Charles Bochet
fb4608e437
## What Security-driven upgrade of the biggest-drift Tier-1 dependencies (staying on latest = staying patched). Bundled because they share the lockfile and the googleapis/gaxios pair must move together. | Package | From | To | Gap | |---|---|---|---| | googleapis | 105.0.0 | **173.0.0** | 68 majors | | gaxios | 5.1.3 | **7.1.5** | 2 majors | | express | 4.22.2 | **5.2.1** | 1 major | | jsdom | 26.1.0 | **29.1.1** | 3 majors | | date-fns | 2.30.0 | **4.4.0** | 2 majors | | date-fns-tz | 2.0.0 | **3.2.0** | 1 major | | stripe | 19.3.1 | **20.4.1** | 1 major | `yarn npm audit` reports **0 high/critical** advisories before and after. ## Code changes - **gaxios v7** — `GaxiosError.code` is now `string | number` (guard the calendar network-error check by `typeof`); `GaxiosError` config/response use `URL` + `Headers`; and crucially the v7 constructor drops `response.data` unless `bodyUsed` is set — updated the synthetic gmail error mocks accordingly (production gaxios sets it, so real error parsing is unaffected). - **google-auth-library / gaxios dedup** — `googleapis-common@8.0.2` exact-pins `google-auth-library@10.5.0` + `gaxios@7.1.3` while `googleapis` pulls `^10.2.0`; the two copies made `OAuth2Client`/`GaxiosError` type-identities diverge across every gmail/calendar service. Added two singleton `resolutions` (documented inline in root `package.json`). - **express 5** — no source changes. `@nestjs/platform-express@11.1.24` already resolves `express@5.2.1` internally; the old `4.22.2` pin was the override. - **jsdom 29** — no source changes, but it now pulls ESM-only transitive deps (`@csstools/*` `.mjs`, `parse5`, `entities`, `tough-cookie`, `@exodus/bytes`). Extended the server jest `transformIgnorePatterns` allowlist and added `.mjs` to the transform/extensions so jest can load jsdom. - **stripe 20** — `Subscription` gained a required `customer_account` field; added to mocks. No runtime changes. - **date-fns v4** — `Locale` is no longer ambient (import explicitly in 5 files); per-locale entrypoints dropped the typed `default` export (the locale loader now reads the single named export); fixed the default locale import in `formatTimeZoneLabel`. ## Tests - Full suites green locally: **twenty-server 5709 passed**, **twenty-front 4937 passed**, twenty-ui / twenty-ui-deprecated green; typecheck + builds (swc + vite) + lint all pass. - Added regression tests for the two runtime behaviors these upgrades touch and that had no coverage: - `getDateFnsLocale` — named-export locale resolution (date-fns v4). - `sanitizeFile` — jsdom 29 + DOMPurify still strips `<script>`/event handlers from uploaded SVGs (security guard). ## Deliberately deferred (not in this PR) - **stripe → 21/22**: stripe **21** bundles a runtime `Decimal` type for money fields **and** jumps the pinned API version to `2026-03-25.dahlia` (changes webhook/billing payload behavior) — too risky to fold into a deps bump on billing code. stripe **22** additionally drops the node10-resolvable `types` entry, which would force a repo-wide `moduleResolution` change. Capped at the latest clean **20.x**. - **openid-client → 6**: v6 is a full functional rewrite and its passport strategy manages the OAuth `state` internally, but our SSO flow uses `state` to carry `identityProviderId` across the shared `/auth/oidc/callback`. That needs an auth-flow redesign (session-carried provider id) on Enterprise SSO code with no integration harness — it deserves its own focused PR rather than riding along here. ## Tier-1 source Originated from a dependency-drift audit; remaining Tier-1 items (date-fns done here) plus Tier-2/3 follow-ups tracked separately. <!-- This is an auto-generated description by cubic. --> <a href="https://cubic.dev/pr/twentyhq/twenty/pull/21570?utm_source=github" target="_blank" rel="noopener noreferrer" data-no-image-dialog="true"><picture><source media="(prefers-color-scheme: dark)" srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source media="(prefers-color-scheme: light)" srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img alt="Review in cubic" src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a> <!-- End of auto-generated description by cubic. -->
134 lines
3.4 KiB
TypeScript
134 lines
3.4 KiB
TypeScript
import type Stripe from 'stripe';
|
|
|
|
export const createMockStripeSubscriptionCreatedData = (
|
|
overrides = {},
|
|
): Stripe.CustomerSubscriptionCreatedEvent.Data => ({
|
|
object: {
|
|
object: 'subscription',
|
|
id: 'sub_default',
|
|
customer: 'cus_default1',
|
|
customer_account: null,
|
|
status: 'active',
|
|
items: {
|
|
data: [
|
|
{
|
|
plan: {
|
|
id: 'plan_default',
|
|
object: 'plan',
|
|
active: true,
|
|
amount_decimal: '0',
|
|
billing_scheme: 'per_unit',
|
|
interval_count: 1,
|
|
livemode: false,
|
|
nickname: null,
|
|
tiers_mode: null,
|
|
transform_usage: null,
|
|
trial_period_days: null,
|
|
interval: 'month',
|
|
currency: 'usd',
|
|
amount: 0,
|
|
created: 1672531200,
|
|
product: 'prod_default',
|
|
usage_type: 'licensed',
|
|
metadata: {},
|
|
meter: null,
|
|
},
|
|
id: '',
|
|
object: 'subscription_item',
|
|
billing_thresholds: null,
|
|
created: 0,
|
|
current_period_end: 1672531200,
|
|
current_period_start: 1672531200,
|
|
discounts: [],
|
|
metadata: {},
|
|
price: {
|
|
id: 'price_default',
|
|
object: 'price',
|
|
active: true,
|
|
billing_scheme: 'per_unit',
|
|
created: 1672531200,
|
|
currency: 'usd',
|
|
custom_unit_amount: null,
|
|
livemode: false,
|
|
lookup_key: null,
|
|
metadata: {},
|
|
nickname: null,
|
|
product: 'prod_default',
|
|
recurring: {
|
|
interval: 'month',
|
|
interval_count: 1,
|
|
meter: null,
|
|
trial_period_days: null,
|
|
usage_type: 'licensed',
|
|
},
|
|
tax_behavior: null,
|
|
tiers_mode: null,
|
|
transform_quantity: null,
|
|
type: 'recurring',
|
|
unit_amount: 1000,
|
|
unit_amount_decimal: '1000',
|
|
},
|
|
subscription: '',
|
|
tax_rates: null,
|
|
},
|
|
],
|
|
object: 'list',
|
|
has_more: false,
|
|
url: '',
|
|
},
|
|
cancel_at_period_end: false,
|
|
currency: 'usd',
|
|
metadata: { workspaceId: '3b8e6458-5fc1-4e63-8563-008ccddaa6db' },
|
|
trial_end: null,
|
|
trial_start: null,
|
|
canceled_at: null,
|
|
...overrides,
|
|
application: null,
|
|
application_fee_percent: null,
|
|
automatic_tax: {
|
|
disabled_reason: null,
|
|
enabled: true,
|
|
liability: {
|
|
type: 'self',
|
|
},
|
|
},
|
|
billing_cycle_anchor: 0,
|
|
billing_cycle_anchor_config: null,
|
|
billing_mode: {
|
|
type: 'flexible',
|
|
flexible: {},
|
|
},
|
|
billing_thresholds: null,
|
|
cancel_at: null,
|
|
cancellation_details: null,
|
|
collection_method: 'charge_automatically',
|
|
created: 0,
|
|
days_until_due: null,
|
|
default_payment_method: null,
|
|
default_source: null,
|
|
description: null,
|
|
discounts: [],
|
|
ended_at: null,
|
|
invoice_settings: {
|
|
account_tax_ids: null,
|
|
issuer: {
|
|
type: 'self',
|
|
},
|
|
},
|
|
latest_invoice: null,
|
|
livemode: false,
|
|
next_pending_invoice_item_invoice: null,
|
|
on_behalf_of: null,
|
|
pause_collection: null,
|
|
payment_settings: null,
|
|
pending_invoice_item_interval: null,
|
|
pending_setup_intent: null,
|
|
pending_update: null,
|
|
schedule: null,
|
|
start_date: 0,
|
|
test_clock: null,
|
|
transfer_data: null,
|
|
trial_settings: null,
|
|
},
|
|
});
|