Abdullah.
155636d7d9
## Summary Bumps **tar -> 7.5.21** in the 13 twenty-apps lockfiles that carry it transitively, clearing **GHSA-r292-9mhp-454m** (medium) on those manifests: uncontrolled recursion in `mapHas`/`filesFilter` allows an uncatchable stack-overflow DoS via a crafted long-path tar with member selection, vulnerable `<= 7.5.20`. Apps covered: document-generator, hello-world, postcard, self-hosting, twenty-partners, call-recorder, people-data-labs, twenty-discord, twenty-exa, twenty-fireflies, twenty-last-contact, twenty-linear, twenty-slack. Every app reaches tar through a caret range (`^7.5.4`), so a recursive `yarn up -R tar` lifts it in each project with **no resolution and no `package.json` change** - the diff is 13 `yarn.lock` files and nothing else. ## Not included - **Root lockfile**: same advisory, shipped separately in #23330. - **`application-package/constants/seed-dependencies`**: the 14th manifest with this advisory. Its `yarn.lock` is checksum-coupled to `DEFAULT_YARN_LOCK_CHECKSUM`, so it moves in its own PR with the constant regenerated alongside. ## Verification - tar resolves to **7.5.21** in all 13 lockfiles; nothing below remains. - `yarn install --immutable` passes in each of the 13 projects. - 7.5.21 published 2026-07-21, clears the 3-day npm age gate.
Postcard App — Twenty App Example
A rich example app showcasing all Twenty app entity types. Use this as a reference when building your own apps.
What's included
This app demonstrates every entity type available in the Twenty SDK:
| Entity | Files | What it shows |
|---|---|---|
| Application | src/application.config.ts |
App metadata, application variables, server variables |
| Objects | src/objects/ |
Custom objects with inline fields, junction tables |
| Fields | src/fields/ |
Standalone fields, relations (ONE_TO_MANY, MANY_TO_ONE), extending standard objects |
| Logic Functions | src/logic-functions/ |
HTTP routes, database event triggers, cron schedules, tool functions, install hooks |
| Front Components | src/components/ |
React components rendered inside Twenty's UI |
| Roles | src/roles/ |
Permission roles with object and field-level access control |
| Views | src/views/ |
Saved table views with column configuration |
| Navigation | src/navigation-menu-items/ |
Sidebar links targeting views |
| Skills | src/skills/ |
AI skill providing context to agents |
| Agents | src/agents/ |
AI agent with a system prompt |
| Page Layouts | src/page-layouts/ |
Custom record page with a front component widget |
Getting started
# From this directory
yarn install
yarn twenty dev