Charles Bochet
a825dcf2cc
Clears 8 Dependabot alerts via in-range transitive/parent bumps and one dead-dependency removal. **No `resolutions` overrides** were used — every fix is a real version bump within existing semver ranges or a parent upgrade. ### Root `yarn.lock` - **react-router** 6.30.3 → 6.30.4 (open redirect via protocol-relative URL) — pulled through react-router-dom, ranges unchanged — alert #1382 - **yaml** 2.8.1 → 2.9.0 (stack overflow on deeply nested collections) — alert #734 - **uuid** `^13.0.0` → 13.0.2 in twenty-sdk + create-twenty-app (buffer bounds check) — alert #1164 - **ip-address** `^9.0.5` dropped by bumping **socks** 2.8.3 → 2.8.9 (now depends on `ip-address ^10.1.1`, which is unaffected) — alert #1171 ### `seed-dependencies` lockfile - **uuid** `^10.0.0` → `^11.1.1` (direct dep; removed now-redundant `@types/uuid` since uuid v11 ships its own types) — alert #1287 - **ip-address** `^9.0.5` dropped via the same socks bump — alert #1170 ### `twenty-for-twenty` lockfile - **resend** bumped to 6.12.4 (`^6.12.0` range kept), which drops its `svix@1.90.0 → uuid@^10` transitive chain — alert #1278 ### `twenty-companion` - Removed the unused **simplemde** dependency. The note editor loads SimpleMDE from a CDN `<script>` tag and never imports the npm package; `easymde` (its maintained fork) is already a dependency — alert #690 ### Not addressed here The remaining alerts can't be closed without `resolutions` overrides (deliberately avoided in this PR) or a larger migration: - **qs** (#1305, #1304), **lodash** (#824 high / #823 / #385), **ws** (#1238), **postcss** (#1061) — vulnerable copies are pinned exact / bundled by parents (express, body-parser, @nestjs/*, next, styled-components, zapier) with no in-range patch. - **webpack-dev-server** (#1237/#692/#691) — pinned by `@electron-forge/plugin-webpack` (still on v4); dev-tooling only. - **uuid <11.1.1** (#1289) — spread across `^3`/`^8`/`^9` transitive ranges; reaching v11 is a breaking jump. - **apollo-server-core** (#735/#736) — requires an Apollo Server 3 → 4 migration.
Twenty Desktop
WARNING: This application is a Proof of Concept (POC) and must NOT be used in production. It is intended for demonstration and experimentation purposes only. Security, stability, and performance have not been validated for production use.
This is a demo application that shows off what you can build with the Recall.ai Desktop Recording SDK.
This repo is intended to be a mockup of the kind of experience you can build using the Desktop Recording SDK.
Need help? Reach out to our support team support@recall.ai.
Setup
-
Copy the
env.examplefile to a.envfile:cp .env.example .env
-
Replace
RECALLAI_API_URLwith the base URL for the Recall region that you're using that matches your API key, example:RECALLAI_API_URL=https://us-east-1.recall.ai
-
Modify
.envto include your Recall.ai API key:RECALLAI_API_KEY=<your key>
Required: This project also uses live transcription with Assembly AI. You'll need to configure your own Assembly credentials on the Recall.ai dashboard. Follow our AssemblyAI real-time transcription guide to set this up.
If you want to enable the AI summary after a recording is finished, you can specify an OpenRouter API key.
OPENROUTER_KEY=<your key>
Twenty CRM Integration (optional)
To automatically create callRecording records in Twenty when a meeting starts (and mark them as ended when the meeting closes), configure:
TWENTY_API_URL=http://localhost:3000
TWENTY_API_KEY=<your key>
The call-recording Twenty app must be installed in your workspace first (packages/twenty-apps/internal/call-recording). Generate an API key at <your-twenty-instance>/settings/api-webhooks.
To launch the Twenty Desktop application, start the server first, then the app:
npm ci
npm start
Screenshots