twenty

vtwenty/v2.13.0 Security

This release includes 2 security fixes for security teams reviewing exposed deployments.

Published 1mo Productivity & Wikis

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 2 known CVEs

Topics

crm crm-system customer graphql javascript marketing

+8 more

monorepo nestjs postgresql react reactjs sales typescript web

Affected surfaces

auth rce_ssrf deps

ReleasePort's take

Moderate signal

editorial:auto 1mo

Patch CVE-2026-47751 in the claude-code-action dependency and upgrade esbuild to 0.28.1 to address GHSA-g7r4-m6w7-qqqr.

Why it matters: CVE‑2026‑47751 (severity 90) and GHSA‑g7r4‑m6w7‑qqqr require immediate patching of the claude-code-action dependency and upgrading esbuild to version 0.28.1; failure leaves deployments exposed.

Summary

AI summary

Updates span front UI, workflow engine, server fixes, deps upgrades, and chore tasks.

Changes in this release

Type	Severity	Summary	CVE
Security	Critical	Patch CVE-2026-47751 in claude-code-action dependency. Patch CVE-2026-47751 in claude-code-action dependency. Source: llm_adapter@2026-06-15 Confidence: high	—
Security	Critical	Upgrade esbuild to 0.28.1 to address GHSA-g7r4-m6w7-qqqr vulnerability. Upgrade esbuild to 0.28.1 to address GHSA-g7r4-m6w7-qqqr vulnerability. Source: llm_adapter@2026-06-15 Confidence: high	—
Breaking	High	Rename isUIReadOnly to isUIEditable and add isUICreatable, affecting app developers. Rename isUIReadOnly to isUIEditable and add isUICreatable, affecting app developers. Source: llm_adapter@2026-06-15 Confidence: high	—
Breaking	High	Gate record creation on isUICreatable only, decoupled from isSystem. Gate record creation on isUICreatable only, decoupled from isSystem. Source: llm_adapter@2026-06-15 Confidence: high	—
Feature	Medium	Add offset parameter to Find Records node for pagination. Add offset parameter to Find Records node for pagination. Source: llm_adapter@2026-06-15 Confidence: high	—
Feature	Medium	Add idempotent stop and retry for failed workflow runs from failing step. Add idempotent stop and retry for failed workflow runs from failing step. Source: llm_adapter@2026-06-15 Confidence: high	—
Performance	Low	Load Front chat during browser idle time to improve UI responsiveness. Load Front chat during browser idle time to improve UI responsiveness. Source: llm_adapter@2026-06-15 Confidence: high	—
Bugfix
Bugfix	Medium	Store authentication token pair in localStorage instead of a cookie. Store authentication token pair in localStorage instead of a cookie. Source: llm_adapter@2026-06-15 Confidence: high	—
Bugfix	Medium	Avoid frontend build failures after updating the code‑formatting library. Avoid frontend build failures after updating the code‑formatting library. Source: llm_adapter@2026-06-15 Confidence: high	—
Bugfix	Medium	Prevent shell command injection in SDK CLI exec calls. Prevent shell command injection in SDK CLI exec calls. Source: llm_adapter@2026-06-15 Confidence: low	—

Full changelog

What's Changed

Bill People Data Labs enrichments in Twenty credits by @bosiraphael in https://github.com/twentyhq/twenty/pull/21481
i18n - docs translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/21493
Update CI: Argos visual regression for twenty-front storybook by @bosiraphael in https://github.com/twentyhq/twenty/pull/21454
Show app logo on workflow logic function nodes by @bosiraphael in https://github.com/twentyhq/twenty/pull/21482
Add last contact twenty app by @martmull in https://github.com/twentyhq/twenty/pull/21464
chore: bump version to 2.13.0 by @twenty-pr[bot] in https://github.com/twentyhq/twenty/pull/21492
feat(workflow): add offset to Find Records node for pagination by @thomtrp in https://github.com/twentyhq/twenty/pull/21484
fix(server): keep workflow command menu item label in sync with workflow name by @thomtrp in https://github.com/twentyhq/twenty/pull/21490
Move Claude workflow concurrency to job level so PR chatter can't cancel queued runs by @FelixMalfait in https://github.com/twentyhq/twenty/pull/21498
feat(workflow): idempotent stop + retry failed runs from failing step by @thomtrp in https://github.com/twentyhq/twenty/pull/21458
fix(ci): bump claude-code-action to v1.0.146 (CVE-2026-47751) by @charlesBochet in https://github.com/twentyhq/twenty/pull/21499
fix(upgrade): invalidate upgrade-status cache on command end by @charlesBochet in https://github.com/twentyhq/twenty/pull/21497
fix(front): prevent timeline "Invalid configuration" on update events without a diff by @charlesBochet in https://github.com/twentyhq/twenty/pull/21460
Fix: Improve UX by explaining email edit restriction for multi-workspace users by @Rahmanhusain in https://github.com/twentyhq/twenty/pull/18750
Add Enter HotKey to aAuth authroize screen by @martmull in https://github.com/twentyhq/twenty/pull/21512
fix(front): store auth tokenPair in localStorage instead of a cookie by @charlesBochet in https://github.com/twentyhq/twenty/pull/21507
fix(sdk): avoid shell command injection in CLI exec calls by @charlesBochet in https://github.com/twentyhq/twenty/pull/21508
fix(billing): don't crash when workspace has no active subscription by @charlesBochet in https://github.com/twentyhq/twenty/pull/21510
fix(zapier): support Select and Multi Select fields by @charlesBochet in https://github.com/twentyhq/twenty/pull/21509
Normalize defaultValue properly by @martmull in https://github.com/twentyhq/twenty/pull/21511
fix(deps): bump esbuild to 0.28.1 to fix GHSA-g7r4-m6w7-qqqr by @charlesBochet in https://github.com/twentyhq/twenty/pull/21515
fix(front): show readable targets in morph relation picker by @charlesBochet in https://github.com/twentyhq/twenty/pull/21513
i18n - docs translations by @github-actions[bot] in https://github.com/twentyhq/twenty/pull/21518
Rename isUIReadOnly to isUIEditable, add isUICreatable, expose both to app developers by @FelixMalfait in https://github.com/twentyhq/twenty/pull/21504
fix(server): allow ordering operators on SELECT and RATING fields by @charlesBochet in https://github.com/twentyhq/twenty/pull/21506
fix: frontend build failing after code formatting library update by @parshipcy in https://github.com/twentyhq/twenty/pull/21519
fix(deps): esbuild ^0.28.1 floors + vite 7→8 (rolldown) upgrade by @charlesBochet in https://github.com/twentyhq/twenty/pull/21517
Fix navigation and settings UI polish by @Bonapara in https://github.com/twentyhq/twenty/pull/21523
fix(messaging): emit channel and account deletion events from core metadata services by @neo773 in https://github.com/twentyhq/twenty/pull/21491
fix(e2e): reach Settings via workspace dropdown to unbreak merge queue by @charlesBochet in https://github.com/twentyhq/twenty/pull/21528
feat: gate record creation on isUICreatable only, decoupled from isSystem by @FelixMalfait in https://github.com/twentyhq/twenty/pull/21527
CommandMenuItem overridable entity by @Weiko in https://github.com/twentyhq/twenty/pull/21486
Keep synced messages and events when removing a workspace member by @FelixMalfait in https://github.com/twentyhq/twenty/pull/21443
perf(front): load Front chat during browser idle time by @FelixMalfait in https://github.com/twentyhq/twenty/pull/21533
[WIP] Feat/marketing emails by @neo773 in https://github.com/twentyhq/twenty/pull/21173
[Experiment] perf(front): cache-first currentUser bootstrap by @FelixMalfait in https://github.com/twentyhq/twenty/pull/21532

New Contributors

@Rahmanhusain made their first contribution in https://github.com/twentyhq/twenty/pull/18750

Full Changelog: https://github.com/twentyhq/twenty/compare/twenty/v2.12.0...twenty/v2.13.0

Breaking Changes

Rename isUIReadOnly to isUIEditable; add isUICreatable and expose both to app developers

Security Fixes

fix(ci): bump claude-code-action to v1.0.146 (CVE-2026-47751)
fix(deps): bump esbuild to 0.28.1 to fix GHSA-g7r4-m6w7-qqqr

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track twenty

Get notified when new releases ship.

About twenty

Building a modern alternative to Salesforce, powered by the community.

All releases →

Related context

Related tools

Related CVEs

CVE-2026-47751 NVD KEV EPSS

Earlier breaking changes

vtwenty/v2.20.0 Deprecate `fieldMetadata` and `objectMetadata` standardOverrides.
vtwenty/v2.12.0 Deprecate isCustom for Objects and Fields.
vtwenty/v2.12.0 Deprecate dummy enterprise key (2/2).
vtwenty/v2.11.0 Remove IS_WORKFLOW_RUN_STEP_LOGS_ENABLED feature flag
vtwenty/v2.11.0 Rename twenty-ui to twenty-ui-deprecated and promote twenty-new-ui as twenty-ui