Charles Bochet
868cb02e45
Closes the remaining lodash Dependabot alerts **without any `resolutions` override** — by upgrading the parent packages that pinned the vulnerable lodash. Every `lodash` in the tree now resolves to **4.18.1**. ### Closes - **#824 — `_.template` code injection (HIGH)** - #823 / #385 — prototype pollution in `_.unset` / `_.omit` ### What changed (4 parents pinned vulnerable lodash 4.17.x; all upgraded, no override) - **`@stoplight/spectral-functions`** → 1.10.2 (in-range; now uses `lodash ^4.18.1`) - **`zapier-platform-core`** 15.5.1 → 19.0.0 — aligns with the already-present `zapier-platform-cli ^19` (they were mismatched). v19 tightened the `Bundle` types, so 3 call sites now type their bundle as `Bundle<InputData>` and the test bundle includes the new `meta` fields. - **`@graphql-codegen`** → `cli 6.3.1`, `typescript 5.0.10`, `typescript-operations 5.1.0`, `typed-document-node 6.1.8`. These depend on `@graphql-codegen/plugin-helpers ^6.3.0`, the release that dropped lodash. (Stayed on the 6.x/5.x line on purpose — 7.x changes generated output far more.) ### About the generated-file changes — they are cosmetic, not real changes The codegen bump touches one generated file. **Verified there is zero semantic change:** - Only `src/generated-metadata/graphql.ts` changes. `src/generated/graphql.ts` (data) and `src/generated-admin/graphql.ts` (admin) are **byte-identical**. - Same 1,638 type declarations before and after — none added, none removed. - After stripping whitespace and union pipes, the file is **byte-for-byte identical** — no type, field, or union member changed. The entire diff is one formatting change from `typescript-operations@5.x`: multi-member union types are now printed multi-line with a leading `|` instead of on one line — which TypeScript treats identically: ```ts // before payload?: { …ObjectMetadata… } | { …Path… } | null // after payload?: | { …ObjectMetadata… } | { …Path… } | null ``` Only metadata is affected because only its operations select GraphQL union types. To keep generated types otherwise behavior-identical, `defaultScalarType: 'any'` was added to the three codegen configs (codegen 6 would otherwise default unmapped scalars to `unknown`). ### Verification - `twenty-front` typecheck ✓, `twenty-zapier` typecheck ✓ - `yarn install --immutable` ✓ (passes the hardened 3-day age gate) - CI green — including the `graphql:generate` freshness check, which regenerates against the canonical schema and confirms the committed output is exactly what codegen produces - No `lodash@4.17.x` remains anywhere in `yarn.lock` Supersedes #21411 (which closed these via a one-line resolution).
58 lines
2.1 KiB
JavaScript
58 lines
2.1 KiB
JavaScript
process.env.NODE_TLS_REJECT_UNAUTHORIZED = '0';
|
|
|
|
module.exports = {
|
|
schema:
|
|
(process.env.REACT_APP_SERVER_BASE_URL ?? 'http://localhost:3000') +
|
|
'/metadata',
|
|
documents: [
|
|
'./src/modules/auth/graphql/**/*.{ts,tsx}',
|
|
'./src/modules/users/graphql/**/*.{ts,tsx}',
|
|
'./src/modules/views/graphql/**/*.{ts,tsx}',
|
|
'./src/modules/ai/graphql/**/*.{ts,tsx}',
|
|
'./src/modules/applications/graphql/**/*.{ts,tsx}',
|
|
|
|
'./src/modules/workspace/graphql/**/*.{ts,tsx}',
|
|
'./src/modules/workspace-member/graphql/**/*.{ts,tsx}',
|
|
'./src/modules/workspace-invitation/graphql/**/*.{ts,tsx}',
|
|
|
|
'./src/modules/settings/**/graphql/**/*.{ts,tsx}',
|
|
'!./src/modules/settings/admin-panel/**/graphql/**/*.{ts,tsx}',
|
|
'./src/modules/logic-functions/graphql/**/*.{ts,tsx}',
|
|
|
|
'./src/modules/databases/graphql/**/*.{ts,tsx}',
|
|
'./src/modules/analytics/graphql/**/*.{ts,tsx}',
|
|
'./src/modules/object-metadata/graphql/**/*.{ts,tsx}',
|
|
'./src/modules/navigation-menu-item/**/graphql/**/*.{ts,tsx}',
|
|
'./src/modules/command-menu-item/graphql/**/*.{ts,tsx}',
|
|
'./src/modules/attachments/graphql/**/*.{ts,tsx}',
|
|
'./src/modules/file/graphql/**/*.{ts,tsx}',
|
|
'./src/modules/onboarding/graphql/**/*.{ts,tsx}',
|
|
'./src/modules/front-components/graphql/**/*.{ts,tsx}',
|
|
|
|
'./src/modules/page-layout/widgets/**/graphql/**/*.{ts,tsx}',
|
|
'./src/modules/activities/emails/graphql/mutations/**/*.{ts,tsx}',
|
|
|
|
'./src/modules/dashboards/graphql/**/*.{ts,tsx}',
|
|
'./src/modules/page-layout/graphql/**/*.{ts,tsx}',
|
|
'./src/modules/marketplace/graphql/**/*.{ts,tsx}',
|
|
'!./src/**/*.test.{ts,tsx}',
|
|
'!./src/**/*.stories.{ts,tsx}',
|
|
'!./src/**/__mocks__/*.ts',
|
|
],
|
|
overwrite: true,
|
|
generates: {
|
|
'./src/generated-metadata/graphql.ts': {
|
|
plugins: ['typescript', 'typescript-operations', 'typed-document-node'],
|
|
config: {
|
|
skipTypename: false,
|
|
defaultScalarType: 'any',
|
|
scalars: {
|
|
DateTime: 'string',
|
|
UUID: 'string',
|
|
},
|
|
namingConvention: { enumValues: 'keep' },
|
|
},
|
|
},
|
|
},
|
|
};
|