Charles Bochet
a825dcf2cc
Clears 8 Dependabot alerts via in-range transitive/parent bumps and one dead-dependency removal. **No `resolutions` overrides** were used — every fix is a real version bump within existing semver ranges or a parent upgrade. ### Root `yarn.lock` - **react-router** 6.30.3 → 6.30.4 (open redirect via protocol-relative URL) — pulled through react-router-dom, ranges unchanged — alert #1382 - **yaml** 2.8.1 → 2.9.0 (stack overflow on deeply nested collections) — alert #734 - **uuid** `^13.0.0` → 13.0.2 in twenty-sdk + create-twenty-app (buffer bounds check) — alert #1164 - **ip-address** `^9.0.5` dropped by bumping **socks** 2.8.3 → 2.8.9 (now depends on `ip-address ^10.1.1`, which is unaffected) — alert #1171 ### `seed-dependencies` lockfile - **uuid** `^10.0.0` → `^11.1.1` (direct dep; removed now-redundant `@types/uuid` since uuid v11 ships its own types) — alert #1287 - **ip-address** `^9.0.5` dropped via the same socks bump — alert #1170 ### `twenty-for-twenty` lockfile - **resend** bumped to 6.12.4 (`^6.12.0` range kept), which drops its `svix@1.90.0 → uuid@^10` transitive chain — alert #1278 ### `twenty-companion` - Removed the unused **simplemde** dependency. The note editor loads SimpleMDE from a CDN `<script>` tag and never imports the npm package; `easymde` (its maintained fork) is already a dependency — alert #690 ### Not addressed here The remaining alerts can't be closed without `resolutions` overrides (deliberately avoided in this PR) or a larger migration: - **qs** (#1305, #1304), **lodash** (#824 high / #823 / #385), **ws** (#1238), **postcss** (#1061) — vulnerable copies are pinned exact / bundled by parents (express, body-parser, @nestjs/*, next, styled-components, zapier) with no in-range patch. - **webpack-dev-server** (#1237/#692/#691) — pinned by `@electron-forge/plugin-webpack` (still on v4); dev-tooling only. - **uuid <11.1.1** (#1289) — spread across `^3`/`^8`/`^9` transitive ranges; reaching v11 is a breaking jump. - **apollo-server-core** (#735/#736) — requires an Apollo Server 3 → 4 migration.
62 lines
1.9 KiB
JSON
62 lines
1.9 KiB
JSON
{
|
|
"name": "twenty-desktop",
|
|
"productName": "Twenty",
|
|
"version": "1.0.0",
|
|
"description": "Twenty meeting recorder",
|
|
"main": ".webpack/main",
|
|
"scripts": {
|
|
"start": "concurrently \"yarn start:server\" \"yarn start:electron\"",
|
|
"start:electron": "electron-forge start",
|
|
"package": "electron-forge package",
|
|
"make": "electron-forge make",
|
|
"publish": "electron-forge publish",
|
|
"lint": "echo \"No linting configured\"",
|
|
"start:server": "node ./src/server.js"
|
|
},
|
|
"keywords": [],
|
|
"author": {
|
|
"name": "Nick Faro",
|
|
"email": "yux50000@hotmail.com"
|
|
},
|
|
"license": "MIT",
|
|
"devDependencies": {
|
|
"@babel/plugin-proposal-class-properties": "^7.18.6",
|
|
"@electron-forge/cli": "^7.8.0",
|
|
"@electron-forge/maker-deb": "^7.8.0",
|
|
"@electron-forge/maker-dmg": "^7.8.1",
|
|
"@electron-forge/maker-rpm": "^7.8.0",
|
|
"@electron-forge/maker-squirrel": "^7.8.0",
|
|
"@electron-forge/maker-zip": "^7.8.0",
|
|
"@electron-forge/plugin-auto-unpack-natives": "^7.8.0",
|
|
"@electron-forge/plugin-fuses": "^7.8.0",
|
|
"@electron-forge/plugin-webpack": "^7.8.0",
|
|
"@electron/fuses": "^1.8.0",
|
|
"@vercel/webpack-asset-relocator-loader": "^1.7.3",
|
|
"css-loader": "^6.11.0",
|
|
"electron": "^39.8.5",
|
|
"node-loader": "^2.1.0",
|
|
"style-loader": "^3.3.4"
|
|
},
|
|
"resolutions": {
|
|
"@electron/packager/@electron/osx-sign": "github:recallai/osx-sign"
|
|
},
|
|
"dependencies": {
|
|
"@anthropic-ai/sdk": "^0.40.1",
|
|
"@recallai/desktop-sdk": "^2.0.0",
|
|
"@timfish/forge-externals-plugin": "^0.2.1",
|
|
"axios": "^1.16.0",
|
|
"codemirror": "^6.0.1",
|
|
"concurrently": "^10.0.0",
|
|
"dotenv": "^16.5.0",
|
|
"easymde": "^2.20.0",
|
|
"electron-squirrel-startup": "^1.0.1",
|
|
"express": "^4.18.2",
|
|
"marked": "^5.0.0",
|
|
"openai": "^4.97.0",
|
|
"react": "^19.1.0",
|
|
"react-dom": "^19.1.0",
|
|
"react-markdown": "^10.1.0",
|
|
"zod": "^3.25.76"
|
|
}
|
|
}
|