Abdullah.
bebe03e453
## fix(security): bump tar to 7.5.16 across lockfiles (PAX file smuggling) Resolves [#1472 1474 1476 1479 1481 1483 1485 1487 1489 1491 1493 1496 1498 1505](https://github.com/twentyhq/twenty/security/dependabot/1472 1474 1476 1479 1481 1483 1485 1487 1489 1491 1493 1496 1498 1505). ### What `tar` (`node-tar`) `<= 7.5.15` applies a PAX size override to intermediary GNU long-name/long-link headers, causing a tar-parser interpretation differential (file smuggling). Patched in `7.5.16`. ### Why these alerts The advisory is scanned across many independent Yarn projects, so it surfaced as one alert per lockfile: the root `yarn.lock` plus 13 `packages/twenty-apps/**` lockfiles (each pulls `tar` transitively). ### How - Refreshed `tar` to `7.5.16` in the root and all 13 app lockfiles — they hold `tar` via `^7.5.x` ranges that already permit it, so this is an in-range lockfile refresh (no override) via `yarn up -R tar`. - The root additionally had `tar@7.5.15` exact-pinned by `@mintlify/previewing`, which has **no upstream fix** (latest `4.0.1163` still pins `7.5.15`). Added a scoped resolution `@mintlify/previewing/tar -> ^7.5.16`, **extending the existing scoped tar resolutions** already used for `@electron/rebuild` and `@electron/node-gyp`. ### Not included `seed-dependencies/yarn.lock` (alert #1500) is intentionally excluded: that lockfile and its checksum constants are already modified by the open form-data PR, so its `tar` bump will follow separately to avoid a conflict. ### Verification - No `tar <= 7.5.15` remains across the root or any app lockfile. - `yarn install --immutable` passes.
Linear for Twenty
Connect your Linear account to Twenty to create issues and look up teams straight from your workflows or the AI chat.
What you can do
Once installed and connected, two tools become available:
- Create Linear issue — from the AI chat, ask something like
"create a Linear issue in the Engineering team titled 'Fix login bug'"
and the AI will file it for you. From a workflow, add it as a step
with
teamId+title(and optionaldescription). - List Linear teams — discovers the teams in your Linear workspace,
useful when you need to pick a
teamIdfor the create-issue step.
Installing
- Open Settings → Applications in your Twenty workspace.
- Find Linear in the available apps and click Install.
- Open the app, go to the Connections tab, and click Add connection.
- Choose Just for me (your personal Linear account) or Workspace shared (a team-managed Linear account anyone in this workspace can act through), then complete the Linear sign-in.
That's it — you can now use the tools above.
If you see a "Linear OAuth is not yet set up by your server administrator" notice on the Connections tab, ask your Twenty admin to follow the Self-hosting setup below — they need to provide the OAuth credentials before connections can be added.
Self-hosting setup
This section is for Twenty server admins. If you're on Twenty Cloud, skip this — the OAuth credentials are already configured.
1. Register an OAuth app in Linear
- Visit https://linear.app/settings/api/applications/new.
- Set the Redirect URI to
<SERVER_URL>/auth/apps/callback(for local dev:http://localhost:3000/auth/apps/callback). - Copy the generated Client ID and Client Secret.
2. Wire the credentials into Twenty
- In Settings → Applications, find Linear, click into it, and go to the Application registration tab (admin-only).
- Paste your Linear Client ID into
LINEAR_CLIENT_IDand the Client Secret intoLINEAR_CLIENT_SECRET.
Workspace users will now be able to add Linear connections from the Connections tab as described above.
3. (Developers only) Building the app from source
If you're working on this app rather than installing the published version:
cd packages/twenty-apps/internal/twenty-linear
# For day-to-day development (publish + install + watch in one):
yarn twenty dev
# Manual publish flow (publish registers the app, install activates it):
yarn twenty app:publish --private
yarn twenty app:install
twenty dev is recommended for iteration — it publishes, installs, and
watches for changes in one command. Use twenty app:publish --private +
twenty app:install when you want to control each step separately (e.g.
deploying to a production server without auto-installing).
This serves as the reference implementation for Twenty's
defineConnectionProvider({ type: 'oauth' }) flow — useful as a template
when adding OAuth integrations for other providers.