Abdullah.
ed95b8cfde
## Summary Bumps **postcss -> 8.5.22** in the 13 twenty-apps lockfiles that carry it transitively, clearing **GHSA-r28c-9q8g-f849** (high) on those manifests: path traversal in previous source map auto-loading (`sourceMappingURL`) leading to arbitrary `.map` file disclosure, vulnerable `<= 8.5.17`. Apps covered: document-generator, hello-world, postcard, self-hosting, twenty-partners, call-recorder, people-data-labs, twenty-discord, twenty-exa, twenty-fireflies, twenty-last-contact, twenty-linear, twenty-slack. Every app reaches postcss through a caret range (`^8.5.15`), so a recursive `yarn up -R postcss` lifts it in each project with **no resolution and no `package.json` change** - the diff is 13 `yarn.lock` files and nothing else. Yarn resolves to **8.5.22**, the latest in range (above the 8.5.18 fix floor). ## Not included The **root lockfile** carries the same advisory but its postcss copies are held by exact pins - `next` (8.4.31 in every stable release, including 16.2.11) and `@mintlify/common` (8.5.14, unchanged in its latest) - so no `yarn up` reaches it. That one needs a scoped resolution and is handled separately. ## Verification - postcss resolves to **8.5.22** in all 13 lockfiles; nothing at or below 8.5.17 remains. - `yarn install --immutable` passes in each of the 13 projects. - 8.5.22 published 2026-07-22, clears the 3-day npm age gate.
Linear for Twenty
Connect your Linear account to Twenty to create issues and look up teams straight from your workflows or the AI chat.
What you can do
Once installed and connected, two tools become available:
- Create Linear issue — from the AI chat, ask something like
"create a Linear issue in the Engineering team titled 'Fix login bug'"
and the AI will file it for you. From a workflow, add it as a step
with
teamId+title(and optionaldescription). - List Linear teams — discovers the teams in your Linear workspace,
useful when you need to pick a
teamIdfor the create-issue step.
Installing
- Open Settings → Applications in your Twenty workspace.
- Find Linear in the available apps and click Install.
- Open the app, go to the Connections tab, and click Add connection.
- Choose Just for me (your personal Linear account) or Workspace shared (a team-managed Linear account anyone in this workspace can act through), then complete the Linear sign-in.
That's it — you can now use the tools above.
If you see a "Linear OAuth is not yet set up by your server administrator" notice on the Connections tab, ask your Twenty admin to follow the Self-hosting setup below — they need to provide the OAuth credentials before connections can be added.
Self-hosting setup
This section is for Twenty server admins. If you're on Twenty Cloud, skip this — the OAuth credentials are already configured.
1. Register an OAuth app in Linear
- Visit https://linear.app/settings/api/applications/new.
- Set the Redirect URI to
<SERVER_URL>/auth/apps/callback(for local dev:http://localhost:3000/auth/apps/callback). - Copy the generated Client ID and Client Secret.
2. Wire the credentials into Twenty
- In Settings → Applications, find Linear, click into it, and go to the Application registration tab (admin-only).
- Paste your Linear Client ID into
LINEAR_CLIENT_IDand the Client Secret intoLINEAR_CLIENT_SECRET.
Workspace users will now be able to add Linear connections from the Connections tab as described above.