Files

T

Abdullah. bebe03e453 fix(security): bump tar to 7.5.16 across lockfiles (PAX file smuggling) (#21813 )

## fix(security): bump tar to 7.5.16 across lockfiles (PAX file
smuggling)

Resolves [#1472 1474 1476 1479 1481 1483 1485 1487 1489 1491 1493 1496
1498 1505](https://github.com/twentyhq/twenty/security/dependabot/1472
1474 1476 1479 1481 1483 1485 1487 1489 1491 1493 1496 1498 1505).

### What

`tar` (`node-tar`) `<= 7.5.15` applies a PAX size override to
intermediary GNU long-name/long-link headers, causing a tar-parser
interpretation differential (file smuggling). Patched in `7.5.16`.

### Why these alerts

The advisory is scanned across many independent Yarn projects, so it
surfaced as one alert per lockfile: the root `yarn.lock` plus 13
`packages/twenty-apps/**` lockfiles (each pulls `tar` transitively).

### How

- Refreshed `tar` to `7.5.16` in the root and all 13 app lockfiles —
they hold `tar` via `^7.5.x` ranges that already permit it, so this is
an in-range lockfile refresh (no override) via `yarn up -R tar`.
- The root additionally had `tar@7.5.15` exact-pinned by
`@mintlify/previewing`, which has **no upstream fix** (latest `4.0.1163`
still pins `7.5.15`). Added a scoped resolution
`@mintlify/previewing/tar -> ^7.5.16`, **extending the existing scoped
tar resolutions** already used for `@electron/rebuild` and
`@electron/node-gyp`.

### Not included

`seed-dependencies/yarn.lock` (alert #1500) is intentionally excluded:
that lockfile and its checksum constants are already modified by the
open form-data PR, so its `tar` bump will follow separately to avoid a
conflict.

### Verification

- No `tar <= 7.5.15` remains across the root or any app lockfile.
- `yarn install --immutable` passes.

2026-06-19 08:49:07 +02:00

public

feat(app): infrastructure for pre-installed apps (#19973 )

2026-04-23 21:59:00 +02:00

src

feat(apps): split AI tool and workflow action triggers in LogicFunction manifest (#20208 )

2026-05-05 14:56:09 +02:00

.gitignore

feat(app): infrastructure for pre-installed apps (#19973 )

2026-04-23 21:59:00 +02:00

.nvmrc

feat(app): infrastructure for pre-installed apps (#19973 )

2026-04-23 21:59:00 +02:00

.oxlintrc.json

feat(app): infrastructure for pre-installed apps (#19973 )

2026-04-23 21:59:00 +02:00

.yarnrc.yml

feat(app): infrastructure for pre-installed apps (#19973 )

2026-04-23 21:59:00 +02:00

package.json

chore(apps): bump twenty-sdk & twenty-client-sdk to 2.13.0, vitest to 4 (#21553 )

2026-06-14 20:50:57 +02:00

README.md

feat(app): infrastructure for pre-installed apps (#19973 )

2026-04-23 21:59:00 +02:00

tsconfig.json

feat(app): infrastructure for pre-installed apps (#19973 )

2026-04-23 21:59:00 +02:00

yarn.lock

fix(security): bump tar to 7.5.16 across lockfiles (PAX file smuggling) (#21813 )

2026-06-19 08:49:07 +02:00

README.md

twenty-exa

Exposes Exa structured web search to Twenty AI agents (chat + workflow agents + MCP) as the app_exa_web_search tool.

Installation

Register the app on the Twenty server once (admin API / UI): twenty-exa from npm.
Set isPreInstalled=true on the registration so it's installed on every new workspace. Existing workspaces can be backfilled via the install-pre-installed-apps CLI command.
Set the EXA_API_KEY server variable on the registration to your Exa API key. The value is injected into every logic function execution — no per-workspace configuration needed.

Billing

The handler calls Twenty's generic app billing endpoint (POST /app/billing/charge) using the application access token injected into the execution env. Pricing mirrors Exa's auto-search tier: $0.007 base (10 results) + $0.001 per additional result.