Abdullah.
0d876eb714
## Summary Sweeps the **twenty-apps lockfiles** for this week's advisory wave: recursive `yarn up` for **axios, tar, brace-expansion, body-parser** in each of the 12 apps with open Dependabot alerts (hello-world, postcard, self-hosting, twenty-partners, call-recorder, people-data-labs, twenty-discord, twenty-exa, twenty-fireflies, twenty-last-contact, twenty-linear, twenty-slack). All moves fit the declared ranges (apps carry these transitively via `twenty-sdk`, whose `axios ^1.16.0` and deep tar/brace chains are carets), so the diff is **lockfile-only** across all 12 manifests - no resolutions, no `package.json` changes. axios -> 1.18.x, tar -> 7.5.20 (critical GHSA-23hp-3jrh-7fpw chain), brace-expansion -> 1.1.16 / 2.1.2 / 5.0.7, body-parser -> 1.20.6 / 2.3.0. The second commit narrows scope to apps only: the twenty-server fixture projects (seed-dependencies, common-layer-dependencies) move to a dedicated PR because seed-dependencies' yarn.lock is checksum-coupled to `DEFAULT_YARN_LOCK_CHECKSUM` in `get-default-application-package-fields.util.ts`; it also drops accidentally committed `.yarn/install-state.gz` artifacts. ## Deliberately not covered - **sharp**: every path is minor-locked at `^0.34.5` (including twenty-sdk latest) - separate PR bumping twenty-sdk's range. - **react-router / react-router-dom**: no fixed release on the 6.x line (fix is the v7 major); tracked separately. ## Verification - Vulnerable-version scan across all 12 lockfiles: no axios <1.18, tar <7.5.19, brace-expansion below 1.1.16/2.1.2/5.0.7, or body-parser below 1.20.6/2.3.0 remains. - `yarn install --immutable` passes in each app. - All fix versions clear the 3-day npm age gate.
Postcard App — Twenty App Example
A rich example app showcasing all Twenty app entity types. Use this as a reference when building your own apps.
What's included
This app demonstrates every entity type available in the Twenty SDK:
| Entity | Files | What it shows |
|---|---|---|
| Application | src/application.config.ts |
App metadata, application variables, server variables |
| Objects | src/objects/ |
Custom objects with inline fields, junction tables |
| Fields | src/fields/ |
Standalone fields, relations (ONE_TO_MANY, MANY_TO_ONE), extending standard objects |
| Logic Functions | src/logic-functions/ |
HTTP routes, database event triggers, cron schedules, tool functions, install hooks |
| Front Components | src/components/ |
React components rendered inside Twenty's UI |
| Roles | src/roles/ |
Permission roles with object and field-level access control |
| Views | src/views/ |
Saved table views with column configuration |
| Navigation | src/navigation-menu-items/ |
Sidebar links targeting views |
| Skills | src/skills/ |
AI skill providing context to agents |
| Agents | src/agents/ |
AI agent with a system prompt |
| Page Layouts | src/page-layouts/ |
Custom record page with a front component widget |
Getting started
# From this directory
yarn install
yarn twenty dev