Abdullah.
302f46f0ea
## Summary Bumps **brace-expansion -> 5.0.8** in the three app lockfiles whose copy sits on the 5.x line, clearing **GHSA-mh99-v99m-4gvg** (high, vulnerable `<= 5.0.7`) on those manifests: - `examples/hello-world` (`^5.0.2`) - `examples/postcard` (`^5.0.5`) - `internal/self-hosting` (`^5.0.5`) All three are caret ranges, so a recursive `yarn up -R brace-expansion` lifts them with **no resolution and no `package.json` change**. ## Why the fixtures are not included This advisory declares a single vulnerable range, `<= 5.0.7`, which spans **every** major line - so the `brace-expansion@2.1.2` copies in `seed-dependencies` and `common-layer-dependencies` are flagged as well. But **2.1.2 is the last 2.x release** (1.x likewise ends at 1.1.16), and the only patched version is **5.0.8**. Those consumers declare `^2.0.1` / `^2.0.2`, which caps below 3.0.0, so there is no in-range fix: clearing them would mean forcing a cross-major jump from 2.x to 5.x via a resolution, which is a behavior risk rather than a mechanical lift. Same situation for the root alert ([1765](https://github.com/twentyhq/twenty/security/dependabot/1765)), where `nx` pins `brace-expansion` 5.0.6 exact. ## Verification - brace-expansion resolves to **5.0.8** in all three lockfiles. - `yarn install --immutable` passes in each. - 5.0.8 published 2026-07-23, clears the 3-day npm age gate.
This is a Twenty application project bootstrapped with create-twenty-app.
Getting Started
First, authenticate to your workspace:
yarn twenty remote:add --api-url http://localhost:2020 --as local
Then, start development mode to sync your app and watch for changes:
yarn twenty dev
Open your Twenty instance and go to /settings/applications section to see the result.
Available Commands
Run yarn twenty help to list all available commands. Common commands:
# Remotes & Authentication
yarn twenty remote:add --api-url http://localhost:2020 --as local # Authenticate with Twenty
yarn twenty remote:status # Check auth status
yarn twenty remote:use # Set default remote
yarn twenty remote:list # List all configured remotes
yarn twenty remote:remove <name> # Remove a remote
# Application
yarn twenty dev # Start dev mode (watch, build, sync, and auto-generate typed client)
yarn twenty dev:add # Scaffold a new entity (object, field, function, front-component, role, view, navigation-menu-item)
yarn twenty dev:function:logs # Stream function logs
yarn twenty dev:function:exec # Execute a function with JSON payload
yarn twenty app:uninstall # Uninstall app from workspace
Integration Tests
If your project includes the example integration test (src/__tests__/app-install.integration-test.ts), you can run it with:
# Make sure a Twenty server is running at http://localhost:3000
yarn test
The test builds and installs the app, then verifies it appears in the applications list. Test configuration (API URL and API key) is defined in vitest.config.ts.
LLMs instructions
Main docs and pitfalls are available in LLMS.md file.
Learn More
To learn more about Twenty applications, take a look at the following resources:
- twenty-sdk - learn about
twenty-sdktool. - Twenty doc - Twenty's documentation.
- Join our Discord
You can check out the Twenty GitHub repository - your feedback and contributions are welcome!