Charles Bochet
0403762516
## What The standalone apps under `packages/twenty-apps/*` each ship **their own `yarn.lock`** (they're not part of the root workspace), and those lockfiles still pulled vulnerable transitive versions of `axios`, `undici`, `tmp`, `qs`, `ws`, `brace-expansion`, `uuid` (via `twenty-sdk` / `twenty-client-sdk`). This was ~130 of the open Dependabot alerts — none of them reachable from the root-lockfile PRs. Ran `yarn up -R` per app to re-resolve the vulnerable transitives within their existing ranges, across all 13 flagged apps: - **`axios` → 1.17.0** — clears the entire proxy-auth-leak / ReDoS / config-merge MITM advisory set (the 56 axios alerts) - **`qs`, `brace-expansion`, `uuid`** → patched - **`undici`, `ws`** → patched on the in-range majors (older majors that parents pin exactly remain, same situation as the root lockfile) ## Scope - **Lockfile-only**, 13 apps. No `package.json` changes. - Test **fixtures** (`packages/twenty-apps/fixtures/*`) intentionally left untouched — Dependabot didn't flag them and they back snapshot tests.
Linear for Twenty
Connect your Linear account to Twenty to create issues and look up teams straight from your workflows or the AI chat.
What you can do
Once installed and connected, two tools become available:
- Create Linear issue — from the AI chat, ask something like
"create a Linear issue in the Engineering team titled 'Fix login bug'"
and the AI will file it for you. From a workflow, add it as a step
with
teamId+title(and optionaldescription). - List Linear teams — discovers the teams in your Linear workspace,
useful when you need to pick a
teamIdfor the create-issue step.
Installing
- Open Settings → Applications in your Twenty workspace.
- Find Linear in the available apps and click Install.
- Open the app, go to the Connections tab, and click Add connection.
- Choose Just for me (your personal Linear account) or Workspace shared (a team-managed Linear account anyone in this workspace can act through), then complete the Linear sign-in.
That's it — you can now use the tools above.
If you see a "Linear OAuth is not yet set up by your server administrator" notice on the Connections tab, ask your Twenty admin to follow the Self-hosting setup below — they need to provide the OAuth credentials before connections can be added.
Self-hosting setup
This section is for Twenty server admins. If you're on Twenty Cloud, skip this — the OAuth credentials are already configured.
1. Register an OAuth app in Linear
- Visit https://linear.app/settings/api/applications/new.
- Set the Redirect URI to
<SERVER_URL>/apps/oauth/callback(for local dev:http://localhost:3000/apps/oauth/callback). - Copy the generated Client ID and Client Secret.
2. Wire the credentials into Twenty
- In Settings → Applications, find Linear, click into it, and go to the Application registration tab (admin-only).
- Paste your Linear Client ID into
LINEAR_CLIENT_IDand the Client Secret intoLINEAR_CLIENT_SECRET.
Workspace users will now be able to add Linear connections from the Connections tab as described above.
3. (Developers only) Building the app from source
If you're working on this app rather than installing the published version:
cd packages/twenty-apps/internal/twenty-linear
# For day-to-day development (publish + install + watch in one):
yarn twenty dev
# Manual publish flow (publish registers the app, install activates it):
yarn twenty app:publish --private
yarn twenty app:install
twenty dev is recommended for iteration — it publishes, installs, and
watches for changes in one command. Use twenty app:publish --private +
twenty app:install when you want to control each step separately (e.g.
deploying to a production server without auto-installing).
This serves as the reference implementation for Twenty's
defineConnectionProvider({ type: 'oauth' }) flow — useful as a template
when adding OAuth integrations for other providers.