Abdullah.
ed95b8cfde
## Summary Bumps **postcss -> 8.5.22** in the 13 twenty-apps lockfiles that carry it transitively, clearing **GHSA-r28c-9q8g-f849** (high) on those manifests: path traversal in previous source map auto-loading (`sourceMappingURL`) leading to arbitrary `.map` file disclosure, vulnerable `<= 8.5.17`. Apps covered: document-generator, hello-world, postcard, self-hosting, twenty-partners, call-recorder, people-data-labs, twenty-discord, twenty-exa, twenty-fireflies, twenty-last-contact, twenty-linear, twenty-slack. Every app reaches postcss through a caret range (`^8.5.15`), so a recursive `yarn up -R postcss` lifts it in each project with **no resolution and no `package.json` change** - the diff is 13 `yarn.lock` files and nothing else. Yarn resolves to **8.5.22**, the latest in range (above the 8.5.18 fix floor). ## Not included The **root lockfile** carries the same advisory but its postcss copies are held by exact pins - `next` (8.4.31 in every stable release, including 16.2.11) and `@mintlify/common` (8.5.14, unchanged in its latest) - so no `yarn up` reaches it. That one needs a scoped resolution and is handled separately. ## Verification - postcss resolves to **8.5.22** in all 13 lockfiles; nothing at or below 8.5.17 remains. - `yarn install --immutable` passes in each of the 13 projects. - 8.5.22 published 2026-07-22, clears the 3-day npm age gate.
This is a Twenty application project bootstrapped with create-twenty-app.
Getting Started
First, authenticate to your workspace:
yarn twenty remote:add --api-url http://localhost:2020 --as local
Then, start development mode to sync your app and watch for changes:
yarn twenty dev
Open your Twenty instance and go to /settings/applications section to see the result.
Available Commands
Run yarn twenty help to list all available commands. Common commands:
# Remotes & Authentication
yarn twenty remote:add --api-url http://localhost:2020 --as local # Authenticate with Twenty
yarn twenty remote:status # Check auth status
yarn twenty remote:use # Set default remote
yarn twenty remote:list # List all configured remotes
yarn twenty remote:remove <name> # Remove a remote
# Application
yarn twenty dev # Start dev mode (watch, build, sync, and auto-generate typed client)
yarn twenty dev:add # Scaffold a new entity (object, field, function, front-component, role, view, navigation-menu-item)
yarn twenty dev:function:logs # Stream function logs
yarn twenty dev:function:exec # Execute a function with JSON payload
yarn twenty app:uninstall # Uninstall app from workspace
Integration Tests
If your project includes the example integration test (src/__tests__/app-install.integration-test.ts), you can run it with:
# Make sure a Twenty server is running at http://localhost:3000
yarn test
The test builds and installs the app, then verifies it appears in the applications list. Test configuration (API URL and API key) is defined in vitest.config.ts.
LLMs instructions
Main docs and pitfalls are available in LLMS.md file.
Learn More
To learn more about Twenty applications, take a look at the following resources:
- twenty-sdk - learn about
twenty-sdktool. - Twenty doc - Twenty's documentation.
- Join our Discord
You can check out the Twenty GitHub repository - your feedback and contributions are welcome!