fix(ci): patch danger to decline gzip, fixing ERR_STREAM_PREMATURE_CLOSE on Node 24

[charlesBochet]

Problem

The danger-js check (twenty-utils:danger:ci) started failing intermittently with:

FetchError: Invalid response body while trying to fetch
https://api.github.com/repos/twentyhq/twenty/pulls/<n>/files: Premature close
  errno: 'ERR_STREAM_PREMATURE_CLOSE'

It fails before the Dangerfile even runs, while fetching PR files / diff / commits. The existing retry wrapper (#22151) reduced it but can't absorb longer GitHub-API windows, so checks still go red.

Root cause

Not "node-fetch is old" generically — a specific recent regression:

• Node 22.23.0 / 24.17.0 shipped a security fix for CVE-2026-48931 (http.Agent response-queue poisoning) that attaches a 'data' listener to idle keep-alive sockets.
• node-fetch@2 misreads that listener as an unclean connection close — but only on gzip-encoded responses without Content-Length, which is exactly what api.github.com returns.
• The GitHub-hosted runners rolling into the patched Node 24.17.x in recent weeks is why this surfaced now.

See danger/danger-js#1515, nodejs/node#63989.

Why this approach

• node-fetch@2 can't be removed downstream — Danger imports it directly, and it's pervasive transitively (gaxios/googleapis). Dropping it is an upstream migration.
• We don't want to pin an old Node version.

So: bump danger 13.0.4 → 13.0.8 and backport danger/danger-js#1516 via a yarn patch — set compress: false on Danger's shared api() wrapper. GitHub then returns identity-encoded responses with Content-Length, and node-fetch's faulty premature-close detector never fires. Negligible bandwidth cost on these small JSON payloads; explicit caller overrides are preserved via an === undefined guard.

Changes

• packages/twenty-utils/package.json — danger → patched 13.0.8
• yarn.lock — registers the danger@patch: resolution
• .yarn/patches/danger-npm-13.0.8-48aba2788c.patch — the compress: false fix

Verification

• Patch dry-run applies cleanly against pristine danger 13.0.8 source.
• Inspected yarn's materialized patched cache package — the compress fix is present in the linked distribution/api/fetch.js.
• Confirmed the failing calls (getPullRequestInfo / getPullRequestCommits / getPullRequestDiff) all route through this.api → the patched wrapper.

Lifecycle

Temporary backport. When #1516 ships in a Danger release, drop the patch and bump to that version (flagged in a comment inside the patch). The existing CI retry wrapper stays as defense-in-depth.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	danger@​13.0.4 ⏵ 13.0.8	+1

View full report

[Copilot]

Pull request overview

This PR stabilizes the twenty-utils:danger:ci GitHub Actions check on Node 24 by upgrading danger and applying a Yarn patch that disables gzip compression in Danger’s GitHub API fetch wrapper, avoiding node-fetch@2’s ERR_STREAM_PREMATURE_CLOSE failures on gzipped/chunked responses.

Changes:

• Upgrade danger from 13.0.4 to 13.0.8 within packages/twenty-utils.
• Route danger through a Yarn patch: dependency to backport the compress: false behavior in distribution/api/fetch.js.
• Update yarn.lock to reflect the new danger version and patched resolution.

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated no comments.

File	Description
yarn.lock	Updates the lockfile to include danger@13.0.8 and the danger@patch: resolution used by twenty-utils.
packages/twenty-utils/package.json	Switches the danger devDependency to the patched 13.0.8 spec.
.yarn/patches/danger-npm-13.0.8-48aba2788c.patch	Backports the init.compress = false default (guarded by === undefined) to decline gzip responses.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[cubic-dev-ai]

No issues found across 3 files

_{Re-trigger cubic}

[twenty-ci-bot-public]

🔍 Visual Regression Review — twenty-ui

✅ No visual changes to review.

Changed: 0 · Added: 0 · Removed: 0 · Unchanged: 230

---

View run details · advisory mode

[twenty-ci-bot-public]

🔍 Visual Regression Review — twenty-front

✅ 4 visual change(s) reviewed — all explained by this PR.

Changed: 5 · Added: 0 · Removed: 0 · Unchanged: 677

4 item(s) to double-check (uncertain / low confidence)

	Story	Verdict	Confidence	Explained by
🟡	modules-settings-playground-graphqlplayground--default	uncertain	82%	No UI code changed — PR only modifies .yarn/patches/danger-npm-13.0.8-48aba2788c…
🟡	modules-settings-accounts-blocklist-settingsaccountsblocklistsection--default	uncertain	82%	No UI code changed — PR only modifies .yarn/patches/danger-npm-13.0.8-48aba2788c…
🟡	modules-objectrecord-objectoptionsdropdown-objectoptionsdropdowncontent--record-…	uncertain	75%	No UI code changed — PR only modifies .yarn/patches/danger-npm-13.0.8-48aba2788c…
🟡	ui-data-field-input-numberfieldinput--default	uncertain	85%	No UI code changed — PR only modifies .yarn/patches/danger-npm-13.0.8-48aba2788c…

Changed stories

Story	Diff %
modules-settings-playground-graphqlplayground--default	3%
modules-settings-accounts-blocklist-settingsaccountsblocklistsection--default	1%
modules-objectrecord-objectoptionsdropdown-objectoptionsdropdowncontent--record-group-fields	1%
ui-data-field-input-numberfieldinput--default	0%
modules-ai-terminaloutput--stdout-only	0%

---

View run details · advisory mode