Abdullah.
0d876eb714
## Summary Sweeps the **twenty-apps lockfiles** for this week's advisory wave: recursive `yarn up` for **axios, tar, brace-expansion, body-parser** in each of the 12 apps with open Dependabot alerts (hello-world, postcard, self-hosting, twenty-partners, call-recorder, people-data-labs, twenty-discord, twenty-exa, twenty-fireflies, twenty-last-contact, twenty-linear, twenty-slack). All moves fit the declared ranges (apps carry these transitively via `twenty-sdk`, whose `axios ^1.16.0` and deep tar/brace chains are carets), so the diff is **lockfile-only** across all 12 manifests - no resolutions, no `package.json` changes. axios -> 1.18.x, tar -> 7.5.20 (critical GHSA-23hp-3jrh-7fpw chain), brace-expansion -> 1.1.16 / 2.1.2 / 5.0.7, body-parser -> 1.20.6 / 2.3.0. The second commit narrows scope to apps only: the twenty-server fixture projects (seed-dependencies, common-layer-dependencies) move to a dedicated PR because seed-dependencies' yarn.lock is checksum-coupled to `DEFAULT_YARN_LOCK_CHECKSUM` in `get-default-application-package-fields.util.ts`; it also drops accidentally committed `.yarn/install-state.gz` artifacts. ## Deliberately not covered - **sharp**: every path is minor-locked at `^0.34.5` (including twenty-sdk latest) - separate PR bumping twenty-sdk's range. - **react-router / react-router-dom**: no fixed release on the 6.x line (fix is the v7 major); tracked separately. ## Verification - Vulnerable-version scan across all 12 lockfiles: no axios <1.18, tar <7.5.19, brace-expansion below 1.1.16/2.1.2/5.0.7, or body-parser below 1.20.6/2.3.0 remains. - `yarn install --immutable` passes in each app. - All fix versions clear the 3-day npm age gate.
Linear for Twenty
Connect your Linear account to Twenty to create issues and look up teams straight from your workflows or the AI chat.
What you can do
Once installed and connected, two tools become available:
- Create Linear issue — from the AI chat, ask something like
"create a Linear issue in the Engineering team titled 'Fix login bug'"
and the AI will file it for you. From a workflow, add it as a step
with
teamId+title(and optionaldescription). - List Linear teams — discovers the teams in your Linear workspace,
useful when you need to pick a
teamIdfor the create-issue step.
Installing
- Open Settings → Applications in your Twenty workspace.
- Find Linear in the available apps and click Install.
- Open the app, go to the Connections tab, and click Add connection.
- Choose Just for me (your personal Linear account) or Workspace shared (a team-managed Linear account anyone in this workspace can act through), then complete the Linear sign-in.
That's it — you can now use the tools above.
If you see a "Linear OAuth is not yet set up by your server administrator" notice on the Connections tab, ask your Twenty admin to follow the Self-hosting setup below — they need to provide the OAuth credentials before connections can be added.
Self-hosting setup
This section is for Twenty server admins. If you're on Twenty Cloud, skip this — the OAuth credentials are already configured.
1. Register an OAuth app in Linear
- Visit https://linear.app/settings/api/applications/new.
- Set the Redirect URI to
<SERVER_URL>/auth/apps/callback(for local dev:http://localhost:3000/auth/apps/callback). - Copy the generated Client ID and Client Secret.
2. Wire the credentials into Twenty
- In Settings → Applications, find Linear, click into it, and go to the Application registration tab (admin-only).
- Paste your Linear Client ID into
LINEAR_CLIENT_IDand the Client Secret intoLINEAR_CLIENT_SECRET.
Workspace users will now be able to add Linear connections from the Connections tab as described above.