Abdullah.
155636d7d9
## Summary Bumps **tar -> 7.5.21** in the 13 twenty-apps lockfiles that carry it transitively, clearing **GHSA-r292-9mhp-454m** (medium) on those manifests: uncontrolled recursion in `mapHas`/`filesFilter` allows an uncatchable stack-overflow DoS via a crafted long-path tar with member selection, vulnerable `<= 7.5.20`. Apps covered: document-generator, hello-world, postcard, self-hosting, twenty-partners, call-recorder, people-data-labs, twenty-discord, twenty-exa, twenty-fireflies, twenty-last-contact, twenty-linear, twenty-slack. Every app reaches tar through a caret range (`^7.5.4`), so a recursive `yarn up -R tar` lifts it in each project with **no resolution and no `package.json` change** - the diff is 13 `yarn.lock` files and nothing else. ## Not included - **Root lockfile**: same advisory, shipped separately in #23330. - **`application-package/constants/seed-dependencies`**: the 14th manifest with this advisory. Its `yarn.lock` is checksum-coupled to `DEFAULT_YARN_LOCK_CHECKSUM`, so it moves in its own PR with the constant regenerated alongside. ## Verification - tar resolves to **7.5.21** in all 13 lockfiles; nothing below remains. - `yarn install --immutable` passes in each of the 13 projects. - 7.5.21 published 2026-07-21, clears the 3-day npm age gate.
Document Generator
Turn your CRM data into finished documents — in one click.
✨ What you get
- Reusable templates — write once with
{{placeholders}}like{{name.firstName}}or{{company.name}} - Generate anywhere — from the command menu on a record, a workflow step, or AI chat
- Polished PDFs — every document is saved to the record with a downloadable PDF
- Shareable links — open any document as a standalone, printable web page
- Native rich-text editor — author templates in the same editor as Notes and Tasks
📌 Heads up
- Free to run — generation uses no external API, so there's no per-document charge.
- A hands-on reference — this is the app built in the Document Generator tutorial, a tour through most of the Twenty SDK.