Files

T

Charles Bochet a48c158a66 security(apps): bump twenty-sdk to 2.10.1 across twenty-apps (tmp, undici) (#21344 )

## Summary

Propagates the just-published **`twenty-sdk@2.10.1`** security patch
into the `twenty-apps/*` mini-apps, clearing the bulk of the
nested-lockfile Dependabot alerts (the `tmp` + `undici` clusters).

Each app carries its own `yarn.lock`, so the fix only reaches them once
they bump the SDK. `2.10.1` drops the two vulnerable transitive deps
every app inherited:

| Vuln dep | Source | Fixed by |
|---|---|---|
| `tmp@0.0.33` (GHSA-ph9p / GHSA-52f5) | `inquirer ^10 →
external-editor` | `inquirer ^14` → `@inquirer/editor@5` (no
external-editor) |
| `undici@<6.24` (5 GHSAs) | `@genql/cli` | vendored genql codegen
(`@genql/cli` removed) |

## Changes
Bumps `twenty-sdk` **and** `twenty-client-sdk` (whichever each app pins
— several pin both) to `2.10.1` and regenerates each lockfile.

**10 apps updated** (all on the v2 line — minor bump, low risk):
`twenty-slack`, `twenty-discord`, `twenty-linear`, `twenty-partners`,
`twenty-fireflies`, `people-data-labs`, `twenty-for-twenty`, `exa`,
`github-connector`, `postcard`.

Verified per-app after regen: **`tmp@0.0.33` = 0** and **`undici@5` =
0** in every updated lockfile.

## Deliberately excluded
Three apps pin a **pre-2.0** SDK, where `→ 2.10.1` is a major jump that
risks breaking the app and needs per-app validation:
- `examples/hello-world` (`0.9.0`)
- `internal/call-recording` (`0.6.3-alpha`)
- `internal/self-hosting` (`1.22.0-canary.6`)

These still carry one `tmp`/`undici` alert each and should be handled in
a follow-up.

## Related
- `twenty-sdk@2.10.1` release (tag `sdk/v2.10.1`) — backport of #21339
(undici) + #21340 (tmp) from `main`.

2026-06-08 21:31:14 +02:00

public

feat(app): infrastructure for pre-installed apps (#19973 )

2026-04-23 21:59:00 +02:00

src

feat(apps): split AI tool and workflow action triggers in LogicFunction manifest (#20208 )

2026-05-05 14:56:09 +02:00

.gitignore

feat(app): infrastructure for pre-installed apps (#19973 )

2026-04-23 21:59:00 +02:00

.nvmrc

feat(app): infrastructure for pre-installed apps (#19973 )

2026-04-23 21:59:00 +02:00

.oxlintrc.json

feat(app): infrastructure for pre-installed apps (#19973 )

2026-04-23 21:59:00 +02:00

.yarnrc.yml

feat(app): infrastructure for pre-installed apps (#19973 )

2026-04-23 21:59:00 +02:00

package.json

security(apps): bump twenty-sdk to 2.10.1 across twenty-apps (tmp, undici) (#21344 )

2026-06-08 21:31:14 +02:00

README.md

feat(app): infrastructure for pre-installed apps (#19973 )

2026-04-23 21:59:00 +02:00

tsconfig.json

feat(app): infrastructure for pre-installed apps (#19973 )

2026-04-23 21:59:00 +02:00

yarn.lock

security(apps): bump twenty-sdk to 2.10.1 across twenty-apps (tmp, undici) (#21344 )

2026-06-08 21:31:14 +02:00

README.md

twenty-exa

Exposes Exa structured web search to Twenty AI agents (chat + workflow agents + MCP) as the app_exa_web_search tool.

Installation

Register the app on the Twenty server once (admin API / UI): twenty-exa from npm.
Set isPreInstalled=true on the registration so it's installed on every new workspace. Existing workspaces can be backfilled via the install-pre-installed-apps CLI command.
Set the EXA_API_KEY server variable on the registration to your Exa API key. The value is injected into every logic function execution — no per-workspace configuration needed.

Billing

The handler calls Twenty's generic app billing endpoint (POST /app/billing/charge) using the application access token injected into the execution env. Pricing mirrors Exa's auto-search tier: $0.007 base (10 results) + $0.001 per additional result.