Skip to content

twenty

vtwenty/v2.11.0 Security

This release includes 8 security fixes for security teams reviewing exposed deployments.

Published 1mo Productivity & Wikis
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 8 known CVEs

Topics

crm crm-system customer graphql javascript marketing
+8 more
monorepo nestjs postgresql react reactjs sales typescript web

Affected surfaces

deps

ReleasePort's take

Moderate signal
editorial:auto 1mo

The release bumps several dependencies to address RCE and other vulnerabilities (serialize‑javascript, electron, uuid). It also introduces breaking API changes such as renaming twenty-ui and removing a feature flag.

Why it matters: Bumping serialize-javascript fixes an RCE vulnerability; upgrading electron resolves CVE issues; updating uuid eliminates known vulnerabilities. These updates require immediate attention for security hygiene.

Summary

AI summary

Broad release touches fix, server, app-dev, and chore.

Changes in this release

Security Critical

Bump serialize-javascript from 6 to 7 (RCE vulnerability)

Bump serialize-javascript from 6 to 7 (RCE vulnerability)

Source: llm_adapter@2026-06-09

Confidence: high

 —
Security Critical

Bump electron from 36 to 39 in twenty-companion (CVE)

Bump electron from 36 to 39 in twenty-companion (CVE)

Source: llm_adapter@2026-06-09

Confidence: high

 —
Security High

Bump uuid from 9 to 11 across server, shared, and front (vulnerable)

Bump uuid from 9 to 11 across server, shared, and front (vulnerable)

Source: llm_adapter@2026-06-09

Confidence: high

 —
Breaking High

Remove IS_WORKFLOW_RUN_STEP_LOGS_ENABLED feature flag

Remove IS_WORKFLOW_RUN_STEP_LOGS_ENABLED feature flag

Source: llm_adapter@2026-06-09

Confidence: high

 —
Breaking High

Rename twenty-ui to twenty-ui-deprecated and promote twenty-new-ui as twenty-ui

Rename twenty-ui to twenty-ui-deprecated and promote twenty-new-ui as twenty-ui

Source: llm_adapter@2026-06-09

Confidence: low

 —
Feature Medium

Add Argos visual regression testing for twenty-new-ui

Add Argos visual regression testing for twenty-new-ui

Source: llm_adapter@2026-06-09

Confidence: high

 —
Feature Medium

Add job queue latency histogram metric

Add job queue latency histogram metric

Source: llm_adapter@2026-06-09

Confidence: low

 —
Feature Medium

Add LOG driver for local development in emailing-domain

Add LOG driver for local development in emailing-domain

Source: llm_adapter@2026-06-09

Confidence: low

 —
Bugfix Medium

Prevent deletion of standard fields via API

Prevent deletion of standard fields via API

Source: llm_adapter@2026-06-09

Confidence: high

 —
Bugfix Medium

Fix breaking change with dry‑run input in dev sync

Fix breaking change with dry‑run input in dev sync

Source: llm_adapter@2026-06-09

Confidence: high

 —
Full changelog

What's Changed

  • feat(app-dev): surface metadata diff in dev sync and name failing migration actions by @martmull in https://github.com/twentyhq/twenty/pull/21249
  • chore: bump version to 2.11.0 by @twenty-pr[bot] in https://github.com/twentyhq/twenty/pull/21259
  • fix: guard against undefined logicFunctionId when destroying workflow CODE steps by @thomtrp in https://github.com/twentyhq/twenty/pull/21256
  • fix(server): guard role-permission cache against stripped permissionFlag relation during upgrade by @charlesBochet in https://github.com/twentyhq/twenty/pull/21257
  • fix(app-dev): serialize dev sync per workspace with a cache lock by @martmull in https://github.com/twentyhq/twenty/pull/21250
  • fixes - remove billing cancellation at trial end + disable ai chat if suspended by @etiennejouan in https://github.com/twentyhq/twenty/pull/21261
  • Add job queue latency histogram metric by @thomtrp in https://github.com/twentyhq/twenty/pull/21260
  • fix(server): gate viewFilter.relationTargetFieldMetadataId behind its 2.6 upgrade command by @charlesBochet in https://github.com/twentyhq/twenty/pull/21267
  • fix(metadata): resolve junction targets order-independently during mgration by @neo773 in https://github.com/twentyhq/twenty/pull/21193
  • feat(app-dev): add dry-run preview to dev sync by @martmull in https://github.com/twentyhq/twenty/pull/21251
  • feat(server): unify workspace-event ingestion behind one EventSink pipeline by @FelixMalfait in https://github.com/twentyhq/twenty/pull/21197
  • fix: add missing space in README heading by @summykumari567 in https://github.com/twentyhq/twenty/pull/21271
  • fix(settings): ship borderless hero cover images by @FelixMalfait in https://github.com/twentyhq/twenty/pull/21277
  • fix(server): finalize dangling tool calls when persisting agent chat messages by @FelixMalfait in https://github.com/twentyhq/twenty/pull/21276
  • chore(twenty-front): remove dead SettingsAiMCP component and covers by @FelixMalfait in https://github.com/twentyhq/twenty/pull/21281
  • Allow kanban cross-column drag when sorting is enabled by @Val4evr in https://github.com/twentyhq/twenty/pull/21025
  • revert #21177 by @neo773 in https://github.com/twentyhq/twenty/pull/21284
  • chore(server): rename TypeORM migrations dir to legacy-typeorm-migrations-do-not-add by @claude[bot] in https://github.com/twentyhq/twenty/pull/21295
  • fix(settings): gate APIs & Webhooks page on API_KEYS_AND_WEBHOOKS, not WORKSPACE by @EthanPany in https://github.com/twentyhq/twenty/pull/21302
  • fix: use correct userWorkspaceId for navigation menu comparisons by @Manibharadwaj in https://github.com/twentyhq/twenty/pull/21299
  • feat: add Argos visual regression for twenty-new-ui by @charlesBochet in https://github.com/twentyhq/twenty/pull/21262
  • fix: firefox blank import validation screen and center toggles by @parshipcy in https://github.com/twentyhq/twenty/pull/21266
  • chore(deps): bump @babel/plugin-transform-modules-systemjs to 7.29.7 (CVE-2026-44728) by @charlesBochet in https://github.com/twentyhq/twenty/pull/21306
  • fix(ai) - optimize metadata CRUD tools by @etiennejouan in https://github.com/twentyhq/twenty/pull/21235
  • [Website] Product hero rework into a single, scroll-driven story. by @mabdullahabaid in https://github.com/twentyhq/twenty/pull/21105
  • i18n - website translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/21312
  • [Website] Add trust center link to the footer by @mabdullahabaid in https://github.com/twentyhq/twenty/pull/21307
  • Remove twenty-sdk from package.json before build by @martmull in https://github.com/twentyhq/twenty/pull/21305
  • i18n - website translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/21314
  • feat(emailing-domain): add LOG driver for local development by @FelixMalfait in https://github.com/twentyhq/twenty/pull/21286
  • security: bump vulnerable direct dependencies (axios, next, vitest, qs, dompurify, …) by @charlesBochet in https://github.com/twentyhq/twenty/pull/21309
  • security: bump vulnerable transitive dependencies (postcss, fast-xml-parser, react-router, brace-expansion, …) by @charlesBochet in https://github.com/twentyhq/twenty/pull/21310
  • fix: dedupe root yarn.lock to satisfy hardened immutable install (unblocks danger-js) by @charlesBochet in https://github.com/twentyhq/twenty/pull/21320
  • fix: wrong record count on deleted and normal records by @parshipcy in https://github.com/twentyhq/twenty/pull/21292
  • security: bump vulnerable deps in logic-function runtime lockfiles by @charlesBochet in https://github.com/twentyhq/twenty/pull/21317
  • security: refresh twenty-apps lockfiles for vulnerable transitive deps by @charlesBochet in https://github.com/twentyhq/twenty/pull/21316
  • security: bump electron 36 → 39 in twenty-companion by @charlesBochet in https://github.com/twentyhq/twenty/pull/21327
  • security: bump serialize-javascript 6 → 7 (RCE) by @charlesBochet in https://github.com/twentyhq/twenty/pull/21325
  • Remove IS_WORKFLOW_RUN_STEP_LOGS_ENABLED feature flag by @ijreilly in https://github.com/twentyhq/twenty/pull/21323
  • security: bump uuid 9 → 11 (server, shared, front) by @charlesBochet in https://github.com/twentyhq/twenty/pull/21326
  • feat(app-dev): sync error hints, flatEntity labels, dev-mode summary UI, and docs by @martmull in https://github.com/twentyhq/twenty/pull/21252
  • fix: add queue attribute to jobs waiting gauge metric by @thomtrp in https://github.com/twentyhq/twenty/pull/21324
  • fix(docker): bump Node 24.16.0 (OpenSSL fix), strip unused cruft, dedupe node-forge by @charlesBochet in https://github.com/twentyhq/twenty/pull/21322
  • Rename twenty-ui to twenty-ui-deprecated and twenty-new-ui to twenty-ui to prepare package release by @bosiraphael in https://github.com/twentyhq/twenty/pull/21315
  • fix(twenty-front): match loading skeleton menu width to the nav drawer by @FelixMalfait in https://github.com/twentyhq/twenty/pull/21278
  • fix: prevent deletion of standard fields via API by @thomtrp in https://github.com/twentyhq/twenty/pull/21319
  • messaging: Microsoft driver migrate p-limit to native batching by @neo773 in https://github.com/twentyhq/twenty/pull/21132
  • 2474 add a utils to perform route trigger logic function requests in front components by @martmull in https://github.com/twentyhq/twenty/pull/21330
  • chore: remove accidentally committed screenshots by @parshipcy in https://github.com/twentyhq/twenty/pull/21332
  • chore(server): bump @nestjs to 11.1.24 + serve-static 5.0.5 to clear CVEs by @charlesBochet in https://github.com/twentyhq/twenty/pull/21333
  • security: drop unused @genql/runtime dependency by @charlesBochet in https://github.com/twentyhq/twenty/pull/21334
  • i18n - docs translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/21337
  • chore(apps): bump vitest to 3.2.6 in twenty-apps projects (GHSA-5xrq-8626-4rwp) by @charlesBochet in https://github.com/twentyhq/twenty/pull/21336
  • chore: force tmp >= 0.2.7 for root dev tooling (nx/zapier) by @charlesBochet in https://github.com/twentyhq/twenty/pull/21338
  • feat(twenty-partners): notify Discord on new partner application by @rashad in https://github.com/twentyhq/twenty/pull/21313
  • fix(sdk): bump inquirer ^10 -> ^14 to drop external-editor/tmp from apps by @charlesBochet in https://github.com/twentyhq/twenty/pull/21340
  • security: vendor @genql/cli codegen to drop undici/native-fetch by @charlesBochet in https://github.com/twentyhq/twenty/pull/21339
  • chore(deps): upgrade tar to v7, evict vulnerable [email protected] (CVE-2026-24842) by @charlesBochet in https://github.com/twentyhq/twenty/pull/21341
  • i18n - docs translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/21342
  • security(apps): bump twenty-sdk to 2.10.1 across twenty-apps (tmp, undici) by @charlesBochet in https://github.com/twentyhq/twenty/pull/21344
  • feat(twenty-front): generalize the page primary/secondary bars (flat redesign) by @FelixMalfait in https://github.com/twentyhq/twenty/pull/21308
  • fix(ui): restore content-box sizing for components broken by the global border-box reset by @FelixMalfait in https://github.com/twentyhq/twenty/pull/21349
  • chore: sync AI model catalog from models.dev by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/21353
  • Fix breaking change with dry run input by @martmull in https://github.com/twentyhq/twenty/pull/21356
  • fix(twenty-client-sdk): make genql codegen formatter prettier-3 compatible (fixes app-sync server crash) by @charlesBochet in https://github.com/twentyhq/twenty/pull/21354
  • perf(ai): lazy-load agent chat runtime so it doesn't fetch/diff threads until opened by @Weiko in https://github.com/twentyhq/twenty/pull/21331
  • fix(auth): align workspace resolution across SSO and OTP sign-in flows by @FelixMalfait in https://github.com/twentyhq/twenty/pull/21346

New Contributors

  • @summykumari567 made their first contribution in https://github.com/twentyhq/twenty/pull/21271
  • @Val4evr made their first contribution in https://github.com/twentyhq/twenty/pull/21025
  • @claude[bot] made their first contribution in https://github.com/twentyhq/twenty/pull/21295
  • @EthanPany made their first contribution in https://github.com/twentyhq/twenty/pull/21302
  • @Manibharadwaj made their first contribution in https://github.com/twentyhq/twenty/pull/21299

Full Changelog: https://github.com/twentyhq/twenty/compare/twenty/v2.10.0...twenty/v2.11.0

Breaking Changes

  • Removed IS_WORKFLOW_RUN_STEP_LOGS_ENABLED feature flag
  • Renamed package twenty-ui to twenty-ui-deprecated and promoted twenty-new-ui to twenty-ui

Security Fixes

  • CVE-2026-44728 – bump @babel/plugin-transform-modules-systemjs to 7.29.7
  • CVE-2026-24842 – upgrade tar to v7, evict vulnerable [email protected]
  • Bump electron 36 → 39 in twenty-companion
  • Bump serialize-javascript 6 → 7 (RCE fix)
  • Security: bump vulnerable direct dependencies (axios, next, vitest, qs, dompurify, …)
  • Security: bump vulnerable transitive dependencies (postcss, fast-xml-parser, react-router, brace-expansion, …)
  • Security: bump uuid 9 → 11 across server, shared, front
  • Drop unused @genql/runtime dependency
View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track twenty

Get notified when new releases ship.

Sign up free

About twenty

Building a modern alternative to Salesforce, powered by the community.

All releases →

Related context

Earlier breaking changes

  • vtwenty/v2.20.0 Deprecate `fieldMetadata` and `objectMetadata` standardOverrides.
  • vtwenty/v2.13.0 Gate record creation on isUICreatable only, decoupled from isSystem.
  • vtwenty/v2.13.0 Rename isUIReadOnly to isUIEditable and add isUICreatable, affecting app developers.
  • vtwenty/v2.12.0 Deprecate isCustom for Objects and Fields.
  • vtwenty/v2.12.0 Deprecate dummy enterprise key (2/2).

Beta — feedback welcome: [email protected]