Charles Bochet
869680a5a1
## What this does Resolves the remaining esbuild security alerts on packages we own, and upgrades the repo to **Vite 8** (which drops esbuild entirely in favour of rolldown/oxc). ### 1. esbuild → `^0.28.1` (security) - Raised the declared `esbuild` floor in `twenty-sdk` and the logic-function common-layer (both were `^0.25.0`, which can only resolve to a vulnerable version). These are our packages, so this is just declaring the patched version — clears Dependabot **#1467** and **#1468**. ### 2. Vite 7 → 8 - Bumped `vite` to `^8` in the 5 packages that declare it, and `@vitejs/plugin-react-swc` to `^4.3.1` (the only plugin that needed a bump for Vite 8; everything else already supports it). - `twenty-front` keeps esbuild minification, so esbuild is now an explicit (patched) devDependency there — Vite 8 no longer ships it. ### Two Vite-8 fallout fixes (bundler internals changed) - **Storybook tests:** added React to `optimizeDeps.include` so Vite's dep optimizer doesn't re-bundle React mid-run and break in-flight imports in browser-mode tests. - **`hex-rgb`:** it's ESM-only and broke rolldown's CJS interop (a default import resolved to the wrong thing under jest). Replaced its one use with a tiny inline hex→rgb parse and dropped the dependency. ## Verified Vite resolves to a single `8.0.16` with no esbuild in its tree. Builds pass on Vite 8/rolldown: `twenty-front` production build, the SDKs, and Storybook; the previously-failing front and storybook test jobs now pass; `yarn install --immutable` is clean. ## Note This doesn't close root alert **#1469** — esbuild is still pulled by other third-party tools (storybook, tsx, lingui, zapier, etc.) that haven't shipped a patched release. The vulnerable code path (esbuild's dev server) isn't used here, so that one is best dismissed as not-affected.
Create Twenty App
The official scaffolding CLI for building apps on top of Twenty CRM. Sets up a ready-to-run project with twenty-sdk.
Quick start
npx create-twenty-app@latest my-twenty-app
cd my-twenty-app
yarn twenty dev
The scaffolder will:
- Create a new project with TypeScript, linting, tests, and a preconfigured
twentyCLI - Start a local Twenty server via Docker (pulls the latest image automatically)
- Authenticate with the development API key
Options
| Flag | Description |
|---|---|
--name <name> |
Set the app name |
--display-name <displayName> |
Set the display name |
--description <description> |
Set the description |
--url <url> |
Twenty workspace URL (default: http://localhost:2020) |
--authentication-method <method> |
oauth or apiKey (default: apiKey for local, oauth for remote) |
Documentation
Full documentation is available at docs.twenty.com/developers/extend/apps:
- Quick Start — scaffold, run a local server, sync your code
- Concepts — how apps work: entity model, sandboxing, lifecycle
- Operations — CLI, testing, CI, deploy and publish
Troubleshooting
- Server not starting: check Docker is running (
docker info), then tryyarn twenty docker:logs. - Auth not working: run
yarn twenty remote:add --localto re-authenticate. - Types not generated: ensure
yarn twenty devis running — it auto-generates the typed client.