houseassassin/twenty
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
fb4608e437e557ccddae8cdcf3085ccb01ec67e9
twenty/packages/twenty-front/package.json
T
Charles Bochet fb4608e437 chore(deps): upgrade Tier-1 deps (googleapis 173, gaxios 7, express 5, jsdom 29, date-fns 4, stripe 20) (#21570) 
## What

Security-driven upgrade of the biggest-drift Tier-1 dependencies
(staying on latest = staying patched). Bundled because they share the
lockfile and the googleapis/gaxios pair must move together.

| Package | From | To | Gap |
|---|---|---|---|
| googleapis | 105.0.0 | **173.0.0** | 68 majors |
| gaxios | 5.1.3 | **7.1.5** | 2 majors |
| express | 4.22.2 | **5.2.1** | 1 major |
| jsdom | 26.1.0 | **29.1.1** | 3 majors |
| date-fns | 2.30.0 | **4.4.0** | 2 majors |
| date-fns-tz | 2.0.0 | **3.2.0** | 1 major |
| stripe | 19.3.1 | **20.4.1** | 1 major |

`yarn npm audit` reports **0 high/critical** advisories before and
after.

## Code changes

- **gaxios v7** — `GaxiosError.code` is now `string | number` (guard the
calendar network-error check by `typeof`); `GaxiosError` config/response
use `URL` + `Headers`; and crucially the v7 constructor drops
`response.data` unless `bodyUsed` is set — updated the synthetic gmail
error mocks accordingly (production gaxios sets it, so real error
parsing is unaffected).
- **google-auth-library / gaxios dedup** — `googleapis-common@8.0.2`
exact-pins `google-auth-library@10.5.0` + `gaxios@7.1.3` while
`googleapis` pulls `^10.2.0`; the two copies made
`OAuth2Client`/`GaxiosError` type-identities diverge across every
gmail/calendar service. Added two singleton `resolutions` (documented
inline in root `package.json`).
- **express 5** — no source changes. `@nestjs/platform-express@11.1.24`
already resolves `express@5.2.1` internally; the old `4.22.2` pin was
the override.
- **jsdom 29** — no source changes, but it now pulls ESM-only transitive
deps (`@csstools/*` `.mjs`, `parse5`, `entities`, `tough-cookie`,
`@exodus/bytes`). Extended the server jest `transformIgnorePatterns`
allowlist and added `.mjs` to the transform/extensions so jest can load
jsdom.
- **stripe 20** — `Subscription` gained a required `customer_account`
field; added to mocks. No runtime changes.
- **date-fns v4** — `Locale` is no longer ambient (import explicitly in
5 files); per-locale entrypoints dropped the typed `default` export (the
locale loader now reads the single named export); fixed the default
locale import in `formatTimeZoneLabel`.

## Tests

- Full suites green locally: **twenty-server 5709 passed**,
**twenty-front 4937 passed**, twenty-ui / twenty-ui-deprecated green;
typecheck + builds (swc + vite) + lint all pass.
- Added regression tests for the two runtime behaviors these upgrades
touch and that had no coverage:
  - `getDateFnsLocale` — named-export locale resolution (date-fns v4).
- `sanitizeFile` — jsdom 29 + DOMPurify still strips `<script>`/event
handlers from uploaded SVGs (security guard).

## Deliberately deferred (not in this PR)

- **stripe → 21/22**: stripe **21** bundles a runtime `Decimal` type for
money fields **and** jumps the pinned API version to `2026-03-25.dahlia`
(changes webhook/billing payload behavior) — too risky to fold into a
deps bump on billing code. stripe **22** additionally drops the
node10-resolvable `types` entry, which would force a repo-wide
`moduleResolution` change. Capped at the latest clean **20.x**.
- **openid-client → 6**: v6 is a full functional rewrite and its
passport strategy manages the OAuth `state` internally, but our SSO flow
uses `state` to carry `identityProviderId` across the shared
`/auth/oidc/callback`. That needs an auth-flow redesign (session-carried
provider id) on Enterprise SSO code with no integration harness — it
deserves its own focused PR rather than riding along here.

## Tier-1 source

Originated from a dependency-drift audit; remaining Tier-1 items
(date-fns done here) plus Tier-2/3 follow-ups tracked separately.


<!-- This is an auto-generated description by cubic. -->
<a
href="https://cubic.dev/pr/twentyhq/twenty/pull/21570?utm_source=github"
target="_blank" rel="noopener noreferrer"
data-no-image-dialog="true"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source
media="(prefers-color-scheme: light)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img
alt="Review in cubic"
src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a>
<!-- End of auto-generated description by cubic. -->
2026-06-15 10:23:42 +02:00

206 lines
6.6 KiB
JSON
Raw Blame History

{
"name": "twenty-front",
"private": true,
"type": "module",
"scripts": {
"build": "NODE_ENV=production NODE_OPTIONS=--max-old-space-size=8192 npx vite build",
"build:sourcemaps": "NODE_ENV=production VITE_BUILD_SOURCEMAP=true NODE_OPTIONS=--max-old-space-size=8192 npx vite build",
"start:prod": "NODE_ENV=production npx serve -s build",
"tsup": "npx tsup"
},
"engines": {
"node": "^24.5.0",
"npm": "please-use-yarn",
"yarn": "^4.0.2"
},
"browserslist": {
"production": [
">0.2%",
"not dead",
"not op_mini all"
],
"development": [
"last 1 chrome version",
"last 1 firefox version",
"last 1 safari version"
]
},
"msw": {
"workerDirectory": "public"
},
"dependencies": {
"@apollo/client": "^4.0.0",
"@blocknote/mantine": "^0.51.4",
"@blocknote/react": "^0.51.4",
"@blocknote/xl-docx-exporter": "^0.51.4",
"@blocknote/xl-pdf-exporter": "^0.51.4",
"@calcom/embed-react": "^1.5.3",
"@cyntler/react-doc-viewer": "^1.17.0",
"@dagrejs/dagre": "^1.1.8",
"@dnd-kit/react": "^0.3.2",
"@dr.pogodin/react-helmet": "^3.2.2",
"@floating-ui/react": "^0.24.3",
"@graphiql/plugin-explorer": "^5.1.2",
"@graphiql/react": "^0.37.6",
"@hello-pangea/dnd": "^18.0.1",
"@hookform/resolvers": "^5.2.2",
"@lingui/core": "^5.9.5",
"@lingui/detect-locale": "^5.9.5",
"@lingui/react": "^5.9.5",
"@mantine/core": "^8.3.11",
"@mantine/hooks": "^8.3.11",
"@mantine/utils": "^6.0.22",
"@monaco-editor/react": "^4.7.0",
"@nivo/core": "^0.99.0",
"@nivo/line": "^0.99.0",
"@nivo/pie": "^0.99.0",
"@nivo/radial-bar": "^0.99.0",
"@react-email/components": "^0.5.3",
"@react-pdf/renderer": "^4.1.6",
"@scalar/api-reference-react": "^0.9.42",
"@sentry/react": "^10.51.0",
"@sniptt/guards": "^0.2.0",
"@tiptap/core": "3.4.2",
"@tiptap/extension-bold": "3.4.2",
"@tiptap/extension-document": "3.4.2",
"@tiptap/extension-hard-break": "3.4.2",
"@tiptap/extension-heading": "3.4.2",
"@tiptap/extension-image": "3.4.4",
"@tiptap/extension-italic": "3.4.2",
"@tiptap/extension-link": "3.4.2",
"@tiptap/extension-list": "3.4.2",
"@tiptap/extension-paragraph": "3.4.2",
"@tiptap/extension-strike": "3.4.2",
"@tiptap/extension-text": "3.4.2",
"@tiptap/extension-underline": "3.4.2",
"@tiptap/extensions": "3.4.2",
"@tiptap/react": "3.4.2",
"@types/marked": "^6.0.0",
"@xyflow/react": "^12.4.2",
"ai": "6.0.97",
"apollo-link-rest": "^0.10.0-rc.2",
"apollo-upload-client": "^19.0.0",
"buffer": "^6.0.3",
"country-flag-icons": "^1.5.11",
"cron-parser": "5.1.1",
"d3-shape": "^3.2.0",
"date-fns": "^4.4.0",
"date-fns-tz": "^3.2.0",
"deep-equal": "^2.2.2",
"file-saver": "^2.0.5",
"framer-motion": "^11.18.0",
"fuse.js": "^7.1.0",
"graphiql": "^5.2.3",
"graphql": "16.8.1",
"graphql-sse": "^2.5.4",
"graphql-tag": "^2.12.6",
"immer": "^10.1.1",
"input-otp": "^1.4.2",
"jotai": "^2.17.1",
"js-cookie": "^3.0.5",
"json-2-csv": "^5.4.0",
"json-logic-js": "^2.0.5",
"jwt-decode": "^4.0.0",
"libphonenumber-js": "^1.10.26",
"linkify-react": "^4.1.3",
"linkifyjs": "^4.1.3",
"lodash.camelcase": "^4.3.0",
"lodash.groupby": "^4.6.0",
"lodash.isempty": "^4.4.0",
"lodash.omit": "^4.5.0",
"lodash.uniqby": "^4.7.0",
"marked": "^17.0.1",
"microdiff": "^1.3.2",
"papaparse": "^5.4.1",
"pluralize": "^8.0.0",
"qs": "^6.15.2",
"react": "^19.2.0",
"react-data-grid": "7.0.0-beta.59",
"react-datepicker": "^9.1.0",
"react-dom": "^19.2.0",
"react-dropzone": "^14.2.3",
"react-error-boundary": "^4.0.11",
"react-grid-layout": "^1.5.2",
"react-hook-form": "^7.45.1",
"react-hotkeys-hook": "^4.4.4",
"react-imask": "^7.6.0",
"react-intersection-observer": "^9.15.1",
"react-loading-skeleton": "^3.3.1",
"react-markdown": "^10.1.0",
"react-phone-number-input": "patch:react-phone-number-input@npm%3A3.4.5#../../.yarn/patches/react-phone-number-input-npm-3.4.5-dc2895c306.patch",
"react-qr-code": "^2.0.18",
"react-responsive": "^9.0.2",
"react-router-dom": "^6.4.4",
"react-textarea-autosize": "^8.4.1",
"remark-gfm": "^4.0.1",
"rxjs": "^7.2.0",
"temporal-polyfill": "^0.3.0",
"transliteration": "^2.3.5",
"ts-key-enum": "^2.0.12",
"twenty-front-component-renderer": "workspace:*",
"twenty-shared": "workspace:*",
"twenty-ui": "workspace:*",
"twenty-ui-deprecated": "workspace:*",
"type-fest": "4.10.1",
"use-debounce": "^10.0.0",
"uuid": "^11.1.1",
"xlsx-ugnis": "^0.19.3",
"zod": "^4.1.11"
},
"devDependencies": {
"@argos-ci/storybook": "^6.0.6",
"@babel/core": "^7.14.5",
"@babel/preset-typescript": "^7.24.6",
"@graphql-codegen/cli": "^6.3.1",
"@graphql-codegen/typed-document-node": "^6.1.8",
"@graphql-codegen/typescript": "^5.0.10",
"@graphql-codegen/typescript-operations": "^5.1.0",
"@lingui/cli": "^5.9.5",
"@lingui/swc-plugin": "^5.11.0",
"@lingui/vite-plugin": "^5.9.5",
"@playwright/test": "^1.60.0",
"@storybook-community/storybook-addon-cookie": "^5.0.0",
"@storybook/addon-coverage": "^3.0.0",
"@storybook/addon-docs": "^10.3.3",
"@storybook/addon-links": "^10.3.3",
"@storybook/react-vite": "^10.3.3",
"@swc/core": "^1.15.11",
"@swc/jest": "^0.2.39",
"@testing-library/dom": "^10.4.0",
"@testing-library/jest-dom": "^6.6.3",
"@testing-library/react": "^16.3.0",
"@tiptap/suggestion": "3.4.2",
"@types/deep-equal": "^1.0.1",
"@types/file-saver": "^2.0.7",
"@types/jest": "^30.0.0",
"@types/js-cookie": "^3.0.3",
"@types/json-logic-js": "^2",
"@types/react-grid-layout": "^1",
"@types/uuid": "^9.0.2",
"@vitejs/plugin-react-swc": "^4.3.1",
"@vitest/coverage-istanbul": "^4.1.0",
"@wyw-in-js/vite": "^1.1.0",
"dotenv-cli": "^7.4.4",
"esbuild": "^0.28.1",
"jest": "29.7.0",
"jest-environment-jsdom": "30.0.0-beta.3",
"jest-fetch-mock": "^3.0.3",
"monaco-editor": "^0.51.0",
"monaco-editor-auto-typings": "^0.4.5",
"msw": "^2.12.7",
"msw-storybook-addon": "^2.0.6",
"optionator": "^0.9.1",
"oxlint": "^1.51.0",
"oxlint-tsgolint": "^0.16.0",
"playwright": "^1.60.0",
"prettier": "^3.1.1",
"rollup-plugin-node-polyfills": "^0.2.1",
"rollup-plugin-visualizer": "^5.14.0",
"storybook-addon-mock-date": "2.0.0",
"storybook-addon-pseudo-states": "^10.3.3",
"ts-jest": "^29.1.1",
"vite-plugin-svgr": "^4.3.0",
"vite-tsconfig-paths": "^4.2.1"
}
}
Reference in New Issue View Git Blame Copy Permalink