server` passes (with `@types/nodemailer ^7.0.3`), and the `email-sender`, `gmail-message-outbound`, and `imap-smtp-caldav-connection` suites pass (10 tests). ### Not covered (follow-up) Root alert **#1521** will stay open: `imapflow@1.3.6` exact-pins `nodemailer@8.0.10`. The clean fix is `imapflow 1.4.2` (which pins nodemailer `9.0.1`), but it published 2026-06-19 and is **age-gated until ~2026-06-22** — it will land then as a parent-bump (no resolution). ### Verification - `nodemailer` resolves to `9.0.1` for twenty-server; seed lockfile has `9.0.1`; both seed checksums match the canonical recompute. - `yarn install --immutable` passes. |
||
|
Abdullah.
|
a658a8dbb4 | fix(security): bump socks to clear vulnerable ip-address (XSS) (#21872) | ||
|
Abdullah.
|
8899360ebe | fix(security): refresh undici across lockfiles (6.x → 6.27.0, 7.x → 7.28.0) (#21870) | ||
|
Abdullah.
|
bf2ff5899e |
fix(security): drop vulnerable serialize-javascript via terser-webpack-plugin bump (#21871)
## fix(security): drop vulnerable serialize-javascript via terser-webpack-plugin bump Resolves [Dependabot Alert #548](https://github.com/twentyhq/twenty/security/dependabot/548) and [#1290](https://github.com/twentyhq/twenty/security/dependabot/1290). ### What `serialize-javascript` `< 7.0.5` is affected by: - **RCE via `RegExp.flags` / `Date.prototype.toISOString`** ([#548](https://github.com/twentyhq/twenty/security/dependabot/548), High) - **CPU-exhaustion DoS via crafted array-like objects** ([#1290](https://github.com/twentyhq/twenty/security/dependabot/1290), Moderate) ### How — parent-bump, no resolution The only consumer of the vulnerable `serialize-javascript@^6.0.2` in the tree was `terser-webpack-plugin`, which **removed the `serialize-javascript` dependency in 5.4.0**. This bumps `terser-webpack-plugin` `5.3.16 -> 5.6.1` within its existing `^5.3.16` range — an in-range parent-bump that drops `serialize-javascript` from the tree **entirely** (preferred over a `resolutions` override). ### Verification - `serialize-javascript` no longer resolves anywhere in the tree (both the vulnerable `6.0.2` and the prior `7.0.5` copies are gone). - `terser-webpack-plugin` is dev/build tooling (webpack minification), not imported in our source. - Lockfile-only change (net −22 lines); `yarn install --immutable` passes. |
||
|
Félix Malfait
|
adf6eb572b |
feat(billing): embed Stripe Payment Element in onboarding (#21759)
## What & why Replaces the hosted Stripe Checkout redirect on the onboarding "Choose your plan" step (credit-card trial) with an inline Stripe **Payment Element**, so users never leave the app to enter card details. ## How it works - **Frontend:** a deferred `<Elements mode="setup">` renders the Payment Element, themed via the Appearance API. On Continue: `elements.submit()` → `checkoutSession` mutation creates the trialing subscription server-side and returns its pending SetupIntent `clientSecret` → `stripe.confirmSetup()` confirms the card (handling 3DS) → redirect to the existing `/plan-required/payment-success`. - **Backend:** new `BILLING_STRIPE_PUBLISHABLE_KEY` config var exposed via `/client-config`; the card path creates the subscription with `payment_behavior: default_incomplete` + a free trial (so Stripe attaches a `pending_setup_intent`) and returns its client secret. The hosted-Checkout code path is removed. - The **no-credit-card** trial path is unchanged. - Billing address collection is **disabled** in the Payment Element to reduce friction; `automatic_tax` is correspondingly disabled (tax needs an address — collect it later, e.g. at conversion / via the billing portal). ## Required before this works 1. Set `BILLING_STRIPE_PUBLISHABLE_KEY` (`pk_…`) on the server (infra change pending). 2. Run `nx run twenty-front:graphql:generate --configuration=metadata` against a server exposing the updated schema (see inline note on the hand-authored document). 3. Verify in Stripe test mode: happy path, 3DS (`4000 0025 0000 3155`), a decline. ## Verified typecheck (front + server), oxlint + oxfmt clean, `client-config.service.spec` passing. Not run here: the app end-to-end / Stripe test mode and `graphql:generate` (no server/DB in the dev container). I've left self-review comments inline flagging cleanup opportunities plus a couple of architectural/tech-debt items. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01TxCfinXq7abSrbF7aTw2cA --- _Generated by [Claude Code](https://claude.ai/code/session_01TxCfinXq7abSrbF7aTw2cA)_ <!-- This is an auto-generated description by cubic. --> <a href="https://cubic.dev/pr/twentyhq/twenty/pull/21759?utm_source=github" target="_blank" rel="noopener noreferrer" data-no-image-dialog="true"><picture><source media="(prefers-color-scheme: dark)" srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source media="(prefers-color-scheme: light)" srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img alt="Review in cubic" src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a> <!-- End of auto-generated description by cubic. --> --------- Co-authored-by: Claude <noreply@anthropic.com> |
||
|
Abdullah.
|
569d887d1e |
[Website] Cut over to the rebuilt site (#21825)
Renaming the package so any further PRs directed to the website are targeted to the reworked code instead of diverging. Once merged, I will start preparing this for deployment to dev to test before releasing to prod. Any improvements will also be applied to this package. I avoided making significant changes to API routes so nothing breaks, but will test it thoroughly today to confirm. That said, everything is ported - double checked. Big diff PR, impossible to review, but last one! No more rebuilds. |
||
|
Abdullah.
|
ba7b435885 |
fix(security): bump webpack-dev-server resolution to 5.2.5 (HMR WS interception) (#21818)
## fix(security): bump webpack-dev-server resolution to 5.2.5 (HMR WS interception) Resolves [Dependabot Alert #1514](https://github.com/twentyhq/twenty/security/dependabot/1514). ### What `webpack-dev-server` `< 5.2.5` is affected by [GHSA-mx8g-39q3-5c79](https://github.com/advisories/GHSA-mx8g-39q3-5c79) (**Moderate**) — HMR WebSocket interception via permissive user proxies. Patched in `5.2.5`. ### How `webpack-dev-server` is already force-resolved via a scoped `resolutions` entry: its sole consumer `@electron-forge/plugin-webpack` (latest 7.11.2 / 8.x alphas) still declares `webpack-dev-server ^4`, so the resolution evicts the vulnerable 4.x line up to 5.x. The newly-disclosed CVE affects the pinned `5.2.4`, so this **bumps the existing scoped resolution `5.2.4 -> 5.2.5`** and updates its `//resolutions` doc line — extending an already-documented, load-bearing entry rather than adding a new one. **Still-required check:** `@electron-forge/plugin-webpack` still declares `^4`, so the resolution remains necessary (removing it would regress to vulnerable 4.x). ### Verification - `webpack-dev-server` resolves to a single `5.2.5` bucket; no `< 5.2.5` remains. - Not imported in our source (electron-forge build tooling only). - `yarn install --immutable` passes. Co-authored-by: Charles Bochet <charles@twenty.com> |
||
|
Abdullah.
|
2169e15162 |
fix(security): patch yaml across both major lines (stack overflow) (#21817)
## fix(security): patch yaml across both major lines (stack overflow) Resolves [Dependabot Alert #734](https://github.com/twentyhq/twenty/security/dependabot/734) and [#697](https://github.com/twentyhq/twenty/security/dependabot/697). ### What `yaml` is affected by [GHSA-48c2-rrv3-qjmp](https://github.com/advisories/GHSA-48c2-rrv3-qjmp) (**Moderate**) — stack overflow via deeply nested YAML collections — across two major lines: - **2.x** (`>= 2.0.0, < 2.8.3`, patched `2.8.3`) — alert #734 (runtime). - **1.x** (`>= 1.0.0, < 1.10.3`, patched `1.10.3`) — alert #697 (dev, auto-dismissed). ### How Both vulnerable copies are transitive, and `yaml` is not imported in our source: - **2.x:** the `2.8.1` bucket (`^2.0.0` / `^2.4.5`, via `vfile-matter` / `@mintlify/openapi-parser`) is deduped into the safe `2.9.0` already in the tree. - **1.x:** the `1.10.2` bucket (`^1.10.0`, via `cosmiconfig@^7.0.0`) is refreshed to `1.10.3`. Both move within ranges the parents already declared — no `resolutions` override. ### Verification - No `yaml` `1.x < 1.10.3` or `2.x < 2.8.3` resolution remains. - `yaml` is not imported in our source (transitive only). - Lockfile-only change; `yarn install --immutable` passes. |
||
|
Abdullah.
|
ebdf77075a |
fix(security): dedupe uuid to 11.1.1 (missing buffer bounds check) (#21815)
## fix(security): dedupe uuid to 11.1.1 (missing buffer bounds check) Resolves [Dependabot Alert #1289](https://github.com/twentyhq/twenty/security/dependabot/1289). ### What `uuid` `< 11.1.1` is affected by [GHSA-w5hq-g745-h8pq](https://github.com/advisories/GHSA-w5hq-g745-h8pq) (**Moderate**) — a missing buffer bounds check in `v3`/`v5`/`v6` when a `buf` argument is provided. Patched in `11.1.1`. ### How The only vulnerable copy was a transitive `11.1.0` bucket pinned via `^11.1.0` by `typeorm@0.3.26` and `@recallai/desktop-sdk` — both ranges already permit `11.1.1`, and a `11.1.1` bucket already existed (our own packages resolve there). `yarn dedupe uuid` collapses the `^11.1.0` descriptor into the existing `11.1.1` resolution, removing the vulnerable copy. No `resolutions` override; the unrelated `13.x` bucket is left untouched. ### Verification - No `uuid < 11.1.1` resolution remains. - Our packages already resolved to `11.1.1`, so compiled output is unaffected (the change only lifts the transitive `typeorm`/`@recallai` copy). - Lockfile-only change (net −9 lines); `yarn install --immutable` passes. |
||
|
Abdullah.
|
6bbd070172 |
fix(security): bump markdown-it to 14.2.0 (smartquotes ReDoS) (#21814)
## fix(security): bump markdown-it to 14.2.0 (smartquotes ReDoS) Resolves [Dependabot Alert #1511](https://github.com/twentyhq/twenty/security/dependabot/1511). ### What `markdown-it` `<= 14.1.1` is affected by [GHSA-6v5v-wf23-fmfq](https://github.com/advisories/GHSA-6v5v-wf23-fmfq) (**Moderate**) — quadratic-complexity DoS in the smartquotes rule via `replaceAt` string operations. Patched in `14.2.0`. ### How `markdown-it` is pulled transitively by `@graphiql/react` (`^14.1.0`) and `prosemirror-markdown` (`^14.0.0`), both of which already permit `14.2.0`. This refreshes the lockfile resolution `14.1.1 -> 14.2.0` within the existing range — no `resolutions` override. It is **not** imported in our source, and the fix is internal to the smartquotes rule (no public API change). ### Verification - `markdown-it` resolves to `14.2.0`; no `<= 14.1.1` copy remains. - Diff limited to `markdown-it` + its own `linkify-it` dep bump. - Lockfile-only change; `yarn install --immutable` passes. |
||
|
Abdullah.
|
bebe03e453 |
fix(security): bump tar to 7.5.16 across lockfiles (PAX file smuggling) (#21813)
## fix(security): bump tar to 7.5.16 across lockfiles (PAX file smuggling) Resolves [#1472 1474 1476 1479 1481 1483 1485 1487 1489 1491 1493 1496 1498 1505](https://github.com/twentyhq/twenty/security/dependabot/1472 1474 1476 1479 1481 1483 1485 1487 1489 1491 1493 1496 1498 1505). ### What `tar` (`node-tar`) `<= 7.5.15` applies a PAX size override to intermediary GNU long-name/long-link headers, causing a tar-parser interpretation differential (file smuggling). Patched in `7.5.16`. ### Why these alerts The advisory is scanned across many independent Yarn projects, so it surfaced as one alert per lockfile: the root `yarn.lock` plus 13 `packages/twenty-apps/**` lockfiles (each pulls `tar` transitively). ### How - Refreshed `tar` to `7.5.16` in the root and all 13 app lockfiles — they hold `tar` via `^7.5.x` ranges that already permit it, so this is an in-range lockfile refresh (no override) via `yarn up -R tar`. - The root additionally had `tar@7.5.15` exact-pinned by `@mintlify/previewing`, which has **no upstream fix** (latest `4.0.1163` still pins `7.5.15`). Added a scoped resolution `@mintlify/previewing/tar -> ^7.5.16`, **extending the existing scoped tar resolutions** already used for `@electron/rebuild` and `@electron/node-gyp`. ### Not included `seed-dependencies/yarn.lock` (alert #1500) is intentionally excluded: that lockfile and its checksum constants are already modified by the open form-data PR, so its `tar` bump will follow separately to avoid a conflict. ### Verification - No `tar <= 7.5.15` remains across the root or any app lockfile. - `yarn install --immutable` passes. |
||
|
Abdullah.
|
e2df785aec |
fix(security): bump http-proxy-middleware to 3.0.7 (multipart field injection) (#21812)
## fix(security): bump http-proxy-middleware to 3.0.7 (multipart field injection) Resolves [Dependabot Alert #1517](https://github.com/twentyhq/twenty/security/dependabot/1517). ### What `http-proxy-middleware` `3.0.4 – 3.0.6` is affected by [GHSA-gcq2-9pq2-cxqm](https://github.com/advisories/GHSA-gcq2-9pq2-cxqm) (**High**) — multipart/form-data field injection via unescaped CRLF in `fixRequestBody`. Patched in `3.0.7` for the 3.x line. ### How `http-proxy-middleware` is pulled transitively by `@nx/module-federation` and `@nx/react` via `^3.0.5`, which already permits `3.0.7`. This refreshes the stale lockfile resolution `3.0.5 → 3.0.7` within the existing range — no `resolutions` override needed. The separate `2.0.9` bucket (from `webpack-dev-server`) is outside the advisory's `>= 3.0.4` range and is left unchanged. ### Verification - No `http-proxy-middleware` copy in the vulnerable `3.0.4 – 3.0.6` range remains; the 3.x bucket resolves to `3.0.7`. - Diff is limited to the resolved version + checksum. - Lockfile-only change; `yarn install --immutable` passes. |
||
|
Abdullah.
|
2eef2f12be |
fix(security): bump protobufjs to 7.6.4 (DoS + property shadowing) (#21811)
## fix(security): bump protobufjs to 7.6.4 (DoS + property shadowing) Resolves [Dependabot Alert #1508](https://github.com/twentyhq/twenty/security/dependabot/1508) and [#1507](https://github.com/twentyhq/twenty/security/dependabot/1507). ### What `protobufjs` in the 7.x line is affected by two advisories: - [GHSA-wcpc-wj8m-hjx6](https://github.com/advisories/GHSA-wcpc-wj8m-hjx6) (**High**, [#1508](https://github.com/twentyhq/twenty/security/dependabot/1508)) — DoS through unbounded `Any` expansion during JSON conversion. Patched in `7.6.1`. - [GHSA-f38q-mgvj-vph7](https://github.com/advisories/GHSA-f38q-mgvj-vph7) (**Moderate**, [#1507](https://github.com/twentyhq/twenty/security/dependabot/1507)) — schema-derived names can shadow runtime-significant properties. Patched in `7.6.3`. ### How `protobufjs` is pulled transitively via `^7.3.0`, which already permits the patched releases. This refreshes the stale lockfile resolution `7.6.0 → 7.6.4` (the latest `7.x`; `>= 7.6.3` covers both advisories) within the existing range — no `resolutions` override needed. The `8.x` ranges in these advisories do not apply. ### Verification - `protobufjs` resolves to a single `7.6.4` bucket (`>= 7.6.1` and `>= 7.6.3`), clearing both alerts. - Diff is limited to the protobufjs family (`protobufjs` + its `@protobufjs/*` utility deps). - Lockfile-only change; `yarn install --immutable` passes. |
||
|
Abdullah.
|
da49ed81e4 |
fix(security): bump piscina to 4.9.3 (prototype pollution → RCE) (#21810)
## fix(security): bump piscina to 4.9.3 (prototype pollution → RCE) Resolves [Dependabot Alert #1515](https://github.com/twentyhq/twenty/security/dependabot/1515). ### What `piscina` `<= 4.9.2` is affected by [GHSA-x9g3-xrwr-cwfg](https://github.com/advisories/GHSA-x9g3-xrwr-cwfg) / CVE-2026-55388 — a **prototype-pollution gadget enabling RCE via inherited `options.filename`** (High). For the 4.x line, the first patched version is `4.9.3`. ### How `piscina` is pulled transitively by `@swc/cli@0.8.1` via `^4.3.1`, which already permits `4.9.3`. This refreshes the stale lockfile resolution `4.9.2 → 4.9.3` within the existing range — no `resolutions` override needed. ### Verification - `piscina` resolves to a single `4.9.3` bucket; no `<= 4.9.2` copy remains. - Diff is limited to piscina's resolved version + checksum (its dependency set is unchanged). - Lockfile-only change; `yarn install --immutable` passes. |
||
|
Abdullah.
|
d205c72fa2 |
fix(security): remove vulnerable lodash 4.17.23 (code injection + prototype pollution) (#21809)
## fix(security): remove vulnerable lodash 4.17.23 (code injection + prototype pollution) Resolves [Dependabot Alert #824](https://github.com/twentyhq/twenty/security/dependabot/824) and [#823](https://github.com/twentyhq/twenty/security/dependabot/823). ### What `lodash` `<= 4.17.23` is affected by: - **Code injection via `_.template`** ([#824](https://github.com/twentyhq/twenty/security/dependabot/824), High) - **Prototype pollution via `_.unset`/`_.omit`** ([#823](https://github.com/twentyhq/twenty/security/dependabot/823), Medium) Both are patched in `4.18.0`. The repo already resolved lodash to `4.18.1` everywhere **except** one copy held at `4.17.23` by `@stoplight/spectral-functions@1.10.1`, whose `~4.17.21` range capped lodash below `4.18.0`. ### How Instead of a standing `resolutions` override, this bumps the parent that imposed the cap: **`@stoplight/spectral-functions` 1.10.1 → 1.10.3** (pulled transitively via `@asyncapi/parser` ← `@mintlify/common`, accepted through `^1.7.2`). 1.10.3 widened its lodash dependency to `^4.18.1`, so the capped bucket collapses into the existing `4.18.1` resolution and the vulnerable copy is removed — leaving the dependency graph honest with no lingering override. ### Also Refreshes `@types/lodash` to the latest **4.17.24**: bumps the `twenty-client-sdk` pin `^4.17.15 → ^4.17.24` and dedupes the stale transitive `*` bucket (4.17.15) into a single `4.17.24` resolution. Type-stub only. ### Verification - The only real `lodash` resolution is now `4.18.1` (remaining `4.17.x` entries are `@types/lodash` type stubs, not the library); `@types/lodash` resolves to a single `4.17.24` bucket. - Lockfile-only dependency change; `yarn install --immutable` passes; `twenty-client-sdk` typecheck passes. |
||
|
Abdullah.
|
26b4d6caed |
fix(security): bump form-data to 4.0.6 (CRLF injection) (#21808)
Resolves [Dependabot Alert #1473](https://github.com/twentyhq/twenty/security/dependabot/1473), [#1475](https://github.com/twentyhq/twenty/security/dependabot/1475), [#1477](https://github.com/twentyhq/twenty/security/dependabot/1477), [#1478](https://github.com/twentyhq/twenty/security/dependabot/1478), [#1480](https://github.com/twentyhq/twenty/security/dependabot/1480), [#1482](https://github.com/twentyhq/twenty/security/dependabot/1482), [#1484](https://github.com/twentyhq/twenty/security/dependabot/1484), [#1486](https://github.com/twentyhq/twenty/security/dependabot/1486), [#1488](https://github.com/twentyhq/twenty/security/dependabot/1488), [#1490](https://github.com/twentyhq/twenty/security/dependabot/1490), [#1492](https://github.com/twentyhq/twenty/security/dependabot/1492), [#1494](https://github.com/twentyhq/twenty/security/dependabot/1494), [#1495](https://github.com/twentyhq/twenty/security/dependabot/1495), [#1497](https://github.com/twentyhq/twenty/security/dependabot/1497), [#1499](https://github.com/twentyhq/twenty/security/dependabot/1499), [#1501](https://github.com/twentyhq/twenty/security/dependabot/1501) and [#1506](https://github.com/twentyhq/twenty/security/dependabot/1506). |
||
|
Abdullah.
|
b14da2f9e8 |
[Website] Port partner application form rework (required fields, skills, fail-fast) (#21802)
Ports twenty-website PR #21710 (Rashad) into `twenty-website-redone`. The old site's partner application form was reworked last week — required fields, a skills rethink, and fail-fast validation — after the redone had already ported the form, so the redone was running the pre-rework behavior. This brings it to parity. Re-derived into the redone's own conventions rather than copied: it reuses the redone's `STEP_REQUIRED_FIELDS`/`STEP_FORMAT_CHECKS` validator, keeps one-export-per-file, and injects the new `searchPool` as an opt-in prop. |
||
|
Rashad Karanouh
|
7afc991bd6 |
Partner application form: required fields, skills rework, fail-fast validation (#21710)
## Summary (twenty-website — partner application form) - **Required fields**: website URL, city, hourly rate, minimum project are now required (client step-gate + server zod) with `*` markers. The final step validates before POSTing, so empty required fields fail fast client-side instead of round-tripping. - **Technical skills reworked to *complement* "What you cover"** (the service categories) rather than duplicate them — now a small shown set + a larger searchable-only pool of tools / technologies / industries. Field hint clarifies the intent. - **No competitor CRMs** in suggestions (Salesforce/HubSpot/Attio removed); a guard test fails if one ever reappears. Migrations surface as a generic "CRM migration". - `Form.TagInput` gains an optional `searchPool` prop (autocomplete-only entries, not rendered as chips). Companion to the app-side PR #21709. <!-- This is an auto-generated description by cubic. --> <a href="https://cubic.dev/pr/twentyhq/twenty/pull/21710?utm_source=github" target="_blank" rel="noopener noreferrer" data-no-image-dialog="true"><picture><source media="(prefers-color-scheme: dark)" srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source media="(prefers-color-scheme: light)" srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img alt="Review in cubic" src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a> <!-- End of auto-generated description by cubic. --> |
